Android.Packed.56557

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.4884
Android.DownLoader.570.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) cdn.dl.foto####.####.net:80
TCP(HTTP/1.1) cdn.a####.foto####.####.net:80
TCP(HTTP/1.1) api.mo####.sdk.####.com:80
TCP(HTTP/1.1) as.ju####.com:80
TCP(HTTP/1.1) waws-pr####.vip.azurewe####.####.net:80
TCP(HTTP/1.1) fot####.traffic####.net:80
TCP(TLS/1.0) api.appsf####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 1####.250.200.202:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) 2####.58.211.202:443
TCP(TLS/1.0) t####.appsf####.com:443
TCP(TLS/1.2) 2####.58.211.202:443

DNS requests:

and####.a####.go####.com
and####.cli####.go####.com
api.appsf####.com
api.foto####.com
api.mo####.sdk.####.com
as.ju####.com
cdn.a####.foto####.net
cdn.ads.foto####.net
cdn.api.foto####.net
cdn.dl.foto####.net
connect####.gst####.com
d####.fl####.com
g####.foto####.net
p####.google####.com
pla####.google####.com
pla####.googleu####.com
re####.foto####.net
re####.foto####.net.####.8
sett####.crashly####.com
sett####.crashly####.com.####.8
t####.appsf####.com
v.m####.com
v.m####.com.####.8

HTTP GET requests:

api.appsf####.com:443/install_data/v3/<Package>?devkey=####&device_id=####
api.mo####.sdk.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####...
as.ju####.com/as?m=####&v=####&av=####&ch=####&k=####&pkg=####&action=##...
as.ju####.com/as?m=####&v=####&k=####&c=####&pkg=####&json=####
cdn.a####.foto####.####.net/script/mix/?os=####&appid=####
cdn.dl.foto####.####.net//Material/Doodle/getMaterialList/?recommendatio...
cdn.dl.foto####.####.net//material/Zine/getMaterials/?recommendation=###...
cdn.dl.foto####.####.net/Advertise/ads/v4/?os=####&appid=####&enableapi=...
cdn.dl.foto####.####.net/Material/index/getMaterials/?recommendation=###...
cdn.dl.foto####.####.net/dl/colors.json
cdn.dl.foto####.####.net/home/ZineMaterial/getLocalTags/?os=####&appid=#...
cdn.dl.foto####.####.net/home/ZineMaterial/getMaterials/?recommendation=...
fot####.traffic####.net/user/group/v1/?openuuid=####&appid=####&os=####&...
waws-pr####.vip.azurewe####.####.net/

HTTP POST requests:

d####.fl####.com:443/aap.do
t####.appsf####.com:443/api/v2.3/androidevent?buildnumber=####&app_id=####

File system changes:

Creates the following files:

/data/data/####/.YFlurrySenderIndex.info.AnalyticsData_CCJK65GS...24_216
/data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.yflurrydatasenderblock.776dcb42-d27d-4069-ab8e...52068b
/data/data/####/.yflurryreport.799062ecf42acfe
/data/data/####/000.xml
/data/data/####/23.xml
/data/data/####/23356507059351895.xml
/data/data/####/23356507059351895.xml.bak
/data/data/####/24356507059351895.xml
/data/data/####/25356507059351895.xml
/data/data/####/446679.dex
/data/data/####/446679.dex.flock (deleted)
/data/data/####/446679.jar
/data/data/####/621CC30702D6-0001-0DB5-98C9B1CB46F6BeginSession.cls
/data/data/####/621CC30702D6-0001-0DB5-98C9B1CB46F6SessionApp.cls
/data/data/####/621CC30702D6-0001-0DB5-98C9B1CB46F6SessionDevice.cls
/data/data/####/621CC30702D6-0001-0DB5-98C9B1CB46F6SessionEvent...s_temp
/data/data/####/621CC30702D6-0001-0DB5-98C9B1CB46F6SessionOS.cls
/data/data/####/AF_INSTALLATION
/data/data/####/Cookies-journal
/data/data/####/DeviceTestSharedPreferences.xml
/data/data/####/FBNativeInfo.xml
/data/data/####/FBNativeInfo.xml.bak
/data/data/####/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/FotoAdMediationDB.xml
/data/data/####/FotoAdStrategy.xml
/data/data/####/FotoAdStrategy.xml.bak
/data/data/####/FotoCustomReportSet.xml
/data/data/####/FullScreenSharedPrefrence.xml
/data/data/####/KApplicationPref.xml
/data/data/####/MakeUpcolors.json
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/YMMsg.db-journal
/data/data/####/YTAdFactory.xml
/data/data/####/_toolbox_prefs.xml
/data/data/####/agenting_122_602_shadow.png
/data/data/####/agenting_148_571_brow.png
/data/data/####/agenting_175_656_liner.png
/data/data/####/agenting_177_641_lash.png
/data/data/####/appsflyer-data.xml
/data/data/####/awaken.xml
/data/data/####/awaken.xml.bak
/data/data/####/caihuizhuang_156_568_brow.png
/data/data/####/caihuizhuang_163_624_lash.png
/data/data/####/caizhuang_170_653_liner.png
/data/data/####/caizhuang_194_633_doulid.png
/data/data/####/caizhuang_79_581_shadow.png
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.google.android.gms.analytics.prefs.xml
/data/data/####/com.google.android.gms.analytics.prefs.xml.bak
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.qingda.shoujip.tusioagsdgsdg_preferences.xml
/data/data/####/com.wantu.android.WantuSetting.xml
/data/data/####/device_id.xml.xml
/data/data/####/f35e6b2289390fec_0
/data/data/####/google_analytics_v4.db-journal
/data/data/####/hanzhuang01_146_597_shadow.png
/data/data/####/hanzhuang01_147_566_brow.png
/data/data/####/hanzhuang01_179_625_lash.png
/data/data/####/hanzhuang01_182_646_liner.png
/data/data/####/hanzhuang01_184_632_doulid.png
/data/data/####/hanzhuang02_133_557_brow.png
/data/data/####/hanzhuang02_173_637_shadow.png
/data/data/####/hanzhuang02_176_632_lash.png
/data/data/####/hanzhuang02_194_656_liner.png
/data/data/####/hanzhuang03_149_597_shadow.png
/data/data/####/hanzhuang04_141_598_shadow.png
/data/data/####/hanzhuang04_149_562_brow.png
/data/data/####/hanzhuang04_175_653_liner.png
/data/data/####/hanzhuang04_184_632_doulid.png
/data/data/####/hanzhuang04_199_635_lash.png
/data/data/####/hanzhuang04_contact.png
/data/data/####/hanzhuang05_176_635_lash.png
/data/data/####/hanzhuang05_189_658_liner.png
/data/data/####/hanzhuang05_contact.png
/data/data/####/hanzhuang06_171_639_shadow.png
/data/data/####/hanzhuang06_contact.png
/data/data/####/hanzhuang07_156_560_brow.png
/data/data/####/hanzhuang07_contact.png
/data/data/####/hanzhuang08_180_642_shadow.png
/data/data/####/hanzhuang09_173_639_shadow.png
/data/data/####/hanzhuang09_42_697_blush.png
/data/data/####/hanzhuang10_165_638_doulid.png
/data/data/####/hanzhuang11_210_641_doulid.png
/data/data/####/hanzhuang12_181_637_doulid.png
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/isNeedGotoGuideView.xml
/data/data/####/kenya_130_563_brow.png
/data/data/####/liangfen01_102_585_liangfen.png
/data/data/####/liangfen02_144_589_liangfen.png
/data/data/####/liangfen03_156_654_liangfen.png
/data/data/####/liangfen04_190_611_liangfen.png
/data/data/####/liangfen05_159_613_liangfen.png
/data/data/####/liangfen06_150_599_liangfen.png
/data/data/####/libjiagu.so
/data/data/####/luozhuang1_152_594_shadow.png
/data/data/####/luozhuang1_181_625_lash.png
/data/data/####/luozhuang1_202_657_liner.png
/data/data/####/luozhuang2_153_702_shadow.png
/data/data/####/luozhuang2_184_652_liner.png
/data/data/####/luozhuang4_108_721_blush.png
/data/data/####/luozhuang5_179_655_liner.png
/data/data/####/luozhuang7_161_590_shadow.png
/data/data/####/luozhuang7_191_643_doulid.png
/data/data/####/luozhuang8_155_592_shadow.png
/data/data/####/luozhuang8_179_630_lash.png
/data/data/####/luozhuang8_202_656_liner.png
/data/data/####/makeup.xml
/data/data/####/metrics_guid
/data/data/####/moluoge_159_602_shadow.png
/data/data/####/nongzhuang01_contact.png
/data/data/####/nongzhuang02_contact.png
/data/data/####/nongzhuang04_contact.png
/data/data/####/nongzhuang1_112_586_shadow.png
/data/data/####/nongzhuang1_144_569_brow.png
/data/data/####/nongzhuang1_148_644_liner.png
/data/data/####/nongzhuang1_182_630_lash.png
/data/data/####/nongzhuang1_79_698_blush.png
/data/data/####/nongzhuang2_152_569_brow.png
/data/data/####/nongzhuang2_179_622_lash.png
/data/data/####/nongzhuang2_187_660_liner.png
/data/data/####/nongzhuang2_66_557_shadow.png
/data/data/####/nongzhuang3_112_581_shadow.png
/data/data/####/nongzhuang3_147_565_brow.png
/data/data/####/nongzhuang3_168_621_lash.png
/data/data/####/nongzhuang4_107_597_shadow.png
/data/data/####/nongzhuang4_147_569_brow.png
/data/data/####/nongzhuang4_173_624_lash.png
/data/data/####/nongzhuang5_108_583_shadow.png
/data/data/####/nongzhuang5_157_574_brow.png
/data/data/####/nongzhuang5_167_658_liner.png
/data/data/####/nongzhuang5_189_644_lash.png
/data/data/####/nongzhuang6_134_604_shadow.png
/data/data/####/nongzhuang6_145_565_brow.png
/data/data/####/nongzhuang6_158_605_lash.png
/data/data/####/nongzhuang6_158_649_liner.png
/data/data/####/nongzhuang7_111_577_shadow.png
/data/data/####/nongzhuang7_139_570_brow.png
/data/data/####/nongzhuang7_166_606_lash.png
/data/data/####/nongzhuang7_167_663_liner.png
/data/data/####/nongzhuang7_86_685_blush.png
/data/data/####/nongzhuang8_109_602_shadow.png
/data/data/####/nongzhuang8_146_648_liner.png
/data/data/####/nongzhuang8_148_549_brow.png
/data/data/####/nongzhuang8_179_601_lash.png
/data/data/####/nongzhuang8_87_701_blush.png
/data/data/####/proc_auxv
/data/data/####/sa_359f86c8-781c-42b2-bd73-eb4008782822_1646052108488.tap
/data/data/####/sa_96c07e8b-f1bd-4316-a53b-2506eb30e88c_1646052109627.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/signOfIcon.xml
/data/data/####/sysconfig.xml
/data/data/####/the-real-index
/data/data/####/wantu_localpush.xml
/data/data/####/wantu_shareprefsname.xml
/data/data/####/wuhuizhuang02_63_654_blush.png
/data/data/####/wuhuizhuang03_157_569_brow.png
/data/data/####/wuhuizhuang03_179_660_liner.png
/data/data/####/wuhuizhuang03_83_562_shadow.png
/data/data/####/xila_91_568_shadow.png
/data/data/####/y08.dex
/data/data/####/y08.dex.flock (deleted)
/data/data/####/y08.jar
/data/data/####/yidali_128_588_shadow.png
/data/data/####/yingguo_152_561_shadow.png
/data/data/####/yingguo_185_632_doulid.png
/data/data/####/zhili_201_636_doulid.png
/data/media/####/journal
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

lib0oijhy7nvcderty
libcrashlytics
libjiagu

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial