Android.Packed.42561

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.758.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.g####.com:80
TCP(HTTP/1.1) st####.shu####.cn:80
TCP(HTTP/1.1) tls.d####.com:80
TCP(HTTP/1.1) ma####.img.a####.####.com:80
TCP(HTTP/1.1) a####.g####.com:80
TCP(HTTP/1.1) p.cdn.a####.####.com:80
TCP(TLS/1.0) daa.shu####.cn:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) p.a####.com:443

DNS requests:

a####.g####.com
api.g####.com
api.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
gp.hz####.com
h####.b####.com
i####.a####.com
p####.dianx####.com
p.a####.com
p.cdn.a####.com
st####.shu####.cn
tls.d####.com

HTTP GET requests:

api.g####.com/info.php?mt=####&pid=####&sdk=####&chl=####&imei=####&sign...
ma####.img.a####.####.com/data1/icon/201802/07/com.ss.android.article.li...
ma####.img.a####.####.com/data1/icon/201803/22/com.tencent.mobileqq_5445...
ma####.img.a####.####.com/data3/icon/201404/09/com.tencent.news_88829100...
ma####.img.a####.####.com/data3/icon/201412/10/4676a7368814a037ac7a18f88...
ma####.img.a####.####.com/data3/icon/201708/07/com.snda.wifilocating_825...
ma####.img.a####.####.com/data4/icon/201806/24/com.yy.kaitian.phonelocat...
ma####.img.a####.####.com/data5/icon/201811/23/com.newscat.cn_39130000_1...
ma####.img.a####.####.com/data5/icon/201811/26/com.ledo.kof97ol.anzhi_52...
ma####.img.a####.####.com/data5/icon/201812/24/bubei.tingshu_90219700_16...
ma####.img.a####.####.com/data5/icon/201901/09/com.sina.weibo_23387500_1...
ma####.img.a####.####.com/data5/icon/201901/15/com.tencent.tmgp.pubgmhd_...
ma####.img.a####.####.com/data5/icon/201901/22/com.tencent.mtt_22429100_...
ma####.img.a####.####.com/img/201809/25/1537864031_4988.jpg
ma####.img.a####.####.com/img/201810/26/83209200.png
ma####.img.a####.####.com/img/201811/02/78728100.png
ma####.img.a####.####.com/img/201811/09/45201600.png
ma####.img.a####.####.com/img/201811/22/76241800.png
ma####.img.a####.####.com/img/201811/22/84113000.png
ma####.img.a####.####.com/img/201811/23/14808300.png
ma####.img.a####.####.com/img/201812/17/58207000.png
ma####.img.a####.####.com/img/201812/27/1545886854_3440.png
ma####.img.a####.####.com/img/201812/27/1545886854_4254.png
ma####.img.a####.####.com/img/201812/27/1545886854_7289.png
ma####.img.a####.####.com/img/201901/11/14181300.png
ma####.img.a####.####.com/img/201901/11/1547193313_1836.jpg
ma####.img.a####.####.com/img/201901/11/1547193313_8329.jpg
ma####.img.a####.####.com/img/201901/11/1547193313_9068.jpg
p.cdn.a####.####.com/data1/icon/201309/22/com.lectek.android.ecp_4652230...
p.cdn.a####.####.com/data1/icon/201711/24/551fd6423e926e3a731fed86e20ab9...
p.cdn.a####.####.com/data1/img/201804/09/pic0_84693300.jpg
p.cdn.a####.####.com/data1/img/201805/11/pic0_87372700.jpg
p.cdn.a####.####.com/data2/icon/201608/24/com.alibaba.mobileim_79329700_...
p.cdn.a####.####.com/data3/icon/201407/11/com.yy.huanju_62796800_160.png
p.cdn.a####.####.com/data3/icon/201412/29/f0fd875148e5b134bcb93fbd23d200...
p.cdn.a####.####.com/data3/icon/201501/15/com.tencent.pb_12975000_160.png
p.cdn.a####.####.com/data3/icon/201708/25/com.xtc.watch_14294600_160.png
p.cdn.a####.####.com/data3/thumb/201809/11/1536647632_5300.png
p.cdn.a####.####.com/data4/icon/201810/25/f088f1af687c117331a575bc2be496...
p.cdn.a####.####.com/data4/icon/201811/09/com.dfjj.paiyou_37239800_160.png
p.cdn.a####.####.com/data5/icon/201812/28/com.azhi.happyfish_18604900_16...
p.cdn.a####.####.com/data5/icon/201901/02/79802538638738262fffcf3fc59b94...
p.cdn.a####.####.com/data5/icon/201901/07/com.aly.topgun.anzhi_83051000_...
p.cdn.a####.####.com/data5/thumb/201812/24/7b621ec3e1cebe0fbb025b19d3bdd...
p.cdn.a####.####.com/data5/thumb/201812/24/99349615b34d5dfa0c68933befe3d...
p.cdn.a####.####.com/data5/thumb/201812/24/cc2c17a947753b9c531049929fba4...
p.cdn.a####.####.com/data5/thumb/201812/24/f39c37b5c0428ac1cc6932bc9450e...
p.cdn.a####.####.com/img/201811/19/73019000_o.jpg
p.cdn.a####.####.com/img/201812/26/1545791915_5997.png
p.cdn.a####.####.com/pcdn/config_0.json
tls.d####.com/1.0/config/query?auth_ver=####&appkey=####&nonce=####&mode...

HTTP POST requests:

a####.g####.com/api.php
api.g####.com/api.php
st####.shu####.cn/report?v=####&c=####&e=####&t=####
tls.d####.com/api/data?token=####&tk=PmkK####&sv=####
tls.d####.com/api/tokens?tk=PmkK####&sv=####

File system changes:

Creates the following files:

/data/data/####/1.dex
/data/data/####/1401095385.db
/data/data/####/1401095385.db-journal
/data/data/####/DianxinDXB.xml
/data/data/####/DianxinDXB.xml.bak (deleted)
/data/data/####/MESSAGE_LIST_INFO_V3
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1548306336394
/data/data/####/al_events.db-journal
/data/data/####/anzhi_assist.db-journal
/data/data/####/anzhi_new.db-journal
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/behavior_new.db-journal
/data/data/####/cache.xml
/data/data/####/cache.xml.bak
/data/data/####/cache_branch.xml
/data/data/####/cn.goapk.market_preferences.xml
/data/data/####/cn.goapk.market_prefs.xml
/data/data/####/com.anzhi.plugin.design.apk
/data/data/####/com.anzhi.plugin.design.apk.raw
/data/data/####/com.anzhi.plugin.h5web.apk
/data/data/####/com.anzhi.plugin.h5web.apk.raw
/data/data/####/com.anzhi.plugin.push.apk
/data/data/####/com.anzhi.plugin.push.apk.raw
/data/data/####/com.anzhi.plugin.snareden.apk
/data/data/####/com.anzhi.plugin.snareden.apk.raw
/data/data/####/d
/data/data/####/d-journal
/data/data/####/d.xml
/data/data/####/h.xml
/data/data/####/i
/data/data/####/i-journal
/data/data/####/i.xml
/data/data/####/libcuid.so
/data/data/####/libdesign_az2.so
/data/data/####/netstate.xml
/data/data/####/push.db-journal
/data/data/####/rt.xml
/data/data/####/sk
/data/data/####/sk-journal
/data/data/####/t
/data/data/####/utils.xml
/data/data/####/z
/data/data/####/z-journal
/data/media/####/-10992230151548306349900
/data/media/####/-11422890731548306326985
/data/media/####/-11806283331548306325684
/data/media/####/-13411892061548306326342
/data/media/####/-13413154141548306326970
/data/media/####/-13905523161548306348013
/data/media/####/-14775894041548306328274
/data/media/####/-15703658911548306328004
/data/media/####/-16819304951548306325684
/data/media/####/-17731178161548306350423
/data/media/####/-1799832191548306327109
/data/media/####/-18352946451548306327906
/data/media/####/-19924301941548306324421
/data/media/####/-1992782301548306350371
/data/media/####/-3172204391548306326036
/data/media/####/-4758017621548306349900
/data/media/####/-556049391548306350418
/data/media/####/-5599439371548306324421
/data/media/####/-5661958131548306328293
/data/media/####/-692352581548306325686
/data/media/####/-692802591548306348648
/data/media/####/-823612461548306350766
/data/media/####/-9764905021548306343450
/data/media/####/..ccvid
/data/media/####/..cvtid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.acc.dat
/data/media/####/.aio.dat
/data/media/####/.ccvid
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.cvtid
/data/media/####/.timestamp
/data/media/####/.userReturn
/data/media/####/10742818631548306348012
/data/media/####/12494064591548306324421
/data/media/####/13916626441548306324421
/data/media/####/14797636461548306327098
/data/media/####/16332018171548306348014
/data/media/####/180514491548306325684
/data/media/####/18751820341548306348071
/data/media/####/19373114461548306350213
/data/media/####/19635145101548306348072
/data/media/####/20601168271548306324424
/data/media/####/2094605131548306351227
/data/media/####/2293906551548306325683
/data/media/####/2436293481548306328004
/data/media/####/2798009961548306327774
/data/media/####/3530507961548306350941
/data/media/####/4810746591548306350576
/data/media/####/4942424821548306349866
/data/media/####/5520936231548306349882
/data/media/####/5654466521548306348461
/data/media/####/6261244061548306327088
/data/media/####/6677783221548306327586
/data/media/####/7456117581548306327584
/data/media/####/7632608121548306327936
/data/media/####/9334606741548306320792
/data/media/####/9597024351548306349900
/data/media/####/DEFAULT_KEYWORDS_v1
/data/media/####/GET_CONFIGURED_IMG
/data/media/####/HOME_RECOMMEND_APP_LIST_V3_DOUBLE
/data/media/####/HOME_SOARGING_BATCH_v24_COUNT_60
/data/media/####/MAYBE_LIKE_com.tencent.mobileqq
/data/media/####/SEARCH_HOT_KEYWORDS_v6
/data/media/####/SOFT_DETAIL_3089952
/data/media/####/SOFT_UPDATE_PAGE_v13
/data/media/####/TIPS
/data/media/####/TOP_KEYWORDS_v1
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/acc.dat
/data/media/####/aio.dat
/data/media/####/anzhi_push
/data/media/####/anzhi_push-journal
/data/media/####/ucenter
/data/media/####/ucenter-journal

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/meminfo
/system/bin/cat /sys/block/mmcblk0/device/cid
/system/bin/cat /sys/block/mmcblk1/device/cid
/system/bin/cat /sys/block/mmcblk2/device/cid
/system/bin/cat /sys/block/mmcblk3/device/cid
app_process /system/bin com.android.commands.pm.Pm list package
date
df
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURl
sh -c echo MkJGNEY0MjYwQjMwQ0YwNzkwM0NBQzc2MTJGRTBFMzZEQ0FBMjA6RjU4ODI0OjM4MTI5Mw== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo MkJGNEY0MjYwQjMwQ0YwNzkwM0NBQzc2MTJGRTBFMzZEQ0FBMjA6RjU4ODI0OjM4MTI5Mw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo Q0EyNkEyQkY2RDNDNjE4NTQ2N0Q4OEVCNEU5NzJDNzQxNTQ4MzA2MzM5 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo Q0EyNkEyQkY2RDNDNjE4NTQ2N0Q4OEVCNEU5NzJDNzQxNTQ4MzA2MzM5 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RUJENUQ5ODk2NDQ4MkUxRUUwNDU1NDJCREJGNkVFMDgxNTQ4MzA2MzQ1 > <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c echo RUJENUQ5ODk2NDQ4MkUxRUUwNDU1NDJCREJGNkVFMDgxNTQ4MzA2MzQ1 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c echo RjFFODY0Q0E3OEZDOTQ0QTdBQzZFM0EyMzRERTZFOTI4NjlDNjA6Mzc1NzBCOkEzQzM2OQ== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo RjFFODY0Q0E3OEZDOTQ0QTdBQzZFM0EyMzRERTZFOTI4NjlDNjA6Mzc1NzBCOkEzQzM2OQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo RkMwRTc1RTBCNkM3RTdCNTc5RUYwQzI3NjZGQkM2OTExNTQ4MzA2MzQ0 > <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c echo RkMwRTc1RTBCNkM3RTdCNTc5RUYwQzI3NjZGQkM2OTExNTQ4MzA2MzQ0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat

Loads the following dynamic libraries:

bspatch_az
design_az2
du

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DESede
RSA
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

DES
DESede
desede-CBC-NoPadding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Manages Wi-Fi connectivity.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial