Android.Backdoor.1503

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.613.origin
Android.DownLoader.714.origin
Android.Triada.258.origin
Android.Xiny.240.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.206.227.63:80
TCP(HTTP/1.1) i####.api.zhifa####.net:10001
TCP(HTTP/1.1) 1####.159.103.205:8090
TCP(HTTP/1.1) wn.qiazhiw####.cn.####.net:80
TCP(HTTP/1.1) i####.api.zhifa####.net:10002
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) i####.api.zhifa####.net:10003
TCP(HTTP/1.1) cnmon####.com:8080
TCP(HTTP/1.1) rs3.u####.net.####.com:80
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) 1####.55.93.104:9004
TCP(HTTP/1.1) www.ai####.com:80
TCP(HTTP/1.1) ji####.jieme####.com:8152
TCP(HTTP/1.1) b.yunj####.cn:5284
TCP(HTTP/1.1) ic.o####.net:80
TCP(HTTP/1.1) p1.i####.cc:80
TCP(HTTP/1.1) i####.api.zhifa####.net:10201
TCP(HTTP/1.1) 1####.129.132.111:8001
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.159.152.136:8090
TCP(HTTP/1.1) v####.api.eeric####.com:80
TCP(HTTP/1.1) www.ka####.com:8080
TCP(HTTP/1.1) ia.z####.net:80
TCP(HTTP/1.1) yuey####.ld####.com:80
TCP(TLS/1.0) res-jar####.oss-cn-####.aliy####.com:443

DNS requests:

10.86.31.####.arpa
131.86.31.####.arpa
14.86.31.####.arpa
142.86.31.####.arpa
190.86.31.####.arpa
a####.u####.com
b.yunj####.cn
cnmon####.com
dl.huih####.com
i####.api.zhifa####.net
i####.api.zhifa####.net
ia.in####.com
ia.xuan####.com
ia.z####.net
ic.huihui####.net
ic.o####.net
ic.yo####.com
int.d####.s####.####.cn
ji####.dl####.com
ji####.jieme####.com
p1.i####.cc
pv.s####.com
re####.api.zhifa####.net
res-jar####.oss-cn-####.aliy####.com
rs3.u####.net
sdk.api.zhifa####.net
v####.api.eeric####.com
wn.qiazhiw####.cn
www.ai####.com
www.ka####.com
yuey####.ld####.com

HTTP GET requests:

cnmon####.com:8080/console/client/app/check/data.do?pModel=####&netType=...
cnmon####.com:8080/console/client/spApi/init/data.do?productNo=####&pMod...
cnmon####.com:8080/console/upload/control/control.jar
cnmon####.com:8080/console/upload/sdk/208caa2f-2f31-4777-a79e-ac17251dd4...
gdv.a.s####.com/cityjson?ie=####
q####.a####.com/jieplginf/wchenhddats23
rs3.u####.net.####.com/iad/1099/SK1099/0001/1/V.1.17121901(NT)/815a8293d...
rs3.u####.net.####.com/iad/specialChannel/e4cdc0e8cfbbbcbc14185dbb534804...
wn.qiazhiw####.cn.####.net/update/up01036465_66

HTTP HEAD requests:

rs3.u####.net.####.com/iad/1099/SK1099/0001/1/V.1.17121901(NT)/815a8293d...
rs3.u####.net.####.com/iad/specialChannel/e4cdc0e8cfbbbcbc14185dbb534804...

HTTP POST requests:

a####.u####.com/app_logs
b.yunj####.cn:5284/android.frontserver/pcsvc
cnmon####.com:8080/console/client/spApi/reportError/data.do
i####.api.zhifa####.net:10001/v2/adconfig/get?app_id=####&t=####
i####.api.zhifa####.net:10001/v2/bag/monitor?app_id=####&t=####
i####.api.zhifa####.net:10001/v2/sdk/init?app_id=####&t=####
i####.api.zhifa####.net:10001/v2/update/check?app_id=####&t=####
i####.api.zhifa####.net:10002/v2/callback/message?app_id=####&t=####
i####.api.zhifa####.net:10002/v2/log/add?app_id=####&t=####
i####.api.zhifa####.net:10003/v2/chis
i####.api.zhifa####.net:10201/v2/sdk/report?app_id=####&t=####
ia.z####.net/ps/actionLog.do
ia.z####.net/ps/appShare.do
ia.z####.net/ps/getSpecialChannel.do
ia.z####.net/ps/platformStat.do
ia.z####.net/ps/platformStatConfirm.do
ia.z####.net/ps/updatesdk.do
ic.o####.net/domain/domainConfig.do
ji####.jieme####.com:8152/ryf_webserver/payment/checkupdate.html
p1.i####.cc/index.php/MC/HB
p1.i####.cc/index.php/MC/UPM
v####.api.eeric####.com/api/payment/mobileInit.html
www.ai####.com/doking/smsd!hiReect.action
www.ka####.com:8080/game/paycontrolv2
yuey####.ld####.com/channel/paymentHandle.action?requestId=####&v=####

Modified file system:

Creates the following files:

/data/data/####/.a5179ead466409ef55d6abadbbaae804
/data/data/####/.f714abdd50f081a174b3de53b3c9e3f2
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/347781996620052-journal
/data/data/####/6056a0e434260e3514af030d9cf24078.jar
/data/data/####/822d8db3dfa33a92ad5a99835776f3d6.jar
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Framework.db
/data/data/####/Framework.db-journal
/data/data/####/PlatformCore.db
/data/data/####/PlatformCore.db-journal
/data/data/####/a2o5o000c2k6f6u9h9C1A8B797v4B3.xml
/data/data/####/a5179ead466409ef55d6abadbbaae804.tmp
/data/data/####/action_stats.dat
/data/data/####/action_time.dat
/data/data/####/app_bid
/data/data/####/app_caller
/data/data/####/app_mid
/data/data/####/b.d
/data/data/####/buntutu_data_s.xml
/data/data/####/buntutu_duration
/data/data/####/c868f2190c3d2c142468a94de06b03e9.dat (deleted)
/data/data/####/c868f2190c3d2c142468a94de06b03e9.jar
/data/data/####/cached.pref.xml
/data/data/####/cb.d
/data/data/####/cbn.d
/data/data/####/cbn_d.d
/data/data/####/cbs.d
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/check_info
/data/data/####/com.game.CrazyZoo10.mtyfang217.xml
/data/data/####/com.game.CrazyZoo10.mtyfang217_preferences.xml
/data/data/####/config.xml
/data/data/####/config50274.xml
/data/data/####/d_h_d.d
/data/data/####/device_ip.dat
/data/data/####/download_info
/data/data/####/e4cdc0e8cfbbbcbc14185dbb5348042f.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f714abdd50f081a174b3de53b3c9e3f2.jar.tmp
/data/data/####/initRoot.xml
/data/data/####/installTime.xml
/data/data/####/jiepay_config.xml
/data/data/####/jiepayplugin.apk
/data/data/####/jiepayplugin.apkdata
/data/data/####/kb_st_database.db
/data/data/####/kb_st_database.db-journal
/data/data/####/libjiagu-1797687239.so
/data/data/####/load_info
/data/data/####/lt.d
/data/data/####/mm_nw_app.xml
/data/data/####/mutex.dat
/data/data/####/new_md.jar
/data/data/####/onib_clz.jar
/data/data/####/pcn.d
/data/data/####/pcs.d
/data/data/####/pgb.d
/data/data/####/pretw.xml
/data/data/####/pretw6000050ZYXD_P25895_1381.xml
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/sdk_task.dat
/data/data/####/sdk_version.dat
/data/data/####/service_info.dat
/data/data/####/shunpay_config
/data/data/####/twc.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/up01036465_66
/data/data/####/up01036465_66.jar
/data/data/####/update_script.dat
/data/data/####/uuid.dat
/data/data/####/webview.db-journal
/data/data/####/wx.d
/data/data/####/yy.dt
/data/data/####/zfb.d
/data/media/####/.nomedia
/data/media/####/1B3A2967E5FD862EFD957606C65C8122
/data/media/####/2887A00B589C85A5FF5607D7EB45E7C8
/data/media/####/30592A6B8B0C769E3F7FDE6E1A033DF5
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app_mutex.lock
/data/media/####/buntutu.jaru
/data/media/####/cash_2018-08-06_log.txt
/data/media/####/config.dat
/data/media/####/kb_sn.ini
/data/media/####/setting.dat
/data/media/####/spay_v10040.dex
/data/media/####/sysid.dat
/data/media/####/system.dat
/data/media/####/system_meta.config
/data/media/####/tkhzfd_3009_2301.zip
/data/media/####/tw

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /proc/cpuinfo
cat /sys/block/mmcblk0/device/cid
chmod 755 <Package Folder>/.jiagu/libjiagu-1797687239.so
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
ping -c 2 113.31.86.140
ping -c 2 113.31.86.143
ping -c 2 ia.in6way.com
ping -c 2 ia.xuanwu88.com
ping -c 2 ic.huihuitech.net
ping -c 2 ic.yoko66.com

Loads the following dynamic libraries:

0DA6C
2581F
libjiagu-1797687239
shunpay

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial