Android.Packed.41327

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.3887

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) 1####.50.63.227:8881
TCP(HTTP/1.1) ip.zhito####.com:88
TCP(HTTP/1.1) i####.pcon####.fas####.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) tt.kyli####.com:80
TCP(HTTP/1.1) d0.x####.com.cn:80
TCP(HTTP/1.1) 362b3d8####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 58.2####.198.131:888
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) www.pc####.com.####.cn:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) i####.i####.com:80
TCP(HTTP/1.1) api.con####.kyli####.com:666
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) idu####.qini####.com:80
TCP(HTTP/1.1) c####.zhito####.com:808
TCP(HTTP/1.1) 2####.187.226.25:80
TCP(HTTP/1.1) yun.tuit####.com.####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) ec####.b####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) p####.caiji####.com:80
TCP(HTTP/1.1) 1####.75.29.14:8961
TCP(HTTP/1.1) ip.zhito####.com:807
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) s####.x####.com.cn:80
TCP(HTTP/1.1) a####.b0.upa####.com:80
TCP(HTTP/1.1) s####.funs####.net:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) c####.x####.com.cn:80
TCP(HTTP/1.1) zf####.v.qin####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) v####.funs####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) idv####.qini####.com:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) g.cn.miao####.com:443
TCP(TLS/1.0) mg####.pcon####.com.cn:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) js.3con####.com:443
TCP(TLS/1.0) pc####.i####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) img.pcon####.com.####.cn:443
TCP(TLS/1.0) 362b3d8####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) ivy.pcon####.com.cn:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) c####.pc####.com.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) r.s####.cn:443
TCP(TLS/1.0) yun.tuit####.com.####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) en####.lveha####.com:443

DNS requests:

362b3d8####.oss-cn-####.aliy####.com
a####.b0.upa####.com
adm.t####.com
api.con####.kyli####.com
c####.mm####.com
c####.pc####.com.cn
c####.x####.com.cn
c####.zhito####.com
c.c####.com
c.xz####.com
cdn.1####.wang
d####.wos####.com
d0.x####.com.cn
dl.api.kyli####.com
dup.baidust####.com
ec####.b####.com
en####.lveha####.com
g.cn.miao####.com
h####.c####.com
hm.b####.com
i####.com
i####.pcon####.com.cn
i####.x####.com.cn
i####.xca####.com
img.pcon####.com.cn
imgc####.qq.com
ip.zhito####.com
ivy.pcon####.com.cn
js.3con####.com
js.x####.com.cn
k####.kyli####.com
mg####.pcon####.com.cn
mi.g####.qq.com
mt####.go####.com
p####.caiji####.com
p####.pc####.com.cn
p####.x####.com.cn
p.rqco####.com
pc####.i####.com
pco####.c####.com
pj006####.bkt.clo####.com
pos.b####.com
r.s####.cn
s####.e.qq.com
s####.funs####.net
s####.x####.com.cn
s11.c####.com
s13.c####.com
s19.c####.com
s22.c####.com
s4.c####.com
s5.c####.com
s95.c####.com
tt.kyli####.com
v####.fun.tv
v####.fun.tv
v1.c####.com
w####.pc####.com.cn
www.pc####.com.cn
www.pcon####.com.cn
yun.tuit####.com
z11.c####.com
z13.c####.com
z6.c####.com
z7.c####.com
z8.c####.com
z9.c####.com

HTTP GET requests:

362b3d8####.oss-cn-####.aliy####.com/h.html?id=id=1####&web_id=####
a####.b0.upa####.com/paramslist
c####.x####.com.cn/push/adv.php?pid=####&id=####&oid=####&m=####&pv=####...
c####.zhito####.com:808/waptj.html
c.c####.com/core.php?web_id=####&t=####
c.c####.com/stat.php?id=####
c.c####.com/stat.php?id=####&web_id=####
c.c####.com/z_stat.php?id=####&web_id=####
cdn.1####.wang/sc_156
d0.x####.com.cn/pvlog/ad_count.php?t=####
dup.baidust####.com/js/os.js
ec####.b####.com/rs.jpg?type=####&stamp=####
gm.mm####.com/9.gif?abc=####&rnd=####
i####.i####.com/irt?_iwt_UA=####&jsonp=####
i####.pcon####.fas####.com/blank.gif
idu####.qini####.com/2009/images/t0512_pics_arr.gif
idu####.qini####.com/2009/images/zutupp.gif
idu####.qini####.com/cms/group/r_map.gif
idu####.qini####.com/group/20160125155916566.jpg
idu####.qini####.com/group/20171204135016287.jpg
idu####.qini####.com/group/20171210171001894.jpg
idu####.qini####.com/group/20171219161638837.jpg
idu####.qini####.com/group/20180212145023179.jpg
idu####.qini####.com/group/20180403161240590.jpg
idu####.qini####.com/group/20180717143455396.jpg
idu####.qini####.com/group/20180801124733703.jpg
idu####.qini####.com/group/20181018140550321.jpg
idu####.qini####.com/group/20181125141405494.jpeg
idu####.qini####.com/group/images/s_l.cur
idu####.qini####.com/group/js/changspeed.js
idu####.qini####.com/group/js/picload.js
idu####.qini####.com/group/js/silder.js
idu####.qini####.com/group/view_ab.php?pid=####
idv####.qini####.com/index.html
ip.zhito####.com:807/1102.html
ip.zhito####.com:807/1102off.html
ip.zhito####.com:807/ip1102.html
ip.zhito####.com:807/js1102/jquery.js
ip.zhito####.com:88/zong/1102.html
k####.kyli####.com.####.com/1543809956487_utils.ttf
mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
p.rqco####.com:8806/c/1543875707776
pco####.ta####.com/app.gif?&cna=####
pos.b####.com/bfp/snippetcacher.php?dpv=####&di=####
pos.b####.com/hcum?conwid=234&conhei=60&rtbid=3033352&rdid=13147349&dc=2...
pos.b####.com/hcum?di=5897808&dri=0&dis=3&dai=0&ps=284x8&enu=encoding&dc...
pos.b####.com/ocnm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/vccm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/vcim?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/zcnm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
s####.funs####.net/ecom-ad/ifar_all/?oc=####
s####.funs####.net/ecom-ad/ifar_duration/?rprotocol=####&fck=####&mick=#...
s####.funs####.net/ecom-ad/ifar_load/?rprotocol=1&fck=1543875713afb83&mi...
s####.x####.com.cn/flow/flow.php?t=####
t####.c####.q####.####.com/album/14421/20160125160608530438943216145.jpg...
v####.funs####.com/vasd/pa/index?zzt=####&sid=####&ref=####&mick=####&cv...
www.pc####.com.####.cn/autox/x2.html
yun.tuit####.com.####.com/cms/iwt/iwt-min.js
yun.tuit####.com.####.com/tools/jq/1.5.1.min.js
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zf####.v.qin####.com/market/ext/udc/c00100085.html?zzt=####
zf####.v.qin####.com/unet/static/udc.js?zzt=####

HTTP POST requests:

api.con####.kyli####.com:666/v1/config
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
d####.wos####.com/upload/shortheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
p####.caiji####.com/klv2/sdkkl/mobile
p.rqco####.com:8806/p/1543875708588
s####.e.qq.com/activate
s####.e.qq.com/getad
s####.e.qq.com/msg
tt.kyli####.com/v3/task/mobile

File system changes:

Creates the following files:

/data/data/####/4df489baf9df3e1c8b91dea08af7bf06
/data/data/####/719945FC9586D1F53B4FA16482CED4A6.jar
/data/data/####/719945FC9586D1F53B4FA16482CED4A6.tmp
/data/data/####/ApplicationCache.db-journal
/data/data/####/BuglySdkInfos.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/android-util.zip
/data/data/####/app_spf_scli.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cwnamd
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.xml
/data/data/####/default_sp.xml
/data/data/####/defaultpref1.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/http_photo.xcar.com.cn_0.localstorage-journal
/data/data/####/http_vas.fun.tv_0.localstorage-journal
/data/data/####/https_pos.baidu.com_0.localstorage-journal
/data/data/####/imagedb
/data/data/####/imagedb-journal
/data/data/####/index
/data/data/####/load_MTAwMF8xMjAxXzEyODAwMjAw;.xml
/data/data/####/mobclick_agent_cached_protect.eye.filterv24
/data/data/####/odddk.xml
/data/data/####/pl_sp.xml
/data/data/####/rws_sp.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sp_iconfig.xml
/data/data/####/tray.db-journal
/data/data/####/umengOnEvent.db
/data/data/####/umengOnEvent.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/update_lc
/data/data/####/use_MTAwMF8xMjAxXzEyODAwMjAw;.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/adv
/data/media/####/config
/data/media/####/deviceId
/data/media/####/master
/data/media/####/master.lock
/data/media/####/my.properties
/data/media/####/my.properties.lock

Miscellaneous:

Loads the following dynamic libraries:

tongdun_db

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS7Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial