Android.Packed.40283

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.793.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) hbk.shu####.cn:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) v####.6####.com:80
TCP(HTTP/1.1) s####.3####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) sdk.91a####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) huo####.3####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) sdk.svc.mobi####.com:443
TCP(TLS/1.0) d####.shu####.cn:443
TCP(TLS/1.0) daa.shu####.cn:443
TCP(TLS/1.0) y####.api.3####.com:443
TCP ope####.m.ta####.com:443
TCP openj####.m.ta####.com:443

DNS requests:

a####.man.aliy####.com
ag####.m.ta####.com
amdc####.m.ta####.com
api.shu####.cn
av1.x####.com
c####.x####.com
d####.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
hbk.shu####.cn
huo####.3####.com
i.t####.com
imgc####.qq.com
mi.g####.qq.com
msg.umengc####.com
p####.ugd####.com
plb####.u####.com
s####.3####.com
s####.e.qq.com
sdk.91a####.com
sdk.svc.mobi####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
v####.6####.com
y####.api.3####.com

HTTP GET requests:

mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
s####.3####.com/logstores/ybjzaction/track?APIVersion=####&dtype=####&im...
s####.tc.qq.com/gdt/0/DAAgoqqAKAAPAABLBbj6GdCbDlwXCn.jpg/0?ck=####

HTTP POST requests:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
hbk.shu####.cn/report?v=####&c=####&e=####&t=####
s####.e.qq.com/activate
s####.e.qq.com/msg
sdk.91a####.com/api/DeviceReport.ashx
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
v####.6####.com/api/CheckModule.ashx

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0906735fbfa423012629fbe7299f3218.temp
/data/data/####/1539235367228_2278
/data/data/####/1539235367281_2278
/data/data/####/1539235367342_2278
/data/data/####/1539235367392_2278
/data/data/####/1539235369325_2278
/data/data/####/1539235369343_2278
/data/data/####/1539235373238_2520
/data/data/####/1539235373322_2520
/data/data/####/1539235375347_2520
/data/data/####/1539235378516_2628
/data/data/####/1539235378541_2628
/data/data/####/1539235433600_2520
/data/data/####/2278.yaqcookie
/data/data/####/ACCS_BINDumeng;58b3c76c4ad1563218001387.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/Config.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MVPSplashConfig
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/OneStroke.db-journal
/data/data/####/Setting.xml
/data/data/####/SpUtils.xml
/data/data/####/TDCloudSettingsConfig0D04142E03524AC2A98430296256B5C1.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/a==7.5.3&&4.3.2_1539235369405_envelope.log
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/com.mobivans.onestrokecharge_dna.xml
/data/data/####/com.mobivans.onestrokecharge_preferences.xml
/data/data/####/com.mobivans.onestrokecharge_prefs.xml
/data/data/####/com.mobivans.onestrokecharge_prefs.xml.bak (deleted)
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/device_id.xml.xml
/data/data/####/dexMethod.28020090.dat
/data/data/####/du.lock
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&4.3.2_1539235367675_envelope.log
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu-1349153800.so
/data/data/####/libyaqbasic.28020090.so
/data/data/####/libyaqpro.28020090.so
/data/data/####/max_pref.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/share_date.xml
/data/data/####/tdid.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yaqsdkcookie
/data/media/####/..ccdid
/data/media/####/..ccvid
/data/media/####/..cvtid
/data/media/####/._android.dat
/data/media/####/._system.dat
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.ccdid
/data/media/####/.ccvid
/data/media/####/.cvtid
/data/media/####/.duid
/data/media/####/.n_a
/data/media/####/.n_b
/data/media/####/.n_c
/data/media/####/.n_d
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/.umm.dat
/data/media/####/11c94a6335b84a39901c0fe43d9a894c
/data/media/####/1edf687da3e4456cb5f8f523e55d3a60
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_system.dat
/data/media/####/dde954a98c874be4b608280f222a8931
/data/media/####/deviceToken
/data/media/####/duid
/data/media/####/e3287e8eea8541f2b64a0e271a374640
/data/media/####/id.tmp
/data/media/####/n_a
/data/media/####/n_b
/data/media/####/n_c
/data/media/####/n_d

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58b3c76c4ad1563218001387","utdid":"W77eJxlECEADAGdzx1GsLqEp","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu-1349153800.so
date
df
getprop
id
ip link
ls /dev/socket
ls /sys/class/thermal
ls /system/fonts
mkdir -p <SD-Card> .. .. .. .. .. .. sdcard Android Data System local/
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat /proc/meminfo
sh -c cd /proc/;cat cpuinfo
sh -c echo M0U0OTM3NkY5QUYzQ0EwQzAyRUI5Nzk1MzI3RkI0NEEzQzRFMTM6RjRCNURBOjYzRjU5Ng== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo M0U0OTM3NkY5QUYzQ0EwQzAyRUI5Nzk1MzI3RkI0NEEzQzRFMTM6RjRCNURBOjYzRjU5Ng== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo MTk0RjAwM0I3ODMwNDI0RkQzRkZBOEMyMUNBOTI1RTQwQzk4NEE0Rg== > <SD-Card>/../../../../../..<SD-Card>/.n_a
sh -c echo MTk0RjAwM0I3ODMwNDI0RkQzRkZBOEMyMUNBOTI1RTQwQzk4NEE0Rg== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_a
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c echo MjUyNDE1OEE1QUMzNTI1RDcyRTUyMjc3RkI4QUJCMEUxNTM5MjM1Mzc3 > <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c echo MjUyNDE1OEE1QUMzNTI1RDcyRTUyMjc3RkI4QUJCMEUxNTM5MjM1Mzc3 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/.n_b
sh -c echo NjcwQjE0NzI4QUQ5OTAyQUVDQkEzMkUyMkZBNEY2QkQwMDAwMDA= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_b
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo ODZBQ0QxN0I3NTU0N0I1QTIwNUU3NTVCRTBFOEE3NTczNzNhMGFhOWIxMzI0ODhhOWYwOWZmNTQ0OTFkNTE2bAo= > <SD-Card>/../../../../../..<SD-Card>/.duid
sh -c echo ODZBQ0QxN0I3NTU0N0I1QTIwNUU3NTVCRTBFOEE3NTczNzNhMGFhOWIxMzI0ODhhOWYwOWZmNTQ0OTFkNTE2bAo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo QjhGMDU3MDY0QUQ0NjcwMDMzNThBMTFGRjA1RTYwMTVDNDAx > <SD-Card>/../../../../../..<SD-Card>/.n_d
sh -c echo QjhGMDU3MDY0QUQ0NjcwMDMzNThBMTFGRjA1RTYwMTVDNDAx > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_d
sh -c echo RkQxODlGOEE4RTk3MjE2MkQ3MTI3RTJENUVEM0RENDUwMDBB > <SD-Card>/../../../../../..<SD-Card>/.n_c
sh -c echo RkQxODlGOEE4RTk3MjE2MkQ3MTI3RTJENUVEM0RENDUwMDBB > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/n_c

Loads the following dynamic libraries:

du
libjiagu-1349153800
libyaqbasic.28020090
libyaqpro.28020090
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
desede-CBC-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial