Android.Packed.45356

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.859.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) aliyun-####.al####.com:80
TCP(HTTP/1.1) baf9352####.dlc####.fas####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) if.a####.com.cn:8000
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) g.fas####.net:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) fy.innot####.com:443
TCP(TLS/1.0) co####.in####.com:443
TCP(TLS/1.0) yt####.s####.com:443
TCP(TLS/1.0) tt####.wa####.cn:443
TCP(TLS/1.0) dat####.te####.cn:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) sis.baixunt####.com:18443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
UDP 1####.168.121.1:137
TCP sis.baixunt####.com:3000
UDP sis.baixunt####.com:19000
TCP zb-cent####.m.ta####.com:443
UDP 2####.0.0.1:9998

DNS requests:

a####.m.ta####.com
a####.n####.cn
a####.u####.com
acc####.m.ta####.com
acs4pu####.m.ta####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
ag####.m.ta####.com
an####.l####.com
baixunt####.com
beacon####.aliy####.com
c####.baixunt####.com
cgi.con####.qq.com
co####.in####.com
dat####.te####.cn
fp.fraudme####.cn
fy.innot####.com
g.fas####.net
if.a####.com.cn
l####.tbs.qq.com
mpush####.al####.com
re####.baixunt####.com
sdk.c####.com
sis.baixunt####.com
tt####.wa####.cn
yt####.s####.com

HTTP GET requests:

baf9352####.dlc####.fas####.com/kubo/dex/hh_8.2_120.dex
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
g.fas####.net/ga?slotid=####&pid=####&hid=####&jdata=####

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&deviceId=####&pla...
a####.u####.com/app_logs
aliyun-####.al####.com/config
beacon####.aliy####.com/beacon/fetch/config/byappkey
if.a####.com.cn:8000/paste/fill
l####.tbs.qq.com/ajax?c=####&k=####
sdk.c####.com/versiontapi.php?v=####&type=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.td-3
/data/data/####/.tdck
/data/data/####/075fc86a179cd691a02617dcf90e6e4cbb1eff2a1065b9b....0.tmp
/data/data/####/1a6d23dce1d60a3a95fab082b9a4a8dd55ee64cf53f5601....0.tmp
/data/data/####/1d2bf2550bcc62c121e0e4d7cfd1a0a69e133a274f62911....0.tmp
/data/data/####/36d460034dc18885b3cd8ac302b8fdda5ea373135ebfed8....0.tmp
/data/data/####/5eae7ab24ce97210ef1b3ca851936ea46a2f56b9fea28a4....0.tmp
/data/data/####/639571831bc1a465d98634b6f0c5c21c3369a362eeeb877....0.tmp
/data/data/####/6cb0d4c7dbe69546404f5ed02c05e86c615adfb89887ce2....0.tmp
/data/data/####/746d7a53567a582e72ea7f19e61e6db30599621bf4379d3....0.tmp
/data/data/####/912fc82356e79258e667b02423b200c783cc6dd6596a507....0.tmp
/data/data/####/9cba81881d004afff1d9bef96e66f984c01f19884cc954f....0.tmp
/data/data/####/9f9dbc7de55b728e689991657dadbafa4c1961f9d2456c6....0.tmp
/data/data/####/ACCS_BIND24720081.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/DailyNews.xml
/data/data/####/DownloadTaskStore.db-journal
/data/data/####/JPushSA_Config.xml
/data/data/####/LKME_Server_Request_Queue.xml
/data/data/####/MultiDex.lock
/data/data/####/OFFERSCONFIG1.xml
/data/data/####/OxgHkj2lz09F-journal
/data/data/####/Push_Page_Config.xml
/data/data/####/T2hHci_ktH6FOxwC67-6FkkxRl-OlC9D
/data/data/####/T4ziUS72vh9lx94dG4YU6kFje5M1RxHS
/data/data/####/T7QKP7CTLZwvbKhgDZrasEDFixfSOE89
/data/data/####/TwHnzUVHeE9LWh7665nsiEFfuT23M-J-
/data/data/####/TzpqrAK949t1anOe86VTfEs1rqDIgOfS
/data/data/####/UTCommon.xml
/data/data/####/a0c64094-a771-45b2-932d-488ed928a587
/data/data/####/a38ffbcedf5a08dca8505b22befe56da9448cdc5fde208d....0.tmp
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/ap.Lock
/data/data/####/ax_c.xml
/data/data/####/ax_c.xml.bak
/data/data/####/b2de712ddc50e8130185b3d33c2fd18af27aa6c870ed0b1....0.tmp
/data/data/####/c06894ec-0e5b-44af-aa44-f1f82e26850a
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/cn.push.preferences.v2.rid.xml
/data/data/####/cn.push.preferences.v2.xml
/data/data/####/com.im.keyValueStore.aes_key_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml
/data/data/####/com.im.keyValueStore.sdk_version_store.xml
/data/data/####/com.im_7.1.0.db
/data/data/####/com.im_7.1.0.db-journal
/data/data/####/com.push.sdk.user.profile.xml
/data/data/####/com.tencent.open.config.json.1105964143
/data/data/####/com.yunju.dailynews.xml
/data/data/####/com.yunju.dailynews_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core_info
/data/data/####/ddcac926-a184-4373-b590-260daf0b1eb1
/data/data/####/e1e7f0da41eaf7cbf3968d403e9eac10f94e4447ec9498e....0.tmp
/data/data/####/e55475488ca85a94c7c6e4d88339e40e
/data/data/####/e55475488ca85a94c7c6e4d88339e40e-journal
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f40f586d7fa2b0b4315fb2cda37c7ddb9a73fc7b2eada03....0.tmp
/data/data/####/fm_shared.xml
/data/data/####/hh_8.4.dex
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libjiagu1502583314.so
/data/data/####/linkedme_link_active_sp.xml
/data/data/####/loc_plugin.dex
/data/data/####/loc_plugin.ini
/data/data/####/mc120.dex
/data/data/####/mc_cache.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/push_device_info.xml
/data/data/####/push_stat_cache.json
/data/data/####/push_stat_cache_history.json
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/td_fm.jar
/data/data/####/testin.bug.allocation.xml
/data/data/####/testin.data.allocation.0e21432b0dada125891821d3...eb.xml
/data/data/####/testin.data.identify.xml
/data/data/####/testin.youguo.allocation864199ca6a7c4ed4a386776...48.xml
/data/data/####/testinad-journal
/data/data/####/testinbug-journal
/data/data/####/testindata-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/data/####/ymdex.jar
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid2
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid2
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid2
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.acid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid2
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid2
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.acid
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid2
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid2
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid2
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.acid
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid2
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.acid
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid2
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid2
/data/media/####/.54835cf5b563a206fd5112aa828721d9.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid2
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid2
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid2
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid2
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8d777f385d3dfec8815d20f7496026dc.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid2
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid2
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid2
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid2
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid2
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid2
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid2
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.td-3
/data/media/####/.tdck
/data/media/####/45a0dbab6b504b06804592ace919254a
/data/media/####/4DyOQTU2bbOx00gaPOkL6g
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/axacount
/data/media/####/cusc
/data/media/####/cusc2
/data/media/####/cusys
/data/media/####/cusys2
/data/media/####/ebd77933917c47bfb6a955e42b4778d2
/data/media/####/qtac
/data/media/####/systemccu
/data/media/####/systemccu2
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"24720081","utdid":"XPOSbh++MCADAGdzx1EGr4a6","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /sys/class/net/wlan0/address
chmod 444/storage/emulated/0/.td-3
chmod 444/storage/emulated/0/.tdck
chmod 444/storage/emulated/0/Alarms/.td-3
chmod 444/storage/emulated/0/Alarms/.tdck
chmod 444/storage/emulated/0/Movies/.tdck
chmod 444/storage/emulated/0/Notifications/.tdck
chmod 444/storage/emulated/0/aacout/.td-3
chmod 444/storage/emulated/0/aacout/.tdck
chmod 444/storage/emulated/0/axacount/.tdck
chmod 444/storage/emulated/0/cusc/.td-3
chmod 444/storage/emulated/0/cusc/.tdck
chmod 444/storage/emulated/0/cusys/.td-3
chmod 444/storage/emulated/0/cusys/.tdck
chmod 444/storage/emulated/0/cusys2/.tdck
chmod 444/storage/emulated/0/data/.tdck
chmod 444/storage/emulated/0/qt/.td-3
chmod 444/storage/emulated/0/qt/.tdck
chmod 444/storage/emulated/0/systemccu2/.td-3
chmod 444/storage/emulated/0/systemccu2/.tdck
chmod 444/storage/emulated/0/tencent/.td-3
chmod 444/storage/emulated/0/tencent/.tdck
chmod 444/storage/emulated/0/weitac/.td-3
chmod 444/storage/emulated/0/weitac/.tdck
chmod 444/storage/emulated/0/wxt/.td-3
chmod 444/storage/emulated/0/wxt/.tdck
chmod 444/storage/emulated/0/wxtac/.td-3
chmod 444/storage/emulated/0/wxtac/.tdck
chmod 500 <Package Folder>/files/DaemonServer
getprop
getprop net.dns1
getprop net.hostname
getprop ro.product.cpu.abi
getprop ro.serialno
ls -i
ls -l
ls -l /system/xbin/su
ps
sh
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T2hHci_ktH6FOxwC67-6FkkxRl-OlC9D
sh <Package Folder>/files/T4ziUS72vh9lx94dG4YU6kFje5M1RxHS
sh <Package Folder>/files/T7QKP7CTLZwvbKhgDZrasEDFixfSOE89
sh <Package Folder>/files/TwHnzUVHeE9LWh7665nsiEFfuT23M-J-
sh <Package Folder>/files/TzpqrAK949t1anOe86VTfEs1rqDIgOfS
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Loads the following dynamic libraries:

InnoSo
bugout-ndk
jcore123
libjiagu1502583314
native-lib
tnet-3.1
tongdun
ut_c_api

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
PBEWITHMD5andDES
RSA-ECB-NoPadding
RSA-ECB-nopadding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
PBEWITHMD5andDES

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial