Android.Packed.56179

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MulDrop.1140

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) sdk.cm####.com.####.com:80
TCP(HTTP/1.1) s####.m####.cn.####.com:80
TCP(HTTP/1.1) g####.g####.net:8080
TCP(HTTP/1.1) v####.99w.net:80
TCP(HTTP/1.1) drm.cm####.com:80
TCP(HTTP/1.1) h0####.ultra####.cn.####.com:80
TCP(HTTP/1.1) sd####.cm####.com:80
TCP(HTTP/1.1) www.sy####.com:80
TCP(HTTP/1.1) h####.ultra####.cn:4022
TCP(HTTP/1.1) c.appj####.com:80
TCP(HTTP/1.1) cop.ultra####.cn:80
TCP(HTTP/1.1) 2####.111.8.140:8080
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.250.179.138:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 64.2####.163.138:443
TCP(TLS/1.2) 1####.251.1.113:443
TCP(TLS/1.2) 64.2####.163.94:443
TCP(TLS/1.2) 1####.250.179.138:443

DNS requests:

1####.i####.com
1####.i####.com.####.8
and####.google####.com
android####.go####.com
c.appj####.com
cf.gdata####.net
cf.gdata####.net.####.8
cop.ultra####.cn
drm.cm####.com
g####.g####.net
h####.ultra####.cn
h0####.ultra####.cn
instant####.google####.com
m####.go####.com
rd.d####.net
rd.d####.net.####.8
rd.gdata####.net
rd.gdata####.net.####.8
s####.m####.cn
sd####.cm####.com
sdk.cm####.com
v####.99w.net
wap.cm####.com
www.sy####.com

HTTP GET requests:

cop.ultra####.cn/getdata/?gameid=####&qudao=####&uid=####&ver=####&os=##...
drm.cm####.com/egsb/otherPay/querySMSLimitMoney
drm.cm####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
drm.cm####.com/egsb/verification/checkSDKModuleUpdate?sdkVersion=####&co...
h####.ultra####.cn:4022/cc_patch/game16/android_publish_v1/patch_info.json
h0####.ultra####.cn.####.com/cc_patch/fake_version.txt
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/10.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/11.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/12.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/13.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/14.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/15.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/16.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/17.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/18.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/19.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/20.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/21.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/22.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/23.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/24.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/25.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/26.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/27.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/28.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/29.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/30.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/31.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/32.zip
h0####.ultra####.cn.####.com/cc_patch/game16/android_publish_v1/0/33.zip
s####.m####.cn.####.com/MiguPay.SO30.Lib_082226_9BC201CE716D9B354C407FFB...
s####.m####.cn.####.com/MiguPay.Sdk30.Lib_12003084_3BFFC37E286588E18DF87...
sdk.cm####.com.####.com/download/sdkGame/logo_20180801140713231.jpg
sdk.cm####.com.####.com/download/sdkGame/logo_20180801140815111.jpg
sdk.cm####.com.####.com/download/shortcut/temprecgame/wangyunfangwx_1541...
sdk.cm####.com.####.com/download/shortcut/temprecgame/wangyunfangwx_1547...
v####.99w.net/sc/pojie/99wan_v3_pojie.apk

HTTP POST requests:

c.appj####.com/ad/splash/stats.html
drm.cm####.com/egsb/activityCfg/queryCfgAct
drm.cm####.com/egsb/game/getPaymentCapability
drm.cm####.com/egsb/gshare/switches
drm.cm####.com/egsb/otherPay/querySMSInterceptorConf
drm.cm####.com/egsb/recommendGame/gameListNew
drm.cm####.com/egsb/thirdPay/queryThirdPayInfo
drm.cm####.com/egsb/verification/getUpdateUrl
g####.g####.net:8080/migusdk/tl/tcttl
g####.g####.net:8080/migusdk/verification/checkSdkUpdate
sd####.cm####.com/behaviorLogging/eventLogging/accept?
www.sy####.com/Api.php/Home/Index/force

File system changes:

Creates the following files:

/data/data/####/.DS_Store
/data/data/####/.appInfo
/data/data/####/.hptc.cache_.gameapp.game16
/data/data/####/.jg.ic
/data/data/####/1382536.0669554481
/data/data/####/1382536.0669554481 (deleted)
/data/data/####/3465.dex
/data/data/####/3465.dex.flock (deleted)
/data/data/####/760000081097.png
/data/data/####/760000096337.png
/data/data/####/760000097262.png
/data/data/####/760000119591.png
/data/data/####/760000119595.png
/data/data/####/760000127787.png
/data/data/####/760000132563.png
/data/data/####/760000140317.png
/data/data/####/ActionEx.lua
/data/data/####/Cocos2dxPrefsFile.xml
/data/data/####/Cocos2dxPrefsFile.xml.bak
/data/data/####/DialogActionBase.lua
/data/data/####/DialogBase.lua
/data/data/####/ED.ini
/data/data/####/LabelEx.lua
/data/data/####/MiguPay.Sdk30.Lib_12003011_93c096f1ff1a225e83dd...02.cod
/data/data/####/MiguPay.Sdk30.Lib_12003011_93c096f1ff1a225e83dd...02.dat
/data/data/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffbc...02.cod
/data/data/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffbc...02.dat
/data/data/####/MiguPay.Sdk30.Res_00026014_3C3B3538E3D2C3DFD6BD...02.zip
/data/data/####/NodeLayouterBase.lua
/data/data/####/NodeLayouterHBox.lua
/data/data/####/NodeLayouterVBox.lua
/data/data/####/NodeLayouterVGrid.lua
/data/data/####/PoolManager.lua
/data/data/####/ReuseLayouterBase.lua
/data/data/####/ReuseLayouterHBox.lua
/data/data/####/ReuseLayouterHGrid.lua
/data/data/####/ReuseLayouterVBox.lua
/data/data/####/ReuseLayouterVGrid.lua
/data/data/####/ReuseList.lua
/data/data/####/StageScriptBase.lua
/data/data/####/StageScriptGuide1.lua
/data/data/####/Tools.lua
/data/data/####/UIWidget.lua
/data/data/####/UndirectedGraph.lua
/data/data/####/ViewBaseEx.lua
/data/data/####/_test_alu.lua
/data/data/####/_test_sdk.lua
/data/data/####/ad_event_db.json
/data/data/####/ad_reward_db.json
/data/data/####/ad_show_time.xml
/data/data/####/alu_db.json
/data/data/####/art_01.png
/data/data/####/art_02.png
/data/data/####/art_03.png
/data/data/####/art_04.png
/data/data/####/art_05.png
/data/data/####/art_flag_8zhe.png
/data/data/####/art_flag_discount.png
/data/data/####/art_flag_double.png
/data/data/####/btn_11.png
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cloth_share_reward_db.json
/data/data/####/cocos2dx-update-temp-package.zip
/data/data/####/cocos2dx-update-temp-package.zip.tmp
/data/data/####/consts.lua
/data/data/####/csb_gift_daily_lottery_dialog.csb
/data/data/####/csb_gift_pet_dialog.csb
/data/data/####/csb_gift_pet_upgrade_to_max_dialog.csb
/data/data/####/csb_gift_single_dialog.csb
/data/data/####/csb_gift_suit_item.csb
/data/data/####/csb_gift_suit_single_dialog.csb
/data/data/####/csb_gift_three_in_one_item.csb
/data/data/####/csb_gift_vip_dialog.csb
/data/data/####/csb_gift_wo_vip_about_dialog.csb
/data/data/####/csb_gift_wo_vip_dialog.csb
/data/data/####/csb_hud_scene.csb
/data/data/####/csb_mall_dialog.csb
/data/data/####/csb_mall_item_wo_vip.csb
/data/data/####/csb_pet_upgrade_dialog.csb
/data/data/####/csb_preview_ad_vip.csb
/data/data/####/csb_preview_ad_wo_vip.csb
/data/data/####/csb_preview_dialog.csb
/data/data/####/csb_share_dialog.csb
/data/data/####/csb_splash_scene.csb
/data/data/####/dataeye_database_8D6C66A70ECC7C5BFB08C5F4DA1BE3...ournal
/data/data/####/dataeye_database_8D6C66A70ECC7C5BFB08C5F4DA1BE36C.db
/data/data/####/dc.8D6C66A70ECC7C5BFB08C5F4DA1BE36C.preferences.xml
/data/data/####/functions.lua
/data/data/####/game_arrow_big.png
/data/data/####/game_arrow_little.png
/data/data/####/game_arrow_text.png
/data/data/####/game_businesscard.png
/data/data/####/game_check_success.png
/data/data/####/game_checkbox_mark.png
/data/data/####/game_contacts.png
/data/data/####/game_failure.png
/data/data/####/game_grey_logo.png
/data/data/####/game_loading.png
/data/data/####/game_logo.png
/data/data/####/game_network.png
/data/data/####/game_people.png
/data/data/####/game_piccode_refresh_touched.png
/data/data/####/game_save.png
/data/data/####/game_show_pwd.png
/data/data/####/game_start_logo.png
/data/data/####/game_success.png
/data/data/####/gitHash
/data/data/####/gray.png
/data/data/####/guide_db.json
/data/data/####/icon_about.png
/data/data/####/icon_annoucement_close.png
/data/data/####/icon_back.png
/data/data/####/icon_bind_email.png
/data/data/####/icon_bind_tel.png
/data/data/####/icon_businesscard.png
/data/data/####/icon_center_about.png
/data/data/####/icon_center_arrow.png
/data/data/####/icon_center_look.png
/data/data/####/icon_center_save.png
/data/data/####/icon_check_failure.png
/data/data/####/icon_checkbox.png
/data/data/####/icon_close.png
/data/data/####/icon_common_problem.png
/data/data/####/icon_compact_close.png
/data/data/####/icon_discount_icon.png
/data/data/####/icon_edit_del.png
/data/data/####/icon_email_icon.png
/data/data/####/icon_extend.png
/data/data/####/icon_firends_circle.png
/data/data/####/icon_full_arrow_down.png
/data/data/####/icon_full_arrow_up.png
/data/data/####/icon_grey_contacts.png
/data/data/####/icon_head.png
/data/data/####/icon_hide_pwd.png
/data/data/####/icon_magnet_draghide.png
/data/data/####/icon_magnet_gameshare.png
/data/data/####/icon_magnet_help.png
/data/data/####/icon_magnet_onlineservice.png
/data/data/####/icon_magnet_startlogin.png
/data/data/####/icon_magnet_welfare.png
/data/data/####/icon_notification.png
/data/data/####/icon_online_service.png
/data/data/####/icon_people.png
/data/data/####/icon_personal_bg.png
/data/data/####/icon_personal_bg_l.png
/data/data/####/icon_piccode.png
/data/data/####/icon_piccode_refresh.png
/data/data/####/icon_qq.png
/data/data/####/icon_recommend_flow_one.png
/data/data/####/icon_recommend_flow_third.png
/data/data/####/icon_recommend_flow_two.png
/data/data/####/icon_recommend_hall.png
/data/data/####/icon_rightextend.png
/data/data/####/icon_security_setting.png
/data/data/####/icon_service_tel.png
/data/data/####/icon_share_game.png
/data/data/####/icon_shrink.png
/data/data/####/icon_sina.png
/data/data/####/icon_sms.png
/data/data/####/icon_tel.png
/data/data/####/icon_transaction_detail.png
/data/data/####/icon_upgrade_pass.png
/data/data/####/icon_vip_01.png
/data/data/####/icon_vip_02.png
/data/data/####/icon_vip_03.png
/data/data/####/icon_wechat.png
/data/data/####/icon_window.png
/data/data/####/icon_wo_vip.png
/data/data/####/init.lua
/data/data/####/isAnd.txt
/data/data/####/item_template_db.json
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/libmgRun_04.22.07_01.so
/data/data/####/libmgRun_08.22.26_01.so
/data/data/####/libmiguED.so
/data/data/####/mgAS.dat
/data/data/####/mgSS.dat
/data/data/####/mgid.dat
/data/data/####/mgrAd.lua
/data/data/####/mgrAlu.lua
/data/data/####/mgrCfg.lua
/data/data/####/mgrDebug.lua
/data/data/####/mgrGuide.lua
/data/data/####/mgrPlayer.lua
/data/data/####/mgrSdk.lua
/data/data/####/mgrShare.lua
/data/data/####/mgrShop.lua
/data/data/####/mgrSound.lua
/data/data/####/mgrStage.lua
/data/data/####/mgrWoVip.lua
/data/data/####/migu_slider_target.png
/data/data/####/migu_slider_thumb_nor.png
/data/data/####/migu_slider_thumb_prs.png
/data/data/####/migu_slider_thumb_suc.png
/data/data/####/movie_db.json
/data/data/####/pay_icon_0.png
/data/data/####/pay_icon_1.png
/data/data/####/pay_icon_2.png
/data/data/####/pay_icon_3.png
/data/data/####/pay_icon_4.png
/data/data/####/pay_icon_5.png
/data/data/####/pay_icon_payment.png
/data/data/####/pay_icon_phonenumber.png
/data/data/####/pay_icon_telpoint.png
/data/data/####/plus_businesscard.png
/data/data/####/plus_check_success.png
/data/data/####/plus_checkbox_mark.png
/data/data/####/plus_contacts.png
/data/data/####/plus_failure.png
/data/data/####/plus_grey_logo.png
/data/data/####/plus_loading.png
/data/data/####/plus_logo.png
/data/data/####/plus_network.png
/data/data/####/plus_people.png
/data/data/####/plus_piccode_refesh_touched.png
/data/data/####/plus_save.png
/data/data/####/plus_show_pwd.png
/data/data/####/plus_start_logo.png
/data/data/####/plus_success.png
/data/data/####/proc_auxv
/data/data/####/sAvatar.lua
/data/data/####/sdk_prefs
/data/data/####/shoe_part_db.json
/data/data/####/shoe_part_type_db.json
/data/data/####/shop_router_db.json
/data/data/####/shop_template_db.json
/data/data/####/shortcut_desktop_icon.png
/data/data/####/stage_db.json
/data/data/####/tab_other_pay.png
/data/data/####/tab_other_pay.png_text.png
/data/data/####/text_db.json
/data/data/####/ui_suyan.json
/data/data/####/vDebugInfoDialog.lua
/data/data/####/vDevTestScene.lua
/data/data/####/vGiftDailyLotteryDialog.lua
/data/data/####/vGiftPetDialog.lua
/data/data/####/vGiftPetUpgradeToMaxDialog.lua
/data/data/####/vGiftSingleDialog.lua
/data/data/####/vGiftSuitDialog.lua
/data/data/####/vGiftSuitItem.lua
/data/data/####/vGiftSuitSingleDialog.lua
/data/data/####/vGiftThreeInOneDialog.lua
/data/data/####/vGiftThreeInOneItem.lua
/data/data/####/vGiftVipDialog.lua
/data/data/####/vGiftWoVipAboutDialog.lua
/data/data/####/vGiftWoVipDialog.lua
/data/data/####/vGotChestDialog.lua
/data/data/####/vGuideTip.lua
/data/data/####/vGuideView.lua
/data/data/####/vHudScene.lua
/data/data/####/vMallDialog.lua
/data/data/####/vMallItemOtherPay.lua
/data/data/####/vMallItemWoVip.lua
/data/data/####/vMovieDialog.lua
/data/data/####/vPetScene.lua
/data/data/####/vPetUpgradeDialog.lua
/data/data/####/vPreviewAdVip.lua
/data/data/####/vPreviewAdWoVip.lua
/data/data/####/vPreviewDialog.lua
/data/data/####/vResultScene.lua
/data/data/####/vRoomScene.lua
/data/data/####/vShareDialog.lua
/data/data/####/vShoeObject.lua
/data/data/####/vSignDialog.lua
/data/data/####/vqs_shared_data.xml
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cache.db-journal (deleted)
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/data/####/xUtils_http_cookie.db-journal (deleted)
/data/data/####/xxl_about.png
/data/data/####/xxl_arraw_left.png
/data/data/####/xxl_billing_failure.png
/data/data/####/xxl_billing_success.png
/data/data/####/xxl_close.png
/data/data/####/xxl_logo.png
/data/data/####/xxl_pic_refresh.png
/data/data/####/xxl_right_arraw.png
/data/data/####/xxl_sale.png
/data/media/####/1F20D24443A76B2CB4176497439CD8A2
/data/media/####/647916065586userInfo.txt
/data/media/####/MiguPay.SO30.Lib_082226_9BC201CE716D9B354C407F...02.zip
/data/media/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffb...02.cod
/data/media/####/MiguPay.Sdk30.Lib_12003084_16bd67d3fcbf0e19ffb...02.dat
/data/media/####/MiguPay.Sdk30.Lib_12003084_3BFFC37E286588E18DF...02.zip
/data/media/####/MiguPay.Sdk30.Res_00026014_3C3B3538E3D2C3DFD6B...02.zip
/data/media/####/ShareData.txt
/data/media/####/app_info.txt
/data/media/####/deviceId.txt
/data/media/####/jjwgame.apk
/data/media/####/jjwgame.apk.tmp
/data/media/####/libmgRun_08.22.26_01.so
/data/media/####/migu.sdk.cn.ultralisk.gameapp.game16.migulog.txt
/data/media/####/oid
/data/media/####/sdk_prefs.txt
/data/media/####/uid
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
ls -l /sbin/su
ls -l /system/bin/su
ls -l /system/sbin/su
ls -l /system/xbin/su
ls -l /vendor/bin/su

Loads the following dynamic libraries:

mg20pbase

Uses the following algorithms to encrypt data:

DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial