Android.Packed.44907

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.363.origin
Android.DownLoader.3887

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.75.116.197:8881
TCP(HTTP/1.1) 39.1####.91.255:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) nb.i36####.com:9000
TCP(HTTP/1.1) dn.bule####.com:80
TCP(HTTP/1.1) tes####.youxi####.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) a.xinxian####.com:80
TCP(HTTP/1.1) f####.caiji####.com:80
TCP(HTTP/1.1) bj####.j####.cn:80
TCP(HTTP/1.1) m.expv####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) np.bul####.cn:6087
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) 2####.98.33.230:8888
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) 1####.26.106.206:8088
TCP(HTTP/1.1) mp.a####.com.cn:88
TCP(HTTP/1.1) api.lubang####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) p4####.b0.a####.com:80
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) cdn.i.arie####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) res####.b####.com:80
TCP(HTTP/1.1) ip.zhito####.com:807
TCP(HTTP/1.1) adv.99y####.com:80
TCP(HTTP/1.1) p.69####.com.####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) cs.and####.com:80
TCP(HTTP/1.1) ny.bul####.cn:666
TCP(HTTP/1.1) st####.guantou####.com:80
TCP(HTTP/1.1) s####.caiji####.com:666
TCP(HTTP/1.1) a.ibit####.com:80
TCP(HTTP/1.1) imgc####.qq.com.####.com:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) p####.caiji####.com:80
TCP(HTTP/1.1) img.cashs####.cn:80
TCP(HTTP/1.1) a####.caiji####.com:80
TCP(TLS/1.0) ex####.sn####.com:443
TCP(TLS/1.0) shenxin####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) gd-s####.j####.cn:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) t####.j####.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) ss####.youxi####.com:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) n.3####.com:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) is.sn####.com:443
UDP s.j####.cn:19000
TCP 1####.230.236.46:7010

DNS requests:

612.a####.top
a####.b####.qq.com
a####.caiji####.com
a.ibit####.com
a.xinxian####.com
adv.99y####.com
aexcep####.b####.qq.com
ali-s####.j####.cn
aliyuno####.oss-cn-####.aliy####.com
and####.b####.qq.com
api.g####.vip
api.lubang####.com
api.yunco####.com
bj####.j####.cn
c####.mm####.com
c.c####.com
cdn.i.arie####.com
cdn.pal####.net
cs.and####.com
d####.wos####.com
dn.bule####.com
ex####.sn####.com
f####.caiji####.com
gd-s####.j####.cn
hm.b####.com
i.sn####.com
img.cashs####.cn
imgc####.qq.com
ip.zhito####.com
is.sn####.com
k####.kyli####.com
lhyysdk####.oss-cn-####.aliy####.com
m.expv####.com
mi.g####.qq.com
mp.a####.com.cn
n.3####.com
nb.i36####.com
np.bul####.cn
ny.bul####.cn
p####.caiji####.com
p####.ugd####.com
p.69####.com
plb####.u####.com
pv.s####.com
r####.n####.127.net
r.ibit####.com
res####.b####.com
s####.caiji####.com
s####.e.qq.com
s.j####.cn
s23.c####.com
s5.c####.com
s96.c####.com
sf1-ttc####.ps####.com
shenxin####.com
ss####.youxi####.com
st####.guantou####.com
t####.j####.cn
tes####.youxi####.com
u####.u####.com
w####.pcon####.com.cn
z####.heyc####.net
z2.c####.com
z9.c####.com

HTTP GET requests:

a.ibit####.com/c/strawberry_sdk
a.ibit####.com/update_ch/fruit/core.jar
a.ibit####.com/update_ch/fruit/coreconfig.jar
bj####.j####.cn/v1/appawake/status?uid=####&appkey=####&model=####&manuf...
cdn.i.arie####.com/c/_ii_?_=####
cdn.i.arie####.com/e/i.html
cdn.i.arie####.com/e/i.js
dn.bule####.com/dnfile/cmm/SWrapComm0515_YAP.jar
dn.bule####.com/dnfile/wmp/WG20190228182857_7N1027.jar
img.cashs####.cn/hip-h5/css/common.min.css?v=####
img.cashs####.cn/hip-h5/js/refferrer.js
img.cashs####.cn/hip-h5/t17/css/index.css
img.cashs####.cn/hip-h5/t17/css/page_details.css
img.cashs####.cn/hip-h5/t17/js/bundle.js?v=####
imgc####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/progu...
ip.zhito####.com:807/1102.html
ip.zhito####.com:807/fei.html
k####.kyli####.com.####.com/1557820324778_utils.ttf
m.expv####.com/bd/clkm?ext=MgkxNDEJMTk3CeaOqOiNkAkJCQkJCQkJCQkJCQkJCVJqW...
m.expv####.com/bd/news/a?submedia=####&conn=####&category=####&sid=####&...
mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
nb.i36####.com:9000/jsonServer/LanMei003
nb.i36####.com:9000/jsonServer/LanMei01
p.69####.com.####.com/data/sdkm/ch_yuxiusen_2015_20_20190424161739374_v4...
p.69####.com.####.com/data/sdkm/ch_yuxiusen_2015_20_papp_sdk_20190506092...
p4####.b0.a####.com/nv/49F3BBC80AB15148282189A063770E6C.jpg
res####.b####.com/LHYY.png
res####.b####.com/sdk17.png
res####.b####.com/sdk1_1.png
res####.b####.com/sdk5_2.png
res####.b####.com/sdk6_11.png
s####.tc.qq.com/gdt/0/DAAl6z-AMgASwABjBcuBC8B_Acw8ZP.jpg/0?ck=####
sf1-ttc####.ps####.com/icovr-20190515-1d01c0f525ea08ac1a8143c50b2ad9f6.jpg
sf1-ttc####.ps####.com/icovr-20190515-414d0391760894229a5c737e0448f8ba.jpg
sf1-ttc####.ps####.com/icovr-20190515-5147fef72d0eb6ba616649db5ccf7110.jpg
sf1-ttc####.ps####.com/icovr-20190515-63adc12671756adf0845649c415b0f4a.jpg
sf1-ttc####.ps####.com/icovr-20190515-9694e1b5f183ee809ee3bab3808d83be.jpg
sf1-ttc####.ps####.com/icovr-20190515-b5746e07512c576ed47536b2306ea880.jpg
sf1-ttc####.ps####.com/icovr-20190515-d2e09eef066533068ac06a2e41ca58e1.jpg
sf1-ttc####.ps####.com/img/ad.union.api/25560e9689a13601d6013c685964b0af...
sf1-ttc####.ps####.com/irec-20190515-6b9f5672b56bd2f0e3d6d71322370839.jpg
sf1-ttc####.ps####.com/irec-20190515-91b5f88afb6233efe49c8d1093b26192.jpg
sf1-ttc####.ps####.com/irec-20190515-b5cbede6b4d5ef8363803def03d77f65.jpg
st####.guantou####.com/stat13.html

HTTP POST requests:

a####.caiji####.com/v2/load/mobile
a.xinxian####.com/encrypt/json/taokl
adv.99y####.com/adv/pluginReq
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
api.lubang####.com/domain.php
api.yunco####.com/service/rest
cs.and####.com/ydt580/sv2
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
f####.caiji####.com/v3/task/mobile
gd.a.s####.com/cityjson
mp.a####.com.cn:88/get/task
nb.i36####.com:9000/api/getAdInfoByDevice.do
nb.i36####.com:9000/api/getAdInfoById.do
nb.i36####.com:9000/api/jadReport.do
nb.i36####.com:9000/api/vsp/getVspCore.do
np.bul####.cn:6087/Sdk/reportTask
np.bul####.cn:6087/Sdk/task
ny.bul####.cn:666/slsdk/cmm_settings.aspx
ny.bul####.cn:666/slsdk/getdata.aspx
p####.caiji####.com/klv2/sdkkl/mobile
s####.caiji####.com:666/v1/config
s####.e.qq.com/activate
s####.e.qq.com/msg
tes####.youxi####.com/sdkinfo/statistics?channelId=####&version=####&sdk...
w####.pcon####.com.cn/ip.jsp
z####.heyc####.net/getlist

File system changes:

Creates the following files:

/data/data/####/-1802889889_app_spf_scli.xml
/data/data/####/-1802889889_pl_sp.xml
/data/data/####/-1802889889_rss_pl_cty.xml
/data/data/####/-1802889889_rws_sp.xml
/data/data/####/-1802889889_sp_iconfig.xml
/data/data/####/-1802889889_sp_iconfig.xml.bak
/data/data/####/.__mob_ad_data.xml
/data/data/####/.imprint
/data/data/####/0680a28d9240c050d7deca581bcdcb4a18ba0d219377a32....0.tmp
/data/data/####/09b42b24-39ef-4918-add1-e4d213486f28
/data/data/####/2328.yaqcookie
/data/data/####/36d885d1-dd1d-4108-9e1a-ae9c4edd096a
/data/data/####/3cd45d78eaf39400622241dc6e776a87a829c1c213dfbb0....0.tmp
/data/data/####/4f4d98207b8efc7ac84584e05fccffed.temp
/data/data/####/64dfbb59d325a4518c2a9cb3e201568feb98eccd69d2447....0.tmp
/data/data/####/73a3a6fa-fdf6-406d-bc61-41f4622a906a
/data/data/####/74862e2cca124c2c7ed3510d0c058de13d4db750ca8d15a....0.tmp
/data/data/####/7da19a7b92b69f2338a9012cf9df8ba9483e36a31f64207....0.tmp
/data/data/####/827df534edb5a51d39b29f13f4a750bec05a24da1952ffd....0.tmp
/data/data/####/837437468-187665094
/data/data/####/961e06629709ed88adf18101763120b204b64406554b7be....0.tmp
/data/data/####/99f30850-4a28-4952-832e-ee0c1241ce8f
/data/data/####/9b4c13fbc45fed6d31f81847f79d69b23e271010f2663ed....0.tmp
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/BuglySdkInfos.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/JPushSA_Config.xml
/data/data/####/MultiDex.lock
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a==8.0.2&&2.30_1557923120070_envelope.log
/data/data/####/a==8.0.2&&2.30_1557923149710_envelope.log
/data/data/####/ad3f6d2c-1186-434f-8038-3f9a6a2b981b
/data/data/####/ae1d8ac2-823c-4aef-8e9d-ca51680a0fc4
/data/data/####/all_today_clean.xml
/data/data/####/all_total_clean.xml
/data/data/####/appPackageNames_v2
/data/data/####/app_crash_copy.xml
/data/data/####/ba51d8936b4a6dc11916a3d3f7aacdde3b890f584906224....0.tmp
/data/data/####/ba51d8936b4a6dc11916a3d3f7aacdde3b890f584906224...d0a5.0
/data/data/####/bugly_db_legu-journal
/data/data/####/c06217e0330f919d51d1dec6f1f1dbf0e2231d40ef64585....0.tmp
/data/data/####/cache_-1802889889_onsp.xml
/data/data/####/cc4ff570-3ae7-42da-ace1-24a5ef522aef
/data/data/####/clean_data.xml
/data/data/####/clean_onekeyclean_preference.xml
/data/data/####/clean_wechat_preference.xml
/data/data/####/cm_cfgt_spf.xml
/data/data/####/cmcc.xml
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml (deleted)
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.ymnet.cleanmanager_preferences.xml
/data/data/####/config.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU3OTIzMDk1NjY0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU3OTIzMTE4NTI3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU3OTIzMTMzNzYz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU3OTIzMTQ4MzA1;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.xml
/data/data/####/defaultpref1.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/dexMethod.91475202.dat
/data/data/####/download.db-journal
/data/data/####/downloader.db-journal
/data/data/####/dpi
/data/data/####/ebe99373fe0f4c284d2f09bdab19f641
/data/data/####/ed042f5017bf02ac5a0731a3343c23ff7f99ce18a26791f....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f57bb34440185dfb547fbf2ff06d1267d37deeea34e7e58....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/fa4eb133b50393ff4e955be347ac4431e4995d6c0f738e1....0.tmp
/data/data/####/fa5962666d57416c587ccdab70cb656643a2e71f1bec2e8....0.tmp
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/i==1.2.0&&2.30_1557923095703_envelope.log
/data/data/####/i==1.2.0&&2.30_1557923118622_envelope.log
/data/data/####/i==1.2.0&&2.30_1557923133764_envelope.log
/data/data/####/i==1.2.0&&2.30_1557923148309_envelope.log
/data/data/####/img-cache.zip
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/kobox.0.sp.xml
/data/data/####/libnfix.so
/data/data/####/libshella-3.0.0.0.so
/data/data/####/libufix.so
/data/data/####/libyaqbasic.91475202.so
/data/data/####/libyaqpro.91475202.so
/data/data/####/load_MTAwMF8xMjAxXzE0OTAwODAw;.xml
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/module_ch_yuxiusen_2015_20_papp_sdk_v1.0.jar
/data/data/####/module_ch_yuxiusen_2015_20_v4.2.jar
/data/data/####/msg_queue
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/onekeyclean_temp.xml
/data/data/####/prdopt.xml
/data/data/####/request_control.xml
/data/data/####/request_position.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/spfn_MTAwMF8xMjAxXzE0OTAwODAw;.xml
/data/data/####/spu_ti.xml
/data/data/####/ssp_module_data.xml
/data/data/####/t==8.0.2&&2.30_1557923097137_envelope.log
/data/data/####/tdargs.xml
/data/data/####/tmp7.xml
/data/data/####/tools8977.xml
/data/data/####/tools8977New.xml
/data/data/####/tt_materialMeta.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_splash.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/u877.jar
/data/data/####/u877.jar.tmp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umengDown.jar
/data/data/####/umengDown17.jar
/data/data/####/umengDown1_1.jar
/data/data/####/umengDown5_2.jar
/data/data/####/umengDown6_11.jar
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wechat_temp.xml
/data/data/####/xconfig.xml
/data/data/####/xsdk_preference.xml
/data/data/####/yaqsdkcookie
/data/media/####/.YiAds.log
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.cdeviceID
/data/media/####/.mgData
/data/media/####/.nid
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.umm.dat
/data/media/####/backstage_ad_path
/data/media/####/c.jar
/data/media/####/c.jar.tm
/data/media/####/cf.jar
/data/media/####/cf.jar.tm
/data/media/####/dec_c.jar
/data/media/####/dec_cf.jar
/data/media/####/engc.jar
/data/media/####/news_source_path
/data/media/####/ssp_brush_lib.data
/data/media/####/ssp_brush_sdk_data.data
/data/media/####/sysid.dat
/data/media/####/tag2.datdc9e9274-3904-4135-88ba-bd2d9055e78f.tmp
/data/media/####/tmpbl.jar
/data/media/####/tt_splash_image_cache
/data/media/####/u877.jar.tmp.tmp
/data/media/####/user_channel_path
/data/media/####/webengine.jar

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
cat /proc/cpuinfo
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
cat /sys/class/net/wlan0/address
chmod 700 /data/user/0/<Package>/tx_shell/libnfix.so
chmod 700 /data/user/0/<Package>/tx_shell/libshella-3.0.0.0.so
chmod 700 /data/user/0/<Package>/tx_shell/libufix.so
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-3.0.0.0.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.letv.release.version
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
ps

Loads the following dynamic libraries:

Bugly
jcore127
libnfix
libshella-3.0.0.0
libufix
libyaqbasic.91475202
libyaqpro.91475202
nfix
ufix

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NOPADDING
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5PADDING
AES-CBC-PKCS7Padding
AES-CFB-NOPADDING
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
ARCFOUR
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Gets information about accounts associated with the device (Google, Facebook, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial