Android.Packed.40149

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.793.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) hbk.shu####.cn:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) s####.3####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(SSL/3.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) huo####.3####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) sdk.svc.mobi####.com:443
TCP(TLS/1.0) d####.shu####.cn:443
TCP(TLS/1.0) daa.shu####.cn:443
TCP(TLS/1.0) y####.api.3####.com:443
TCP ope####.m.ta####.com:443
TCP openj####.m.ta####.com:443

DNS requests:

a####.man.aliy####.com
ag####.m.ta####.com
amdc####.m.ta####.com
api.shu####.cn
av1.x####.com
c####.x####.com
d####.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
hbk.shu####.cn
huo####.3####.com
i.t####.com
imgc####.qq.com
mi.g####.qq.com
msg.umengc####.com
p####.ugd####.com
plb####.u####.com
s####.3####.com
s####.e.qq.com
sdk.svc.mobi####.com
u####.u####.com
u####.umengc####.com
umen####.m.ta####.com
umengj####.m.ta####.com
y####.api.3####.com

HTTP GET requests:

mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
s####.3####.com/logstores/ybjzaction/track?APIVersion=####&dtype=####&im...
s####.3####.com/logstores/ybjzaction_ops/track?APIVersion=####&dtype=###...
s####.tc.qq.com/gdt/0/DAABSIgAKAAPAABIBbkMg1BxaxoMWb.jpg/0?ck=####

HTTP POST requests:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
hbk.shu####.cn/report?v=####&c=####&e=####&t=####
s####.e.qq.com/activate
s####.e.qq.com/msg
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1538321286468_2286
/data/data/####/1538321286490_2286
/data/data/####/1538321286581_2286
/data/data/####/1538321286610_2286
/data/data/####/1538321287123_2286
/data/data/####/1538321288275_2286
/data/data/####/1538321288331_2286
/data/data/####/1538321292411_2499
/data/data/####/1538321292445_2499
/data/data/####/1538321297915_2579
/data/data/####/1538321297976_2579
/data/data/####/1538321315300_2286
/data/data/####/1538321321483_2579
/data/data/####/1538321352600_2499
/data/data/####/2286.yaqcookie
/data/data/####/5d9616e4a51c6390c97a9b867c872e99.temp
/data/data/####/ACCS_BINDumeng;58b3c76c4ad1563218001387.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/Config.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MVPSplashConfig
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/OneStroke.db-journal
/data/data/####/Setting.xml
/data/data/####/SpUtils.xml
/data/data/####/TDCloudSettingsConfig0D04142E03524AC2A98430296256B5C1.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/a==7.5.3&&4.3.1_1538321288385_envelope.log
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/com.mobivans.onestrokecharge_dna.xml
/data/data/####/com.mobivans.onestrokecharge_preferences.xml
/data/data/####/com.mobivans.onestrokecharge_prefs.xml
/data/data/####/com.mobivans.onestrokecharge_prefs.xml.bak
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/device_id.xml.xml
/data/data/####/dexMethod.28020090.dat
/data/data/####/du.lock
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&4.3.1_1538321286845_envelope.log
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu-1349153800.so
/data/data/####/libyaqbasic.28020090.so
/data/data/####/libyaqpro.28020090.so
/data/data/####/max_pref.xml
/data/data/####/max_pref.xml.bak (deleted)
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/share_date.xml
/data/data/####/tdid.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/yaqsdkcookie
/data/media/####/..ccdid
/data/media/####/..ccvid
/data/media/####/..cvtid
/data/media/####/._android.dat
/data/media/####/._system.dat
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.ccdid
/data/media/####/.ccvid
/data/media/####/.cvtid
/data/media/####/.duid
/data/media/####/.n_a
/data/media/####/.n_b
/data/media/####/.n_c
/data/media/####/.n_d
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/.umm.dat
/data/media/####/08994ab494e8497596c0b2815d73cb53
/data/media/####/1fd1743cba904841ae6b5f59756e9a56
/data/media/####/24c7b71a30504c749efdc8cefead05ac
/data/media/####/503c5a838c804992a0418a834c639018
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_system.dat
/data/media/####/deviceToken
/data/media/####/duid
/data/media/####/id.tmp
/data/media/####/n_a
/data/media/####/n_b
/data/media/####/n_c
/data/media/####/n_d

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58b3c76c4ad1563218001387","utdid":"W7DrhmzYuogDAGdzx1GBcxq1","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu-1349153800.so
date
df
getprop
id
ip link
ls /dev/socket
ls /sys/class/thermal
ls /system/fonts
mkdir -p <SD-Card> .. .. .. .. .. .. sdcard Android Data System local/
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat /proc/meminfo
sh -c cat /sys/class/net/eth0/address
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c echo MDcyNEI1MENEMDNEQjBERTQ4MTUyNDI2QjUwNDk1MkVmZDgyM2U1MjE1NWE0OWZhYjgxOTA3Njc5YjYzNjdhZgo= > <SD-Card>/../../../../../..<SD-Card>/.duid
sh -c echo MDcyNEI1MENEMDNEQjBERTQ4MTUyNDI2QjUwNDk1MkVmZDgyM2U1MjE1NWE0OWZhYjgxOTA3Njc5YjYzNjdhZgo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid
sh -c echo MTk0RjAwM0I3ODMwNDI0RkQzRkZBOEMyMUNBOTI1RTQwQzk4NEE0Rg== > <SD-Card>/../../../../../..<SD-Card>/.n_a
sh -c echo MTk0RjAwM0I3ODMwNDI0RkQzRkZBOEMyMUNBOTI1RTQwQzk4NEE0Rg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_a
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_b
sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_b
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo ODc1QzI1MTM1QTMwQkUxRDhBOTI5NkZEQUNCNUZGRDIzREQ2NUU6QkNERDJGOkM2RTQ1Mg== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo ODc1QzI1MTM1QTMwQkUxRDhBOTI5NkZEQUNCNUZGRDIzREQ2NUU6QkNERDJGOkM2RTQ1Mg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo QjhGMDU3MDY0QUQ0NjcwMDMzNThBMTFGRjA1RTYwMTVDNDAx > <SD-Card>/../../../../../..<SD-Card>/.n_d
sh -c echo QjhGMDU3MDY0QUQ0NjcwMDMzNThBMTFGRjA1RTYwMTVDNDAx > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_d
sh -c echo RkMyNzdGMThFMzBBMjU0OTAxN0FDMEM3MTIwNDFERTExNTM4MzIxMzI0 > <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c echo RkMyNzdGMThFMzBBMjU0OTAxN0FDMEM3MTIwNDFERTExNTM4MzIxMzI0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c echo RkQxODlGOEE4RTk3MjE2MkQ3MTI3RTJENUVEM0RENDUwMDBB > <SD-Card>/../../../../../..<SD-Card>/.n_c
sh -c echo RkQxODlGOEE4RTk3MjE2MkQ3MTI3RTJENUVEM0RENDUwMDBB > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_c

Loads the following dynamic libraries:

du
libjiagu-1349153800
libyaqbasic.28020090
libyaqpro.28020090
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
desede-CBC-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial