Android.Packed.40144

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.792.origin
Android.DownLoader.793.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) as.j####.com:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) yy.hotgo####.com:80
TCP(HTTP/1.1) i####.in####.j####.com:80
TCP(HTTP/1.1) v####.6####.com:80
TCP(HTTP/1.1) h####.b####.com:80
TCP(HTTP/1.1) dps.wt####.com:8085
TCP(HTTP/1.1) s####.ch####.com:80
TCP(HTTP/1.1) s####.j####.cn:80
TCP(HTTP/1.1) 362b3d8####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) api.voic####.cn:80
TCP(HTTP/1.1) d####.opensp####.cn:80
TCP(HTTP/1.1) www.3####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) ss.wx1####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) x1.api.gg####.com:80
TCP(HTTP/1.1) 5g.bai####.net.####.com:80
TCP(HTTP/1.1) n.k####.com:80
TCP(HTTP/1.1) s.c####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) m.chin####.com:80
TCP(HTTP/1.1) www.leop####.com:80
TCP(HTTP/1.1) bb.dugeshe####.com:80
TCP(HTTP/1.1) ip.adi####.net:80
TCP(HTTP/1.1) ads.voic####.cn:80
TCP(HTTP/1.1) dsp.tou####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) js.lotu####.com:80
TCP(HTTP/1.1) ss####.mogu####.com:80
TCP(HTTP/1.1) src.r####.com.####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) q.in####.j####.com:80
TCP(HTTP/1.1) ssp.huay####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) sdk.91a####.com:80
TCP(HTTP/1.1) w####.5####.com:80
TCP(SSL/3.0) z.c####.com:443
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) ip.adi####.net:443
TCP(TLS/1.0) 5g.bai####.net.####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) sl####.b0.a####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) www.leop####.com:443
TCP(TLS/1.0) l####.b####.com:443
TCP(TLS/1.0) gov.coc####.cn:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) n.k####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ei.c####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) ad.i####.xyz:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) org.wt####.cn:443
TCP 1####.46.30.56:7001
UDP s.j####.cn:19000

DNS requests:

362b3d8####.oss-cn-####.aliy####.com
5g.bai####.net
ad.i####.xyz
ads.voic####.cn
adser####.go####.com
amap####.cn-hang####.oss####.####.com
an####.l####.com
api.heart####.cn
api.voic####.cn
as.j####.com
bb.dugeshe####.com
bj.imp.voic####.cn
c####.mm####.com
c.c####.com
cx.v####.com
d####.opensp####.cn
dd.arg####.com
dps.wt####.com
dsp.tou####.com
ei.c####.com
gov.coc####.cn
h####.b####.com
h####.opensp####.cn
hm.b####.com
i####.in####.j####.com
ip.adi####.net
js.c####.com
js.lotu####.com
l####.b####.com
m.chin####.com
n.k####.com
org.wt####.cn
p####.be####.com
pco####.c####.com
q.in####.j####.com
r####.wx.qq.com
res####.a####.com
s####.ch####.com
s####.j####.cn
s.c####.com
s.j####.cn
s13.c####.com
s19.c####.com
s22.c####.com
sdk.91a####.com
sdk.c####.com
sf1-ttc####.ps####.com
src.r####.com
ss####.mogu####.com
ss.wx1####.com
ssl.gst####.com
ssp.huay####.com
v####.6####.com
w####.5####.com
w####.5####.com
www.3####.com
www.go####.com
www.go####.nl
www.gst####.com
www.leop####.com
x1.api.gg####.com
yy.hotgo####.com
z1.c####.com
z7.c####.com
z8.c####.com

HTTP GET requests:

362b3d8####.oss-cn-####.aliy####.com/h.html?id=id=1####&web_id=####
5g.bai####.net.####.com/es/htpddjs/css/Swiper-4.0.5.css
5g.bai####.net.####.com/es/htpddjs/css/animate.min.css
5g.bai####.net.####.com/es/htpddjs/css/index.css
5g.bai####.net.####.com/es/htpddjs/css/item.css
5g.bai####.net.####.com/es/htpddjs/css/loading.css
5g.bai####.net.####.com/es/htpddjs/img/hongbao.png
5g.bai####.net.####.com/es/htpddjs/img/search.png
5g.bai####.net.####.com/es/htpddjs/index.html?cid=####
5g.bai####.net.####.com/es/htpddjs/js/Swiper-4.0.5.js
5g.bai####.net.####.com/es/htpddjs/js/Tools.js
5g.bai####.net.####.com/es/htpddjs/js/echo.js
5g.bai####.net.####.com/es/htpddjs/js/index.js
5g.bai####.net.####.com/es/htpddjs/js/sy.js
5g.bai####.net.####.com/es/htpddz/css/Swiper-4.0.5.css
5g.bai####.net.####.com/es/htpddz/css/animate.min.css
5g.bai####.net.####.com/es/htpddz/css/index.css
5g.bai####.net.####.com/es/htpddz/css/item.css
5g.bai####.net.####.com/es/htpddz/css/loading.css
5g.bai####.net.####.com/es/htpddz/img/hongbao.png
5g.bai####.net.####.com/es/htpddz/img/search.png
5g.bai####.net.####.com/es/htpddz/index.html?cid=####
5g.bai####.net.####.com/es/htpddz/js/Swiper-4.0.5.js
5g.bai####.net.####.com/es/htpddz/js/Tools.js
5g.bai####.net.####.com/es/htpddz/js/echo.js
5g.bai####.net.####.com/es/htpddz/js/index.js
5g.bai####.net.####.com/es/htpddz/js/sy.js
5g.bai####.net.####.com/lh/smart/common/gz_176_1.js
5g.bai####.net.####.com/lh/smart/inv/pxinteraction_400554.html?td_channe...
5g.bai####.net.####.com/lh/smart/inv/pxinteraction_lx_up_81001.html?td_c...
5g.bai####.net.####.com/lh/smart/smartpull_400554.js
api.voic####.cn/a/impress?impressId=####&traceId=####&inAId=####&wPltId=...
api.voic####.cn/hotUpdate/?ver=####
as.j####.com/getStatus?id=MgV9F6P6LHs=&h=/yy.hotgopark.com/OYTS/Index?Pe...
as.j####.com/getStatus?id=fdQ3MD0mlvU=&h=/yy.hotgopark.com/OYTS/Index?Pe...
bb.dugeshe####.com/yhws/channel/wf/wfye.js
bb.dugeshe####.com/yhws/channel/zy/zyikd.html
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####&web_id=####
dps.wt####.com:8085/js/blhc11/yz.js
dps.wt####.com:8085/js/blhc7/yz.js
dps.wt####.com:8085/js/yys5/yz.js
dsp.tou####.com/api/xunfei/ads/show?extra=####&price=####
gm.mm####.com/9.gif?abc=####&rnd=####
h####.opensp####.cn/launchconfig?t=####&p=ZWxwZ####
i####.in####.j####.com/version?category=####&rest=####&client=####&ver=#...
ip.adi####.net/api/ad/ad/getScreenAd?seq=####&ad_channal_code=####&fetch...
ip.adi####.net/api/ad/ad/sendDeviceInfo
ip.adi####.net/dspapi/ad/showurl?a=####&d=####&h=####&i=####&p=####&s=##...
js.lotu####.com/lsd.js
m.chin####.com/710.js
m.chin####.com/hot/710.ashx
n.k####.com/pos_891_.js
n.k####.com/pos_891_tj.html
n.k####.com/pos_891_tj.js
n.k####.com/yt_1828.html?t=####
n.k####.com/yt_1828.js
pco####.ta####.com/app.gif?&cna=####
q.in####.j####.com/getAdConfig?client=####&version=####
q.in####.j####.com/userinfo?client=####&mid=hO7####&user_id####&key=####
s####.ch####.com/extra/information/list?acc=####
s.c####.com/s.htm?s=####&id=####&pid=####
s.c####.com/s.htm?s=####&id=####&pid=####&2####
sdk.91a####.com/static/20180925144459mod.enc
sf1-ttc####.ps####.com/img/ad.union.api/7a6aee15c55d8b5477634ece887dcc99...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
src.r####.com.####.com/kubo/dex/hh_8.6_109.dex
ss####.mogu####.com/singlefun/jspullup/recentjspullup?ggid=####&cid=####...
ss.wx1####.com/yhws/channel/wf/as_wfyei.html
ss.wx1####.com/yhws/channel/wf/as_wfyeo.html
ssp.huay####.com/adinfo.htm?pid=####&protocol=####
www.3####.com/s.htm?s=####&id=####&pid=####
www.leop####.com/index.php?m=####&c=####&a=####&type=####
www.leop####.com/index.php?m=####&c=####&a=####&url=####
www.leop####.com/mattu.html
yy.hotgo####.com/OYTS/Index?Personcode=####&TICKETCODE=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
z.c####.com/stat.htm?id=1271523318&r=http://n.kzsha.com/yt_1828.html?t=#...

HTTP POST requests:

ads.voic####.cn/ad/request
d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
h####.b####.com/app.gif
q.in####.j####.com/addUserInfo
s####.j####.cn/v2/report
sdk.91a####.com/api/DeviceReport.ashx
sdk.c####.com/getsiteapi.php
sdk.c####.com/sdkallapi.php
sdk.c####.com/sdkreapi.php
sdk.c####.com/versiontapi.php?v=####&type=####
v####.6####.com/0/ca477c3b25914a5f821296be846eca73.html
v####.6####.com/18/a41844eff5ff4a0a96c9603142acfcf6.html
v####.6####.com/20/8c10c5184b36491eb6ed32bdbafb1eb4.html
v####.6####.com/21/951b059d52e34526bd44b82d5204ff96.html
v####.6####.com/9/17ecff40f1644f1a9cbb04dad5d6013f.html
v####.6####.com/9/83c2961314204ae699a3379a8f3dbc1e.html
v####.6####.com/api/CheckModule.ashx
v####.6####.com/api/GetLockAppOpenTask.ashx
v####.6####.com/api/GetModuleConfig.ashx
v####.6####.com/api/GetPkNameList.ashx
v####.6####.com/api/GetTSecret.ashx
v####.6####.com/api/GetTreasureJS.ashx
v####.6####.com/api/GetTreasureTask.ashx
v####.6####.com/api/ReportAppLog.ashx
v####.6####.com/api/ReportTreasure.ashx
w####.5####.com/0/76179c31f5d04e21bcf7fee1debf1df1.html
x1.api.gg####.com/api.htm?pid=####&appid=####

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/35104416806479.0
/data/data/####/3963235188808.0
/data/data/####/8042581554585.0
/data/data/####/9883869494053.0
/data/data/####/AdDex.3.1.0.dex
/data/data/####/DownloadTaskStore.db-journal
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/adsp.xml
/data/data/####/ax_c.xml
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.iflytek.id.xml
/data/data/####/com.iflytek.msc.xml
/data/data/####/d734a396262fed7b7e4fa1276c05b624.0
/data/data/####/data.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_2 (deleted)
/data/data/####/data_3
/data/data/####/data_3 (deleted)
/data/data/####/domainset
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/hh_8.6.dex
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/ibkad_config.xml
/data/data/####/ibus_20180712
/data/data/####/ifly_launch_lib.xml
/data/data/####/iflytek_state_com.cn.bushelper.xml
/data/data/####/index
/data/data/####/indexnews
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_statistics.db
/data/data/####/jpush_statistics.db-journal
/data/data/####/libjiagu312090826.so
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/max_pref.xml
/data/data/####/mc109.dex
/data/data/####/mc_cache.xml
/data/data/####/mod.dec
/data/data/####/mod.dex
/data/data/####/mod.enc
/data/data/####/multidex.version.xml
/data/data/####/native_plates
/data/data/####/native_plates-journal
/data/data/####/phan.xml
/data/data/####/pref.xml
/data/data/####/smartbusdata.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/welcome
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/1538307463133.db
/data/media/####/47674591a9ea569e6b2e48192292fbf8
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/id.tmp
/data/media/####/iflyworkdir_test

Miscellaneous:

Executes next shell scripts:

cat /sys/class/net/wlan0/address
chmod 755 <Package Folder>/.jiagu/libjiagu312090826.so

Loads the following dynamic libraries:

jpush213
libjiagu312090826
msc
sqlcipher
utlilib

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial