Android.Packed.46534

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.363.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) m.lif####.com:80
TCP(HTTP/1.1) hd.a####.com:80
TCP(HTTP/1.1) api.g####.vip:80
TCP(HTTP/1.1) api.lubang####.com:80
TCP(HTTP/1.1) ap####.meiju####.com:80
TCP(HTTP/1.1) 1####.135.32.187:80
TCP(HTTP/1.1) adv.patrick####.com.cn:80
TCP(HTTP/1.1) 65.52.1####.249:80
TCP(HTTP/1.1) ty.downlo####.com.####.com:80
TCP(HTTP/1.1) filt####.a####.top:80
TCP(HTTP/1.1) weib####.g####.sina####.com:80
TCP(HTTP/1.1) jx.lyh####.com:80
TCP(HTTP/1.1) 61.1####.215.225:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) 1####.233.249.176:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) 1####.192.92.45:443
TCP(TLS/1.0) img1-do####.b0.a####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) weib####.g####.sina####.com:443
TCP(TLS/1.0) 2####.58.211.106:443
TCP(TLS/1.0) s####.d####.com:443
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) ip.goq####.com:443
TCP(TLS/1.0) a####.d####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) l####.b####.com:443
TCP(TLS/1.2) 59.1####.185.106:443
TCP(TLS/1.2) weib####.g####.sina####.com:443
TCP(TLS/1.2) 1####.192.92.45:443
TCP(TLS/1.2) 47.2####.48.228:443

DNS requests:

2.and####.p####.####.org
a####.d####.com
adv-u####.t####.u####.net
adv.99y####.com
adv.google####.com.cn
adv.patrick####.com.cn
and####.cli####.go####.com
and####.google####.com
ap####.meiju####.com
api.g####.vip
api.icinep####.com
api.lubang####.com
api.meiju####.n####.####.8
api.yunco####.com
filt####.a####.top
hm.b####.com
i####.d####.com
i####.doub####.com
instant####.google####.com
ip.goq####.com
jx.lyh####.com
l####.b####.com
m.lif####.com
res####.a####.top
s####.d####.com
ty.downlo####.com
u####.a####.top
ww1.sin####.cn
www.google-####.com
www.tv####.com

HTTP GET requests:

1####.233.249.176/Uploads/vod/2017-06-06/59364a8993226.jpg
1####.233.249.176/Uploads/vod/2017-10-23/59edb8c7f34a6.jpg
1####.233.249.176/Uploads/vod/2017-12-21/5a3b563e04f2d.jpg
1####.233.249.176/Uploads/vod/2019-05-11/5cd6c2b3a3a85.jpg
ap####.meiju####.com/daima/img.png
api.g####.vip/landing_with_phy.js
filt####.a####.top/617.html
filt####.a####.top/filter_control_617.json
hd.a####.com/android/adv/qsz/advsdk/release/advsdk-release.enc
jx.lyh####.com/img/01.jpg
m.lif####.com/cdn-cgi/images/error_icons.png
m.lif####.com/cdn-cgi/styles/cf.errors.css
m.lif####.com/cdn-cgi/styles/fonts/opensans-300.woff
m.lif####.com/cdn-cgi/styles/fonts/opensans-400.woff
m.lif####.com/cdn-cgi/styles/fonts/opensans-600.woff
m.lif####.com/favicon.ico
m.lif####.com/forum-47-1.html
m.lif####.com/thread-3010-1-2.html
ty.downlo####.com.####.com/1560749308235300.jpeg
ty.downlo####.com.####.com/1564129454573594.jpeg
weib####.g####.sina####.com/large/683cb5a1gy1g1mbi0xz6bj20go08cdg8.jpg

HTTP POST requests:

1####.135.32.187/
adv.patrick####.com.cn/adv/dayActive
adv.patrick####.com.cn/adv/getTask
adv.patrick####.com.cn/adv/pluginFeedback
adv.patrick####.com.cn/adv/pluginReq
api.lubang####.com/domain.php
api.lubang####.com/srp.php
api.yunco####.com/service/rest

File system changes:

Creates the following files:

/data/data/####/.__mob_ad_data.xml
/data/data/####/.jgck
/data/data/####/.zx
/data/data/####/00993f511c8b1b878830aa908a599c16c3d7ae512bc2c46....0.tmp
/data/data/####/0389ab9faa3d953a_0
/data/data/####/0404a49d5efdf009_0
/data/data/####/0ac0e5bda6d38aa1_0
/data/data/####/100b5aedfecee899_0 (deleted)
/data/data/####/107458e27c982b56_0
/data/data/####/107458e27c982b56_1
/data/data/####/18873752c3fbe12ffe85ee4952f33c449532fba942089c4....0.tmp
/data/data/####/18b144aefd680643_0
/data/data/####/1923452b4778993757a615a6305aca2ab5df307f01054eb....0.tmp
/data/data/####/19472ed15f918edd_0
/data/data/####/27f2dd6b1ceca7b927c695cad6d8d546.0.tmp
/data/data/####/27f2dd6b1ceca7b927c695cad6d8d546.1.tmp
/data/data/####/2940195bd9870d6e_0
/data/data/####/2940195bd9870d6e_1
/data/data/####/2ca7543f7403ae89_0
/data/data/####/36bef24989be335c_0
/data/data/####/39b1968ee2025e1cff2a8552295ab0ad.db
/data/data/####/3d34829d581c8ea575d7dbeed9f17dfc977b79e2e3273e7...6612.0
/data/data/####/402a3c145e89fe017738b95148df3bc9.0.tmp
/data/data/####/402a3c145e89fe017738b95148df3bc9.1.tmp
/data/data/####/41e516fdda7eebb8_0
/data/data/####/41e516fdda7eebb8_1
/data/data/####/42e3379b554d697429c03f7f78da57aa.0.tmp
/data/data/####/42e3379b554d697429c03f7f78da57aa.1.tmp
/data/data/####/4931ad34b691f4a376fadad624eac30b988806d612b7a50....0.tmp
/data/data/####/4a4a3d77d34b7b1ee42ff657e226d11dcc22e818844552f....0.tmp
/data/data/####/54500874f61556d7_0
/data/data/####/54500874f61556d7_1
/data/data/####/54663408912e3595_0
/data/data/####/54663408912e3595_1
/data/data/####/577c4ce26a4957bf44a4b0fc1bb09f8c80844b492c60abf....0.tmp
/data/data/####/587e012d2c826ef2_0
/data/data/####/592meiju_data.xml
/data/data/####/59d103a390634512_0
/data/data/####/59d103a390634512_0 (deleted)
/data/data/####/59d103a390634512_1
/data/data/####/5cf539dac029c152_0 (deleted)
/data/data/####/6225cab9af5c0389_0
/data/data/####/6225cab9af5c0389_1
/data/data/####/6461692990eb9d3b5defb084f61d9973.dex
/data/data/####/6461692990eb9d3b5defb084f61d9973.dex.flock (deleted)
/data/data/####/64ff5b8028e0eb309567dd414093d6972aa99f343305c6d...9d6b.0
/data/data/####/65f902bb7add2083272be23ebee1e906a5b5730dc391233...546d.0
/data/data/####/6c66e0fa5430ef73_0
/data/data/####/6c66e0fa5430ef73_0 (deleted)
/data/data/####/6c66e0fa5430ef73_1
/data/data/####/7321a51809a09e94_0
/data/data/####/767e3a8dd5db898f_0
/data/data/####/77e45a4bd2464b65012d12713c208e3498b862f051e3ec5....0.tmp
/data/data/####/7afebf049ddf4f6b_0
/data/data/####/8298303e5e475f1abaeed822ae4e2b859376956d64fe81c....0.tmp
/data/data/####/837437468-187665094
/data/data/####/87002adc3f1a6057_0
/data/data/####/8a038e80a75f309c_0
/data/data/####/8e4a8094a305a07da68cb45e7969a87c.db
/data/data/####/8e548492c3f9f73d_0
/data/data/####/9255e7e6f01f7fd5c5b3a2b92c36890906ca8e9ec8b8cbb....0.tmp
/data/data/####/93957c9abca456d0_0
/data/data/####/99d97c14a48b45bf32d8f3a0d2cc915be48030c80f3ea21....0.tmp
/data/data/####/9cd6bf576c312b20_0 (deleted)
/data/data/####/Cookies-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ad74f930edbab62a_0
/data/data/####/ad74f930edbab62a_1
/data/data/####/ae1abf72da15754391348125ec470e4b636c698e5ce3211....0.tmp
/data/data/####/ahq_spu_ti.xml
/data/data/####/b18458f123f03116_0
/data/data/####/b1a4c8e1b7a06bc5_0
/data/data/####/b3252a85bb63bd34_0
/data/data/####/b3252a85bb63bd34_1
/data/data/####/b38c720d5ed910eac3de592fddbc82bc457ba8687073332....0.tmp
/data/data/####/b4183f72fab0d05dbfbe2d5bc976f74e51611c5f12b518f....0.tmp
/data/data/####/b704bc6006131134_0
/data/data/####/b704bc6006131134_0 (deleted)
/data/data/####/baf01dbfc1d590b6_0
/data/data/####/baf01dbfc1d590b6_0 (deleted)
/data/data/####/baf01dbfc1d590b6_1
/data/data/####/bb229b2983b3f087b727ccd257ac3e14.0.tmp
/data/data/####/bb229b2983b3f087b727ccd257ac3e14.1.tmp
/data/data/####/be10dd3eb0de75f2_0
/data/data/####/bfa5ef04605659d5_0
/data/data/####/c1ba94632d39a91c70ce72d8ca5efea4c5f675e019331b7....0.tmp
/data/data/####/cf3f0425423686de_0 (deleted)
/data/data/####/classes.oat
/data/data/####/com.meiju592.app.xml
/data/data/####/com.meiju592.app.xml.bak
/data/data/####/com.meiju592.app_preferences.xml
/data/data/####/com.meiju592.app_preferences.xml.bak
/data/data/####/d15d83a28343d1c4_0 (deleted)
/data/data/####/d92730f5ceace7a8_0 (deleted)
/data/data/####/da16f7c07344520b_0
/data/data/####/da16f7c07344520b_0 (deleted)
/data/data/####/da16f7c07344520b_1
/data/data/####/da1f7edbe942b3001c9ee34f9dc805786b7602c1a2967d1....0.tmp
/data/data/####/dd953667527986bde6f90566be2030866032b46833ec183....0.tmp
/data/data/####/de22669bcf80da03_0
/data/data/####/deab6b0bf5a17df3_0
/data/data/####/dns_ip_info.db
/data/data/####/dns_ip_info.db-journal
/data/data/####/downUmeng.dex
/data/data/####/downUmeng.dex.flock (deleted)
/data/data/####/downUmeng.jar
/data/data/####/e6b8df8945b5dba5e83c21f950de0c1b58a21f577786d15....0.tmp
/data/data/####/e9cacf6f0fd39712_0
/data/data/####/ea0158761ec5657582490ad8f8bd4af7d32768d7f7eb96c....0.tmp
/data/data/####/ed74789485a5a231_0
/data/data/####/ed74789485a5a231_1
/data/data/####/ef6a4549ae3e826e9485dba5705fcbf7d906fced3806976....0.tmp
/data/data/####/f75a391818d6a645_0
/data/data/####/fcb7c26f44c85095_0
/data/data/####/fcb7c26f44c85095_0 (deleted)
/data/data/####/fcb7c26f44c85095_1
/data/data/####/fefaffe0e68e81f60dfcc6a05b1918429709fd3a75ea4ef....0.tmp
/data/data/####/ff124dbae98817e8_0 (deleted)
/data/data/####/ff8e4deddbe319b5_0
/data/data/####/hhq_spu_ti.xml
/data/data/####/hid.db
/data/data/####/https_sw3sy.duoyi.com_0.localstorage-journal
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/meijuniaoV2.db-journal
/data/data/####/metrics_guid
/data/data/####/msy.xml
/data/data/####/msy.xml.bak
/data/data/####/msy.xml.bak (deleted)
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_down18.dex
/data/data/####/umeng_down18.dex.flock (deleted)
/data/data/####/umeng_down18.jar
/data/data/####/umeng_down2.dex
/data/data/####/umeng_down2.dex.flock (deleted)
/data/data/####/umeng_down2.jar
/data/data/####/umeng_down5_2.dex
/data/data/####/umeng_down5_2.dex.flock (deleted)
/data/data/####/umeng_down5_2.jar
/data/data/####/umeng_down6_3.dex
/data/data/####/umeng_down6_3.dex.flock (deleted)
/data/data/####/umeng_down6_3.jar
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/advDB/6461692990eb9d3b5defb084f61d9973.db --oat-fd=71 --oat-location=/data/user/0/<Package>/cache/advDB/6461692990eb9d3b5defb084f61d9973.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=78 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/umeng_down18.jar --oat-fd=64 --oat-location=/data/user/0/<Package>/app_umeng_down/umeng_down18.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/umeng_down2.jar --oat-fd=39 --oat-location=/data/user/0/<Package>/app_umeng_down/umeng_down2.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/umeng_down5_2.jar --oat-fd=158 --oat-location=/data/user/0/<Package>/app_umeng_down/umeng_down5_2.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/umeng_down6_3.jar --oat-fd=162 --oat-location=/data/user/0/<Package>/app_umeng_down/umeng_down6_3.dex --compiler-filter=speed
/system/bin/sh
cat /proc/cpuinfo
ls -l /dev
ls -l /dev/__properties__
ls -l /dev/block
ls -l /dev/block/pci
ls -l /dev/block/pci/pci0000:00
ls -l /dev/block/pci/pci0000:00/0000:00:01.1
ls -l /dev/block/pci/pci0000:00/0000:00:01.1/by-num
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuset
ls -l /dev/cpuset/background
ls -l /dev/cpuset/foreground
ls -l /dev/cpuset/foreground/boost
ls -l /dev/cpuset/system-background
ls -l /dev/cpuset/top-app
ls -l /dev/fscklogs
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/memcg/apps
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ls -l /dev/stune
ls -l /dev/stune/background
ls -l /dev/stune/foreground
ls -l /dev/stune/top-app

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
ARCFOUR
DES
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial