Android.Packed.38900

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.455.origin
Android.DownLoader.570.origin
Android.DownLoader.698.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) l####.c####.q####.####.net:80
TCP(HTTP/1.1) api.ad.xi####.com:80
TCP(HTTP/1.1) bmob-cd####.b0.upa####.com:80
TCP(HTTP/1.1) f####.ma####.xi####.####.net:80
TCP(HTTP/1.1) o####.b####.cn:80
TCP(HTTP/1.1) ff.t####.com.####.com:80
TCP(HTTP/1.1) 1####.200.221.131:8080
TCP(HTTP/1.1) trac####.m####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.57.218.214:8080
TCP(HTTP/1.1) sdkco####.ad.xi####.com:80
TCP(HTTP/1.1) au.y####.net:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) f####.b####.cn:80
TCP(HTTP/1.1) s.y####.net:80
TCP(TLS/1.0) s####.map.b####.com:443
UDP 2####.0.0.1:9998
TCP p1.jz####.com:7801
TCP i3.jiz####.com:7703
TCP p2.jz####.com:7802
TCP i2.jiz####.com:7702
TCP p2.jz####.com:7803
TCP i1.jiz####.com:7701

DNS requests:

4####.nd####.y####.com
a####.u####.com
aos.gw.y####.net
aos.w####.y####.net
api.ad.xi####.com
au.y####.net
bmob-cd####.b0.upa####.com
f####.b####.cn
f1.ma####.xi####.com
ff.t####.com
i1.jiz####.com
i2.jiz####.com
i3.jiz####.com
loc.map.b####.com
o####.b####.cn
oc.u####.com
p1.jz####.com
p2.jz####.com
p3.jz####.com
s####.gw.y####.net
s####.map.b####.com
s.y####.net
sdk.st####.y####.com
sdkco####.ad.xi####.com
t####.dmp.y####.net
trac####.m####.com

HTTP GET requests:

1####.200.221.131:8080/spotService/a.jsp?k=####
1####.57.218.214:8080/jfservice/a.jsp?k=####
au.y####.net/offer/dist/aos/pkg/3.2.2/offers_3.2.2.zip
bmob-cd####.b0.upa####.com/2016/10/22/067d0b5c4ed7490195b1e3b20f545490.jpg
bmob-cd####.b0.upa####.com/2017/03/03/5aa8fdad82db45ac8a070835eccf171d.jpg
bmob-cd####.b0.upa####.com/2017/03/08/b639d16065a743e9a3374c1276138311.jpg
bmob-cd####.b0.upa####.com/2017/03/20/44d71dd1c95148309e3aff595f3009c5.jpg
bmob-cd####.b0.upa####.com/2017/05/18/180a4c8c82b3498798c32687b67fb829.jpg
bmob-cd####.b0.upa####.com/2017/05/19/16f072c0edb04001bcb82820f7249e35.jpg
bmob-cd####.b0.upa####.com/2017/05/19/41efd7927b2f4d67addd7bba5a113f72.jpg
bmob-cd####.b0.upa####.com/2017/05/22/44dd7227917b42a492f76f0c5592290e.jpg
bmob-cd####.b0.upa####.com/2017/06/12/50ff22cbabbc4090b3ad7c51b7ee5074.jpg
bmob-cd####.b0.upa####.com/2017/06/30/ab97ab4685284262b960d59c3d745945.jpg
bmob-cd####.b0.upa####.com/2017/07/06/14214224882a416abea62d884d959c1a.jpg
bmob-cd####.b0.upa####.com/2017/07/13/315a633565a4468ebd76b6fb4f2a0555.jpg
bmob-cd####.b0.upa####.com/2017/07/24/43b40d573d984285ba77ddfaae0869e8.jpg
bmob-cd####.b0.upa####.com/2017/07/24/ed310ae1fffd40bea08b24c8f71d6fae.jpg
bmob-cd####.b0.upa####.com/2017/07/31/e2d9e7b6bdb74f16adbcac4a8abc60fe.jpg
bmob-cd####.b0.upa####.com/2017/07/31/faf6d52b68f644b6a105001f53cd5fa1.jpg
bmob-cd####.b0.upa####.com/2017/08/07/bf60ae11cb784894a0ee014abca947a4.jpg
f####.b####.cn/M01/9C/1E/oYYBAFbEckWAY2HoAACX82cY6_M843.jpg
f####.b####.cn/M02/16/85/oYYBAFYe-MOARVESAACmWExwgPc251.jpg
f####.b####.cn/M02/2A/D1/oYYBAFaDjQeAEMLFAAAROKF8ORc797.jpg
f####.b####.cn/M02/3C/3D/oYYBAFaPFkCAAs6-AAAODC4YSt4064.jpg
f####.b####.cn/M02/43/AE/oYYBAFYsw3KATtsDAABhh_aGVnY339.jpg
f####.b####.cn/M02/6A/02/oYYBAFXruECAbtkYAACZRXyNyH0603.jpg
f####.b####.cn/M02/90/03/oYYBAFZEPKGAbZkLAAARrCizbnA926.jpg
f####.b####.cn/M02/9B/28/oYYBAFbEGzSAdpjLAABdId4wN7g396.jpg
f####.b####.cn/M02/BA/96/oYYBAFd7IUuAabOzAABiJ-nnLGI002.jpg
f####.b####.cn/M02/CB/79/oYYBAFYGTfiAQSxSAABEugYvYZ0349.jpg
f####.b####.cn/M02/F5/17/oYYBAFZuLNWAHfmkAABVWDGT3n0328.jpg
f####.b####.cn/M03/06/59/oYYBAFb7J9mAAAUXAAANXdMQrVM419.jpg
f####.b####.cn/M03/0B/A4/oYYBAFb-ROeAY0AIAABCpgfIX3Q893.jpg
f####.b####.cn/M03/1E/4C/oYYBAFcHQyGADrBOAAB-bzLAoz8029.jpg
f####.b####.cn/M03/AA/C8/oYYBAFbKZViAHWyXAABYDBkB3N8410.jpg
f####.b####.cn/M03/AA/FA/oYYBAFbKggWAAHSsAAAj2DotjQI990.jpg
f####.b####.cn/M03/B2/C2/oYYBAFbOc82ACYe5AABVCgy490M215.jpg
f####.b####.cn/M03/C2/E6/oYYBAFbVA2iARpMYAABgcsSNmuE297.jpg
f####.b####.cn/M03/E8/04/oYYBAFbrD9yARluOAAAdx6Uy6_g932.jpg
f####.b####.cn/M03/EF/C6/oYYBAFecN3aAOQZyAAAJLRD4aa4624.jpg
f####.b####.cn/M03/F9/0D/oYYBAFbz49CAd0GyAABPqIvpLnQ043.jpg
f####.ma####.xi####.####.net/download/AdCenter/0d63f52cae384825ea6fe6b11...
ff.t####.com.####.com/d/43cw.png
l####.c####.q####.####.net/core/aos-dex/1609/6446/4595cef0.jar
s.y####.net/aos/v3/initf?s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
s.y####.net/stat/v3/udt2?appid=####&s=####
s.y####.net/v3/get?s=####
s.y####.net/v3/zip_upd?s=####
sdkco####.ad.xi####.com/api/checkupdate/lastusefulversion?currentApiVers...
sdkco####.ad.xi####.com/api/detail/3b8f59b731bda8fe486b11dca5a906c9?ts=#...
sdkco####.ad.xi####.com/api/detail/54db829f09424caad69f7fb9350fa48d?ts=#...
sdkco####.ad.xi####.com/api/detail/5a0d76b426bd66bf94b94e19a8719e41?ts=#...

HTTP POST requests:

a####.u####.com/app_logs
api.ad.xi####.com/union/fetchAds
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php
o####.b####.cn/8/find
o####.b####.cn/8/init
o####.b####.cn/8/secret
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####
trac####.m####.com/track/v1

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/01532139734088.jar
/data/data/####/01532139734446.jar
/data/data/####/1000.xml
/data/data/####/1532139735137.RequestCommand.find.3.3097750b732...c8a0c5
/data/data/####/1532139735216.RequestCommand.find.3.55ac5712d00...577a86
/data/data/####/16bfecd4b7239deefe111c793e8710e0
/data/data/####/16bfecd4b7239deefe111c793e8710e0-journal
/data/data/####/41532139736300.jar
/data/data/####/99d849a9cf49db0ce88d4a2e1c4e59e8.zip
/data/data/####/AdServer_asset.apk
/data/data/####/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
/data/data/####/C306239E75034d979DB1957AC06E4612.xml
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVVersion.cfg
/data/data/####/E_ID356507059351895.db
/data/data/####/E_ID356507059351895.db-journal
/data/data/####/OFFERSCONFIG1.xml
/data/data/####/OxgHkj2lz09F
/data/data/####/OxgHkj2lz09F-journal
/data/data/####/P15pKIjsm64m
/data/data/####/P15pKIjsm64m-journal
/data/data/####/ReporterService.xml
/data/data/####/ResPack.rs
/data/data/####/T1oX0rhhuXWt
/data/data/####/T1oX0rhhuXWt-journal
/data/data/####/XKwVoK0huy3R
/data/data/####/XKwVoK0huy3R-journal
/data/data/####/_miad_sdk_module_versions.xml
/data/data/####/a1.db-journal
/data/data/####/a1.xml
/data/data/####/a1356507059351895.xml
/data/data/####/analytics.apk.tmp
/data/data/####/analytics.db-journal
/data/data/####/analytics_asset.apk
/data/data/####/apkloader.xml
/data/data/####/arrow-left-pink.png
/data/data/####/arrow-left.png
/data/data/####/arrow-right-pink.png
/data/data/####/arrow-right.png
/data/data/####/authStatus_com.lch.siyun.xml
/data/data/####/authStatus_com.lch.siyun;remote.xml
/data/data/####/b.xml
/data/data/####/b1356507059351895.xml
/data/data/####/blank.gif
/data/data/####/bmob_sp.xml
/data/data/####/c1356507059351895.xml
/data/data/####/close-icon.png
/data/data/####/com.lch.siyun_prefs.xml
/data/data/####/default.png
/data/data/####/detail-wx-miniprogram.html
/data/data/####/detail-wx-miniprogram.js
/data/data/####/detail-wx.html
/data/data/####/detail-wx.js
/data/data/####/detail.html
/data/data/####/detail.js
/data/data/####/f2b50d81124fed405577766bd66696aa-journal
/data/data/####/f548aadccd8ac704507ad80aa398a12e
/data/data/####/f548aadccd8ac704507ad80aa398a12e-journal
/data/data/####/feedback.html
/data/data/####/feedback.js
/data/data/####/firll.dat
/data/data/####/form.css
/data/data/####/global.js
/data/data/####/heartbeat.xml
/data/data/####/i.xml
/data/data/####/i_fac_pre356507059351895.xml
/data/data/####/i_finfo_pre356507059351895.xml
/data/data/####/i_fionf_pre356507059351895.xml
/data/data/####/jqIqJYOT3JpT
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libanalytics.so
/data/data/####/libas.so
/data/data/####/libdu.so
/data/data/####/lists.css
/data/data/####/lists.html
/data/data/####/lists.js
/data/data/####/mapstyle.sty
/data/data/####/md5.js
/data/data/####/mobclick_agent_online_setting_com.lch.siyun.xml
/data/data/####/nointernet.png
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/pic_friend_step1.jpg
/data/data/####/pic_friend_step2.jpg
/data/data/####/pic_friend_step3.jpg
/data/data/####/pic_friend_step4.jpg
/data/data/####/pic_friend_step5.jpg
/data/data/####/pic_m.png
/data/data/####/pic_tips_01.png
/data/data/####/pic_tips_02.png
/data/data/####/pic_xiaochengxu_kefu_step1.png
/data/data/####/pic_xiaochengxu_kefu_step2.png
/data/data/####/pic_xiaochengxu_kefu_step3.png
/data/data/####/pic_xiaochengxu_kefu_step4.png
/data/data/####/pic_xiaochengxu_kefu_step5.png
/data/data/####/pic_xiaochengxu_kefu_step6.png
/data/data/####/pic_xiaochengxu_step1.png
/data/data/####/pic_xiaochengxu_step2.png
/data/data/####/pic_xiaochengxu_step3.png
/data/data/####/pic_xiaochengxu_step4.png
/data/data/####/pic_xiaochengxu_step5.png
/data/data/####/policy.cache
/data/data/####/requests.db-journal
/data/data/####/result.png
/data/data/####/rule.html
/data/data/####/satellitestyle.sty
/data/data/####/sdetail.html
/data/data/####/share.css
/data/data/####/share.html
/data/data/####/share.js
/data/data/####/shuzilm.db
/data/data/####/siyun.xml
/data/data/####/sprite-face.png
/data/data/####/sprite-icons.png
/data/data/####/sprite-icons2.png
/data/data/####/trafficstyle.sty
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/updater.xml
/data/data/####/ver.dat
/data/data/####/wIU6pTyUBYWX
/data/data/####/wIU6pTyUBYWX-journal
/data/data/####/webview.db-journal
/data/data/####/wsUL1uCdKvjD
/data/data/####/wsUL1uCdKvjD-journal
/data/data/####/wx-qr-step1.jpg
/data/data/####/wx-qr-step2.jpg
/data/data/####/wx-qr-step3.jpg
/data/data/####/wx-qr-step4.jpg
/data/data/####/wx-qr-step5.jpg
/data/data/####/wx-step1.jpg
/data/data/####/wx-step2.jpg
/data/data/####/wx-step3.jpg
/data/data/####/wx-step4.jpg
/data/data/####/wx-step5.jpg
/data/data/####/wx-wifi-step1.jpg
/data/data/####/wx-wifi-step2.jpg
/data/data/####/wx-wifi-step3.jpg
/data/data/####/wx-wifi-step4.jpg
/data/data/####/wx-wifi-step5.jpg
/data/data/####/xappInfo_pre.xml
/data/data/####/ymdex.jar.new
/data/media/####/-1002268605
/data/media/####/-1112008094
/data/media/####/-1121294516
/data/media/####/-1284894977
/data/media/####/-160162598
/data/media/####/-1797552694
/data/media/####/-1907895889
/data/media/####/-20190794
/data/media/####/-394474954
/data/media/####/-456687533
/data/media/####/-906158632
/data/media/####/.cuid
/data/media/####/.nomedia
/data/media/####/1294910304
/data/media/####/1480704651
/data/media/####/1760370411
/data/media/####/2084694711
/data/media/####/43cw.png.dat
/data/media/####/562015864
/data/media/####/62134409
/data/media/####/6e956d95717545c4612b3607245f8f48
/data/media/####/6e956d95717545c4612b3607245f8f48b
/data/media/####/761ebf817ec056095fad98e32cf851a0
/data/media/####/761ebf817ec056095fad98e32cf851a0.ymtf
/data/media/####/DXTX902KJZX9JASLDJF
/data/media/####/DXTX902KJZX9JASLDJF.ymtf
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/conlts.dat
/data/media/####/i42d45df023jnkdd93la483f9xGFKXI
/data/media/####/ller.dat
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/lut
/data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
/data/media/####/test.0

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/kernel_max
ls /dev/socket
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid

Loads the following dynamic libraries:

BaiduMapSDK_v3_5_0_15
abcdefgh
bmob
du
locSDK6a

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
PBEWITHMD5andDES
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES
PBEWITHMD5andDES

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial