Android.Packed.31735

Technical information

Malicious functions:

Executes code of the following detected threats:

Tool.SilentInstaller.3.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) c00.ho####.l####.####.cn:80
TCP(HTTP/1.1) s.we####.l####.com:80
TCP(HTTP/1.1) api.ib####.com:80
TCP(HTTP/1.1) api.plat####.le####.com:80
TCP(HTTP/1.1) alydown####.bob####.com:80
TCP(HTTP/1.1) for####.sf.c####.com:80
TCP(HTTP/1.1) as####.aliyu####.re####.cn:80
TCP(HTTP/1.1) 1####.205.163.87:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) i####.diansh####.cn:80
TCP(HTTP/1.1) bc.g####.gosu####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) a####.www.leyi####.com:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP 1####.205.160.76:443

DNS requests:

a####.www.leyi####.com
a.appj####.com
alydown####.bob####.com
api.ib####.com
api.l####.com
api.plat####.l####.com
as####.aliyu####.re####.cn
c00.ho####.l####.####.cn
d####.fl####.com
i####.diansh####.cn
int.d####.s####.####.cn
ip.ta####.com
l####.dan####.net
msg.umengc####.com
playbac####.sobeyc####.com
s.we####.l####.com
static2####.c####.ott.####.net

HTTP GET requests:

api.ib####.com/api/ad/corner
api.ib####.com/api/ad/endView2
api.ib####.com/api/ad/startView
api.ib####.com/api/config/lobby
api.ib####.com/api/config/sinstall
api.ib####.com/api/custom/checked
api.ib####.com/api/data/area
api.ib####.com/api/offProgram/list
api.ib####.com/api/update/new_version
api.ib####.com/api/v1/channels
api.ib####.com/api/v1/plugin/update?pkgName=####
api.ib####.com/api/v1/programs/1302
api.ib####.com/api/v1/programs/1304
api.ib####.com/api/v1/programs/1305
api.ib####.com/api/v1/programs/1307
api.ib####.com/api/v1/programs/1318
api.ib####.com/api/v1/programs/1320
api.ib####.com/api/v1/programs/1322
api.ib####.com/api/v1/programs/1323
api.ib####.com/api/v1/programs/1324
api.ib####.com/api/v1/programs/1326
api.ib####.com/api/v1/programs/1329
api.ib####.com/api/v1/programs/1332
api.ib####.com/api/v1/programs/1387
api.ib####.com/api/v1/programs/457
api.ib####.com/api/v1/shin?injectConditions=####
api.ib####.com/systime
api.plat####.le####.com/upgrade?appid=####&appkey=####&app_channel=####&...
as####.aliyu####.re####.cn/img/ott/dianshijia/dianshijia131-10.png
bc.g####.gosu####.com/photo/aqy-wdqbs.jpg
c00.ho####.l####.####.cn/ghs.m3u8
i####.diansh####.cn/api/config/info
int.d####.s####.####.cn/iplookup/iplookup.php?format=####&ip=####
s.we####.l####.com/upgrade?locVer=####&serVer=####&model=####&vendor=###...

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
a.appj####.com/jiagu/check/upgrade
api.ib####.com/api/pay/documents

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/Plugin/####/-1118613601.tmp
<Package Folder>/Plugin/####/-1333644737.tmp
<Package Folder>/Plugin/####/-458884404.tmp
<Package Folder>/Plugin/####/00a7c39bad9da3ff33a1d92fa5ea95cf.0.tmp
<Package Folder>/Plugin/####/00a7c39bad9da3ff33a1d92fa5ea95cf.1.tmp
<Package Folder>/Plugin/####/100a50d7f52302dac5cb0bdc22bd74cc.0.tmp
<Package Folder>/Plugin/####/100a50d7f52302dac5cb0bdc22bd74cc.1.tmp
<Package Folder>/Plugin/####/1497730907.tmp
<Package Folder>/Plugin/####/14d44c8ea7317ed3c1ff4291f822cf3b.0.tmp
<Package Folder>/Plugin/####/14d44c8ea7317ed3c1ff4291f822cf3b.1.tmp
<Package Folder>/Plugin/####/1621430290.tmp
<Package Folder>/Plugin/####/1d226ca6565ade140fc22e82c01c51f0.0.tmp
<Package Folder>/Plugin/####/1d226ca6565ade140fc22e82c01c51f0.1.tmp
<Package Folder>/Plugin/####/2e1bce795434e4741062a511af1df879.0.tmp
<Package Folder>/Plugin/####/2e1bce795434e4741062a511af1df879.1.tmp
<Package Folder>/Plugin/####/368cb113cf4e1f4c527fed72367c6825.0.tmp
<Package Folder>/Plugin/####/368cb113cf4e1f4c527fed72367c6825.1.tmp
<Package Folder>/Plugin/####/41caa47395816610f4cc5b41d53e532b.0.tmp
<Package Folder>/Plugin/####/41caa47395816610f4cc5b41d53e532b.1.tmp
<Package Folder>/Plugin/####/434f0f16f7b882af3e7de7bd0b5c1238.0.tmp
<Package Folder>/Plugin/####/434f0f16f7b882af3e7de7bd0b5c1238.1.tmp
<Package Folder>/Plugin/####/43c4b908bdbc0c94130c9a8d0279c4bc.0.tmp
<Package Folder>/Plugin/####/43c4b908bdbc0c94130c9a8d0279c4bc.1.tmp
<Package Folder>/Plugin/####/444af4c114178825e6d998db4864c736.0.tmp
<Package Folder>/Plugin/####/444af4c114178825e6d998db4864c736.1.tmp
<Package Folder>/Plugin/####/45fa8bcc5906f38b119452ba2aaabafc.0.tmp
<Package Folder>/Plugin/####/45fa8bcc5906f38b119452ba2aaabafc.1.tmp
<Package Folder>/Plugin/####/575fae8adb8607e71d7affd863723bbf.0.tmp
<Package Folder>/Plugin/####/575fae8adb8607e71d7affd863723bbf.1.tmp
<Package Folder>/Plugin/####/5cfd8678261eb976b423e0d09113ff9b.0.tmp
<Package Folder>/Plugin/####/5cfd8678261eb976b423e0d09113ff9b.1.tmp
<Package Folder>/Plugin/####/5e152cf1ba03a3a84595451e7e95a31d.0.tmp
<Package Folder>/Plugin/####/5e152cf1ba03a3a84595451e7e95a31d.1.tmp
<Package Folder>/Plugin/####/672633468b7cb7bf0c1598aca53132c4.0.tmp
<Package Folder>/Plugin/####/672633468b7cb7bf0c1598aca53132c4.1.tmp
<Package Folder>/Plugin/####/682c7b5f583a8209431e9e230a31ef68.0.tmp
<Package Folder>/Plugin/####/682c7b5f583a8209431e9e230a31ef68.1.tmp
<Package Folder>/Plugin/####/6a6a4d2bd3ee96d2f5a962c0207b3ece.0.tmp
<Package Folder>/Plugin/####/6a6a4d2bd3ee96d2f5a962c0207b3ece.1.tmp
<Package Folder>/Plugin/####/6b7a3107114d122228b8fe8eea60567d.0.tmp
<Package Folder>/Plugin/####/6b7a3107114d122228b8fe8eea60567d.1.tmp
<Package Folder>/Plugin/####/77f7db06cb184353bb415909a879987e.0.tmp
<Package Folder>/Plugin/####/77f7db06cb184353bb415909a879987e.1.tmp
<Package Folder>/Plugin/####/7a8bc4d430b4e344e507759ee533ad88.0.tmp
<Package Folder>/Plugin/####/7a8bc4d430b4e344e507759ee533ad88.1.tmp
<Package Folder>/Plugin/####/7e2ef636d59138903c8b4891425363b4.0.tmp
<Package Folder>/Plugin/####/7e2ef636d59138903c8b4891425363b4.1.tmp
<Package Folder>/Plugin/####/83105fe00360cf8f93eeac4704ad9d98.0.tmp
<Package Folder>/Plugin/####/83105fe00360cf8f93eeac4704ad9d98.1.tmp
<Package Folder>/Plugin/####/89a07ec53c4f9cc43c19feb2dd682cc5.0.tmp
<Package Folder>/Plugin/####/89a07ec53c4f9cc43c19feb2dd682cc5.1.tmp
<Package Folder>/Plugin/####/Alvin2.xml
<Package Folder>/Plugin/####/CONFIG.xml
<Package Folder>/Plugin/####/CUSTOM_CONFIG.xml
<Package Folder>/Plugin/####/ContextData.xml
<Package Folder>/Plugin/####/DOWNLOAD_END_AD.xml
<Package Folder>/Plugin/####/DOWNLOAD_START_AD.xml
<Package Folder>/Plugin/####/LIVE_CONFIG.xml
<Package Folder>/Plugin/####/SWITCH_CONFIG.xml
<Package Folder>/Plugin/####/SYSTEM_INFO.xml
<Package Folder>/Plugin/####/Signature_0.key
<Package Folder>/Plugin/####/base-1.apk
<Package Folder>/Plugin/####/base-1.dex
<Package Folder>/Plugin/####/bbb4b21bcc0036a2f8e1c132b62212ec.0.tmp
<Package Folder>/Plugin/####/bbb4b21bcc0036a2f8e1c132b62212ec.1.tmp
<Package Folder>/Plugin/####/c12eb9ce2d454e83146a081709de3686.0.tmp
<Package Folder>/Plugin/####/c12eb9ce2d454e83146a081709de3686.1.tmp
<Package Folder>/Plugin/####/c18397b5450f2fa6fc52406d6f4d50dd.0.tmp
<Package Folder>/Plugin/####/c18397b5450f2fa6fc52406d6f4d50dd.1.tmp
<Package Folder>/Plugin/####/c4d98507ab389d050dab5716719c1da6.0.tmp
<Package Folder>/Plugin/####/c4d98507ab389d050dab5716719c1da6.1.tmp
<Package Folder>/Plugin/####/d4765011a845ab106e19bb465dacb787.0.tmp
<Package Folder>/Plugin/####/d4765011a845ab106e19bb465dacb787.1.tmp
<Package Folder>/Plugin/####/de9ee5045db4771542e8c93591f20427.0.tmp
<Package Folder>/Plugin/####/de9ee5045db4771542e8c93591f20427.1.tmp
<Package Folder>/Plugin/####/e7b4356d1c1e9ce07902158bfb243142.0.tmp
<Package Folder>/Plugin/####/e7b4356d1c1e9ce07902158bfb243142.1.tmp
<Package Folder>/Plugin/####/exit_document.data
<Package Folder>/Plugin/####/exit_recommend.data
<Package Folder>/Plugin/####/journal
<Package Folder>/Plugin/####/journal.tmp
<Package Folder>/Plugin/####/launcher_ad.data
<Package Folder>/Plugin/####/redirect_urls.xml
<Package Folder>/Plugin/####/tmp.Cu2079
<Package Folder>/Plugin/####/tmp.Lg2079
<Package Folder>/Plugin/####/tmp.Wa2079
<Package Folder>/Plugin/####/tmp.cM2079
<Package Folder>/Plugin/####/tmp.mR2079
<Package Folder>/Plugin/####/tmp.nF2079
<Package Folder>/Plugin/####/tmp.nx2079
<Package Folder>/Plugin/####/tmp.qh2079
<Package Folder>/Plugin/####/tvlive2.db-journal
<Package Folder>/Plugin/####/user_defined_channel.data
<Package Folder>/Plugin/####/user_defined_import_channel.data
<Package Folder>/databases/####/cc.db
<Package Folder>/databases/####/cc.db-journal
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/temp.apk
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_X...MK_225
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
<Package Folder>/files/.yflurrydatasenderblock.0d5f949d-4c41-48...c4195f
<Package Folder>/files/.yflurrydatasenderblock.1fb27e7c-145e-43...ea3764
<Package Folder>/files/.yflurrydatasenderblock.95bfb7d6-dfd6-4f...d0de0e
<Package Folder>/files/.yflurrydatasenderblock.d4de0a81-f62c-42...e67931
<Package Folder>/files/.yflurryreport.-2e8c028846af660c
<Package Folder>/files/mobclick_agent_cached_<Package>90
<Package Folder>/libs/libcde-native.so
<Package Folder>/libs/version.txt
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ACCS_BIND.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
<Package Folder>/shared_prefs/cde_config.xml
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/5cd17383adeb4b91a6c76010d3edc92c
<SD-Card>/Android/####/d3aa6376449a4d4eb9dcee4cca042888
<SD-Card>/Android/####/f89052f725e04c4ea534502758f19838
<SD-Card>/PluginLog/####/CrashLog_20171004130919_2203.log
<SD-Card>/PluginLog/####/CrashLog_20171004130937_2427.log

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

ijkffmpeg
ijkplayer
ijksdl
libcde-native
libjiagu
tnet-3.1

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial