Android.Packed.56543

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.1051.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) n####.um####.top:80
TCP(HTTP/1.1) api.news-he####.co:80
TCP(TLS/1.0) b.airmo####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) b####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.250.187.227:443
TCP(TLS/1.0) im####.tab####.com:443
TCP(TLS/1.0) n####.um####.top:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) bxx.pooboo####.com:443
TCP(TLS/1.0) 7.z####.top:443
TCP(TLS/1.0) api.news-he####.co:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) 1####.217.169.42:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.187.227:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

5.ah####.com
7.z####.top
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.mobitec####.xyz
api.news-he####.co
b####.com
b.airmo####.com
bxx.pooboo####.com
h####.b####.com
im####.tab####.com
n####.um####.top
p####.google####.com
pla####.google####.com
safebro####.google####.com

HTTP GET requests:

api.news-he####.co/v1.1/HR11020NTC/document/get?type=####&user_ip=####&u...
api.news-he####.co/v1.1/HR212942NT/document/get?type=####&user_ip=####&u...
api.news-he####.co/v1.1/HR271NTN3/document/get?type=####&user_ip=####&ua...
api.news-he####.co/v1.1/HR29120NT/document/get?type=####&user_ip=####&ua...
api.news-he####.co/v1.1/HR316NT/document/get?type=####&user_ip=####&ua=#...
api.news-he####.co/v1.1/HR9120NTN/document/get?type=####&user_ip=####&ua...
n####.um####.top/
n####.um####.top/favicon.ico
n####.um####.top/normal2/index.html
n####.um####.top/normal2/zepto.min.js
n####.um####.top/zepto.min.js

HTTP POST requests:

b####.com:443/s/x
h####.b####.com:443/app.gif

File system changes:

Creates the following files:

/data/data/####/.confd
/data/data/####/.confd-journal
/data/data/####/.mtj_timestamp
/data/data/####/011134986548f3458aa3e7e2a7fceb8d
/data/data/####/01e9376588a3cc6a_0
/data/data/####/028f7279090e6be8_0
/data/data/####/093e09a3c4a3fe06_0
/data/data/####/0b86d452a9f29ab5_0
/data/data/####/0d67b2e7f352234f_0
/data/data/####/104913fnp
/data/data/####/104913fnp.dex
/data/data/####/104913fnp.dex.flock (deleted)
/data/data/####/105e58016d3e9b18_0
/data/data/####/18fec4f160cab9a4_0
/data/data/####/199a094c369cf5f7_0
/data/data/####/2436612a51ad11ec82027cd30adffce0335d68ac-83c1-4...0f.dex
/data/data/####/2436612a51ad11ec82027cd30adffce0335d68ac-83c1-4...4f5c0f
/data/data/####/2436612a51ad11ec82027cd30adffce0335d68ac-83c1-4...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce05fdddcf9dbb5d26...0e3bc4
/data/data/####/2436612a51ad11ec82027cd30adffce05fdddcf9dbb5d26...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce07750666b-e383-4...0b8528
/data/data/####/2436612a51ad11ec82027cd30adffce07750666b-e383-4...28.dex
/data/data/####/2436612a51ad11ec82027cd30adffce07750666b-e383-4...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce07f330257fa0f7d0...849278
/data/data/####/2436612a51ad11ec82027cd30adffce07f330257fa0f7d0...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce0eb58409f-87f8-4...931cb8
/data/data/####/2436612a51ad11ec82027cd30adffce0eb58409f-87f8-4...b8.dex
/data/data/####/2436612a51ad11ec82027cd30adffce0eb58409f-87f8-4...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce0ee3780d83d4e414...851643
/data/data/####/2436612a51ad11ec82027cd30adffce0ee3780d83d4e414...leted)
/data/data/####/2436612a51ad11ec82027cd30adffce0f80aa90fbc9e8ee...119631
/data/data/####/2436612a51ad11ec82027cd30adffce0f80aa90fbc9e8ee...1cache
/data/data/####/2436612a51ad11ec82027cd30adffce0ff1f92c2-f3ed-4...aadeda
/data/data/####/2436612a51ad11ec82027cd30adffce0ff1f92c2-f3ed-4...da.dex
/data/data/####/2436612a51ad11ec82027cd30adffce0ff1f92c2-f3ed-4...leted)
/data/data/####/29241e082a2130ff_0
/data/data/####/2be9d18df18e7390_0
/data/data/####/31bb2f6720a78cdd_0
/data/data/####/36e873f1c88b44e1_0
/data/data/####/36e873f1c88b44e1_0 (deleted)
/data/data/####/39efb38ff3794b6e_0
/data/data/####/39efb38ff3794b6e_0 (deleted)
/data/data/####/3a937615685c280f_0
/data/data/####/3a937615685c280f_0 (deleted)
/data/data/####/3f3c0581f5a202422e9e37256291b355.xml
/data/data/####/43bcd98c4e9e4ccc_0
/data/data/####/4525bbcdfa18e0f8_0
/data/data/####/4673dfb83bb1edb6_0
/data/data/####/4959e7eabd8eff57_0
/data/data/####/49edfeb0d8659dba_0
/data/data/####/4b89557dc04028fd_0
/data/data/####/4bd30b5c0e13c57a_0
/data/data/####/4f04427b66ccf25b_0
/data/data/####/4f50a9d26629ac31_0
/data/data/####/53a6586a659c646c_0
/data/data/####/53a6586a659c646c_0 (deleted)
/data/data/####/557b0eeb0aeb37b1_0
/data/data/####/5b1fe178f18e67e6_0
/data/data/####/5b1fe178f18e67e6_1
/data/data/####/5eb70b7e917131f6_0
/data/data/####/629e03ad5a7a8d38_0
/data/data/####/629e03ad5a7a8d38_0 (deleted)
/data/data/####/62db9687217f1001_0
/data/data/####/66e3ae7ecc637fd1_0
/data/data/####/6ce56342ecf6b9a8_0
/data/data/####/712a101fffb44786_0
/data/data/####/712a101fffb44786_0 (deleted)
/data/data/####/74a93a2c8e4a5d28_0
/data/data/####/78b1183e9ddc67c9_0
/data/data/####/78b1183e9ddc67c9_0 (deleted)
/data/data/####/7d35b6b04008f96a_0
/data/data/####/7e8bc56210a7a45b_0
/data/data/####/7ea7e9840d56309b_0
/data/data/####/7fb964c09c12b7f6_0
/data/data/####/81d0caa17e3dd51d_0
/data/data/####/825a089e75feb5b1c3c07eb3c1a27691.xml
/data/data/####/8925fb778d54bdd0_0
/data/data/####/8925fb778d54bdd0_0 (deleted)
/data/data/####/9100f60a93f0c233_0
/data/data/####/92e904c2acac3d53_0
/data/data/####/94104b5b23ddd2f1_0
/data/data/####/988dafdc08c857cc_0
/data/data/####/99690aaa
/data/data/####/99690aaa.dex
/data/data/####/99690aaa.dex.flock (deleted)
/data/data/####/9c68555e454f50ab_0
/data/data/####/9e31ab134df45432_0
/data/data/####/9e31ab134df45432_0 (deleted)
/data/data/####/9f2f5f93e4fa7e81_0
/data/data/####/Cookies-journal
/data/data/####/WTI5dExtNXpZWE11WVhCdw==.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml (deleted)
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1645772194048
/data/data/####/__send_data_1645772195028
/data/data/####/__send_data_1645772195471
/data/data/####/a5c2763b6694db4e_0
/data/data/####/a9c7cf18c0c52afd_0
/data/data/####/ac942dbad91ade19_0
/data/data/####/af7f9143fb864ced_0
/data/data/####/b022b69b24edbc29_0
/data/data/####/b0de57fb5a445358_0
/data/data/####/b16329418569e4e8_0
/data/data/####/b20b387d3603e6a1_0
/data/data/####/b2e048d8ec1f6d4a_0
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/bb7895881eff0e0e_0
/data/data/####/bb7895881eff0e0e_1
/data/data/####/bcdb63a5a1712b2f_0
/data/data/####/bf494e79f1a9483c_0
/data/data/####/c4d5c82701e89496_0
/data/data/####/cf94bb57fb9db477_0
/data/data/####/com.android.fer2_preferences.xml
/data/data/####/d2a838467be460ab_0
/data/data/####/d69d2e54e5b584b6b69254cc35c04c07.xml
/data/data/####/daef35936b84c3c1_0
/data/data/####/dd149162f4ae21f1_0
/data/data/####/dl_obhjnb.apk
/data/data/####/e11fa8b8a3d12a99_0
/data/data/####/e39eea4f334a3dee_0
/data/data/####/e5c99158330e454b_0
/data/data/####/e5c99158330e454b_0 (deleted)
/data/data/####/e62bc9f8612eed0f_0
/data/data/####/ea0eeb8276f0571ec290eb23c3f787dd.xml
/data/data/####/ec49e80f03dd3f44_0
/data/data/####/ec95bf4053ac7686_0
/data/data/####/edaf00b783a9574b_0
/data/data/####/f009abb8eccabc2d_0
/data/data/####/f1e2f91c75cb6413_0
/data/data/####/f9b0c7707ad22db8_0
/data/data/####/fc782376c5e21a0947860b9f4521031c.xml
/data/data/####/fc8d9863cbba1da8_0
/data/data/####/fe4a275a6d2cee41_0
/data/data/####/hfu__local_last_session.json
/data/data/####/hfu__local_stat_cache.json
/data/data/####/index
/data/data/####/indicator_d
/data/data/####/indicator_d-c
/data/data/####/indicator_p
/data/data/####/indicator_p-c
/data/data/####/libcuid.so
/data/data/####/metrics_guid
/data/data/####/nsaj_a.xml
/data/data/####/nsas.xml
/data/data/####/nsas_c.xml
/data/data/####/proc_auxv
/data/data/####/syr5__local_last_session.json
/data/data/####/syr5__local_stat_cache.json
/data/data/####/temp-index
/data/data/####/the-real-index
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version

Loads the following dynamic libraries:

libmoon

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CFB-NoPadding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial