Android.Packed.39410

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) large11####.c####.l####.####.com:80
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) b.qchann####.cn:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) do####.g####.uc.cn:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) 1####.131.24.61:80
TCP(HTTP/1.1) dow####.g####.uc.cn:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) reso####.msg.xi####.net:80
TCP(HTTP/1.1) cdn.app.fr####.top:80
TCP(HTTP/1.1) mon####.uu.qq.com:80
TCP(HTTP/1.1) www.q####.cn:80
TCP(TLS/1.0) m.i####.com:443
TCP(TLS/1.0) b####.be####.top:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) regi####.xm####.xi####.com:443
TCP(TLS/1.0) oth.eve.mdt.####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP 47.74.1####.156:5222
TCP 4####.62.94.2:443
UDP 1####.168.119.254:4466

DNS requests:

allre####.re####.qq.com
b####.be####.top
b.qchann####.cn
cdn.app.fr####.top
cdn.img.fly####.top
do####.g####.uc.cn
dow####.g####.uc.cn
l####.tbs.qq.com
m.i####.com
mon####.uu.qq.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
pis.al####.com
pns.al####.com
pss.al####.com
pus.al####.com
regi####.xm####.xi####.com
reso####.msg.xi####.net
ssl.google-####.com
www.q####.cn
www.qchann####.cn

HTTP GET requests:

cdn.app.fr####.top/upload/201808/31/app/20180831180519896.apk
cdn.app.fr####.top/upload/201809/4/app/20180904134109784.apk
cdn.app.fr####.top/upload/201809/5/app/20180905095638285.apk
do####.g####.uc.cn/download/package/2416-100101531
dow####.g####.uc.cn/s/0/0/20180827170008_ninegame_v5.2.1.1_build_1808271...
large11####.c####.l####.####.com/upload/201806/22/img/20180622182119519....
large11####.c####.l####.####.com/upload/201808/9/img/20180809170726401.png
large11####.c####.l####.####.com/upload/201809/4/img/20180904134105867.png
large11####.c####.l####.####.com/upload/201809/5/img/20180905095630579.png
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
reso####.msg.xi####.net/gslb/?ver=4.0&type=wap&conpt=dvidpodv >>4>>4>>4...
www.q####.cn/n/dpz/?app=####&uid=####&sv=####&appver=####&osver=####&cve...

HTTP POST requests:

b.qchann####.cn/n/qts?uid=####&appkey=####&did=####&sdk=####&type=####&r...
l####.tbs.qq.com/ajax?c=####&k=####
mon####.uu.qq.com/analytics/rqdsync
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
www.qchann####.cn/center/adj?uid=####&ak=####&offline=####
www.qchann####.cn/center/adj?uid=####&appkey=####&did=####&sdk=####&type...

Modified file system:

Creates the following files:

/data/data/####/28399a01-6b18-4df8-af17-6ee10dc44c3a
/data/data/####/29f579ca-616f-469a-8619-193485df77b3.jar
/data/data/####/2c9560ca-057f-4a12-9208-8b6855b6a7bb.jar
/data/data/####/5d3003fc-5cda-4939-a4f8-6e4d021770ee
/data/data/####/6396dbef-ab2c-4edd-8608-a4d9f9ea354a
/data/data/####/6cce9981-4020-4c88-b873-20871a1bae85
/data/data/####/ApplicationCache.db-journal
/data/data/####/BIZ_CONFIG.xml
/data/data/####/Beacon_sig_1.lock
/data/data/####/DENGTA_META.xml
/data/data/####/DENGTA_META.xml (deleted)
/data/data/####/HMTAGENT_INFO.xml
/data/data/####/LOGIN.xml
/data/data/####/PLUGIN_CLIENT_VERSION_SETTING.xml
/data/data/####/QT.xml
/data/data/####/READ_CONFIG.xml
/data/data/####/REPORT.xml
/data/data/####/SETTING.xml
/data/data/####/SUBOXLOG_
/data/data/####/SYS_CONFIG.xml
/data/data/####/ads-1944190462.jar
/data/data/####/alldown.xml
/data/data/####/ar.xml
/data/data/####/arch.xml
/data/data/####/ba87f059-0eef-4cef-bdab-c3615769606e
/data/data/####/beacon_db-journal
/data/data/####/c8666808-e5ef-4d2b-aa69-9fbb9736b587.jar
/data/data/####/com.qq.reader-1.apk.classes-1944190462.zip
/data/data/####/com.qq.reader-1.apk.classes992606038.zip
/data/data/####/config
/data/data/####/config.gz
/data/data/####/config.xml
/data/data/####/core_info
/data/data/####/d8d6b8dd-8060-495c-9515-b4e4eeae8acc.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.db
/data/data/####/default.db-journal
/data/data/####/e8d2d47e-2ff4-4991-8adf-91d5bafca2dd.jar
/data/data/####/eup_db
/data/data/####/eup_db-journal
/data/data/####/gaClientId
/data/data/####/geofencing.db
/data/data/####/geofencing.db-journal
/data/data/####/google_analytics_v4.db-journal
/data/data/####/hmt_agent_commonutill_com.qq.reader.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_irsuid.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/index
/data/data/####/isfirst.xml
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc_new.so
/data/data/####/mipush.xml
/data/data/####/mipush_extra.xml
/data/data/####/multidex.version.xml
/data/data/####/o.xml
/data/data/####/online.db
/data/data/####/online.db-journal
/data/data/####/openudid_prefs.xml
/data/data/####/pcdnconfigs.xml
/data/data/####/pcdnconfigs.xml.bak
/data/data/####/qtsession.xml
/data/data/####/remarks.db
/data/data/####/remarks.db-journal
/data/data/####/setContext.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbslock.txt
/data/data/####/theme.xml
/data/data/####/theme.xml (deleted)
/data/data/####/v.jar
/data/data/####/webversion.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/x_hup.db-journal
/data/media/####/-1095004204.0
/data/media/####/-1103490328.0
/data/media/####/-1158882563.0
/data/media/####/-1196477945.0
/data/media/####/-1277835294.0
/data/media/####/-1325560664.0
/data/media/####/-1681810218.0
/data/media/####/-1705499485.0
/data/media/####/-1967192738.0
/data/media/####/-2039091584.0
/data/media/####/-2139159264.0
/data/media/####/-279988536.0
/data/media/####/-285661441.0
/data/media/####/-285661442.0
/data/media/####/-285661443.0
/data/media/####/-285661444.0
/data/media/####/-285661445.0
/data/media/####/-355051955.0
/data/media/####/-418930314.0
/data/media/####/-437619651.0
/data/media/####/-61648948.0
/data/media/####/-634133156.0
/data/media/####/-712333321.0
/data/media/####/-801601197.0
/data/media/####/-820856655.0
/data/media/####/-938312507.0
/data/media/####/-941857969.0
/data/media/####/.nomedia
/data/media/####/071cb814429c539831f71709c70ff621
/data/media/####/0a2a970a05156
/data/media/####/113f6c28b569f
/data/media/####/11_3_c.png
/data/media/####/12_4_c.png
/data/media/####/1396589703.0
/data/media/####/14_5_c.png
/data/media/####/1_1_c.png
/data/media/####/1_c.png
/data/media/####/25_6_c.png
/data/media/####/29_7_c.png
/data/media/####/2_c.png
/data/media/####/3_c.png
/data/media/####/434147411.0
/data/media/####/447d791b372ec
/data/media/####/4_c.png
/data/media/####/4a900ad0f92efb63f829cc538e68cf68
/data/media/####/4f7f59c9a78d89f393a3126ba67ce3aee4258fe23e3399....0.tmp
/data/media/####/530369258.0
/data/media/####/5_c.png
/data/media/####/62ef3770c72cd
/data/media/####/6_c.png
/data/media/####/7_c.png
/data/media/####/93792b7b39426006fd974d2219ff521f
/data/media/####/94b65fdd7dff244b9724e19141aa4b7c.apk
/data/media/####/964029037.0
/data/media/####/account.db
/data/media/####/adv.db
/data/media/####/adv.db-journal
/data/media/####/app
/data/media/####/b.tmp
/data/media/####/b.tmp (deleted)
/data/media/####/b5b2558b4739ffc5469bca51f6112a7f.apk
/data/media/####/d532a8a939728e360d9814fe80b494ba.apk
/data/media/####/fc7c16608a164f476b25d843a3425dca
/data/media/####/journal.rl
/data/media/####/journal.tmp
/data/media/####/log.lock
/data/media/####/log1.txt
/data/media/####/meta.dat
/data/media/####/myself.dat
/data/media/####/plugin.db
/data/media/####/qt.csv.1536307302653.txt
/data/media/####/record.db
/data/media/####/skinlist.db
/data/media/####/skinlist.db-journal
/data/media/####/tid.db
/data/media/####/uuid
/data/media/####/webcolumn.db

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
cat /proc/cpuinfo
cat /proc/version
chmod 777/storage/emulated/0/Android/data/<Package>/files/Download/spark/b/94b65fdd7dff244b9724e19141aa4b7c.apk
chmod 777/storage/emulated/0/Android/data/<Package>/files/Download/spark/b/b5b2558b4739ffc5469bca51f6112a7f.apk
chmod 777/storage/emulated/0/Android/data/<Package>/files/Download/spark/b/d532a8a939728e360d9814fe80b494ba.apk
getprop androVM.vbox_dpi
getprop androVM.vbox_graph_mode
getprop init.svc.droid4x
getprop init.svc.microvirtd
getprop init.svc.noxd
getprop init.svc.qemud
getprop init.svc.su_kpbs_daemon
getprop init.svc.ttVM_x86-setup
getprop init.svc.vbox86-setup
getprop init.svc.xxkmsg
getprop ro.kernel.android.qemud
getprop ro.product.manufacturer
ps -P

Loads the following dynamic libraries:

libpcdn_acc
pcdn_acc

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Gains access to camera interface.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial