Android.Packed.37787

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.2083
Android.DownLoader.546.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sni.c####.q####.####.com:80
TCP(HTTP/1.1) err.ta####.com:80
UDP(NTP) t2.h####.org:123
UDP(NTP) t1.h####.org:123
TCP(TLS/1.0) wss.app-r####.com:443
TCP(TLS/1.0) sni.c####.q####.####.com:443
TCP(TLS/1.0) l####.app-r####.com:443
TCP(TLS/1.0) api.app-r####.com:443
TCP(TLS/1.0) tinyqi####.b0.a####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443

DNS requests:

api.app-r####.com
apis-ho####.ta####.com
av####.app-r####.com
err.ta####.com
h####.b####.com
l####.app-r####.com
live####.app-r####.com
pic.app-r####.com
t1.h####.org
t2.h####.org
wss.app-r####.com

HTTP GET requests:

err.ta####.com/error1.html
sni.c####.q####.####.com/1QNJO2AMA8DOK5C7.jpg?imageMo####
sni.c####.q####.####.com/4ZINYNF9Y2EZY8QD.jpg?imageMo####
sni.c####.q####.####.com/84TSQH6S70FQGZVC.jpg?imageMo####
sni.c####.q####.####.com/9eb98fd6c922c29b5.png
sni.c####.q####.####.com/L1RWAVRC5DL50SK8.jpg?imageMo####
sni.c####.q####.####.com/RFJD3IOBZQEX1LA1.jpg?imageMo####

Modified file system:

Creates the following files:

/data/data/####/-10463367551362522227
/data/data/####/-1389167623-449504995
/data/data/####/-316812491
/data/data/####/-492614136
/data/data/####/-7127023021566336618
/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/.old_file_converted
/data/data/####/1004
/data/data/####/117889047940101031
/data/data/####/1276449771-834648563
/data/data/####/1450320812-2101004272
/data/data/####/355352425-12809175
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Qiubai_Stat_SDK_Cfg.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1526454801792
/data/data/####/__stat_cache.json
/data/data/####/_andfix_.xml
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.ixintui.stat.setting.xml
/data/data/####/com.ixintui.stat.setting.xml.bak
/data/data/####/com.ixintui.time.setting.xml
/data/data/####/crashrecord.xml
/data/data/####/db_public-journal
/data/data/####/filedownloader.db-journal
/data/data/####/ixintui
/data/data/####/ixintui_plugin.jar
/data/data/####/libcuid.so
/data/data/####/libixintui_asset.so
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_qsbk.app.remixra428
/data/data/####/multidex.version.xml
/data/data/####/qsbk.app.remixra.odex
/data/data/####/qsbk.app.remixra.zip
/data/data/####/qsbk.app.remixra_preferences.xml
/data/data/####/remix_config.xml
/data/data/####/stat_plugin.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/ye.xml
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.timestamp
/data/media/####/053bc1c9893fa4c6811870013b06bc21
/data/media/####/053bc1c9893fa4c6811870013b06bc21.temp
/data/media/####/0ywceibtDTpjOQUPtPs6pxMG-YY.1373222081.tmp
/data/media/####/158609839dfc3afd95f64aca7617d418
/data/media/####/158609839dfc3afd95f64aca7617d418.temp
/data/media/####/1c7fef1a2e6afbfd75441fa893dde688
/data/media/####/1c7fef1a2e6afbfd75441fa893dde688.temp
/data/media/####/1d986b68d23645b1bf465ac69a1ad1c5
/data/media/####/1d986b68d23645b1bf465ac69a1ad1c5.temp
/data/media/####/258b1c63469695758941cfaeafa9f022
/data/media/####/258b1c63469695758941cfaeafa9f022.temp
/data/media/####/2fd323c67e5a5f2f95375f9e6f74b75c
/data/media/####/2fd323c67e5a5f2f95375f9e6f74b75c.temp
/data/media/####/3d6a8115003191c385c2565caa4cb5b5
/data/media/####/3d6a8115003191c385c2565caa4cb5b5.temp
/data/media/####/4DoOTp7dn5OS1ps9l74SEXF1w_Y.1559833274.tmp
/data/media/####/5190b241afe099dc9b1e5cc6686ffdaf
/data/media/####/5190b241afe099dc9b1e5cc6686ffdaf.temp
/data/media/####/653fddf7b89950f994885ded34480b4a
/data/media/####/653fddf7b89950f994885ded34480b4a.temp
/data/media/####/76b80c8861dcaf790dd6cb9d8763b776
/data/media/####/76b80c8861dcaf790dd6cb9d8763b776.temp
/data/media/####/7a2d04632e2b819156331a878fed4da7
/data/media/####/7a2d04632e2b819156331a878fed4da7.temp
/data/media/####/7ca43efc06f0ae3022629f9e30b80d9a
/data/media/####/7ca43efc06f0ae3022629f9e30b80d9a.temp
/data/media/####/81dff72807036cc16a0dcd29ad8f5a81
/data/media/####/81dff72807036cc16a0dcd29ad8f5a81.temp
/data/media/####/94a4340ddcb7aa4c36ac9aaef226ec51
/data/media/####/94a4340ddcb7aa4c36ac9aaef226ec51.temp
/data/media/####/95844769
/data/media/####/ASUABtkEaLHjjJ-T1oR1szENnb0.1974914061.tmp
/data/media/####/Ag2nGp7GGmaLoITGFTnUsLxUTCw.-2053303422.tmp
/data/media/####/CtsMJNCrT9cdcYxObPI3qIuA6pk.-1678115046.tmp
/data/media/####/Fv9XRY7bXdqOFpYK1aeiJCFQvHQ.1422221106.tmp
/data/media/####/IhaHPZjyyoK2uuQ-k69jWuAFbFA.2078170206.tmp
/data/media/####/NmklKuz3pgmAokD09P0KdWQzz50.1086229036.tmp
/data/media/####/QdfH6x62QgHUwT3Bgr7y-Stjng4.-1699433868.tmp
/data/media/####/QuXvsBK-jXhqPYP7PBxfB9B6pMQ.16838277.tmp
/data/media/####/SagbcXsbvLkLqpd3vOTBfFlgJBg.1839139020.tmp
/data/media/####/YFBcd_1_PS3huswR0AlSEENpMZM.1187486898.tmp
/data/media/####/a663afdb1e976e584ab4e7db008342cc
/data/media/####/a663afdb1e976e584ab4e7db008342cc.temp
/data/media/####/a6ee4a420d1f6181f54f36290f9534bd
/data/media/####/a6ee4a420d1f6181f54f36290f9534bd.temp
/data/media/####/aa7ced4b83dd9d758bce420b4da5647c
/data/media/####/aa7ced4b83dd9d758bce420b4da5647c.temp
/data/media/####/bI9pVyp9vCF2HCmChjrygRW0EPM.-128142766.tmp
/data/media/####/bae2d3a64e0e872d8b2da7d5fff87aa3
/data/media/####/bae2d3a64e0e872d8b2da7d5fff87aa3.temp
/data/media/####/c0118a953f05a9d08442eb50b1d37593
/data/media/####/c0118a953f05a9d08442eb50b1d37593.temp
/data/media/####/c271de23018185d5ee9e35da2417bce3
/data/media/####/c271de23018185d5ee9e35da2417bce3.temp
/data/media/####/crash.txt
/data/media/####/df15c55707756cde80b49d922246203f
/data/media/####/df15c55707756cde80b49d922246203f.temp
/data/media/####/e85d131028dfd77374f000e6a7fef15b
/data/media/####/e85d131028dfd77374f000e6a7fef15b.temp
/data/media/####/eemDZceGLiV23En7JND0qvQJ3ro.185223646.tmp
/data/media/####/f252a4a05975b825a9304565b5e2d42b
/data/media/####/f252a4a05975b825a9304565b5e2d42b.temp
/data/media/####/f8b267345696d5254912efbf600f1e27
/data/media/####/f8b267345696d5254912efbf600f1e27.temp
/data/media/####/fatal_error.txt
/data/media/####/fewOKaSxYijx0Jm3PiZVKu5UFNI.-125008369.tmp
/data/media/####/ySEjXLJe0VyA1Yn_piL-2TaiQm4.535352429.tmp
/data/media/####/yjMji8aPu3oPC0ATM-iWDbYWl6c.-1312569033.tmp

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 <Package Folder>/ixintui
dd if <Package Folder>/files/libixintui_asset.so of <Package Folder>/ixintui
sh

Loads the following dynamic libraries:

Bugly
imagepipeline
libjiagu

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial