Android.Packed.43423

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.859.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) aliyun-####.al####.com:80
TCP(HTTP/1.1) do.sta.cn####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) src.r####.com.####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) if.a####.com.cn:8000
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) g.fas####.net:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) co####.in####.com:443
TCP(TLS/1.0) yt####.s####.com:443
TCP(TLS/1.0) tt####.wa####.cn:443
TCP(TLS/1.0) dat####.te####.cn:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) 1####.217.168.206:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP ope####.m.ta####.com:443
TCP openj####.m.ta####.com:443
UDP 2####.0.0.1:9998

DNS requests:

a####.m.ta####.com
a####.u####.com
accscdn####.m.ta####.com
acs4pu####.m.ta####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
ag####.m.ta####.com
an####.l####.com
beacon####.aliy####.com
cgi.con####.qq.com
co####.in####.com
dat####.te####.cn
do.sta.cn####.com
g.fas####.net
if.a####.com.cn
l####.tbs.qq.com
mpush####.al####.com
pv.s####.com
sdk.c####.com
src.r####.com
tt####.wa####.cn
yt####.s####.com

HTTP GET requests:

cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
g.fas####.net/ga?slotid=####&jdata=####
gdv.a.s####.com/cityjson?ie=####
src.r####.com.####.com/kubo/dex/hh_8.2_120.dex

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&deviceId=####&pla...
a####.u####.com/app_logs
aliyun-####.al####.com/config
beacon####.aliy####.com/beacon/fetch/config/byappkey
do.sta.cn####.com/do.js
if.a####.com.cn:8000/paste/fill
l####.tbs.qq.com/ajax?c=####&k=####
sdk.c####.com/versiontapi.php?v=####&type=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/03b5505ec485a62c480f4a4f695de0610353dc74a490a2b....0.tmp
/data/data/####/0883e5e0adf2c651f17c5a1128d171532be5f244169d93a....0.tmp
/data/data/####/195459c8-1f59-43a8-abb8-ff3d9571a477
/data/data/####/1b925a4ec7876d7d1fe1c7b28057acaebf7a775d48ba0ee....0.tmp
/data/data/####/2fb38382d1810f3428a64c9ff18e370d9023e8e82bfa2bd....0.tmp
/data/data/####/31dbd53470874a588555b8322773776a2da1c6e53c2ec09....0.tmp
/data/data/####/3b588f997556fa575ab993d2e396496746d820672b3cd27....0.tmp
/data/data/####/3c4a279c0190998f014abd1cbf30c5d37f3f04357c87f7e....0.tmp
/data/data/####/3c7547ae773d101f56ca9bd86dd671443303f147acf1542....0.tmp
/data/data/####/653b8e3c07a01677eb94a688b52c8c1ca910d43e2e77785....0.tmp
/data/data/####/6975f0b39312c40152de6ed5ff81f7ae9d4991c51ef2af6....0.tmp
/data/data/####/6ea23244edffac336da5268877dbdf05bc3b3a5d7383d79....0.tmp
/data/data/####/88f66466f2a630b1779f3868a592dda1d39a7ab03c0efa8....0.tmp
/data/data/####/ACCS_BIND24720081.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/DailyNews.xml
/data/data/####/DownloadTaskStore.db-journal
/data/data/####/JPushSA_Config.xml
/data/data/####/LKME_Server_Request_Queue.xml
/data/data/####/MultiDex.lock
/data/data/####/OFFERSCONFIG1.xml
/data/data/####/OxgHkj2lz09F-journal
/data/data/####/UTCommon.xml
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/ap.Lock
/data/data/####/ax_c.xml
/data/data/####/bd452ce984e8da5411e8534d1c504b8af81cf5f9525d722....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.im.keyValueStore.aes_key_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml
/data/data/####/com.im.keyValueStore.sdk_version_store.xml
/data/data/####/com.im_7.1.0.db
/data/data/####/com.im_7.1.0.db-journal
/data/data/####/com.tencent.open.config.json.1105964143
/data/data/####/com.yunju.dailynews_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core_info
/data/data/####/d13c49447272a6d591c5fc0c75f82bebe35705b1ae8e99f....0.tmp
/data/data/####/e086c2ae54a7bf5880cffc43b9d5e00bd1f7df7a922dd02....0.tmp
/data/data/####/e55475488ca85a94c7c6e4d88339e40e
/data/data/####/e55475488ca85a94c7c6e4d88339e40e-journal
/data/data/####/eudemon
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f2457334-c053-4699-ba39-742632ffcda9
/data/data/####/hh_8.4.dex
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libjiagu1502583314.so
/data/data/####/linkedme_link_active_sp.xml
/data/data/####/loc_plugin.dex
/data/data/####/loc_plugin.ini
/data/data/####/mc120.dex
/data/data/####/mc_cache.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/testin.bug.allocation.xml
/data/data/####/testin.data.allocation.0e21432b0dada125891821d3...eb.xml
/data/data/####/testin.data.identify.xml
/data/data/####/testinbug-journal
/data/data/####/testindata-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/visualeditor.changes.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/ymdex.jar
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/08c3357f0b0a4c048c229713748f4e2c
/data/media/####/0f693ad6b0624232816b701d6a885444
/data/media/####/4DyOQTU2bbOx00gaPOkL6g
/data/media/####/6fcf77287d69416da8244ab41017f979
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a7d6c34056bf44acb0d6b7ef437c0fc7

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"24720081","utdid":"XIyKU1RfmYIDAGdzx1EwavV/","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
getprop ro.product.cpu.abi
sh

Loads the following dynamic libraries:

jcore123
libjiagu1502583314
native-lib
tnet-3.1
ut_c_api

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
PBEWITHMD5andDES
RSA-ECB-NoPadding
RSA-ECB-nopadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
PBEWITHMD5andDES

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial