Android.Packed.38681

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.657.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.amp.####.com:80
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) idu####.qini####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) cdn.app.f####.####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) cdn.img.h####.####.com:80
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) f####.l####.top:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
UDP 1####.168.58.1:137
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224
TCP ope####.m.ta####.com:443

DNS requests:

a####.u####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.g####.ig####.com
cdn.app.f####.top
cdn.img.h####.top
ddd.1####.com
f####.l####.top
h####.1####.com
i####.1####.com
msg.umengc####.com
qfy.innot####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
umen####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com

HTTP GET requests:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&OSVers...
api.1####.com/app/coldStart?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/eventConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getAdConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getConfig?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/getGuide?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/app/getPatch?versionName=####&dtu=####
api.1####.com/app/start?model=####&lon=####&OSVersion=####&deviceCode=##...
api.1####.com/content/getDefaultChannelList?lon=####&OSVersion=####&devi...
api.1####.com/qupwd/config?sign=####&guid=####&time=####&lon=####&OSVers...
api.1####.com/welfare/redbagconfig?lon=####&OSVersion=####&deviceCode=##...
cdn.app.f####.####.com/upload/201806/28/app/20180628185933832.apk
cdn.app.f####.####.com/upload/201806/29/app/20180629153450748.apk
cdn.img.h####.####.com/upload/201806/28/img/20180628185933012.png
cdn.img.h####.####.com/upload/201806/29/img/20180629153445640.png
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html
idu####.qini####.com/image/sp/2018/04/24/d924bb0a82c950831205052271f531d...
sdk.o####.amp.####.com/api.htm?format=####&t=####
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
sni.c####.q####.####.net/config/hz-hzv3.conf

HTTP POST requests:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.a####.com/v3/json
ddd.1####.com/report
up####.sdk.jig####.cn/v1/push/sdk/postlist

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/00E9BCBD00BE37B185A69AFEDF10B81F.xml
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1004
/data/data/####/21c22f492aba3de8.lock
/data/data/####/6.dex
/data/data/####/6.jar
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/930a31b34bd52c08.lock
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/GFDUYBIFDSA0DSGFDSA0MOC.ct
/data/data/####/GFDUYBIFDSA0DSGFDSA0MOC.st
/data/data/####/JPushSA_Config.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UCNewsApp_1.1.1.111_161117190816_GT-I8190_4.3.1...leted)
/data/data/####/UCNewsApp_1.1.1.111_161117190816_GT-I8190_4.3.1...log.gz
/data/data/####/UCNewsApp_1.1.1.111_161117190816_GT-I8190_4.3.1...va.log
/data/data/####/ab914f43b8296c2c.lock
/data/data/####/accs.db-journal
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.jifen.qukan-1.apk.classes-1625815310.zip
/data/data/####/com.jifen.qukan-1.apk.classes1457259345.zip
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/crashrecord.xml
/data/data/####/daemon
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/de9082bf14e1895a.lock
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/ffc1d42b1ca5e3db2657d00b91997f6a.xml
/data/data/####/getui_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/idis031s3331ddsn.lock
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/kr.xml
/data/data/####/libjiagu.so
/data/data/####/libsgmain_1510830432000.dex
/data/data/####/libsgmain_1510830432000.zip.tmp
/data/data/####/libsgmainso-5.1.38.so.tmp
/data/data/####/local_crash_lock
/data/data/####/lock.lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/sdhfgcxvx.sadfhguyg.asdfighhjsdfgjh.uyad.xml
/data/data/####/security_info
/data/data/####/sp.lock
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/t_u.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/unique
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.2a66550db6af88c32c4f281a172ea2d2.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.nomedia
/data/media/####/0780fe60939179766e3e035c8272b212.apk
/data/media/####/3cd1c6816a596cfb0fd65939a1577199.apk
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/b.tmp
/data/media/####/c8fb82bc00430
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/dd7893586a493dc3
/data/media/####/f5d1a06386c94
/data/media/####/systemccu
/data/media/####/template.html
/data/media/####/wcout

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
cat /proc/cpuinfo | grep Serial
cat /sys/class/net/wlan0/address
chmod 700 /data/data/com.jifen.qukan/app_bin/daemon
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/0780fe60939179766e3e035c8272b212.apk
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/3cd1c6816a596cfb0fd65939a1577199.apk
date
df
getprop
id
logcat -d -b events -b main -v threadtime -t 1500
ls -i
ls -l /system/xbin/su
ls /dev/socket
ls /system/fonts
mount
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Loads the following dynamic libraries:

infoflow
libjiagu
sgmainso-5.1

Uses the following algorithms to decrypt data:

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial