Android.Packed.38490

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) 4####.92.62.1:80
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.1) cdn.app.1####.top:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) cdn.app.be####.top:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) 189adb2####.ksy####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) b####.be####.top:443
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) www.news####.net.####.com:443
UDP 1####.168.68.254:4466
TCP 1####.11.52.16:443

DNS requests:

a####.news####.net
amap####.cn-hang####.oss####.####.com
amdc####.m.ta####.com
and####.b####.qq.com
api.w####.com
b####.be####.top
cdn.app.1####.top
cdn.app.be####.top
cdn.img.fly####.top
pis.al####.com
plb####.u####.com
pns.al####.com
pss.al####.com
pus.al####.com
res####.a####.com
u####.u####.com
umen####.m.ta####.com
www.news####.net

HTTP GET requests:

cdn.app.1####.top/upload/201806/15/app/20180615213201069.apk
cdn.app.be####.top/sfile/s1501
cdn.app.be####.top/sfile/spy149
cdn.app.be####.top/upload/201803/7/img/20180307171834691.png
cdn.app.be####.top/upload/201804/17/img/20180417133720619.png
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so

HTTP POST requests:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/ACCS_BINDumeng;58a17eef9f06fd47b5000e2b.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a==7.5.3&&2.7.2_1526454318313_envelope.log
/data/data/####/accs.db-journal
/data/data/####/ads-758047677.jar
/data/data/####/alldown.xml
/data/data/####/bugly_db_-journal
/data/data/####/c.xml
/data/data/####/crashrecord.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dwer.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/i==1.2.0&&2.7.2_1526454317164_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libjiagu-480729360.so
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc_new.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/mivmi.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pcdnconfigs.xml
/data/data/####/pcdnconfigs.xml.bak
/data/data/####/pref.xml
/data/data/####/pref_splash.xml
/data/data/####/pref_user.xml
/data/data/####/security_info
/data/data/####/setContext.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/v.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/weibo_sdk_aid1
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/004b420cc8a44153ad31a6bdcb47f34a
/data/media/####/00f3971af70649f99aa4fec712513ad8
/data/media/####/2d83458c6505f
/data/media/####/5d637151f27a403bf2eb10bfe3836e86.apk
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/cl.tmp
/data/media/####/ds.tmp
/data/media/####/ds.tmp (deleted)
/data/media/####/e27ef37931fe8
/data/media/####/myself.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
chmod 755 /data/data/com.cctv.ugc/.jiagu/libjiagu-480729360.so
chmod 777 /storage/emulated/0/spxin/5d637151f27a403bf2eb10bfe3836e86.apk
getprop
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libpcdn_acc
pcdn_acc

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial