Android.DownLoader.4918

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.277.origin
Android.Triada.513.origin

Downloads the following detected threats from the Internet:

Android.RemoteCode.277.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) laun####.clu####.feiyu####.com:80
TCP(HTTP/1.1) co####.ssp.adoc####.com:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) app.feiyu####.com:80
TCP(HTTP/1.1) li####.cn-qin####.log.####.com:80
TCP(HTTP/1.1) cdn.id####.com:8080
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) p####.api.adoc####.com:80
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) file####.feiyu####.com:80
TCP(HTTP/1.1) hlsmgsp####.miguv####.com.####.com:8080
TCP(HTTP/1.1) gslbmgs####.miguv####.com:80
TCP(HTTP/1.1) ads.h####.tv:80
TCP(HTTP/1.1) log-col####.cn-qin####.log.####.com:80
TCP(HTTP/1.1) a####.u####.com.####.com:80
TCP(HTTP/1.1) qcode-u####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) os.up####.5####.cn:80
TCP(HTTP/1.1) ap####.math####.cn:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(TLS/1.0) s.kk####.com:7777
TCP(TLS/1.0) p####.miguv####.com:443
UDP tm4.binst####.live:13
UDP tm3.binst####.live:3925
UDP 2####.255.255.250:1900
UDP as1.binst####.live:13
UDP as1.binst####.live:3925
UDP tm3.binst####.live:3923
UDP tm3.binst####.live:13
UDP tm2.binst####.live:13
UDP tm2.binst####.live:3925
UDP tm2.binst####.live:3924
UDP as1.binst####.live:3923
UDP tm4.binst####.live:3925
UDP tm4.binst####.live:3924

DNS requests:

a####.u####.com
ads.h####.tv
and####.b####.qq.com
ap####.math####.cn
api.feiyu####.com
api.m.ta####.com
app.feiyu####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
cdn.id####.com
co####.ssp.adoc####.com
egg.clu####.feiyu####.com
error-l####.cn-qin####.log.####.com
file####.feiyu####.com
gslbmgs####.miguv####.com
hlsmgsp####.miguv####.com
ip.ta####.com
laun####.clu####.feiyu####.com
li####.cn-qin####.log.####.com
log-col####.cn-qin####.log.####.com
newap####.math####.cn
os.up####.5####.cn
p####.api.adoc####.com
p####.miguv####.com
qcf####.5####.cn
qcode-u####.oss-cn-####.aliy####.com
s.kk####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live

HTTP GET requests:

ads.h####.tv/a.gif?ao=1^l=####
api.m.ta####.com/rest/api3.do?api=####
app.feiyu####.com/homepage/parser/lua_metv/r34265/android2.jar
app.feiyu####.com/homepage/parser/lua_metv/r34265/lib4a03a0c0.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/lib4a03a0c1.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/lib69c5d103.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/libacb6afe1.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/libavformat.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/libd3a4309b.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/libqc_iqiyi.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/libqc_iqiyi_t.so.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/live.lua.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/livenew.lua.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/luafiles.config
app.feiyu####.com/homepage/parser/lua_metv/r34265/main.lua.gz
app.feiyu####.com/homepage/parser/lua_metv/r34265/mzsdk_20200817.jar
app.feiyu####.com/livetv/metv5/CTCC/20200915/20200915191912.json
cdn.id####.com:8080/group1/M00/00/1C/ChtYq18rmtGAa_vwAAHQxtlnSDs5963837
co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
file####.feiyu####.com/livetv/epg_20200916_023432.gz
gslbmgs####.miguv####.com/wd_r2/cctv/cctv1/600/01.m3u8?msisdn=####&mdspi...
gslbmgs####.miguv####.com/wd_r2/cctv/cctv1/600/index.m3u8?msisdn=####&md...
gslbmgs####.miguv####.com/wd_r2/cctv/cctv1hd/1200/01.m3u8?msisdn=####&md...
gslbmgs####.miguv####.com/wd_r2/cctv/cctv1hd/1200/index.m3u8?msisdn=####...
hlsmgsp####.miguv####.com.####.com:8080/wd_r2/cctv/cctv1/600/index.m3u8?...
hlsmgsp####.miguv####.com.####.com:8080/wd_r2/cctv/cctv1hd/1200/index.m3...
ip.ta####.com/service/getIpInfo.php?ip=####
laun####.clu####.feiyu####.com/discovery/entrance?category=####&subtype=...
laun####.clu####.feiyu####.com/key/migu?type=####&id=####&v=####&tm=####...
laun####.clu####.feiyu####.com/key/pp1?id=####&v=####&tm=####&sign=####
laun####.clu####.feiyu####.com/live/advert/metv5?mac=####
laun####.clu####.feiyu####.com/live/auth?p=D5kvD####&mac=ztI####&m=SvNID...
laun####.clu####.feiyu####.com/live/discovery?apiVersion=####&mac=####&p...
laun####.clu####.feiyu####.com/live/distribution?vendor=####&pos=####
laun####.clu####.feiyu####.com/live/startup?p=####&mac=####
laun####.clu####.feiyu####.com/live/upgrade?pCode=####&vCode=####&mCode=...
li####.cn-qin####.log.####.com/logstores/metv/track?APIVersion=####&uuid...
li####.cn-qin####.log.####.com/logstores/p2p/track?APIVersion=####&event...
li####.cn-qin####.log.####.com/logstores/p2p/track?APIVersion=0.6.0&even...
log-col####.cn-qin####.log.####.com/logstores/dangb_ad_dist/track?positi...
log-col####.cn-qin####.log.####.com/logstores/errorlog/track?APIVersion=...
newap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
os.up####.5####.cn/auto-update-patch/patch-info-metv/patch-leiniao-relea...
p####.api.adoc####.com/ip
qcode-u####.oss-cn-####.aliy####.com/do_not_delete/time

HTTP POST requests:

a####.u####.com.####.com/app_logs
ap####.math####.cn/titan/monitor/device_info
rq####.sp####.mig.####.net/rqd/async?aid=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1004
/data/data/####/1303999118-836007549
/data/data/####/2d4d1f0b.jar (deleted)
/data/data/####/4d409985
/data/data/####/ExcludeDomain.xml
/data/data/####/METV_EXIT_DistributionApp.xml
/data/data/####/METV_Start_DistributionApp.xml
/data/data/####/MultiDex.lock
/data/data/####/ParserSave.xml
/data/data/####/QcastLive.db
/data/data/####/QcastLive.db-journal
/data/data/####/QcastLiveSave.xml
/data/data/####/acfun.lua
/data/data/####/acfun.lua.gz
/data/data/####/acn.lua
/data/data/####/acn.lua.gz
/data/data/####/aeskey
/data/data/####/android2.jar
/data/data/####/base64.lua
/data/data/####/base64.lua.gz
/data/data/####/bestv.lua
/data/data/####/bestv.lua.gz
/data/data/####/bilibili.lua
/data/data/####/bilibili.lua.gz
/data/data/####/bson.lua
/data/data/####/bson.lua.gz
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/channel.txt
/data/data/####/cjson.so
/data/data/####/cjson.so.gz
/data/data/####/cmcc.lua
/data/data/####/cmcc.lua.gz
/data/data/####/common.lua
/data/data/####/common.lua.gz
/data/data/####/console.lua
/data/data/####/console.lua.gz
/data/data/####/crashrecord.xml
/data/data/####/db61e876.xml
/data/data/####/djhuo.lua
/data/data/####/djhuo.lua.gz
/data/data/####/epg.txt
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/ftp.lua
/data/data/####/ftp.lua.gz
/data/data/####/fun.lua
/data/data/####/fun.lua.gz
/data/data/####/greet.lua
/data/data/####/greet.lua.gz
/data/data/####/headers.lua
/data/data/####/headers.lua.gz
/data/data/####/hex.lua
/data/data/####/hex.lua.gz
/data/data/####/hmac.lua
/data/data/####/hmac.lua.gz
/data/data/####/http.lua
/data/data/####/http.lua.gz
/data/data/####/huand_ad_sdk.xml
/data/data/####/hunantv.lua
/data/data/####/hunantv.lua.gz
/data/data/####/import.lua
/data/data/####/import.lua.gz
/data/data/####/iqiyi.lua
/data/data/####/iqiyi.lua.gz
/data/data/####/json.lua
/data/data/####/json.lua.gz
/data/data/####/letv.lua
/data/data/####/letv.lua.gz
/data/data/####/lib3c055e6c.so
/data/data/####/lib3c055e6c.so.gz
/data/data/####/lib3d20b609.so
/data/data/####/lib3d20b609.so.gz
/data/data/####/lib4a03a0c0.so
/data/data/####/lib4a03a0c0.so.gz
/data/data/####/lib4a03a0c1.so
/data/data/####/lib4a03a0c1.so.gz
/data/data/####/lib69c5d103.so
/data/data/####/lib69c5d103.so.gz
/data/data/####/lib857c1e0a.so
/data/data/####/lib857c1e0a.so.gz
/data/data/####/libUpdateInstaller.so
/data/data/####/libUpdateInstaller.so.gz
/data/data/####/libacb6afe1.so
/data/data/####/libacb6afe1.so.gz
/data/data/####/libavformat.so
/data/data/####/libavformat.so.gz
/data/data/####/libcntvlive2.so
/data/data/####/libcntvlive2.so.gz
/data/data/####/libd24ea003.so
/data/data/####/libd24ea003.so.gz
/data/data/####/libd3a4309b.so
/data/data/####/libd3a4309b.so.gz
/data/data/####/libfdc61a8.so
/data/data/####/libfdc61a8.so.gz
/data/data/####/libload.so
/data/data/####/libload.so.gz
/data/data/####/libqc_iqiyi.so
/data/data/####/libqc_iqiyi.so.gz
/data/data/####/libqc_iqiyi_t.so
/data/data/####/libqc_iqiyi_t.so.gz
/data/data/####/live.lua
/data/data/####/live.lua.gz
/data/data/####/live_new.lua
/data/data/####/live_new.lua.gz
/data/data/####/livenew.lua
/data/data/####/livenew.lua.gz
/data/data/####/local_crash_lock
/data/data/####/ltn12.lua
/data/data/####/ltn12.lua.gz
/data/data/####/m1905.lua
/data/data/####/m1905.lua.gz
/data/data/####/main.lua
/data/data/####/main.lua.gz
/data/data/####/metvTime.xml
/data/data/####/mime.lua
/data/data/####/mime.lua.gz
/data/data/####/mime_core.so
/data/data/####/mime_core.so.gz
/data/data/####/multidex.version.xml
/data/data/####/mzsdk_20200817.jar
/data/data/####/native_record_lock
/data/data/####/out.lua
/data/data/####/out.lua (deleted)
/data/data/####/peed
/data/data/####/percent.lua
/data/data/####/percent.lua.gz
/data/data/####/philosophy.lua
/data/data/####/pptv.lua
/data/data/####/pptv.lua.gz
/data/data/####/qqlive.lua
/data/data/####/qqlive.lua.gz
/data/data/####/security_info
/data/data/####/sha2_256.lua
/data/data/####/sha2_256.lua.gz
/data/data/####/smtp.lua
/data/data/####/smtp.lua.gz
/data/data/####/socket.lua
/data/data/####/socket.lua.gz
/data/data/####/socket_core.so
/data/data/####/socket_core.so.gz
/data/data/####/tengxun.lua
/data/data/####/tengxun.lua.gz
/data/data/####/tp.lua
/data/data/####/tp.lua.gz
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng.config
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/url.lua
/data/data/####/url.lua.gz
/data/data/####/util_array.lua
/data/data/####/util_array.lua.gz
/data/data/####/util_queue.lua
/data/data/####/util_queue.lua.gz
/data/data/####/util_stream.lua
/data/data/####/util_stream.lua.gz
/data/data/####/webview.db-journal
/data/data/####/xml.lua
/data/data/####/xml.lua.gz
/data/data/####/youku.lua
/data/data/####/youku.lua.gz
/data/data/####/zlib.so
/data/data/####/zlib.so.gz
/data/data/####/zxfuli.lua
/data/data/####/zxfuli.lua.gz

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
getprop

Loads the following dynamic libraries:

Bugly
avcodec
avutil
cdd
ff_te
lib4a03a0c0
lib4a03a0c1
libavformat
libd3a4309b
libfdc61a8
libload

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DESede
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DESede
RSA-ECB-PKCS1Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial