Android.Packed.38660

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.611.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) p2.q####.com:80
TCP(HTTP/1.1) c####.b####.com:80
TCP(HTTP/1.1) bj.bc####.com:80
TCP(HTTP/1.1) f####.jy####.com:80
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) l####.c####.q####.####.net:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) s.a.longy####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) api.tui####.b####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) fc-####.cdn.bc####.####.com:80
TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
TCP(HTTP/1.1) p0.q####.com:80
TCP(HTTP/1.1) d####.eas####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) t####.cor####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) pre.bule####.cn:6501
TCP(HTTP/1.1) pop.jufe####.com:80
TCP(HTTP/1.1) 1####.25.201.164:8000
TCP(HTTP/1.1) reso####.msg.xi####.net:80
TCP(HTTP/1.1) v3.bule####.cn:7001
TCP(HTTP/1.1) s.y####.net:80
TCP(HTTP/1.1) cdn.a####.com:80
TCP(HTTP/1.1) k.36####.com:80
TCP(HTTP/1.1) p4.q####.com:80
TCP(HTTP/1.1) imag####.cdn.bc####.####.com:80
TCP(HTTP/1.1) dn.gogo####.top:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) api.itaoxia####.com:80
TCP(SSL/3.0) p1.ssl.q####.com:443
TCP(TLS/1.0) s3.ps####.com:443
TCP(TLS/1.0) ci####.s####.com:443
TCP(TLS/1.0) m.tt.vip-dns####.com:443
TCP(TLS/1.0) p1.ssl.q####.com:443
TCP(TLS/1.0) weiboi####.g####.sina####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) t####.eas####.com:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) lf.sn####.com:443
TCP(TLS/1.0) softwor####.dftou####.com:443
TCP(TLS/1.0) statson####.pu####.b####.com:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) lu####.b####.com:443
TCP(TLS/1.0) d####.eas####.com:443
TCP(TLS/1.0) regi####.xm####.xi####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) api.tui####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ss2.b####.com:443
TCP(TLS/1.0) paim####.b####.com:443
TCP(TLS/1.0) posi####.dftou####.com:443
TCP(TLS/1.0) em.b####.com:443
TCP 4####.62.94.2:443
TCP sa9.tui####.b####.com:5287
TCP 47.74.1####.158:5222

DNS requests:

00.img####.eas####.com
01.img####.eas####.com
08.img####.eas####.com
09.img####.eas####.com
2####.nd####.y####.com
2####.nd####.y####.com
a####.tui####.b####.com
a####.u####.com
and####.b####.qq.com
aod-i####.b####.com
api.itaoxia####.com
api.tui####.b####.com
bj.bc####.com
c####.b####.com
c####.baidust####.com
cdn.a####.com
ci####.s####.com
d####.eas####.com
dn.gogo####.top
dup.baidust####.com
ec####.b####.com
em.b####.com
f####.jy####.com
f10.b####.com
f11.b####.com
f12.b####.com
fc-####.cdn.bc####.com
hm.b####.com
imag####.cdn.bc####.com
imgc####.qq.com
int.d####.s####.####.cn
k.36####.com
lf.sn####.com
lu####.b####.com
m####.eas####.com
m.t####.cn
mi.g####.qq.com
p####.g####.cn
p0.q####.com
p1.ssl.q####.com
p2.q####.com
p4.q####.com
paim####.b####.com
pop.jufe####.com
pos.b####.com
posi####.dftou####.com
pre.bule####.cn
qzones####.g####.cn
rcv.a####.com
regi####.xm####.xi####.com
reso####.msg.xi####.net
rp####.itaoxia####.com
rp####.itaoxia####.com
s####.e.qq.com
s####.gw.y####.net
s.a.longy####.com
s.y####.net
s1.ps####.com
s3.ps####.com
sa9.tui####.b####.com
sdk.st####.y####.com
sf1-ttc####.ps####.com
softwor####.dftou####.com
ss1.b####.com
ss2.b####.com
statson####.pu####.b####.com
t####.cor####.com
t####.dmp.y####.net
t####.eas####.com
t10.b####.com
t11.b####.com
t12.b####.com
v3.bule####.cn
w####.pcon####.com.cn
wx3.sin####.cn

HTTP GET requests:

1####.25.201.164:8000/configs/hbnews_options.txt
api.itaoxia####.com/authopt/get_withdraw_mission_money.do?android_id=###...
api.itaoxia####.com/get_channels.do?android_id=####&appid=####&brand=###...
api.itaoxia####.com/get_news_item.do?android_id=####&appid=####&brand=##...
api.itaoxia####.com/get_news_items.do?android_id=####&appid=####&brand=#...
api.itaoxia####.com/get_video_channels.do?android_id=####&appid=####&bra...
api.itaoxia####.com/get_withdraw_orders.do?android_id=####&appid=####&br...
api.itaoxia####.com/public/v2/get_activity_list.do?android_id=####&appid...
api.itaoxia####.com/redpaper/dv/get_feed_ads_list.do?PACKAGE_NAME=####&V...
api.itaoxia####.com/redpaper/dv/get_splash_ads.do?PACKAGE_NAME=####&VERS...
api.itaoxia####.com/redpaper/dv/get_tuia_share_ads.do?PACKAGE_NAME=####&...
bj.bc####.com/fc-feed/0/pic/1bd840cba4fd0131216255e936f9311d.jpg
bj.bc####.com/fc-feed/0/pic/1d9fccdc9a4a9987a3bab3aaa343de70.jpg
bj.bc####.com/fc-feed/0/pic/cb385c3dedca395f52310f28c67def35.png
c####.b####.com/cpro/ui/uijs.php?rs=4&u=https://mini.eastday.com/mobile/...
cdn.a####.com//uploads/31ef52190dc850beff19df8ce7c2ec68_1519694_225_150....
d####.eas####.com/yhl?woxa=####&caey=####&e=####&eqpu=####&fr=####&n=###...
dn.gogo####.top/dnfile/IMG/20180521145007gk8aut.jpg
dn.gogo####.top/dnfile/IMG/201805211450100pr568.jpg
dn.gogo####.top/dnfile/Video/20180612150512phyvmv.mp4
dn.gogo####.top/dnfile/shengjibao/VideoKApiNewYi84.jar
f####.jy####.com/10/?ad_id=####&_toutiao_params=####
f####.jy####.com/10/?ad_id=####&_toutiao_params=####&v=####
f####.jy####.com/10/src/css/style.css
f####.jy####.com/10/src/images/20171027_01.jpg
f####.jy####.com/10/src/images/20171027_02.jpg
f####.jy####.com/10/src/images/20171027_04.jpg
f####.jy####.com/10/src/images/20171027_05.jpg
f####.jy####.com/10/src/images/20171027_06.jpg
f####.jy####.com/10/src/images/20171027_07.jpg
f####.jy####.com/10/src/images/bbb_03.jpg
f####.jy####.com/10/src/images/redwhite.png
f####.jy####.com/10/src/js/base.js
f####.jy####.com/10/src/js/jquery-1.9.1.min.js
f####.jy####.com/10/src/js/layer.js
f####.jy####.com/10/src/js/need/layer.css?2####
fc-####.cdn.bc####.####.com/0/pic/59634f6b3c82310d2cf78b9a17f385fc.jpg
fc-####.cdn.bc####.####.com/0/pic/b5cc4174d95f04c03830f1c615e532a9.jpg
fc-####.cdn.bc####.####.com/0/pic/fbf4b0ba27b0a70636391dea148459cc.jpg
fc-####.cdn.bc####.####.com/image/public//vcg/6ad669/802400481.jpg@c_1,x...
imag####.cdn.bc####.####.com/0/pic/0abe2e8f18f1cafb8c6f5e86e6dd5916.jpg
imag####.cdn.bc####.####.com/0/pic/0cb976aa0676fdbd4e1e7f85facf339a.jpg
imag####.cdn.bc####.####.com/0/pic/1990d929edab6e9fd336d428da5deb72.jpg
imag####.cdn.bc####.####.com/0/pic/1b40df8ffdaa93817af8453fc23202fc.jpg
imag####.cdn.bc####.####.com/0/pic/5d8118c12e37130e2e7a3e960b86225e.jpg
imag####.cdn.bc####.####.com/0/pic/6b4b39bbab8b494577bb63d5805eba80.jpg
imag####.cdn.bc####.####.com/0/pic/a79f6c6a7d80fc330b32ecf506b29b50.jpg
imag####.cdn.bc####.####.com/0/pic/b1539fe98a2d4bf9c79706cbef7d3787.jpg
imag####.cdn.bc####.####.com/0/pic/f921869c9f3ed21feb9599c47a63c54b.jpg
imag####.cdn.bc####.####.com/image/public//vcg/2b74d1/1009071617.jpg@c_1...
imag####.cdn.bc####.####.com/image/public//vcg/42f5df/802400497.jpg@c_1,...
k.36####.com/pc/list?channel_id=####
k.36####.com/pc/list?n=####&p=####&f=####&ajax=####&channel_id=####
l####.c####.q####.####.net/core/aos-dex/1806/8204/de603c61
l####.c####.q####.####.net/core/aos-so/1611/7000/ad389c56.so
mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android03/js-release/1.1.0/nati...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
p0.q####.com/dr/_100_70/t0108300a866f076e3a.jpg
p0.q####.com/dr/_100_70/t01280b1e8a467d5bfc.jpg
p0.q####.com/dr/_100_70/t012c5af66898efa47a.jpg
p0.q####.com/dr/_100_70/t01739cf2d40d0cdad6.jpg
p0.q####.com/dr/_100_70/t01baf86000305fa87f.jpg
p0.q####.com/video/568_320_70/t0118cc6203c0d9095d.jpg
p0.q####.com/video/568_320_70/t014510d185b1e5a773.jpg
p0.q####.com/video/568_320_70/t0161d08010bdbc947c.jpg
p0.q####.com/video/568_320_70/t01734e1b44ff218a57.jpg
p0.q####.com/video/568_320_70/t01838bbece168a093a.jpg
p0.q####.com/video/568_320_70/t01baf36b91b61b18d4.jpg
p0.q####.com/video/568_320_70/t01c133286eaa3d2829.jpg
p0.q####.com/video/568_320_70/t01c2a2f0cd297f99af.jpg
p2.q####.com/dr/_100_70/t0103d6f9671f56926b.jpg
p4.q####.com/dr/_100_70/t0123365626c960a29e.jpg
pop.jufe####.com/2/index_files/data-a.js
rcv.a####.com/show?CAAQCw.####
reso####.msg.xi####.net/gslb/?ver=####&type=####&conpt=####&uuid=####&li...
s####.tc.qq.com/gdt/0/DAAd67eAUAALQABjBbAlzhAfAzb9xc.jpg/0?ck=####
s.y####.net/aos/v3/initf?s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
s.y####.net/stat/v3/udt2?appid=####&s=####
sf1-ttc####.ps####.com/bytecom/resource/track_log/src/toutiao-track-log.js
sf1-ttc####.ps####.com/img/ad.union.api/93f1c809755f0af10e9045b5921a3b1f...
sf1-ttc####.ps####.com/mobile/180627153317490.html?qid=####
sf1-ttc####.ps####.com/mobile/20180627/20180627135649_c8a1fc5a002778d146...
sf1-ttc####.ps####.com/mobile/20180627/20180627153317_8ff097a21f052973a1...
sf1-ttc####.ps####.com/mobile/20180628/20180628045319_23f1cc17e23cebc18b...
sf1-ttc####.ps####.com/mobile/20180628/20180628141810_f2ea494e8ca44d5b1c...
sf1-ttc####.ps####.com/mobile/20180629/20180629065210_5ef406f12b91fe7740...
sf1-ttc####.ps####.com/mobile/20180629/20180629081700_0ed950944f96bd8052...
si####.jom####.com/it/u=2383638222,3419487030&fm=76
si####.jom####.com/it/u=2594222363,3786436383&fm=76
t####.cor####.com/tj?bid=####&id=####&ua=####&ip=####&m=####&n=####&imp=...
weiboi####.g####.sina####.com/mw690/6954537bly1fiu3ty2kidj20u009ojtz.jpg

HTTP POST requests:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
api.tui####.b####.com/rest/2.0/channel/3891059720954606069
api.tui####.b####.com/rest/2.0/channel/channel
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
pre.bule####.cn:6501/pre/api_settings.aspx
s####.e.qq.com/activate
s.a.longy####.com/
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####
v3.bule####.cn:7001/v3/api_request.aspx
v3.bule####.cn:7001/v3/api_settings.aspx
w####.pcon####.com.cn/ip.jsp

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1002
/data/data/####/1004
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/BuglySdkInfos.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml (deleted)
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml.bak
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml (deleted)
/data/data/####/ContextData.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/P15pKIjsm64m
/data/data/####/P15pKIjsm64m-journal
/data/data/####/T1oX0rhhuXWt
/data/data/####/T1oX0rhhuXWt-journal
/data/data/####/VideoRes.apk
/data/data/####/VideoRes.apk (deleted)
/data/data/####/XKwVoK0huy3R
/data/data/####/XKwVoK0huy3R-journal
/data/data/####/XMPushServiceConfig.xml
/data/data/####/__gather_impl-8408096344243747249.jar
/data/data/####/__gather_impl.jar
/data/data/####/ac4d0794ee3cb114f87af712c10f4fbf
/data/data/####/ac4d0794ee3cb114f87af712c10f4fbf-journal
/data/data/####/bdpush_modeconfig.json
/data/data/####/bfa01a9f16a114b84f0c4265540acb63
/data/data/####/bfa01a9f16a114b84f0c4265540acb63-journal
/data/data/####/bindcache.xml
/data/data/####/bugly_db_-journal
/data/data/####/cache126574727644243258644
/data/data/####/cache137684869844243543962
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.martian.hbnews-1.apk.classes-1125133004.zip
/data/data/####/com.martian.hbnews-1.apk.classes-383226151.zip
/data/data/####/com.martian.hbnews.BETA_VALUES.xml
/data/data/####/com.martian.hbnews.push_sync.xml
/data/data/####/com.martian.hbnews.self_push_sync.xml
/data/data/####/com.martian.hbnews;pushservice
/data/data/####/com.martian.hbnews_preferences.xml
/data/data/####/config.xml
/data/data/####/config.xml.bak
/data/data/####/config_pre7.xml
/data/data/####/crashrecord.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f59ef9c3d9472f60d7ba26ff8ef776cd-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/http_cpro.baidu.com_0.localstorage-journal
/data/data/####/http_df888.eastday.com_0.localstorage-journal
/data/data/####/https_mini.eastday.com_0.localstorage-journal
/data/data/####/ide8523d7b-c520-43ec-9e6b-5d16eb1a084c.tmp
/data/data/####/index
/data/data/####/jqIqJYOT3JpT
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libabcdefgh.so.new
/data/data/####/libcuid.so
/data/data/####/libgather.xml
/data/data/####/lmvideonewad_db-journal
/data/data/####/local_crash_lock
/data/data/####/longyun_sdk.xml
/data/data/####/longyun_sdk.xml.bak (deleted)
/data/data/####/martian_cache_cookie.json
/data/data/####/mipush.xml
/data/data/####/mipush_account.xml
/data/data/####/mipush_extra.xml
/data/data/####/multidex.version.xml
/data/data/####/pst.xml
/data/data/####/pushclient.xml
/data/data/####/pushinfo.db
/data/data/####/pushinfo.db-journal
/data/data/####/pushstat_5.1.0.db
/data/data/####/pushstat_5.1.0.db-journal
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/videokernel.apk
/data/data/####/wIU6pTyUBYWX
/data/data/####/wIU6pTyUBYWX-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wsUL1uCdKvjD
/data/data/####/wsUL1uCdKvjD-journal
/data/data/####/wxoptions_json_file
/data/data/####/ymdex.jar
/data/data/####/ymdex.jar.new
/data/media/####/-114697494.tmp
/data/media/####/-1334273437.tmp
/data/media/####/-1483691683
/data/media/####/-1723170930.tmp
/data/media/####/-1741925649.tmp
/data/media/####/-1747946352.tmp
/data/media/####/-1954656612.tmp
/data/media/####/-1967986762.tmp
/data/media/####/-1979046132.tmp
/data/media/####/-2135129452.tmp
/data/media/####/-2143698141
/data/media/####/-382146458.tmp
/data/media/####/-650609399.tmp
/data/media/####/-726650376.tmp
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/1131566866.tmp
/data/media/####/1173217260
/data/media/####/1203302314.tmp
/data/media/####/1306797284.tmp
/data/media/####/1413864303.tmp
/data/media/####/1455586409.tmp
/data/media/####/14785960.tmp
/data/media/####/1503844892.tmp
/data/media/####/1574246248.tmp
/data/media/####/1596697300.tmp
/data/media/####/1882806214.tmp
/data/media/####/193862472.tmp
/data/media/####/1976038737.tmp
/data/media/####/2026793367.tmp
/data/media/####/2038153762.tmp
/data/media/####/287094995.tmp
/data/media/####/289534879.tmp
/data/media/####/355057352.tmp
/data/media/####/391613104.tmp
/data/media/####/493863209.tmp
/data/media/####/614395058.tmp
/data/media/####/729774377.tmp
/data/media/####/860782054.tmp
/data/media/####/877385819.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/DXTX902KJZX9JASLDJF
/data/media/####/DXTX902KJZX9JASLDJF.ymtf
/data/media/####/SOX90123JSOALK2098SD
/data/media/####/SOX90123JSOALK2098SD.ymtf
/data/media/####/Videoshell.log
/data/media/####/i42d45df023jnkdd93la483f9xGFKXI
/data/media/####/kernel.dat
/data/media/####/log.lock
/data/media/####/log1.txt
/data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/kernel_max
/system/bin/sh -c getprop
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
getprop

Loads the following dynamic libraries:

Bugly
abcdefgh
bdpush_V2_7
tongdun_db

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
PBEWITHMD5andDES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
PBEWITHMD5andDES
RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial