Android.HiddenAds.3561

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.1708

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) im.clean####.info:80
TCP(HTTP/1.1) c.sdk.medi####.cn:80
TCP(HTTP/1.1) ip####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.didi####.com.cn:80
TCP(HTTP/1.1) stt.medi####.cn:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) beacon####.aliy####.com:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) ap####.uc.cn:443
TCP(TLS/1.0) adash####.man.aliy####.com:443
TCP(TLS/1.0) ev####.appsf####.com:443
TCP(TLS/1.0) ve####.baid####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) adt.cp####.net:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) cgi.con####.qq.com:443
TCP(TLS/1.0) ap.cp####.net:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) t.appsf####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) aip.baid####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.2) 64.2####.165.94:443
TCP zb-cent####.m.ta####.com:443
UDP and####.google####.com:443
TCP openj####.m.ta####.com:443

DNS requests:

2.and####.p####.####.org
a####.man.aliy####.com
adt.cp####.net
aip.baid####.com
amdc####.m.ta####.com
and####.a####.go####.com
and####.b####.qq.com
and####.google####.com
ap####.uc.cn
ap.cp####.net
api.didi####.com.cn
app-mea####.com
beacon####.aliy####.com
c####.x####.com
c.sdk.medi####.cn
cf.clean####.info
cgi.con####.qq.com
ev####.appsf####.com
geomobi####.google####.com
im.clean####.info
ip####.com
m####.go####.com
p####.google####.com
plb####.u####.com
plb####.u####.com.####.8
stt.clean####.info
stt.medi####.cn
t.appsf####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
ve####.baid####.com

HTTP GET requests:

api.didi####.com.cn/task/notices/index/1?app_id=####
api.didi####.com.cn/task/notices/index/2?app_id=####
api.didi####.com.cn/task/tasks/index/15?app_id=####
api.didi####.com.cn/task/tasks/index/1?app_id=####
api.didi####.com.cn/task/tasks/index/2?app_id=####
api.didi####.com.cn/task/tasks/index/3?app_id=####
api.didi####.com.cn/task/tasks/status?app_id=####&token=####
c.sdk.medi####.cn/cr/config?appid=####&func=####&pkg_ver=####&app_ver=##...
cgi.con####.qq.com:443/qqconnectopen/openapi/policy_conf?status_os=####&...
im.clean####.info/cr/config?pubid=####&gaid=####&guid=####&pkg_name=####...
im.clean####.info/m/config?pubid=####&moduleid=####&file_ver=####&lang=#...
im.clean####.info/m/config?pubid=####&moduleid=####&gaid=####&guid=####&...
ip####.com/json

HTTP POST requests:

adash####.man.aliy####.com:443/man/api?ak=####&s=####
adt.cp####.net:443/15622bd/1
adt.cp####.net:443/93d57886/1
aip.baid####.com:443/public/2.0/license/face-api/app/querydevicelicense
and####.b####.qq.com/rqd/async?aid=####
ap####.uc.cn:443/collect?chk=####&vno=####&uuid=####&app=####&enc=####
ap.cp####.net:443/u/a/v1/1d6977a3
ap.cp####.net:443/u/a/v1/3fa3fbb0
ap.cp####.net:443/u/a/v1/56c4b106
ap.cp####.net:443/u/a/v1/5b1f9fe6
ap.cp####.net:443/u/a/v1/7391c0d6
ap.cp####.net:443/u/a/v1/75b2406
ap.cp####.net:443/u/a/v1/9cea83cd
ap.cp####.net:443/u/a/v1/a7c1e14f
ap.cp####.net:443/u/a/v1/d0ab6375
ap.cp####.net:443/u/a/v1/d47f9e9f
ap.cp####.net:443/u/a/v1/e5df5f75
beacon####.aliy####.com/beacon/fetch/config/byappkey
c####.x####.com:443/configcloud/rest/sdk/match
ev####.appsf####.com:443/api/v4/androidevent?buildnumber=####&app_id=####
im.clean####.info/ac/rt
im.clean####.info/nw/ne
im.clean####.info/nw/nn
im.clean####.info/nw/nu
im.clean####.info/nw/nx
im.clean####.info/nw/tk
stt.medi####.cn/zyt/ac/rt
stt.medi####.cn/zyt/ap/ct
stt.medi####.cn/zyt/nw/ne
stt.medi####.cn/zyt/nw/nn
stt.medi####.cn/zyt/nw/nu
stt.medi####.cn/zyt/nw/nx
t.appsf####.com:443/api/v4/androidevent?buildnumber=####&app_id=####
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg
ve####.baid####.com:443/verify/1.0/token/sk?sdkVersion=####

File system changes:

Creates the following files:

/data/data/####/.cl
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.lock
/data/data/####/.
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/09cedb3b912bb50bc8dff8a22d1039ea.xml
/data/data/####/09cedb3b912bb50bc8dff8a22d1039ea.xml.bak
/data/data/####/1004
/data/data/####/1666864655619_3722
/data/data/####/1666864655664_3722
/data/data/####/1666864686168_3722
/data/data/####/1666864686194_3722
/data/data/####/1666864686301_3722
/data/data/####/1666864686987_3722
/data/data/####/1666864687657_3722
/data/data/####/1666864687795_3722
/data/data/####/1666864687884_3722
/data/data/####/1666864688308_3722
/data/data/####/1666864688473_3722
/data/data/####/1666864688769_3722
/data/data/####/1666864689038_3767
/data/data/####/1666864689095_3722
/data/data/####/1666864689211_3722
/data/data/####/1666864689302_3722
/data/data/####/1666864689567_3722
/data/data/####/1666864689634_3722
/data/data/####/1666864689685_3722
/data/data/####/1666864689737_3722
/data/data/####/1666864689882_3722
/data/data/####/1666864689955_3722
/data/data/####/1666864689965_4309
/data/data/####/1666864689997_3722
/data/data/####/1666864690196_3722
/data/data/####/1666864690219_3722
/data/data/####/1666864690247_3722
/data/data/####/1666864690266_3722
/data/data/####/1666864690349_3722
/data/data/####/1666864690387_3722
/data/data/####/1666864690584_3722
/data/data/####/1666864690611_3722
/data/data/####/1666864690621_3722
/data/data/####/1666864690695_3722
/data/data/####/1666864690781_3722
/data/data/####/1666864690972_3722
/data/data/####/1666864691135_3722
/data/data/####/1666864691287_3722
/data/data/####/1666864691354_3722
/data/data/####/1666864691671_3722
/data/data/####/1666864691741_3722
/data/data/####/1666864691818_3722
/data/data/####/1666864691973_3722
/data/data/####/1666864692412_3722
/data/data/####/1666864693709_3767
/data/data/####/1666864693743_3767
/data/data/####/1666864694737_4309
/data/data/####/1666864694772_4309
/data/data/####/1666864694846_3767
/data/data/####/1666864695180_3722
/data/data/####/1666864695465_3722
/data/data/####/1666864700739_3722
/data/data/####/1666864701982_3722
/data/data/####/1666864702652_3722
/data/data/####/1666864703085_3722
/data/data/####/1666864703423_3722
/data/data/####/1666864703711_3722
/data/data/####/1666864704454_3722
/data/data/####/1666864704814_3722
/data/data/####/1666864705064_3722
/data/data/####/1666864705140_3722
/data/data/####/1666864705203_3722
/data/data/####/1666864705238_3722
/data/data/####/1666864705271_3722
/data/data/####/1666864705302_3722
/data/data/####/1666864705332_3722
/data/data/####/1666864705368_3722
/data/data/####/1666864705406_3722
/data/data/####/1666864705437_3722
/data/data/####/1666864705477_3722
/data/data/####/1666864705502_3722
/data/data/####/1666864705529_3722
/data/data/####/1666864705572_3722
/data/data/####/1666864705610_3722
/data/data/####/1666864705647_3722
/data/data/####/1666864705676_3722
/data/data/####/1666864705714_3722
/data/data/####/1666864705740_3722
/data/data/####/1666864705773_3722
/data/data/####/1666864705801_3722
/data/data/####/1666864705824_3722
/data/data/####/1666864705862_3722
/data/data/####/1666864705904_3722
/data/data/####/1666864705937_3722
/data/data/####/1666864705959_3722
/data/data/####/1666864705984_3722
/data/data/####/1666864706012_3722
/data/data/####/1666864706037_3722
/data/data/####/1666864706060_3722
/data/data/####/1666864706092_3722
/data/data/####/1666864706129_3722
/data/data/####/1666864706162_3722
/data/data/####/1666864706201_3722
/data/data/####/1666864706232_3722
/data/data/####/1666864706262_3722
/data/data/####/1666864706299_3722
/data/data/####/1666864706341_3722
/data/data/####/1666864706372_3722
/data/data/####/1666864706401_3722
/data/data/####/1666864706422_3722
/data/data/####/1666864706441_3722
/data/data/####/1666864706704_3722
/data/data/####/2c64b21034236f5a324d8b6cf32e160d.xml
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/ContextData.xml
/data/data/####/DRGP1RETSAM0NAELC0MOC.st
/data/data/####/INSTALLATION
/data/data/####/LENNAHC1RETSAM0NAELC0MOC.st
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/RETSAM0NAELC0MOC.st
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_cloudcontrol2.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_longtime1.xml
/data/data/####/TDpref_longtime1.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml.bak (deleted)
/data/data/####/TDpref_shorttime0.xml
/data/data/####/TDpref_shorttime0.xml.bak
/data/data/####/TDpref_shorttime0.xml.bak (deleted)
/data/data/####/TDpref_shorttime1.xml
/data/data/####/TDpref_shorttime1.xml.bak
/data/data/####/TDpref_shorttime1.xml.bak (deleted)
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/anay_sp_name.xml
/data/data/####/anay_sp_name.xml.bak
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/app_idl-license.face-android
/data/data/####/app_update.xml
/data/data/####/appcons.db
/data/data/####/appcons.db-journal
/data/data/####/appsflyer-data.xml
/data/data/####/appsflyer-data.xml.bak
/data/data/####/appsflyer-data.xml.bak (deleted)
/data/data/####/ast
/data/data/####/booster_sp.xml
/data/data/####/booster_sp.xml.bak
/data/data/####/bugly_db_-journal
/data/data/####/cdt.wa
/data/data/####/channel_umeng_common_config.xml
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.oat
/data/data/####/com.android.calculator2_7.1.2.png
/data/data/####/com.android.calendar_7.1.2.png
/data/data/####/com.android.camera2_2.0.002.png
/data/data/####/com.android.contacts_1.4.22.png
/data/data/####/com.android.deskclock_4.5.0.png
/data/data/####/com.android.development_1.0.png
/data/data/####/com.android.dialer_3.00.00.png
/data/data/####/com.android.documentsui_7.1.2.png
/data/data/####/com.android.email_7.1.2.png
/data/data/####/com.android.gallery3d_1.1.40030.png
/data/data/####/com.android.messaging_1.0.001.png
/data/data/####/com.android.quicksearchbox_7.1.2.png
/data/data/####/com.android.settings_7.1.2.png
/data/data/####/com.android.vending_32.7.13-21 [0] [PR] 479692038.png
/data/data/####/com.baidu.ocr.sdk.xml
/data/data/####/com.clean.master_preferences.xml
/data/data/####/com.cyanogenmod.eleven_3.0.png
/data/data/####/com.example.android.notepad_7.1.2.png
/data/data/####/com.example.android.rssreader_7.1.2.png
/data/data/####/com.google.InstanceId.properties
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.appid.xml.bak
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak (deleted)
/data/data/####/com.google.android.play.games_2022.01.32371 (42...0).png
/data/data/####/com.tencent.open.config.json.101880750
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info_com.cl...hannel
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info_com.cl...r;pgrd
/data/data/####/cr.wa
/data/data/####/crashrecord.xml
/data/data/####/d8b1588e9cccbb51534afcaa977ca0cf.xml
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNjY2ODY0NjU3MTY5;
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/dt.wa
/data/data/####/e9f8f24b4c419de5bfef11aaba220a24.xml
/data/data/####/ee77a6b85cdd708523fde12493438780.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fb2620e632eefaaf1da1ab89152a2533.xml
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak
/data/data/####/httpdns_config_enable.xml
/data/data/####/i==1.2.0&&1.1.3_1666864645140_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/iv
/data/data/####/jackpal.androidterm_1.0.70.png
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/mobi_anay_db.db-journal
/data/data/####/mobid_anay_db.db-journal
/data/data/####/my_opd_event_ids_day.xml
/data/data/####/ocr_sdk_uuid.xml
/data/data/####/org.chromium.webview_shell_1.0.png
/data/data/####/pgrd_umeng_common_config.xml
/data/data/####/pref_utils.xml
/data/data/####/pref_utils.xml.bak
/data/data/####/proc_auxv
/data/data/####/pv.wa
/data/data/####/qweoiqwioenz12jla.xml
/data/data/####/salt
/data/data/####/security_info
/data/data/####/sp_tiny.xml
/data/data/####/spc.db-journal
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak (deleted)
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_it_sl.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_message_state.xml.bak (deleted)
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_sp_zdata.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/unique
/data/data/####/ver
/data/data/####/videox.xml
/data/data/####/z==1.2.0&&1.1.3_1666864638251_envelope.log
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/com.tencent.mobileqq_connectSdk.22.10.27.12.log
/data/media/####/deviceToken
/data/media/####/sysid.dat
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
app_process /system/bin com.android.commands.pm.Pm list packages
getprop
getprop debug.bucketid
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list packages
sh
sh -c type su

Loads the following dynamic libraries:

libFaceSDK
libbaidu_license
libcrashsdk
libjiagu
libocr-sdk
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RC4-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about accounts associated with the device.

Adds tasks to the system scheduler.

Intercepts notifications.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial