Android.Packed.41890

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.743.origin

Prompts to install third-party apps.

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sys.assis####.9####.cn:80
TCP(HTTP/1.1) large####.c####.l####.####.com:80
TCP(HTTP/1.1) biz.assis####.9####.cn:80
TCP(HTTP/1.1) hy.9####.cn:8080
TCP(HTTP/1.1) o####.e.189.cn:80
TCP(HTTP/1.1) co####.assis####.9####.cn:80
TCP(HTTP/1.1) cdn.app.fr####.top:80
TCP(HTTP/1.1) appb####.com:80
TCP(HTTP/1.1) 1####.241.0.188:8080
TCP(HTTP/1.1) a####.al####.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) 1####.60.159.228:80
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) sh.wagbr####.ali####.com:443
TCP(TLS/1.0) b####.be####.top:443
TCP(TLS/1.0) ap####.uc.cn:443
TCP 1####.205.35.73:443

DNS requests:

a####.al####.com
ap####.uc.cn
api.qd.ali####.com
appb####.com
b####.be####.top
biz.assis####.9####.cn
cdn.app.fr####.top
cdn.img.fly####.top
co####.assis####.9####.cn
hy.9####.cn
o####.e.189.cn
pns.al####.com
pss.al####.com
ssl.google-####.com
sys.assis####.9####.cn
usdp####.g####.u####.com

HTTP GET requests:

a####.al####.com/collina/sbb/get_config?bid=####
appb####.com/apps.xml
appb####.com/promimg/birthdayphotoframewishes.png
appb####.com/promimg/breakingnewsphotoframes125.png
appb####.com/promimg/callername125.png
appb####.com/promimg/changephotobackground.png
appb####.com/promimg/coffemug125new.png
appb####.com/promimg/customcollagemaker1125.png
appb####.com/promimg/dpstatus125.png
appb####.com/promimg/echomagicmirror1251.png
appb####.com/promimg/feather125.png
appb####.com/promimg/flashoncallnew.png
appb####.com/promimg/friendscollage125.png
appb####.com/promimg/ganeshchathurthiphotoframes125.png
appb####.com/promimg/gardenphotoframe125.png
appb####.com/promimg/happybirthdayphotoframes2.png
appb####.com/promimg/honeymoon125.png
appb####.com/promimg/horseicon125.png
appb####.com/promimg/lionpf125.png
appb####.com/promimg/locationtracker.png
appb####.com/promimg/lovelyring125.png
appb####.com/promimg/menweddingphotosuit125.png
appb####.com/promimg/neonlivewallpaper.png
appb####.com/promimg/nightphotoframes125.png
appb####.com/promimg/periodtracker_125.png
appb####.com/promimg/photogridmixer125.png
appb####.com/promimg/scary125.png
appb####.com/promimg/slowmotionvideomaker125.png
appb####.com/promimg/snowfallphotoframes125.png
appb####.com/promimg/squarephotomakermain125.png
appb####.com/promimg/statusdownloder125.png
appb####.com/promimg/usefultools.png
appb####.com/promimg/waterfallv125.png
appb####.com/promimg/womemtraditionaldresses.png
appb####.com/promimg/womensareeicon125.png
appb####.com/promimg/womenweddingphotosuit125.png
biz.assis####.9####.cn/tclient/splashupdate.html?platform=####&version=#...
cdn.app.fr####.top/upload/201811/21/app/20181121113354709.apk
cdn.app.fr####.top/upload/201812/12/app/20181212120136270.apk
large####.c####.l####.####.com/upload/201709/14/img/20170914164519090.png
large####.c####.l####.####.com/upload/201709/14/img/20170914164520204.png
large####.c####.l####.####.com/upload/201807/25/img/20180725141120849.png
large####.c####.l####.####.com/upload/201807/25/img/20180725141121686.png

HTTP POST requests:

biz.assis####.9####.cn/api/client.basic.generateNgdid
biz.assis####.9####.cn/api/layout.home.calHomeUserData
co####.assis####.9####.cn/api/config.basic.list
hy.9####.cn:8080/v1/d
hy.9####.cn:8080/v2/m?account_id=####
o####.e.189.cn/openapi/freeflow/auth.do
pss.al####.com/iku/log/acc
sys.assis####.9####.cn/api/client.basic.getSplashList
sys.assis####.9####.cn/api/client.upload.info

File system changes:

Creates the following files:

/data/data/####/05c5c21f-8ef6-4e10-9df6-bf8cd687b849.jar
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1141736549_frun
/data/data/####/8a11db1c-bc72-4a9d-9988-f249abd1817a
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/90ca2509-f0ef-4ef6-90ca-df803aa361e8.jar
/data/data/####/9game-logo.png
/data/data/####/ACCS_SDK.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/BaseSDK.xml
/data/data/####/C5D11769CD98E4951A74ED680A09CB6F.lock
/data/data/####/CE55D964DFD5F947AC2BBFC5CBE4C210.lock
/data/data/####/ContextData.xml
/data/data/####/EROC1REGANAMEMAG0EMAGENIN0NC.st
/data/data/####/EROC1REGANAMEMAG0EMAGENIN0NC.time
/data/data/####/EROC1REGANAMEMAG0EMAGENIN0NC.uptime
/data/data/####/ModuleManifest.json
/data/data/####/MtopConfigStore.xml
/data/data/####/REGANAMEMAG0EMAGENIN0NC.bati
/data/data/####/REGANAMEMAG0EMAGENIN0NC.end
/data/data/####/REGANAMEMAG0EMAGENIN0NC.hdr
/data/data/####/REGANAMEMAG0EMAGENIN0NC.meminfo
/data/data/####/REGANAMEMAG0EMAGENIN0NC.pid
/data/data/####/REGANAMEMAG0EMAGENIN0NC.ps
/data/data/####/REGANAMEMAG0EMAGENIN0NC.st
/data/data/####/REGANAMEMAG0EMAGENIN0NC.start
/data/data/####/REGANAMEMAG0EMAGENIN0NC.status
/data/data/####/REGANAMEMAG0EMAGENIN0NC.time
/data/data/####/REGANAMEMAG0EMAGENIN0NC.uptime
/data/data/####/Swipe.js
/data/data/####/_hyDnsServiceIp.txt
/data/data/####/accs.db-journal
/data/data/####/activate.js
/data/data/####/activation.tpl.html
/data/data/####/activationCtrl.js
/data/data/####/ads1346201513.jar
/data/data/####/albumDetail.tpl.html
/data/data/####/albumDetailCtrl.js
/data/data/####/albumList.tpl.html
/data/data/####/albumListCtrl.js
/data/data/####/ali_cleaner_pref_name.xml
/data/data/####/android_observer
/data/data/####/anima_down.png
/data/data/####/app.js
/data/data/####/armyGroup.tpl.html
/data/data/####/armyGroupCtrl.js
/data/data/####/arrow_sprites.png
/data/data/####/article-list.css
/data/data/####/articleDetail.css
/data/data/####/articleDetail.tpl.html
/data/data/####/articleDetailCtrl.js
/data/data/####/articleList.tpl.html
/data/data/####/articleListCtrl.js
/data/data/####/articleListType.tpl.html
/data/data/####/articleListTypeCtrl.js
/data/data/####/autoSuggestion.tpl.html
/data/data/####/autocomplete.js
/data/data/####/b36ce8d879e33bc88f717f74617ea05a
/data/data/####/b387697d-fd46-422f-a554-b060d264faa5
/data/data/####/bangdan.css
/data/data/####/bbs.css
/data/data/####/bg_daichong.png
/data/data/####/bg_detail.png
/data/data/####/bg_gh.png
/data/data/####/bg_ghbase.png
/data/data/####/bg_ghhome.png
/data/data/####/bg_nav.png
/data/data/####/bg_nav_tag.png
/data/data/####/bg_newgame.png
/data/data/####/bg_quan.png
/data/data/####/bg_quan_v2.png
/data/data/####/bg_search.png
/data/data/####/bg_solo_gift.png
/data/data/####/bg_sprites.png
/data/data/####/bg_tips.png
/data/data/####/blockGameList.tpl.html
/data/data/####/border-b.png
/data/data/####/border-l.png
/data/data/####/border-r.png
/data/data/####/border-t.png
/data/data/####/border-x.png
/data/data/####/brokeList.tpl.html
/data/data/####/brokeListCtrl.js
/data/data/####/btn_default.png
/data/data/####/btn_default_long.png
/data/data/####/btn_dis.png
/data/data/####/btn_dis_long.png
/data/data/####/btn_follow.png
/data/data/####/btn_follow_long.png
/data/data/####/btn_pop_long_em.png
/data/data/####/btn_primary.png
/data/data/####/btn_primary_dis.png
/data/data/####/btn_task.png
/data/data/####/cborder-x.png
/data/data/####/cdt.wa (deleted)
/data/data/####/checkIn.js
/data/data/####/checkList.tpl.html
/data/data/####/checkListCtrl.js
/data/data/####/checkMobile.js
/data/data/####/clean_white_list.db
/data/data/####/cn.ninegame.gamemanager-1.apk.classes1346201513.zip
/data/data/####/cn.ninegame.gamemanager;core_afu_preferences.xml
/data/data/####/cn.ninegame.gamemanager_afu_preferences.xml
/data/data/####/cn.ninegame.gamemanager_preferences.xml
/data/data/####/coinGift.tpl.html
/data/data/####/coinGiftCtrl.js
/data/data/####/com.pp.assistant.cockroach.xml
/data/data/####/crack.tpl.html
/data/data/####/crackCtrl.js
/data/data/####/cs.xml
/data/data/####/custom.js
/data/data/####/customNewsDetail.tpl.html
/data/data/####/customNewsDetailCtrl.js
/data/data/####/customNewsList.tpl.html
/data/data/####/customNewsListCtrl.js
/data/data/####/cxhh.db-journal
/data/data/####/daichong.css
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/day_sprites.png
/data/data/####/default-top.png
/data/data/####/default_group.png
/data/data/####/default_pic.png
/data/data/####/default_user.png
/data/data/####/delete-mask.png
/data/data/####/dialog.js
/data/data/####/dialog.tpl.html
/data/data/####/divide-default.png
/data/data/####/donate.js
/data/data/####/donate.tpl.html
/data/data/####/donateCtrl.js
/data/data/####/donateDesc.tpl.html
/data/data/####/donateDescCtrl.js
/data/data/####/dt.wa (deleted)
/data/data/####/evaluateList.tpl.html
/data/data/####/evaluateListCtrl.js
/data/data/####/excellentGameList.tpl.html
/data/data/####/expectList.tpl.html
/data/data/####/expectListCtrl.js
/data/data/####/find-no-data.png
/data/data/####/five_icon.png
/data/data/####/footer_line.png
/data/data/####/forum.tpl.html
/data/data/####/forumCtrl.js
/data/data/####/forumHot.tpl.html
/data/data/####/forumHotCtrl.js
/data/data/####/fund-nodata.png
/data/data/####/gaClientId
/data/data/####/gameArea.css
/data/data/####/gameChoose.tpl.html
/data/data/####/gameChooseCtrl.js
/data/data/####/gameComment.css
/data/data/####/gameComment.tpl.html
/data/data/####/gameCommentCtrl.js
/data/data/####/gameGift.tpl.html
/data/data/####/gameGiftCtrl.js
/data/data/####/gameGiftList.js
/data/data/####/gameGiftList.tpl.html
/data/data/####/gameGiftListCtrl.js
/data/data/####/gameGuide.tpl.html
/data/data/####/gameGuideCtrl.js
/data/data/####/gameList.js
/data/data/####/gameList.tpl.html
/data/data/####/gameRecommend.js
/data/data/####/gameRecommend.tpl.html
/data/data/####/gameRecommendCtrl.js
/data/data/####/gameReference.tpl.html
/data/data/####/gameReferenceCtrl.js
/data/data/####/gameSlide.tpl.html
/data/data/####/gameTopic.tpl.html
/data/data/####/gameTopicCtrl.js
/data/data/####/gameVerList.tpl.html
/data/data/####/gh-home-page.css
/data/data/####/gh.css
/data/data/####/ghGiftList.js
/data/data/####/ghGiftList.tpl.html
/data/data/####/gh_top.png
/data/data/####/ghbase-handbook.css
/data/data/####/ghbase_sprites.png
/data/data/####/gift.css
/data/data/####/giftDetail.tpl.html
/data/data/####/giftDetailCtrl.js
/data/data/####/giftFaHao.css
/data/data/####/giftIndex.tpl.html
/data/data/####/giftIndexCtrl.js
/data/data/####/giftList.js
/data/data/####/giftList.tpl.html
/data/data/####/giftListCtrl.js
/data/data/####/giftModal.tpl.html
/data/data/####/giftModalCtrl.js
/data/data/####/giftSearch.tpl.html
/data/data/####/giftSearchCtrl.js
/data/data/####/giftSearchResult.tpl.html
/data/data/####/giftSearchResultCtrl.js
/data/data/####/gift_del.png
/data/data/####/gift_search.png
/data/data/####/gift_sprites.png
/data/data/####/global.css
/data/data/####/gonglue.css
/data/data/####/google_analytics_v4.db-journal
/data/data/####/grabGift.tpl.html
/data/data/####/grabGiftCtrl.js
/data/data/####/gradient-black.png
/data/data/####/guild.js
/data/data/####/guildActivity.tpl.html
/data/data/####/guildActivityCtrl.js
/data/data/####/guildBaseHelp.tpl.html
/data/data/####/guildBaseHelpCtrl.js
/data/data/####/guildCoin.tpl.html
/data/data/####/guildCoinCtrl.js
/data/data/####/guildCreate.tpl.html
/data/data/####/guildCreateCtrl.js
/data/data/####/guildGift.tpl.html
/data/data/####/guildGiftCtrl.js
/data/data/####/guildGiftDialog.tpl.html
/data/data/####/guildGiftDialogCtrl.js
/data/data/####/guildGiftService.js
/data/data/####/guildGuide.tpl.html
/data/data/####/guildGuideCtrl.js
/data/data/####/guildIndex.tpl.html
/data/data/####/guildIndexCtrl.js
/data/data/####/guildInfo.tpl.html
/data/data/####/guildInfoCtrl.js
/data/data/####/guildLevel.tpl.html
/data/data/####/guildLevelCtrl.js
/data/data/####/guildMemberSlide.tpl.html
/data/data/####/guildSearch.tpl.html
/data/data/####/guildSearchCtrl.js
/data/data/####/hide-mask.png
/data/data/####/icon-arrow.png
/data/data/####/icon-refresh.png
/data/data/####/icon-seal.png
/data/data/####/icon-video.png
/data/data/####/icon_android.png
/data/data/####/icon_article.png
/data/data/####/icon_article_video.png
/data/data/####/icon_article_zan.png
/data/data/####/icon_btn.png
/data/data/####/icon_double.png
/data/data/####/icon_face.png
/data/data/####/icon_fans.png
/data/data/####/icon_freegift.png
/data/data/####/icon_game.png
/data/data/####/icon_ghhome.png
/data/data/####/icon_gonglue.png
/data/data/####/icon_ios.png
/data/data/####/icon_jihuoma.png
/data/data/####/icon_libo.png
/data/data/####/icon_member.png
/data/data/####/icon_mianshen.png
/data/data/####/icon_nav.png
/data/data/####/icon_nav_count.png
/data/data/####/icon_nav_jingxuan.png
/data/data/####/icon_net.png
/data/data/####/icon_news.png
/data/data/####/icon_packs.png
/data/data/####/icon_sprites.png
/data/data/####/icon_testing.png
/data/data/####/icon_time.png
/data/data/####/icon_video.png
/data/data/####/imageSlide.tpl.html
/data/data/####/index
/data/data/####/index.html
/data/data/####/index_v2.html
/data/data/####/iscroll.js
/data/data/####/latestGameListCtrl.js
/data/data/####/level.png
/data/data/####/libao.png
/data/data/####/libsgmainso-6.1.88.so.tmp
/data/data/####/libsgmiscso-6.1.19.so.tmp
/data/data/####/libsgsecuritybodyso-6.1.22.so.tmp
/data/data/####/list.css
/data/data/####/lock.lock
/data/data/####/main_process.xml
/data/data/####/md5.js
/data/data/####/mivmi.xml
/data/data/####/modal.tpl.html
/data/data/####/modalCtrl.js
/data/data/####/multidex.version.xml
/data/data/####/mustplay.tpl.html
/data/data/####/mustplayCtrl.js
/data/data/####/myGift.tpl.html
/data/data/####/myGiftCtrl.js
/data/data/####/nav_sprites.png
/data/data/####/nav_tips.png
/data/data/####/netGame.css
/data/data/####/newGame-new.css
/data/data/####/newGame.css
/data/data/####/newGameList.tpl.html
/data/data/####/newGameListCtrl.js
/data/data/####/newGift.tpl.html
/data/data/####/newGiftCtrl.js
/data/data/####/newgame.tpl.html
/data/data/####/newgameCtrl.js
/data/data/####/ng-sortable.js
/data/data/####/ngmAdSlide.js
/data/data/####/ngmAnimProgress.js
/data/data/####/ngmCommentService.js
/data/data/####/ngmGameService.js
/data/data/####/ngmGiftInterval.js
/data/data/####/ngmMarquee.js
/data/data/####/ngmScroller.js
/data/data/####/ngmSortable.js
/data/data/####/ngmTouch.js
/data/data/####/ninegame.db-journal
/data/data/####/ninegame_dao_state.xml
/data/data/####/ninegame_sds.db-journal
/data/data/####/no_sprites.png
/data/data/####/noticeList.tpl.html
/data/data/####/noticeListCtrl.js
/data/data/####/package.json
/data/data/####/pcdnconfigs.xml
/data/data/####/personSlide.tpl.html
/data/data/####/pkgcache_basic.db
/data/data/####/pop_bind_succ.jpg
/data/data/####/pop_error.png
/data/data/####/pop_gift_top.png
/data/data/####/pop_line.png
/data/data/####/pop_none.png
/data/data/####/pop_nothing.png
/data/data/####/pop_search.png
/data/data/####/pop_succ.png
/data/data/####/pop_vip_gift_top.png
/data/data/####/pop_wrong.png
/data/data/####/postForm.js
/data/data/####/postForm.tpl.html
/data/data/####/progressText.tpl.html
/data/data/####/promote_splash_0
/data/data/####/property
/data/data/####/public.css
/data/data/####/quan.png
/data/data/####/route.js
/data/data/####/search.css
/data/data/####/search_video.png
/data/data/####/sel-game.css
/data/data/####/select_tips.png
/data/data/####/signature
/data/data/####/simpleGiftList.tpl.html
/data/data/####/single.css
/data/data/####/singleGame.tpl.html
/data/data/####/singleGhGift.tpl.html
/data/data/####/singleGift.tpl.html
/data/data/####/sortable.js
/data/data/####/sp.lock
/data/data/####/spokes-bg.png
/data/data/####/sprites.png
/data/data/####/standaloneGift.tpl.html
/data/data/####/standaloneGiftCtrl.js
/data/data/####/star_bg.png
/data/data/####/stat.dat
/data/data/####/stat.js
/data/data/####/stat_id.dat
/data/data/####/thirdParty.css
/data/data/####/thirdParty.tpl.html
/data/data/####/thirdPartyCtrl.js
/data/data/####/title-t.png
/data/data/####/title-x.png
/data/data/####/topic.js
/data/data/####/unique
/data/data/####/updateAppModalCtrl.js
/data/data/####/url.js
/data/data/####/urlmapping.conf
/data/data/####/v.jar
/data/data/####/ver
/data/data/####/version
/data/data/####/vip_grade.png
/data/data/####/wa.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.nomedia
/data/media/####/130f633b07416
/data/media/####/3f0ea7e43b6b1
/data/media/####/55ed89037668e
/data/media/####/9a78a4c40f484
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a9682bde89751ea6db359b9738db772a.apk
/data/media/####/b2e597e42e9356dc753baa5c70a732c2.apk
/data/media/####/cl.tmp
/data/media/####/dd7893586a493dc3
/data/media/####/ds.tmp
/data/media/####/ngdid.conf
/data/media/####/version.info

Miscellaneous:

Executes the following shell scripts:

chmod 555 /data/data/cn.ninegame.gamemanager/android_observer
chmod 777 /storage/emulated/0/spxin/a9682bde89751ea6db359b9738db772a.apk
chmod 777 /storage/emulated/0/spxin/b2e597e42e9356dc753baa5c70a732c2.apk
ls -l /system/bin/su
ps
sh

Loads the following dynamic libraries:

pcdn_acc

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about accounts associated with the device (Google, Facebook, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial