Android.Packed.36061

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.657.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.a####.com:80
TCP(HTTP/1.1) kvt####.m####.a####.com:80
TCP(HTTP/1.1) www.a####.com.####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) nb4052-####.a####.com:80
TCP(HTTP/1.1) nb3201-####.a####.com:80
TCP(HTTP/1.1) cs228-####.a####.com:80
TCP(HTTP/1.1) cs227-####.a####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) c47.a####.com:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) fs007-####.a####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) nb3200-####.a####.com:80
TCP(HTTP/1.1) cs229-####.a####.com:80
TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
TCP(HTTP/1.1) nb4051-####.a####.com:80
TCP(HTTP/1.1) nb4510-####.a####.com:80
TCP(HTTP/1.1) nb3199-####.a####.com:80
TCP(HTTP/1.1) fu1.a####.com:80
TCP(HTTP/1.1) cdn.img.h####.####.com:80
TCP(HTTP/1.1) nb4520-####.a####.com:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) f####.l####.top:443

DNS requests:

a####.u####.com
c47.a####.com
cdn.game####.org
cdn.img.h####.top
cs227-####.a####.com
cs228-####.a####.com
cs229-####.a####.com
cs230-####.a####.com
d14uy7w####.cloudf####.net
f####.l####.top
fs007-####.a####.com
fu1.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
ip.ta####.com
kvt####.m####.a####.com
log.u####.com
m####.a####.com
m.a####.com
nb3194-####.a####.com
nb3199-####.a####.com
nb3200-####.a####.com
nb3201-####.a####.com
nb4051-####.a####.com
nb4052-####.a####.com
nb4500-####.a####.com
nb4510-####.a####.com
nb4520-####.a####.com
policyc####.a####.com
res.we####.cn
s####.u####.com
so.a####.com
www.a####.com
x####.a####.com
x####.l####.top

HTTP GET requests:

c47.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=####&to=####
c47.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
c47.a####.com/user/9/10613009/1005/card/47536252/info.xml
c47.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####&to=####
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.img.h####.####.com/upload/201803/1/img/20180301132145970.png
cs227-####.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
cs227-####.a####.com/user/168/19783168/1005/card/47573714/47573714_800.jpg
cs228-####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####&...
cs229-####.a####.com/user/448/64609448/1005/card/47542021/47542021_800.jpg
d14uy7w####.cloudf####.net/download/key
fs007-####.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=###...
fu1.a####.com/account/168/19783168/account/19783168_normal.jpg
fu1.a####.com/account/448/64609448/account/64609448_normal.jpg
fu1.a####.com/account/87/35755087/account/35755087_normal.jpg
fu1.a####.com/account/9/10613009/account/10613009_normal.jpg
fu1.a####.com/account/92/22433092/account/22433092_normal.jpg
h####.a####.com/user/100/38978100/1041/card/47571966/47571966_400.jpg
h####.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=####
h####.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
h####.a####.com/user/168/19783168/1005/card/47562727/card.mp4?l=####
h####.a####.com/user/168/19783168/1005/card/47573714/47573714_800.jpg
h####.a####.com/user/448/64609448/1005/card/47542021/47542021_800.jpg
h####.a####.com/user/556/20732556/4322236/card/44071548/44071548_800.jpg
h####.a####.com/user/556/20732556/4322236/card/44071548/card.mp4?l=####
h####.a####.com/user/556/20732556/4322236/card/44071548/info.xml
h####.a####.com/user/87/35755087/1005/card/47520358/47520358_800.jpg
h####.a####.com/user/87/35755087/1005/card/47520358/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
h####.a####.com/user/9/10613009/1005/card/47536252/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47536252/info.xml
h####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
h####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47552931/info.xml
h####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
ip.ta####.com/service/getIpInfo2.php?ip=####
kvt####.m####.a####.com/kvinfo.php
nb3199-####.a####.com/user/168/19783168/1005/card/47562727/card.mp4?l=##...
nb3200-####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####...
nb3200-####.a####.com/user/9/10613009/1005/card/47552931/info.xml
nb3201-####.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
nb4051-####.a####.com/user/9/10613009/1005/card/47536252/card.mp4?l=####...
nb4051-####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
nb4052-####.a####.com/user/87/35755087/1005/card/47520358/47520358_800.jpg
nb4052-####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
nb4510-####.a####.com/user/9/10613009/1005/card/47536252/info.xml
nb4520-####.a####.com/user/87/35755087/1005/card/47520358/card.mp4?l=###...
www.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2...
www.a####.com.####.com/api/framework/conf/19?appver=####&os=####&version...
www.a####.com.####.com/api/hot/bannerItem/355?appver=####&os=####&versio...
www.a####.com.####.com/api/hot/titleItem/356?appver=####&os=####&version...
www.a####.com.####.com/api/hot/videos/3045?appId=####&xifenId=####&appve...
www.a####.com.####.com/api/specialTopic/itemList/358?appver=####&os=####...
www.a####.com.####.com/api/specialTopic/view/116
www.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?appver=#...
www.a####.com.####.com/common/img/upload/auxplayData/1471310830_303.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899538_546.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899548_434.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899556_347.gif
www.a####.com.####.com/common/img/upload/xifen/1480329950_399.png
www.a####.com.####.com/common/img/upload/xifen/1480330432_559.png
www.a####.com.####.com/common/img/upload/xifen/1480331697_834.png
www.a####.com.####.com/common/img/upload/xifen/1480331730_72.png
www.a####.com.####.com/common/img/upload/xifen/1480384995_717.png
www.a####.com.####.com/common/img/upload/xifen/1480385031_108.png
www.a####.com.####.com/common/img/upload/xifen/1480385054_409.png
www.a####.com.####.com/common/img/upload/xifen/1480385074_351.png
www.a####.com.####.com/common/img/upload/xifen/1480385282_467.png
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&appver...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
www.a####.com.####.com/pc/operator

HTTP POST requests:

a####.u####.com/app_logs
kvt####.m####.a####.com/i.gif

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/Matrix
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/ddexe
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/debuggerd
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/device.db
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/fileWork
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/insta...ery.sh
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/pidof
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/root3
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/su
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/supolicy
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/toolbox
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/wsroot.sh
<Package Folder>/app_2a10ffca-1f74-4dbd-98c3-4e3f3990118f/07b61...18.jar
<Package Folder>/app_a0cc07c3-eacc-44d8-bfc1-24ebb8abccbf/4459a...cd.jar
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/Matrix
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/ddexe
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/debuggerd
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/fileWork
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/insta...ery.sh
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/pidof
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/su
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/supolicy
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/toolbox
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/wsroot.sh
<Package Folder>/app_priv_res/1da7cb78-7e74-4d61-941a-844f487c90dd
<Package Folder>/app_priv_res/f4e22d8d-b3d2-4764-be71-8423c27b8418
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox_download/01fe8fc3-c0ab-4180-b84b-84dad9ea99f2
<Package Folder>/app_subox_download/1af63e0a-0f39-4516-ad84-9d5b72ef0441
<Package Folder>/app_subox_download/1ce58bbf-c2b5-4e9a-b44f-7fb2b08d75f8
<Package Folder>/app_subox_download/2b7d9347-eaba-47d7-b2f6-afaa762cfedd
<Package Folder>/app_subox_download/7f7d26cb-b202-40dd-ad5e-71ac1dc94112
<Package Folder>/app_subox_download/a19b5964-9d42-4022-9a7b-5592bbb8fcfd
<Package Folder>/cache/####/0606f3787b644f32c867242d6877947d454....0.tmp
<Package Folder>/cache/####/4045ea2f9cacd22ab78dfe8e4590d03cbf2....0.tmp
<Package Folder>/cache/####/457cb70031de6290c5fad10c1678db19dd2....0.tmp
<Package Folder>/cache/####/4bd130b98794f631e45fb9277287ea391e5....0.tmp
<Package Folder>/cache/####/5d1e5f8ee3ae9f4d3f2359d7b3e7798dd35....0.tmp
<Package Folder>/cache/####/6cb640604223288af9168e08c57e9f846cf....0.tmp
<Package Folder>/cache/####/7149b0557521ffbfeb4172b1cbb1e4d5ca8....0.tmp
<Package Folder>/cache/####/7261720ee32cb112415d5bfbe37bf52fad9....0.tmp
<Package Folder>/cache/####/774a3f35b0c53e2923a6822babeeeeeabca....0.tmp
<Package Folder>/cache/####/7fabd1ad286e2e488ad2c0f377d6363fa4c....0.tmp
<Package Folder>/cache/####/7fda041f0ab029a5604abadda8c3a5832b7....0.tmp
<Package Folder>/cache/####/8afd34cf115859c435f51aa4b5150866446....0.tmp
<Package Folder>/cache/####/8ca5761fe3dd4e2f1fcbcabbcfcfe505795....0.tmp
<Package Folder>/cache/####/8fb855636d6af48d5d3d9fab9f748311e3a....0.tmp
<Package Folder>/cache/####/8fc06dae258ed67189bde220350f9c849fd....0.tmp
<Package Folder>/cache/####/ab04b4f1f90889acbb013ad9af1679ead33....0.tmp
<Package Folder>/cache/####/add4e6ea4c5621e37ad160783a5a4aa432d....0.tmp
<Package Folder>/cache/####/b1ea7f45af958dad0c2e751fca7cf72ccdb....0.tmp
<Package Folder>/cache/####/ba8fbd85df8a009128c6cc6252b7900fbcd....0.tmp
<Package Folder>/cache/####/ca257792088b768c9c8dab9d79b441d292d....0.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e48119de671f8678b2710f15d80f452d301....0.tmp
<Package Folder>/cache/####/e76292b8652c35fff43d409b168a2a0f989....0.tmp
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/0ac454fb239bbc42c0f51cb44a8e794d.0.tmp
<Package Folder>/cache/0ac454fb239bbc42c0f51cb44a8e794d.1.tmp
<Package Folder>/cache/13b31f240e07d0548ba82c0cdb939620.0.tmp
<Package Folder>/cache/13b31f240e07d0548ba82c0cdb939620.1.tmp
<Package Folder>/cache/8ebab337196647abd0bb017a02060a28.0.tmp
<Package Folder>/cache/8ebab337196647abd0bb017a02060a28.1.tmp
<Package Folder>/cache/d1068871518f9f3d69744af872bc645a.0.tmp
<Package Folder>/cache/d1068871518f9f3d69744af872bc645a.1.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
<Package Folder>/cache/journal.tmp
<Package Folder>/databases/aipai.db
<Package Folder>/databases/aipai.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/config.json
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/6.jar
<Package Folder>/files/RptKVStrategy.txt
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/aipai.guid
<Package Folder>/files/mobclick_agent_cached_<Package>300000
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/CookiePersistence.xml
<Package Folder>/shared_prefs/au.eypr.qa.xc.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/rx_sf_account.xml
<Package Folder>/shared_prefs/rx_sf_app.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_socialize.xml
<SD-Card>/Android/####/eb2d82c431253

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Loads the following dynamic libraries:

libjiagu

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
DES

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial