Android.Packed.25105

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Moplus.1

Downloads the following detected threats from the Web:

Android.Moplus.1

Network activity:

Connecting to:

7j####.####.com
a####.####.com
c-h####.####.com
m####.####.com
o####.####.com
o####.####.com:8080
ope####.####.cn
p####.####.com
qb####.com
reso####.####.net
s####.####.com
sh####.####.com
ta####.com

HTTP GET requests:

7j####.####.com/tdata_cFw670
a####.####.com/qbmapp/api/getAppUrl.html
m####.####.com/?sprefer=####
ope####.####.cn/index/upgrade?package=####&version=####&apk_version=####...
p####.####.com/t01793163f68a77f8b6.png
qb####.com/zaimages/data/upload/zizhi/qbmimg/borrow/images/856a7daf5dce8...
reso####.####.net/gslb/?ver=####&type=####&uuid=####&list=####&key=####
s####.####.com/config/hz-hzv3.conf
sh####.####.com/160422/7bcec7e7c45683a01b4ffc5c68c66f94/libpatch1.so
ta####.com/

HTTP POST requests:

a####.####.com/app_logs
c-h####.####.com/api.php?format=####&t=####
o####.####.com/analytics/upload?rid=####&sid=####
o####.####.com/v2/check_config_update
o####.####.com:8080/analytics/upload?sid=####
p####.####.com/api/q/a/3db355750bea842d8ee0cece950aa5ecd
s####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/cache/####/-537602549-1944165769
<Package Folder>/cache/####/-563892635671332205
<Package Folder>/cache/####/1119397974-1857480812
<Package Folder>/cache/####/15755799612074743640
<Package Folder>/cache/####/206FF0C0FD7237E1C5F12C246CF067DA.png
<Package Folder>/cache/####/215607179-961916502
<Package Folder>/cache/####/846412350-1115112825
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/index
<Package Folder>/cache/####/libpatch.so
<Package Folder>/cache/####/libpatch1.so
<Package Folder>/cache/####/temp.tmp~ (deleted)
<Package Folder>/databases/beacon_db-journal
<Package Folder>/databases/increment.db-journal
<Package Folder>/databases/mpush_app.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/.imprint
<Package Folder>/files/<Package>;pushservice
<Package Folder>/files/Beacon_sig_1.lock
<Package Folder>/files/TDtcagent.db
<Package Folder>/files/TDtcagent.db-journal
<Package Folder>/files/init.pid
<Package Folder>/files/init_c.pid
<Package Folder>/files/mobclick_agent_cached_<Package>57
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/td.lock
<Package Folder>/files/tdlock.txt
<Package Folder>/files/umeng_it.cache
<Package Folder>/libs/####/libpatch
<Package Folder>/libs/####/libpatch1
<Package Folder>/mobilepaysdk.zip
<Package Folder>/mobilepaysdk/####/back_holo_dark.png
<Package Folder>/mobilepaysdk/####/back_holo_light.png
<Package Folder>/mobilepaysdk/####/chkbtn.png
<Package Folder>/mobilepaysdk/####/chkbtn_cur.png
<Package Folder>/mobilepaysdk/####/common.css
<Package Folder>/mobilepaysdk/####/common.js
<Package Folder>/mobilepaysdk/####/cordova.js
<Package Folder>/mobilepaysdk/####/httpRequest.js
<Package Folder>/mobilepaysdk/####/jquery-2.1.1.min.js
<Package Folder>/mobilepaysdk/####/jquery.mobile-1.4.2.min.css
<Package Folder>/mobilepaysdk/####/jquery.mobile-1.4.2.min.js
<Package Folder>/mobilepaysdk/####/jquery.touchSwipe.min.js
<Package Folder>/mobilepaysdk/####/localData.js
<Package Folder>/mobilepaysdk/####/logo.png
<Package Folder>/mobilepaysdk/####/md5.js
<Package Folder>/mobilepaysdk/####/mobiscroll.core.js
<Package Folder>/mobilepaysdk/####/mobiscroll.datetime.js
<Package Folder>/mobilepaysdk/####/mobiscroll.scroller.css
<Package Folder>/mobilepaysdk/####/mobiscroll.scroller.js
<Package Folder>/mobilepaysdk/####/mustache.js
<Package Folder>/mobilepaysdk/####/pay.js
<Package Folder>/mobilepaysdk/####/reset.css
<Package Folder>/mobilepaysdk/####/spin.min.js
<Package Folder>/mobilepaysdk/####/style.css
<Package Folder>/mobilepaysdk/####/xml2json.js
<Package Folder>/mobilepaysdk/agreement_book.html
<Package Folder>/mobilepaysdk/agreement_book_fast.html
<Package Folder>/mobilepaysdk/bank_list.html
<Package Folder>/mobilepaysdk/card_manager.html
<Package Folder>/mobilepaysdk/card_setup.html
<Package Folder>/mobilepaysdk/card_setup_credit.html
<Package Folder>/mobilepaysdk/card_setup_debit.html
<Package Folder>/mobilepaysdk/card_setup_fucard.html
<Package Folder>/mobilepaysdk/card_setup_two.html
<Package Folder>/mobilepaysdk/index.html
<Package Folder>/mobilepaysdk/pay_pwd_setup.html
<Package Folder>/mobilepaysdk/payment.html
<Package Folder>/mobilepaysdk/result.html
<Package Folder>/mobilepaysdk/version.json
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/DENGTA_META.xml
<Package Folder>/shared_prefs/DENGTA_META.xml.bak
<Package Folder>/shared_prefs/TDCloudSettingsConfig0C8662BE5E88719737C444AED18493D8.xml
<Package Folder>/shared_prefs/TDCloudSettingsConfig0C8662BE5E88719737C444AED18493D8.xml.bak
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml.bak
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/TDpref_shorttime.xml.bak
<Package Folder>/shared_prefs/first_pref.xml
<Package Folder>/shared_prefs/mipush.xml
<Package Folder>/shared_prefs/mipush_account.xml
<Package Folder>/shared_prefs/mipush_extra.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
<Package Folder>/shared_prefs/pref_registered_pkg_names.xml
<Package Folder>/shared_prefs/qianbaomu.xml
<Package Folder>/shared_prefs/session.xml
<Package Folder>/shared_prefs/share_data_updatesdk.xml
<Package Folder>/shared_prefs/sharedpref.xml
<Package Folder>/shared_prefs/sharedpref.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/update.qh
<SD-Card>/.tcookieid
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/140tcxzw99ryvh46kdkrezpgl.tmp
<SD-Card>/Android/####/1fix5ifo7329vn6epm77agyah.tmp
<SD-Card>/Android/####/1yn9opp1aod0b7gnsnjgjvqy1.tmp
<SD-Card>/Android/####/225umvhhzwgaojezpoznsokyp.tmp
<SD-Card>/Android/####/388bzj8vupd1g1rryftyk5ca0.tmp
<SD-Card>/Android/####/4zcwb1zbh4m310fg7p9yhgat3.tmp
<SD-Card>/Android/####/5prnbvj1h0es33co8soi7c2zk.tmp
<SD-Card>/Android/####/7c9a1fvp1e77n4mjz5o3jj0ld.tmp
<SD-Card>/Android/####/7in7vqn07ssfystpaq1ois79y.tmp
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db
<SD-Card>/qianbaomu/####/ec50048e6447a1af8722dc0835643104
<SD-Card>/tencent/####/meta.dat

Miscellaneous:

Executes next shell scripts:

chmod 755 /data/data/com.qianbaomu.view/.jiagu/libjiagu.so
chmod 755 /data/data/com.qianbaomu.view/cache/360Download
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/cache/360Download

Uses special library to hide executable bytecode.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial