Android.Backdoor.1553

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.582.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.boo####.com:80
TCP(HTTP/1.1) www.yipi####.net:80
TCP(HTTP/1.1) m.sosta####.com:80
TCP(HTTP/1.1) www.a####.com:80
TCP(HTTP/1.1) s.s####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) www.luo####.com:80
TCP(HTTP/1.1) www.a.sh####.com:80
TCP(HTTP/1.1) www.quanshu####.com:80
TCP(HTTP/1.1) www.laoq####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) www.d####.net:80
TCP(HTTP/1.1) www.0####.com:80
TCP(HTTP/1.1) 1####.ab####.net.####.net:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) zha####.b####.com:80
TCP(HTTP/1.1) www.be####.com:80
TCP(HTTP/1.1) www.ais####.com:80
TCP(HTTP/1.1) www.xwx####.com:80
TCP(HTTP/1.1) a####.com:80
TCP(HTTP/1.1) www.t####.com:80
TCP(HTTP/1.1) www.daj####.net:80
TCP(HTTP/1.1) www.wes####.com:80
TCP(HTTP/1.1) www.miao####.com:80
TCP(HTTP/1.1) www.bi####.com.tw:80
TCP(HTTP/1.1) www.6####.com:80
TCP(HTTP/1.1) img.1####.com.####.com:80
TCP(HTTP/1.1) www.shoujik####.org:80
TCP(HTTP/1.1) www.k####.cn:80
TCP(HTTP/1.1) m.2####.org:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) www.55d####.com:80
TCP(HTTP/1.1) www.qiuxiao####.com:80
TCP(HTTP/1.1) www.si####.cc:80
TCP(HTTP/1.1) www.paos####.cc:80
TCP(HTTP/1.1) www.sh####.com:80
TCP(HTTP/1.1) r####.i####.com:80
TCP(HTTP/1.1) www.91####.org:80
TCP(HTTP/1.1) m.bao####.com:80
TCP(HTTP/1.1) www.bo####.com:80
TCP(HTTP/1.1) www.16####.com:80
TCP(SSL/3.0) www.be####.com:443
TCP(TLS/1.0) r####.i####.com:443
TCP(TLS/1.0) m.2####.org:443
TCP(TLS/1.0) www.miao####.com:443
TCP(TLS/1.0) b####.org.cn.####.com:443
TCP(TLS/1.0) b.f####.com.####.com:443
TCP(TLS/1.0) www.piao####.com:443
TCP(TLS/1.0) www.8####.com.####.cn:443
TCP(TLS/1.0) www.bi####.com:443
TCP(TLS/1.0) www.9####.cc:443
TCP(TLS/1.0) www.88d####.com:443
TCP(TLS/1.0) www.xiaoshu####.com:443
TCP(TLS/1.0) g####.c####.vod.####.com:443
TCP(TLS/1.0) www.i####.com:443
TCP(TLS/1.0) www.w####.net:443
TCP(TLS/1.0) hunhu####.cdn.ggf####.com:443
TCP(TLS/1.0) www.120####.com:443
TCP(TLS/1.0) www.bo####.com:443
TCP(TLS/1.0) www.x####.com:443
TCP(TLS/1.0) www.be####.com:443

DNS requests:

a####.com
a####.u####.com
b.f####.com
c.c####.com
img.1####.com
l####.tbs.qq.com
m.2####.org
m.bao####.com
m.sosta####.com
r####.i####.com
r####.wow####.com
s.s####.com
s19.c####.com
so.f####.com
www.0####.com
www.120####.com
www.16####.com
www.55d####.com
www.6####.com
www.8####.com
www.88d####.com
www.9####.cc
www.91####.org
www.a####.com
www.ab####.net
www.ais####.com
www.b####.com
www.b####.org
www.be####.com
www.bi####.com
www.bi####.com
www.bi####.com.tw
www.bo####.com
www.boo####.com
www.book####.com
www.d####.net
www.daj####.net
www.hunhu####.com
www.i####.com
www.k####.cn
www.laoq####.com
www.luo####.com
www.miao####.com
www.paos####.cc
www.piao####.com
www.qiuxiao####.com
www.quanshu####.com
www.sh####.com
www.shoujik####.cc
www.shoujik####.org
www.si####.cc
www.t####.com
www.v####.com
www.w####.net
www.wes####.com
www.x####.com
www.xais####.com
www.xiaoshu####.com
www.xwx####.com
www.yipi####.net
z8.c####.com
zha####.b####.com

HTTP GET requests:

1####.ab####.net.####.net/book-23020.html
a####.com/38634/
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####
img.1####.com.####.com/api/v1/bookcenter/cover/1/1127281/1127281_a60cdd8...
img.1####.com.####.com/api/v1/bookcenter/cover/1/1228859/1228859_d14f18e...
img.1####.com.####.com/api/v1/bookcenter/cover/1/2044498/2044498_b1e079f...
img.1####.com.####.com/api/v1/bookcenter/cover/1/2107590/2107590_2607eaf...
img.1####.com.####.com/api/v1/bookcenter/cover/1/2126166/2126166_c100233...
img.1####.com.####.com/api/v1/bookcenter/cover/1/41584/41584_873f1d8b2f7...
img.1####.com.####.com/api/v1/bookcenter/cover/1/41613/41613_4aa85589426...
img.1####.com.####.com/api/v1/bookcenter/cover/1/41615/41615_2ee961bffe9...
img.1####.com.####.com/api/v1/bookcenter/cover/1/42091/42091_0a867253fc5...
img.1####.com.####.com/api/v1/bookcenter/cover/1/857368/857368_842851658...
img.1####.com.####.com/api/v1/bookcenter/cover/1/871021/871021_e237d224f...
img.1####.com.####.com/api/v1/bookcenter/cover/1/891697/891697_89791245d...
m.bao####.com/wapbook-130524/
m.bao####.com/wapbook-130524/43033829.html
m.bao####.com/wapbook-130524/43033830.html
m.sosta####.com/appserver/searchtip?word=####&type=####
m.sosta####.com/olconfig.php?aid=####&channel=####&h=####&imei=####&imsi...
m.sosta####.com/recommend/
m.sosta####.com/recommend/ajax.php?s=####&n=####&r=####
m.sosta####.com/recommend/css/iscroll.css?v=####
m.sosta####.com/recommend/css/rank.css?v=####
m.sosta####.com/recommend/css/style.css?v=####
m.sosta####.com/recommend/imgs/loading.gif
m.sosta####.com/recommend/js/base-loading.js
m.sosta####.com/recommend/js/iscroll.js?v=####
m.sosta####.com/recommend/js/jquery-3.2.1.min.js
m.sosta####.com/recommend/m_rank.php
r####.i####.com/180/180800/
r####.i####.com/d/180/180800/
s.s####.com/?Key=####&S=####&SS=####
www.91####.org/dushu/25/25612/
www.a.sh####.com/link?url=####
www.a.sh####.com/s?wd=####&ct=####&si=####&sts=####&rn=####
www.a.sh####.com/search/error.html
www.ais####.com/xs13999.html
www.be####.com/
www.bi####.com.tw/modules/article/soshu.php?searchkey=####
www.bo####.com/search.php?search=####
www.d####.net/dzdsearch/????
www.k####.cn/modules/article/search.php?searchkey=####
www.miao####.com/book/2479/
www.qiuxiao####.com/search.htm?keyword=####
www.quanshu####.com/book_161949.html
www.quanshu####.com/book_28097.html
www.sh####.com/chaopinxiangshi/
www.shoujik####.org/book/keyname.php?q=####&searchtype=####
www.si####.cc/html/20987/
www.si####.cc/modules/article/search.php?searchtype=####&searchkey=####
www.xwx####.com/s.php?ie=####&s=####&q=####
www.yipi####.net/modules/article/search.php?searchkey=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zha####.b####.com/cse/search?q=####&s=####&isNeedCheckDomain=####&jump=#...
zha####.b####.com/cse/search?s=####&ie=####&q=####
zha####.b####.com/cse/search?s=####&q=####
zha####.b####.com/cse/search?s=####&q=####&isNeedCheckDomain=####&jump=#...

HTTP POST requests:

1####.ab####.net.####.net/modules/article/search.php
a####.com/modules/article/search.php
a####.u####.com/app_logs
l####.tbs.qq.com/ajax?c=####&k=####
l####.tbs.qq.com/ajax?c=####&v=####&k=####
m.2####.org/s.php
m.bao####.com/s.php
m.sosta####.com/appserver/
www.0####.com/modules/article/search.php
www.16####.com/modules/article/search.php
www.55d####.com/modules/article/search.php
www.6####.com/modules/article/search.php
www.91####.org/modules/article/search.php
www.a####.com/modules/article/soso.php
www.ais####.com/modules/article/search.php
www.boo####.com/Book/Search.aspx
www.daj####.net/modules/article/searchab.php
www.laoq####.com/modules/article/search.php
www.luo####.com/modules/article/search.php
www.paos####.cc/modules/article/search.php
www.quanshu####.com/modules/article/search.php
www.sh####.com/search.php
www.t####.com/search
www.wes####.com/search_paper.php

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DEVICECODE
/data/data/####/aareaderconfig.xml
/data/data/####/app.dat
/data/data/####/bgconfig1.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/core_info
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/debug.conf
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/fav.db
/data/data/####/fav.db-journal
/data/data/####/index
/data/data/####/libjiagu-1190667161.so
/data/data/####/login.dat
/data/data/####/mb_device_id.xml.xml
/data/data/####/olconfig
/data/data/####/ruleconfig.xml
/data/data/####/searchhis.db
/data/data/####/searchhis.db-journal
/data/data/####/seartch.db
/data/data/####/seartch.db-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/4ef6caea1e81a99d.dat
/data/media/####/5b77bf42c079c6f9.txt
/data/media/####/84577c4c9d34bd7f.dat
/data/media/####/9b354e9532b3ac20.dat
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/book.img
/data/media/####/book.src
/data/media/####/book.tmp
/data/media/####/book.unread
/data/media/####/ee1b290f5d8fcf4c.dat
/data/media/####/fdee6ba3cd79d27c.txt
/data/media/####/mb38999441944
/data/media/####/mb40470579703
/data/media/####/mb62915596527

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu-1190667161.so
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

bookjni
libjiagu-1190667161

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DESede-ECB-PKCS5Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial