Android.Packed.55420

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.893.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.126.70.252:443
TCP(HTTP/1.1) es####.dan####.net:80
TCP(HTTP/1.1) log-re####.com:80
TCP(HTTP/1.1) 47.2####.48.224:443
TCP(HTTP/1.1) st####.tin####.com:80
TCP(HTTP/1.1) 2####.119.169.9:443
TCP(HTTP/1.1) api.dianshi####.com:80
TCP(HTTP/1.1) 8.2####.35.113:443
TCP(HTTP/1.1) esw.ty####.com:80
TCP(HTTP/1.1) chec####.cc:80
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) 1####.126.70.252:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 47.2####.48.224:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 2####.119.169.9:443
TCP(TLS/1.0) 8.2####.35.113:443
TCP(TLS/1.2) 1####.250.102.94:443
UDP tm3.binst####.live:13
UDP 2####.255.255.250:1900
UDP as1.binst####.live:3923
UDP as4.binst####.live:3924
UDP md####.google####.com:443
UDP as2.binst####.live:3923
UDP as2.binst####.live:3925
UDP tm3.binst####.live:3924
UDP tm3.binst####.live:3925
UDP as4.binst####.live:13

DNS requests:

360####.org
a####.u####.com
and####.cli####.go####.com
and####.google####.com
api.dianshi####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
chec####.cc
e####.ty####.com
e####.ty####.com
es####.dan####.net
esw.ty####.com
lo####.co####.net
log-re####.com
m####.go####.com
md####.google####.com
st####.tin####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
tv####.chaosuz####.com
u####.u####.com
ucc.u####.com
www.google####.com

HTTP GET requests:

1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/hqg.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/limit.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/pay1.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/qun1.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/ssg.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/ugw.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/date/wxmg1.png
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/d0.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/d1.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/d2.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/d3.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/d4.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/lbch.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/lbmv.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/tvch.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/kds/zbch.txt
1####.126.70.252:443/p/appfiles/d/appfiles/git/raw/master/push/urlcfg.txt
api.dianshi####.com/ipInfo
chec####.cc/feature/config?api_version=####&app_id=####&app_version=####...
chec####.cc/jd?a=####&av=####&d=####&p=####&v=####&vc=####
esw.ty####.com/dbGold/v1/sdkSwitch.do?appkey=####&channel=####&device_na...
st####.tin####.com/static/ij-cloud/cs/google_analytics_6.aar

HTTP POST requests:

2####.119.169.9:443/v1/fetch
47.2####.48.224:443/dbGold/v1/getMaterials.do
47.2####.48.224:443/dbGold/v1/getReplenishMaterial
8.2####.35.113:443/unify_logs
8.2####.35.113:443/zcfg
es####.dan####.net/dbzs/m1/appInfo.do
esw.ty####.com/dbGold/v1/deviceRegister.do
esw.ty####.com/dbGold/v1/liveReveal.do
esw.ty####.com/dbGold/v3/getMaterials.do
log-re####.com/report

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.cl
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/09cb54e25f62d035a63a8ee232c07735cbcb76a917ca2ac...52.apk
/data/data/####/09cb54e25f62d035a63a8ee232c07735cbcb76a917ca2ac...52.dex
/data/data/####/09cb54e25f62d035a63a8ee232c07735cbcb76a917ca2ac...leted)
/data/data/####/0B5645595A.dex
/data/data/####/0B5645595A.dex.flock (deleted)
/data/data/####/0B5645595A.jar
/data/data/####/3258858622.apk
/data/data/####/CBGr2.xml
/data/data/####/HiSDKDataBase.db
/data/data/####/HiSDKDataBase.db-journal
/data/data/####/HiService.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a==9.4.0&&1.02.61_1629429393476_dW5pZnlfbG9ncw==;.log
/data/data/####/a==9.4.0&&1.02.61_1629429398284_dW5pZnlfbG9ncw==;.log
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cconfig_sharedpreference.xml
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/classes.dex.flock (deleted)
/data/data/####/classes.dex;classes2.dex
/data/data/####/d0.txt
/data/data/####/d1.txt
/data/data/####/d2.txt
/data/data/####/d3.txt
/data/data/####/d4.txt
/data/data/####/dbfile.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/favch.db
/data/data/####/favch.db-journal
/data/data/####/hqg.png
/data/data/####/i==1.2.0&&1.02.61_1629429395315_dW5pZnlfbG9ncw==;.log
/data/data/####/info.xml
/data/data/####/kuaisou_downloader-journal
/data/data/####/lbch.txt
/data/data/####/lbmv.txt
/data/data/####/libjiagu.so
/data/data/####/limit.png
/data/data/####/mCFG.xml
/data/data/####/mCFG.xml.bak (deleted)
/data/data/####/pay1.png
/data/data/####/proc_auxv
/data/data/####/qun1.png
/data/data/####/share_date.xml
/data/data/####/ssg.png
/data/data/####/t==9.4.0&&1.02.61_1629429395957_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/ugw.png
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak (deleted)
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/urlcfg.txt
/data/data/####/wxmg1.png
/data/data/####/z==1.2.0&&1.02.61_1629429360118_emNmZw==;.log
/data/data/####/zbch.txt
/data/media/####/.D1C593128F43E2D009A968D7C663F774
/data/media/####/.D1C593128F43E2D009A968D7C663F774-journal
/data/media/####/appcfg.txt
/data/media/####/appdata.txt
/data/media/####/crash.txt
/data/media/####/dbmt.txt
/data/media/####/dbmt.txt (deleted)
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /proc/meminfo
cat /proc/net/arp
chmod 777 /storage/emulated/0/Android/data/<Package>/cache/afinalCache

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Requests the system alert window permission.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial