Android.Backdoor.1543

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.618.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) api.con####.kyli####.com:666
TCP(HTTP/1.1) v####.6####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) api.lubang####.com:80
TCP(HTTP/1.1) a####.wanyu####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) sdk.91a####.com:80
TCP(HTTP/1.1) n####.haiqi####.top:8080
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) www.ib####.com:80
TCP(HTTP/1.1) a####.lubang####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) rcv.ila####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) uc.soul####.mobi:80
TCP(HTTP/1.1) stor####.ne####.com.cn:80
TCP(HTTP/1.1) api.ila####.com:80
TCP(HTTP/1.1) i.s####.ne####.####.cn:10018
TCP(HTTP/1.1) log.soul####.mobi:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) ss####.mogu####.com:80
TCP(HTTP/1.1) api.ha####.top:80
TCP(HTTP/1.1) ap####.wanyu####.com:80
TCP(HTTP/1.1) p####.admo####.com:80
TCP(HTTP/1.1) kl.kyli####.com:80
TCP(HTTP/1.1) s####.g####.oppomo####.com:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(TLS/1.0) i####.oppomo####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) owe.joy-r####.com:9050
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) ss####.mogu####.com:443
UDP 1####.168.101.1:137

DNS requests:

a####.lubang####.com
a####.wanyu####.com
a####.wanyu####.com
ag####.m.ta####.com
ap####.wanyu####.com
ap####.wanyu####.com
api.con####.kyli####.com
api.ha####.top
api.ila####.com
api.kxcon####.com
api.lubang####.com
bx.imo####.com
cdn.joy-r####.com
d####.wos####.com
dl.api.kyli####.com
h####.b####.com
i####.oppomo####.com
i.s####.ne####.####.cn
ip.ta####.com
k####.kyli####.com
kl.kyli####.com
log.soul####.mobi
log.u####.com
n####.haiqi####.top
n####.haiqi####.top
owe.joy-r####.com
p####.admo####.com
p7rv8####.bkt.clo####.com
plb####.u####.com
rcv.ila####.com
s####.g####.oppomo####.com
sdk.91a####.com
sec.u####.com
ss####.mogu####.com
stor####.ne####.com.cn
u####.u####.com
u4.wser####.com
uc.soul####.mobi
v####.6####.com
w####.5####.com
www.ib####.com
z1.c####.com

HTTP GET requests:

ap####.wanyu####.com/v3/axp_set?appid=####&usid=####&imei=####&sim=####&...
api.ila####.com/c/_ii_?_=####
api.ila####.com/c/szssl_20_sdk
api.ila####.com/e/i.html
api.ila####.com/e/i.js
api.ila####.com/update_ch/common/core.jar
api.ila####.com/update_ch/common/coreconfig.jar
api.lubang####.com/Public/jar/remote_1.3.5-911534327813.jar
d####.c####.l####.####.com/844a57bf-02a6-4869-9fc0-bd0b93b557b2bdco_20041
ip.ta####.com/service/getIpInfo.php?ip=####
k####.kyli####.com.####.com/1534404475475_utils.ttf
n####.haiqi####.top:8080/adv_platform/getJarVersion/HQB_Q_0030/23/cn
rcv.ila####.com/report2?t=####&h1=####&c=####&v=####&op1=####&op2=####&n...
sdk.91a####.com/static/20180810163509mod.enc
ss####.mogu####.com/singlefun/jspullup/recentjspullup?ggid=####&cid=####...
stor####.ne####.com.cn/apk/201806/13/2039e1520c0dfc886191a061349d4849.apk
t####.c####.q####.####.com/lh/smart/show/demo2.html
t####.c####.q####.####.com/lh/smart/smartpull.js
t####.c####.q####.####.com/path_gn_q30_update4.dat
z.c####.com/stat.htm?id=####&cnzz_eid=####

HTTP POST requests:

a####.lubang####.com/api_two.php
a####.wanyu####.com/v3/g_das
ap####.wanyu####.com/v3/axp_init
ap####.wanyu####.com/v3/axp_jp
api.con####.kyli####.com:666/v1/config
api.ha####.top/Orders/getlive?channel=####
api.kxcon####.com:666/v1/config
api.lubang####.com/api_two.php?ac=####
api.lubang####.com/domain.php
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
i.s####.ne####.####.cn:10018/statistics/ClientStartUpload
kl.kyli####.com/klv1/sdkkl/mobile
log.soul####.mobi/game_sdk3.0/init
log.soul####.mobi/game_sdk3.0/upload
p####.admo####.com/index.php?r=####
s####.g####.oppomo####.com/soporcollect/appevent/event
sdk.91a####.com/api/DeviceReport.ashx
uc.soul####.mobi/api.php?s=####
v####.6####.com/api/CheckModule.ashx
www.ib####.com/app_watch.php

Modified file system:

Creates the following files:

/data/anr/traces.txt
/data/data/####/-1494365930664822958
/data/data/####/-2126415336-530248817
/data/data/####/-8861977752072820965
/data/data/####/.Yiwk.db
/data/data/####/.Yiwk.db-journal
/data/data/####/.__mob_ad_data.xml
/data/data/####/.__mob_rmt.dat
/data/data/####/.__mob_rmt.dat (deleted)
/data/data/####/.b804e46c204eb389490c6aef1419de65.jar
/data/data/####/.imprint
/data/data/####/.oe.txt
/data/data/####/.plversion2
/data/data/####/.pset_data
/data/data/####/.tmp.jar
/data/data/####/2018_08_16read.xml
/data/data/####/3323003.jar
/data/data/####/3323003.ttf
/data/data/####/837437468-187665094
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/Alvin2.xml
/data/data/####/AndSdk.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/Cocos2dxPrefsFile.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/NearMeSTAT.db-journal
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/SGAnalytics.xml
/data/data/####/SoulGame.db
/data/data/####/SoulGame.db-journal
/data/data/####/YiAdv.db
/data/data/####/YiAdv.db-journal
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/___xad__remote.jar
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__mob_AppKey.xml
/data/data/####/__send_data_1534445165293
/data/data/####/a==7.4.0&&2.0.1_1534445137463_envelope.log
/data/data/####/agoo.pid
/data/data/####/android-util.zip
/data/data/####/app.min.js
/data/data/####/arrow.png
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
/data/data/####/com.nearme.gamecenter.open.xml
/data/data/####/com.soulgame.hero.nearme.gamecenter.xml
/data/data/####/com.soulgame.hero.nearme.gamecenter_preferences.xml
/data/data/####/config.xml
/data/data/####/core.jar.tm
/data/data/####/coreconfig.jar.tm
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default-banner.png
/data/data/####/default-game.png
/data/data/####/detail_icon_1.png
/data/data/####/detail_icon_2.png
/data/data/####/detail_icon_3.png
/data/data/####/detail_icon_4.png
/data/data/####/device.xml
/data/data/####/e34767cae4513c79b2b96d167ce30ace
/data/data/####/empty.png
/data/data/####/error_sorry.png
/data/data/####/error_wifi.png
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/game_comment_bg.png
/data/data/####/game_comment_icon_1.png
/data/data/####/game_comment_icon_2.png
/data/data/####/game_comment_icon_3.png
/data/data/####/i==1.2.0&&2.0.1_1534445166523_envelope.log
/data/data/####/icon-close.png
/data/data/####/icon_detail_nomessage.png
/data/data/####/icon_soulgame.png
/data/data/####/icon_title.png
/data/data/####/index
/data/data/####/index.html
/data/data/####/info.xml
/data/data/####/labs.data-journal
/data/data/####/left_bg.png
/data/data/####/libcuid.so
/data/data/####/libonlywechat_plugin.so
/data/data/####/libs.min.js
/data/data/####/ljtq.xml
/data/data/####/max_pref.xml
/data/data/####/middle_bg.png
/data/data/####/multidex.version.xml
/data/data/####/nearme_func_com.soulgame.hero.nearme.gamecenter.xml
/data/data/####/nearme_setting_com.soulgame.hero.nearme.gamecenter.xml
/data/data/####/no_more_left_icon.png
/data/data/####/no_more_right_icon.png
/data/data/####/num_bg.png
/data/data/####/oppo_game_service_236.apk_temp
/data/data/####/oppo_spinner_black_16.png
/data/data/####/oppo_spinner_black_48.png
/data/data/####/path_gn_q30_update4.temp (deleted)
/data/data/####/pl_o_sp.xml
/data/data/####/pl_sp.xml
/data/data/####/plugin_framework.xml
/data/data/####/ps_de.update
/data/data/####/read.xml
/data/data/####/rws_sp.xml
/data/data/####/sdk_201004_1534445139709.zip
/data/data/####/sgads_plugin_config.xml
/data/data/####/sgadssdk_dex.jar
/data/data/####/share.db-journal
/data/data/####/smile_face.png
/data/data/####/soul_shared.xml
/data/data/####/sp_iconfig.xml
/data/data/####/sp_rvp.xml
/data/data/####/sps.xml
/data/data/####/style.css
/data/data/####/table_bg.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/version
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/xconfig.xml
/data/data/####/xsdk_preference.xml
/data/media/####/.Og.meta
/data/media/####/.YiAds.log
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.umm.dat
/data/media/####/2018_08_16
/data/media/####/255633e1-f975-458f-b4f0-e0c2f879ad1f
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/config
/data/media/####/gxdata
/data/media/####/id.tmp
/data/media/####/isread
/data/media/####/journal.tmp
/data/media/####/mcs_msg.ini
/data/media/####/sysid.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"null","utdid":"W3XGUUpSMH0DAGdzx1HrEGy1","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /proc/cpuinfo
chmod 500 <Package Folder>/files/DaemonServer
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
ls /sys/class/thermal
sh

Loads the following dynamic libraries:

cocos2dlua
securityenv
soulgame_checkmd5

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
desede-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial