Android.Packed.42872

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.396.origin
Android.DownLoader.675.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ff.t####.com.####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP s3.u####.com:7101
TCP s3.u####.com:7102
TCP s3.u####.com:7103

DNS requests:

cg.y####.com
ff.t####.com
k1.yo####.com
s3.u####.com
w####.pcon####.com.cn

HTTP GET requests:

ff.t####.com.####.com/d/4170.jpg
ff.t####.com.####.com/d/44z0.jpg
ff.t####.com.####.com/d/44z7.jpg
ff.t####.com.####.com/d/451c.jpg
ff.t####.com.####.com/d/451h.jpg
ff.t####.com.####.com/d/451k.jpg

HTTP POST requests:

w####.pcon####.com.cn/ip.jsp?qq-pf-to=####&ke=####&sv=####&kv=####&im=##...

File system changes:

Creates the following files:

/data/data/####/-1059131892.xml
/data/data/####/-1059131892.xml.bak
/data/data/####/-1785232530-journal
/data/data/####/-2029706429
/data/data/####/-2029706446.jar
/data/data/####/.lock
/data/data/####/06675555-fa06-47f7-8c20-e413b623f73f
/data/data/####/06c5a4ad-7440-4df6-a5dc-f1a9a2fe62dc
/data/data/####/1110977767.jar
/data/data/####/1403782159.jar
/data/data/####/1550751856044o.jar
/data/data/####/1550751856207sp.jar
/data/data/####/1550751859069o.jar
/data/data/####/1550751859204sp.jar
/data/data/####/1550751861414o.jar
/data/data/####/1550751861556sp.jar
/data/data/####/1550751863360o.jar
/data/data/####/1550751863497sp.jar
/data/data/####/1550751866066o.jar
/data/data/####/1550751866180sp.jar
/data/data/####/1550751867918o.jar
/data/data/####/1550751868060sp.jar
/data/data/####/1550751870216o.jar
/data/data/####/1550751870361sp.jar
/data/data/####/1550751872168o.jar
/data/data/####/1550751872311sp.jar
/data/data/####/1550751875772o.jar
/data/data/####/1550751875904sp.jar
/data/data/####/1550751879180o.jar
/data/data/####/1550751879304sp.jar
/data/data/####/1550751881388o.jar
/data/data/####/1550751881513sp.jar
/data/data/####/1550751885350o.jar
/data/data/####/1550751885504sp.jar
/data/data/####/1550751887632o.jar
/data/data/####/1550751887764sp.jar
/data/data/####/1550751890402o.jar
/data/data/####/1550751890544sp.jar
/data/data/####/1550751894876o.jar
/data/data/####/1550751894995sp.jar
/data/data/####/1550751897533o.jar
/data/data/####/1550751897644sp.jar
/data/data/####/1550751899307o.jar
/data/data/####/1550751899423sp.jar
/data/data/####/1550751902910o.jar
/data/data/####/1550751903020sp.jar
/data/data/####/1550751906640o.jar
/data/data/####/1550751906761sp.jar
/data/data/####/1550751910324o.jar
/data/data/####/1550751910454sp.jar
/data/data/####/1550751912928o.jar
/data/data/####/1550751913071sp.jar
/data/data/####/1550751917607sp.jar
/data/data/####/1a42c488-64d2-4eb8-9d72-c1dc4254d2a4
/data/data/####/2157bca3-11b4-491d-92e4-f91466004035
/data/data/####/2257c40f-de4b-4596-a4f6-211173cb71e2
/data/data/####/28470b35-1e8d-433f-ad79-b62fa55ab9eb
/data/data/####/2f6afeb4-028c-4e73-925d-cc717a868a21
/data/data/####/3d02d4f7-ecc1-4e70-a3b1-7c586cc21aea
/data/data/####/3f86df8a-5e52-4de0-b50f-3c7cc4596f11
/data/data/####/45836ec8-7405-4608-b845-236fb98a7689
/data/data/####/5aed0bf6-fed2-4a82-9355-84944136dcf1
/data/data/####/72dbf15a-e7f7-4388-9d69-976db1e80c41
/data/data/####/757171c9-929f-4615-ba75-7dc2e5b54bb4
/data/data/####/886d46c7-ba98-4b85-b45a-2ab64da9b70a
/data/data/####/8f809824-5ce3-4c08-962c-39d4f73f6468
/data/data/####/9de720f3-1a99-4824-80b2-640ffab80906
/data/data/####/a378f04a-c6f1-46d6-95e4-e23416785667
/data/data/####/a6d82420-a979-4bb2-9b3e-a870fbedce26
/data/data/####/c
/data/data/####/c313a196-5a92-4354-beab-26f89d81c110
/data/data/####/coni_io_356507059351895.xml
/data/data/####/d21e5dd1-7db5-454e-ac4c-182cc1812d2c
/data/data/####/daemon
/data/data/####/db_d356507059351895.db-journal
/data/data/####/faef351f-b303-49f5-adaf-6bd5367893bb
/data/data/####/fcut_appInfo_pre.xml
/data/data/####/fcut_conf_pre.xml
/data/data/####/fdc5b3f8-b516-49da-ad78-19e0d11211fd
/data/data/####/i.xml
/data/data/####/iappInfo_io_356507059351895.xml
/data/data/####/iinfo_io_356507059351895.xml
/data/data/####/itrategy_io_356507059351895.xml
/data/media/####/4170.jpg.data
/data/media/####/44z0.jpg.data
/data/media/####/44z7.jpg.data
/data/media/####/451c.jpg.data
/data/media/####/451h.jpg.data
/data/media/####/451k.jpg.data
/data/media/####/journal
/data/media/####/journal.tmp

Miscellaneous:

Executes the following shell scripts:

chmod 777 <Package Folder>/daemon
sh

Loads the following dynamic libraries:

06675555-fa06-47f7-8c20-e413b623f73f
06c5a4ad-7440-4df6-a5dc-f1a9a2fe62dc
1a42c488-64d2-4eb8-9d72-c1dc4254d2a4
2157bca3-11b4-491d-92e4-f91466004035
2257c40f-de4b-4596-a4f6-211173cb71e2
28470b35-1e8d-433f-ad79-b62fa55ab9eb
2f6afeb4-028c-4e73-925d-cc717a868a21
3d02d4f7-ecc1-4e70-a3b1-7c586cc21aea
3f86df8a-5e52-4de0-b50f-3c7cc4596f11
45836ec8-7405-4608-b845-236fb98a7689
5aed0bf6-fed2-4a82-9355-84944136dcf1
72dbf15a-e7f7-4388-9d69-976db1e80c41
757171c9-929f-4615-ba75-7dc2e5b54bb4
886d46c7-ba98-4b85-b45a-2ab64da9b70a
8f809824-5ce3-4c08-962c-39d4f73f6468
9de720f3-1a99-4824-80b2-640ffab80906
a378f04a-c6f1-46d6-95e4-e23416785667
a6d82420-a979-4bb2-9b3e-a870fbedce26
c313a196-5a92-4354-beab-26f89d81c110
cocos2dcpp
d21e5dd1-7db5-454e-ac4c-182cc1812d2c
faef351f-b303-49f5-adaf-6bd5367893bb
fdc5b3f8-b516-49da-ad78-19e0d11211fd

Uses the following algorithms to encrypt data:

DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

DES
DES-CBC-PKCS5Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial