Android.Packed.38917

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.728.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.75.3.32:8961
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) tt.kyli####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) www.lingzha####.com:8065
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) p.icap####.com:6088
TCP(HTTP/1.1) www.lzt####.com:8997
TCP(HTTP/1.1) 1####.75.3.32:8881
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) kldyn####.c####.ufi####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) d####.wos####.com:80
TCP(TLS/1.0) exp.bdst####.com.####.com:443
TCP(TLS/1.0) publish####.b####.com.####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) cpu.b####.com:443
TCP(TLS/1.0) i####.b####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) cac####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) jin####.b####.com:443
TCP ope####.m.ta####.com:443
TCP umengj####.m.ta####.com:80

DNS requests:

a####.man.aliy####.com
a####.u####.com
ad####.m.ta####.com
ada####.m.ta####.com
ag####.m.ta####.com
amdc####.m.ta####.com
api.kxcon####.com
cac####.b####.com
cdn.1####.wang
cpu.b####.com
d####.wos####.com
dl.api.kyli####.com
exp.bdst####.com
g####.bdst####.com
g####.bdst####.com
hm.b####.com
hpd.b####.com
i####.b####.com
jin####.b####.com
kldyn####.c####.ufi####.com
log.u####.com
p.icap####.com
p.rqco####.com
plb####.u####.com
publish####.b####.com
s####.u####.com
tt.kyli####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
www.lingzha####.com
www.lzt####.com

HTTP GET requests:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
cdn.1####.wang/sc_151_3
kldyn####.c####.ufi####.com/1530152997500_utils.ttf
p.rqco####.com:8806/c/1532246781371
www.lingzha####.com:8065/GetConfig.ashx?AppID=####&Platform=####
www.lzt####.com:8997/XmlSource/GetFestivalImage.aspx
www.lzt####.com:8997/XmlSource/GetFestivalImage.aspx?Area=####

HTTP POST requests:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
api.kxcon####.com:666/v1/config
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
d####.wos####.com/upload/shortheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
p.icap####.com:6088/s/
p.rqco####.com:8806/p/1532246782295
p.rqco####.com:8806/t/1532246791860
p.rqco####.com:8806/t/1532246805486
p.rqco####.com:8806/t/1532246829386
p.rqco####.com:8806/t/1532246835919
p.rqco####.com:8806/t/1532246836206
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
tt.kyli####.com/v1/task/mobile

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/03751BCA345F56C07CFA4B3FF24986DC.jar
/data/data/####/03751BCA345F56C07CFA4B3FF24986DC.tmp
/data/data/####/1532246774949.log
/data/data/####/2995c57b392c9e8d01b2723125acb490
/data/data/####/ACCS_BINDumeng;56a072c667e58eacd8000b0b.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/DailyLuckNotification.xml
/data/data/####/Holiday.xml
/data/data/####/Holiday.xml.bak
/data/data/####/Holiday.xml.bak (deleted)
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UTCommon.xml
/data/data/####/YokMobSP.xml
/data/data/####/accs.db-journal
/data/data/####/addShortFile.xml
/data/data/####/agoo.pid
/data/data/####/android-util.zip
/data/data/####/ap.Lock
/data/data/####/app_spf_scli.xml
/data/data/####/calendar_data.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/config.xml
/data/data/####/corelib.jar.tm
/data/data/####/corelib.tmp.jar
/data/data/####/dailyLuckData.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dcSharedPreferences.dat.xml
/data/data/####/default.xml
/data/data/####/defaultpref1.xml
/data/data/####/docket.db
/data/data/####/docket.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&4.9_1532246773647_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/isHoliday.xml
/data/data/####/isHoliday.xml.bak
/data/data/####/libshahe.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/odddk.xml
/data/data/####/oglfvj
/data/data/####/one49
/data/data/####/onlineDataSP.xml
/data/data/####/pl_o_sp.xml
/data/data/####/pl_sp.xml
/data/data/####/predictor.calendar-1.apk.classes-1824019618.zip
/data/data/####/predictor.calendar-1.apk.classes-212489764.zip
/data/data/####/predictor.calendar_preferences.xml
/data/data/####/rws_sp.xml
/data/data/####/sp_rvp.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_socialize.xml.bak
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/149a29a9207149f0a3569d3f3d91fb12
/data/media/####/22071425FEB07867D1BB72B09CF55C66.tmp
/data/media/####/46F0BA08D030DD89305E35EDE94464E7.tmp
/data/media/####/6f5519f7eac84db0b47d9c52d6afda0d
/data/media/####/89963f77a21a477aa3e2358824e47ee6
/data/media/####/Alvin2.xml
/data/media/####/B174E8EB5AFCFC27B8CAB5318EB71DDC.tmp
/data/media/####/C0F7F16423A0C913F4B8A331258E4CE8.tmp
/data/media/####/ContextData.xml
/data/media/####/E919E8B66E2CBF06918850EF56E353A9.tmp
/data/media/####/EDC57BFB58FBE79E756170F3F0E2CEB5.tmp
/data/media/####/ac5121a064db42bd9e4e989901e5c373
/data/media/####/adv
/data/media/####/config
/data/media/####/deviceId
/data/media/####/deviceToken
/data/media/####/master
/data/media/####/master.lock

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:56a072c667e58eacd8000b0b","utdid":"W1Q69LMyo8oDAGdzx1EvTifP","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
ls /
ls /sys/class/thermal
sh

Loads the following dynamic libraries:

libshahe
ndk
tnet-3.1
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial