Android.Packed.40102

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.743.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) zb####.v.qin####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.non####.####.com:80
TCP(HTTP/1.1) api.zhuishu####.com:80
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(TLS/1.0) h####.b####.com:443

DNS requests:

ad####.m.ta####.com
ada####.m.ta####.com
api.zhuishu####.com
chap####.zhuishu####.com
h####.b####.com
sta####.zhuishu####.com
y####.al####.com

HTTP GET requests:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
api.zhuishu####.com/book-list/5b8a613309545cd659b6aead
api.zhuishu####.com/book-list/5ba52b5be70165ef14b6df09
api.zhuishu####.com/book-list/tagType
api.zhuishu####.com/book-list?duration=####&sort=####&start=####&limit=#...
api.zhuishu####.com/book/hot-word
api.zhuishu####.com/book/recommend?gender=####
api.zhuishu####.com/cats/lv2/statistics
api.zhuishu####.com/mix-atoc/54262d86198ede733cfe3d48?view=####
api.zhuishu####.com/ranking/gender
gl####.w.kunl####.####.com/agent/http://img.1391.com/api/v1/bookcenter/c...
gl####.w.kunl####.####.com/avatar/21/68/216867dffb97a8f8676f544a8d8a13cc
gl####.w.kunl####.####.com/avatar/cd/53/cd539a27b0f35c435b610e50d7b01e60
gl####.w.kunl####.####.com/ranking-cover/142319144267827
gl####.w.kunl####.####.com/ranking-cover/142319166399949
gl####.w.kunl####.####.com/ranking-cover/142319314350435
gl####.w.kunl####.####.com/ranking-cover/142319383473238
gl####.w.kunl####.####.com/ranking-cover/144738093413066
gl####.w.kunl####.####.com/ranking-cover/144738102858782
gl####.w.kunl####.####.com/ranking-cover/144799960841612
gl####.w.kunl####.####.com/ranking-cover/144799965747841
gl####.w.kunl####.####.com/ranking-cover/14750532964058
gl####.w.kunl####.####.com/ranking-cover/147505705336267
zb####.v.qin####.com/chapter/http://book.my716.com/getBooks.aspx?method=...

HTTP POST requests:

ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
na61-####.wagbr####.non####.####.com/saveWb.json

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/03851ef6cdcd9141350377d7482fcea1ff293f37a578889....0.tmp
/data/data/####/07f26c904f7c7a5c50b06bd787f984f8c9a04973e7a1195....0.tmp
/data/data/####/0999dbfa8ef85a9a0944da77a8c50d267fc7e9b85e0b0e7....0.tmp
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/2283244b0c3cd9a21db3c6ef5249ca49c2bd4ef41a7c4e2....0.tmp
/data/data/####/235174e4216a1c2745e086b28d866567d460ed2834e5376....0.tmp
/data/data/####/271f130d622fbdf531f75662fad8e0359e7e27ef2334018....0.tmp
/data/data/####/2a226a084f4d457849c6fd538b47b6908574fe79ab8e244....0.tmp
/data/data/####/2b2c1e26dde726d0a8b1fcd617ff5fb7a802f44021c8055....0.tmp
/data/data/####/35f0ba7235765474c295281fb5a609c4364e07af7cf7042....0.tmp
/data/data/####/3bf01c53c479db02efca575d738b1437e45aa9f76194687....0.tmp
/data/data/####/4327ccca7d4106e8b531f94d3cfe440ef4912481b3d2988....0.tmp
/data/data/####/5552430e9af3d1a9808a17d330668fa0d7807dd0b8cb6ec....0.tmp
/data/data/####/62ede8afa40e9034492f3ae95eecaccd0ff91ebdc45969e....0.tmp
/data/data/####/641e745301565cf85e7866ae3efb91dd2d56f22218b5761....0.tmp
/data/data/####/64253207f61933f6d4c0b57b8a5d1dff50da40ba3daa031....0.tmp
/data/data/####/7040363a4204600218adecfa792e634da4f91c782e2cd48....0.tmp
/data/data/####/70b33cd84024820c1daef3bb1571c64219f1684f71f9b7c....0.tmp
/data/data/####/70cbbeb1b8e978d8fc8eab452255bac246659c44a4f1221....0.tmp
/data/data/####/76c948d58f09850f02cb975e0d3a8202f119d2c121a5639....0.tmp
/data/data/####/7e67dd0291745c4082e8ec0034bfb4d417d75e947d0d86a....0.tmp
/data/data/####/82c7abcedfe1f17d44ade455bf3472d1d7052b88e566187....0.tmp
/data/data/####/8c25b7b9868c51eea2577eb625853bd9680ddba58ad2da9....0.tmp
/data/data/####/8d376d32fc0e8d9a58b63db2f8f5685431400f48598aac7....0.tmp
/data/data/####/8dc1ad0081ef587941557d3599f0e1900482f144f4b0d01....0.tmp
/data/data/####/8fc09cd02fa4df0c2411d3299ce95b10b421d70226f3aaa....0.tmp
/data/data/####/930a31b34bd52c08.lock
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1537992140193
/data/data/####/ad4d962bb79118b6d9be51e7b9b1eb770e411fce88a623e....0.tmp
/data/data/####/afe15d6e8382774cef44712842e8586411f60ce8df24365....0.tmp
/data/data/####/ap.Lock
/data/data/####/b6f3cbde7cc403956bf478e527cb590d4b89792e192ecc6....0.tmp
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/c0ff4008fc8f1bfb1737dc1afefa1240ac9483e4f724d4e....0.tmp
/data/data/####/com.quicklyfreebooks.new_preference.xml
/data/data/####/com.quicklyfreebooks.new_preferences.xml
/data/data/####/config.xml
/data/data/####/e6223e0d27038ada2fe8cfdc06ab4427cce7ce7ae1e3754....0.tmp
/data/data/####/e630fc2aafc50b14d11e7e94bee1aa9ab86ab1ce0776245....0.tmp
/data/data/####/e920f03bcaa325c4b47bbf3b6fdc54e938e5a484aede0d4....0.tmp
/data/data/####/f1457f082411ff8cda8638ce1809c3c06bc84547a3f70e8....0.tmp
/data/data/####/f80c0a1a2219949ccd551b97d7afadb51ba5decf32f99e6....0.tmp
/data/data/####/ffd7619797278c5118078c988cbec5ff63a08f2d3e5c41b....0.tmp
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libjiagu-1744086689.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/lock.lock
/data/data/####/sp.lock
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/media/####/-1202141503
/data/media/####/-1741312354
/data/media/####/-249715954
/data/media/####/-703259647
/data/media/####/-892738503
/data/media/####/-943431157
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.timestamp
/data/media/####/1.txt
/data/media/####/1541366825
/data/media/####/2.txt
/data/media/####/3.txt
/data/media/####/4.txt
/data/media/####/411477508
/data/media/####/5.txt
/data/media/####/511371249
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
chmod 755 <Package Folder>/.jiagu/libjiagu-1744086689.so
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version

Loads the following dynamic libraries:

crash_analysis
libjiagu-1744086689
sgmainso-5.1
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial