Android.Packed.40747

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.589.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 52.52.2####.56:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) p0.ifen####.com:80
TCP(HTTP/1.1) p3.ifen####.com:80
TCP(HTTP/1.1) st####.i####.com:80
TCP(HTTP/1.1) y3.ifen####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) pwe.3####.top:80
TCP(HTTP/1.1) dia####.i####.com:80
TCP(HTTP/1.1) d.ifen####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(TLS/1.0) 2####.58.212.206:443
TCP i####.ifen####.com:80

DNS requests:

a####.u####.com
a.appj####.com
cdn.app.kac####.cn
cdn.game####.org
cdn.img.p####.top
d.ifen####.com
dia####.i####.com
i####.ifen####.com
oc.u####.com
p0.ifen####.com
p2.ifen####.com
p3.ifen####.com
pwe.3####.top
st####.i####.com
y1.ifen####.com
y3.ifen####.com

HTTP GET requests:

cdn.game####.org/strategy/11a3004d25017230
cdn.game####.org/strategy/15fb6224701377a1
cdn.game####.org/strategy/1ae9b32c6e832e41
cdn.game####.org/strategy/240b5f1e461d069c
cdn.game####.org/strategy/351aa6386a77d89f
cdn.game####.org/strategy/91259b7a8e5f58ee
cdn.game####.org/strategy/base
cdn.game####.org/strategy/fc10be62df60ba0f
d.ifen####.com/w370_h370/p0.ifengimg.com/a/2018_35/537f8ce40f72951_size1...
d.ifen####.com/w370_h370/p2.ifengimg.com/cmpp/2017/02/10/3ae878f7854a784...
p0.ifen####.com/cmpp/2016/11/24/50ead053cd11f1271fcc5efc49355767_size18_...
p0.ifen####.com/cmpp/2016/11/24/dc04b295b4a1daa6ecf77c1dae5cd25f_size22_...
p0.ifen####.com/cmpp/2016/11/24/eb528a978f8acb409cc31b169b079e89_size16_...
p3.ifen####.com/cmpp/2016/11/24/29789da1ff1b70ce543d8d4a93db84fd_size16_...
p3.ifen####.com/cmpp/2018/10/17/5528f27bba0e01d6eb82ae6adc134f76_size260...
p3.ifen####.com/cmpp/2018/10/26/d3321c84729f0a9a56e6fb2420cf9f2e_size350...
q####.c####.l####.####.com/sfile/201810/30/all/cp_V2.7.8.txt
st####.i####.com/appsta.js?datatype=####&mos=####&softversion=####&publi...
y3.ifen####.com/a/2015/0703/1fc252e4cc80393.png
y3.ifen####.com/a/2015/0703/465845550bf0662.png
y3.ifen####.com/cmpp/2015/11/18/85b2b93bbdabc4d556217d1fb0944ef7_size14_...

HTTP POST requests:

a####.u####.com/app_logs
a.appj####.com/ad-service/ad/mark
dia####.i####.com/api/sstApi.php?action=####
oc.u####.com/check_config_update
pwe.3####.top/jzbdt/rzd/owbe
pwe.3####.top/jzbdt/sulou/s/wfoq
pwe.3####.top/sdf/ytn

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/0b0354d5-40ce-49e3-8ecb-57f2e9ef3044
/data/data/####/102ad32edbbe15be6a852c9639e232a7
/data/data/####/16247433229d8cccb424536e6d9bc6a4
/data/data/####/43227513780f9a53a644ee736fe98f62
/data/data/####/5553a0bd15ea1d729be5500dd0b434bd
/data/data/####/591a2cf3-070f-4171-815b-7c2b2b011a0c
/data/data/####/5a7164d5-5b70-4f1e-993a-31155fb6b57d
/data/data/####/5ca13336-e1ef-449f-bb65-20f56178c007
/data/data/####/605aeac5-6be1-4b77-8354-6e9ddfbd6910
/data/data/####/6a3dbd49-387e-4db8-b3c3-d716e6ae38d2
/data/data/####/7204974f-2293-4d07-a3e2-8079ecd70f8e
/data/data/####/7723d1a7-3c91-4359-96f5-cdf8bc5caffa
/data/data/####/Matrix
/data/data/####/SUBOXLOG_
/data/data/####/c555f65c72344cea54472e5d056e24b3
/data/data/####/cd1a87da-a6d5-408c-afd9-ab3750aa2f4d
/data/data/####/checker.jar
/data/data/####/com.ifeng.ipush.xml
/data/data/####/ddexe
/data/data/####/debuggerd
/data/data/####/device.db
/data/data/####/dsi.xml
/data/data/####/e01a6afb33753a506c45f8938a4c6fa6
/data/data/####/ed016acd-af48-4c95-b871-8785e781ccf5
/data/data/####/fhdt.ifeng.com.xml
/data/data/####/fileWork
/data/data/####/install-recovery.sh
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/kr.xml
/data/data/####/libjiagu.so
/data/data/####/mo.jar
/data/data/####/mobclick_agent_cached_com.shg.rabbit.tuzi550
/data/data/####/mobclick_agent_online_setting_com.shg.rabbit.tuzi.xml
/data/data/####/phoenixradio.db-journal
/data/data/####/pidof
/data/data/####/root3
/data/data/####/sfe.xml
/data/data/####/su
/data/data/####/subox.xml
/data/data/####/supolicy
/data/data/####/t_u.db-journal
/data/data/####/toolbox
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/wsroot.sh
/data/data/####/wv.xml
/data/data/####/xe.jar
/data/media/####/0468a999e779c113c09a6e07cfc40a13
/data/media/####/0c73d1a62cd547c2e778994d561e87da
/data/media/####/1540917399272
/data/media/####/1540917407998
/data/media/####/1b54275aa3fd347ee6899b1dca492de7
/data/media/####/29e2e16cac55272c46d99721df6d13f3
/data/media/####/2f298bae957c4b42352da28658596c80
/data/media/####/329083895f52174eeec9a7558600e33a
/data/media/####/76c89e23de9a12e1e2b0d45627475dfd
/data/media/####/9b4a7608001bf2dd22e3a1b1a530f51e
/data/media/####/V2.7.8.txt
/data/media/####/a1409362f40aaf7a033eb9e2fa5fd396
/data/media/####/a47d23dc1ba7e4cfed7ed114bb8f02db
/data/media/####/cdca562d2a8e9d4cf54f32976325707c

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
mount
sh

Loads the following dynamic libraries:

_jnqk642
libjiagu

Uses the following algorithms to decrypt data:

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial