Android.Packed.36969

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.692.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) w.a####.ap####.####.com:80
TCP(HTTP/1.1) co####.a####.a####.####.com:80
TCP(HTTP/1.1) qm####.com:8080
TCP(HTTP/1.1) sdk-100####.ap-sout####.elb.####.com:80
TCP(HTTP/1.1) p0.ips####.com:80
TCP(HTTP/1.1) s.gdata####.net:80
TCP(HTTP/1.1) vv.ips####.com:80
TCP(TLS/1.0) v.sho####.com:443
TCP(TLS/1.0) www.googlea####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) a.mailm####.co:443
TCP(TLS/1.0) stat####.y####.co####.####.net:443
TCP(TLS/1.0) s####.w.a####.####.com:443
TCP(TLS/1.0) sg.mobitec####.xyz:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) s####.zot####.com:443
TCP(TLS/1.0) gra####.ho####.com:12443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) cdn-scr####.sign####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) ima####.thestar####.com:443
TCP(TLS/1.0) f####.mailm####.co:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) be####.riski####.com:443
TCP(TLS/1.0) simba-c####.s3.eu-we####.####.com:443
TCP(TLS/1.0) sc####.ho####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) s####.i####.net:443
TCP(TLS/1.0) r.t####.com:443
TCP(TLS/1.0) con####.face####.net:443
TCP(TLS/1.0) st####.zot####.com:443
TCP(TLS/1.0) al####.outb####.org:443
TCP(TLS/1.0) simbas####.sinter-####.com:443
TCP(TLS/1.0) nagano-####.herok####.com:443
TCP(TLS/1.0) cdn.sho####.com.####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) chimpst####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) img.riski####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) st####.ho####.com:443
TCP(TLS/1.0) a####.google####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) lo####.wise####.com:443
TCP(TLS/1.0) d1fc8wv####.cloudf####.net:443
TCP(TLS/1.0) cdn.shopify####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) v####.ho####.com:443
TCP(TLS/1.0) insi####.ho####.com:443
TCP(TLS/1.0) simbama####.nl:443
TCP(TLS/1.0) adc####.g.doublec####.net:443
TCP(TLS/1.0) s3.amazo####.com:443

DNS requests:

a####.google####.com
a.mailm####.co
adc####.g.doublec####.net
amplify####.outb####.com
api.i####.org
api.mobitec####.xyz
be####.riski####.com
cdn-scr####.sign####.com
cdn.sho####.com
cdn.shopify####.com
chimpst####.com
co####.in####.com
con####.face####.net
d1fc8wv####.cloudf####.net
f####.google####.com
f####.gst####.com
f####.mailm####.co
g####.face####.com
googl####.g.doublec####.net
gra####.ho####.com
i.w.in####.com
ima####.thestar####.com
img.riski####.com
insi####.ho####.com
lo####.wise####.com
mt####.go####.com
p0.ips####.com
pag####.googles####.com
plb####.u####.com
qm####.com
r.t####.com
s####.g.doublec####.net
s####.i####.net
s####.w.in####.com
s####.zot####.com
s.gdata####.net
s3.amazo####.com
sc####.ho####.com
sdk-100####.ap-sout####.elb.####.com
simba-c####.s3.eu-we####.####.com
simba-h####.i####.net
simbama####.nl
simbas####.sinter-####.com
st####.ho####.com
st####.zot####.com
stat####.y####.com
tpc.googles####.com
u####.u####.com
v####.ho####.com
v.sho####.com
vv.ips####.com
www.d####.com
www.face####.com
www.go####.com
www.go####.nl
www.google-####.com
www.googlea####.com
www.googlet####.com
z.moa####.com

HTTP GET requests:

p0.ips####.com/large/005a8dcc22c680a5fce2
p0.ips####.com/large/005aad166ef180970726
p0.ips####.com/large/005ab52cdd08009438b1
p0.ips####.com/list/640x360/0059dae5a14d00ad53af
p0.ips####.com/list/640x360/005a4344bde34096f7f3
p0.ips####.com/list/640x360/005a6129d6e040942401
p0.ips####.com/list/640x360/005a94640bb040ae2abb
p0.ips####.com/list/640x360/005a95ec42cb409467b2
p0.ips####.com/list/640x360/005a97b6ae1500a17e6a
p0.ips####.com/list/640x360/005aab1f220a00922b52
p0.ips####.com/list/640x360/005aae3acf1cc091d270
p0.ips####.com/list/640x360/f05a6fe305f5c0a4c483
p0.ips####.com/list/640x360/f05ab7cb6174c09403e1
p0.ips####.com/list/640x360/f05ab8493e8a4097b56d
qm####.com:8080/video/getVideo?page=####&pageSize=####&categoryName=####
vv.ips####.com/01ae0f2b3d15b5ebfbc9e3069cea192c.mp4

HTTP POST requests:

co####.a####.a####.####.com/config-server/v1/config/secure.cfg
s.gdata####.net/async/dc/app20
s.gdata####.net/echo?appId=####&mac=####&imei=####&imei2=####&uid=####&a...
sdk-100####.ap-sout####.elb.####.com/sdk/sdkClient/request
w.a####.ap####.####.com/showad.asm

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1505450608132.jar
/data/data/####/1505450608132.tmp
/data/data/####/18ee37a4bb6bf26b0c844f7ace318ea3e8ef5c3ea2efc7f....0.tmp
/data/data/####/1d7b76968a6aeba8a481286c430c41d4.0.tmp
/data/data/####/1d7b76968a6aeba8a481286c430c41d4.1.tmp
/data/data/####/3a1363fa4e2235a305b497494d2984bbe90f68f68e0ad79....0.tmp
/data/data/####/3b42c89806be3b2b4990d91074cb1749e1f305f850c9a25....0.tmp
/data/data/####/4272c9937f70af70afc389d25b60bde5cc38cd0955dead6....0.tmp
/data/data/####/4f557976ae3468e32faf519df96bef94359572719fac1d0....0.tmp
/data/data/####/6405ebce48426111a496fd60fc4b7a1fbf68553a84a9c68....0.tmp
/data/data/####/6faf3b0e739052069e83e8bec23d048dff32c38952ea599....0.tmp
/data/data/####/71c6d97fad400b8401785e69a5ac5d557cde650f83ddbc2....0.tmp
/data/data/####/7b1e3ae4765523dfcf05bc61eebab22c808cec486f97c3c....0.tmp
/data/data/####/8b67d3fc11c578a96b53d73efa014c8ba0fbfe4ec4b4f43....0.tmp
/data/data/####/8f67cc7fb5b0683111d1605e62f1b3698b4cfb7deac07fb....0.tmp
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/ApplicationCache.db-journal
/data/data/####/FBAdPrefs.xml
/data/data/####/MultiDex.lock
/data/data/####/SDKIDFA.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/admob.xml
/data/data/####/all_info_data.xml
/data/data/####/b5868b321cf7252bc443f92ce475cddf8aa234b032afb50....0.tmp
/data/data/####/com.cpap.video.ploy_preferences.xml
/data/data/####/com.facebook.ads.FEATURE_CONFIG.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.im.keyValueStore.aes_key_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml
/data/data/####/com.im.keyValueStore.sdk_version_store.xml
/data/data/####/com.im_7.0.0.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dataeye_database_.db
/data/data/####/dataeye_database_.db-journal
/data/data/####/dc.C011B1980F8C14F982B016DD138CF7515.preferences.xml
/data/data/####/dc.global.prfrerence.xml
/data/data/####/e72818244750b1846e97d5cfc686d30226ba217bb2718df....0.tmp
/data/data/####/e742563d67618e4cb03acdcad81cdcdab9484822e86d4b4....0.tmp
/data/data/####/e92000efefad492d978d9021c3c6f914ca4b41250a2b13d....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f2cada1269b860446656644733aec5c555214e1bfbd0f7b....0.tmp
/data/data/####/f5369dd930d5621c5dc41f7b49b2ff09336034b2be60996....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/google_ads_flags_meta.xml
/data/data/####/i==1.2.0&&1.1.3_1524192307673_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/multidex.version.xml
/data/data/####/ncore.jar
/data/data/####/so.jar
/data/data/####/tmp-com.cpap.video.ploy-1.apk.classes432462293.zip
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.umm.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh
cat /sys/class/net/wlan0/address
ls -l /sbin/su
ls -l /system/bin/su
ls -l /system/sbin/su
ls -l /system/xbin/su
ls -l /vendor/bin/su
ls /
ls /sys/class/thermal

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-nopadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial