Android.Packed.41496

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.3887

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) apk.91h####.com:80
TCP(HTTP/1.1) tt.kyli####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) 362b3d8####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) 4####.97.20.12:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) ope####.m.ta####.com:80
TCP(HTTP/1.1) mt.kap####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) 1####.75.3.32:8881
TCP(HTTP/1.1) dps.wt####.com:8085
TCP(HTTP/1.1) bb.dugeshe####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.non####.####.com:80
TCP(HTTP/1.1) 1####.75.29.14:8961
TCP(HTTP/1.1) dd.arg####.com:80
TCP(HTTP/1.1) cx.v####.com.####.com:80
TCP(HTTP/1.1) js.lotu####.com:80
TCP(HTTP/1.1) ss####.mogu####.com:80
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) crea####.j####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) ttt.arg####.com:80
TCP(HTTP/1.1) hjq.91h####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) kl.kyli####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) cdn.boo####.com.####.net:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) 1####.217.20.78:443
TCP(TLS/1.0) nbsdk-b####.al####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) api.t####.co:443
TCP(TLS/1.0) cx.v####.com.####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) ei.c####.com:443
TCP(TLS/1.0) ad.i####.xyz:443
TCP(TLS/1.0) l####.b####.com:443
TCP acc####.m.ta####.com:80

DNS requests:

362b3d8####.oss-cn-####.aliy####.com
a####.m.ta####.com
a####.man.aliy####.com
acc####.m.ta####.com
acs4bai####.m.ta####.com
ad####.m.ta####.com
ad.i####.xyz
ada####.m.ta####.com
ag####.m.ta####.com
api.kxcon####.com
api.map.b####.com
api.t####.co
apk.91h####.com
bb.dugeshe####.com
bx.imo####.com
c####.mm####.com
c.c####.com
c.xz####.com
cdn.1####.wang
cdn.boo####.com
crea####.j####.com
cx.v####.com
d####.wos####.com
dd.arg####.com
dl.api.kyli####.com
dps.wt####.com
ei.c####.com
hjq.91h####.com
ip.ta####.com
js.lotu####.com
k####.kyli####.com
kl.kyli####.com
l####.b####.com
l####.tbs.qq.com
loc.map.b####.com
log.u####.com
mi.g####.qq.com
mt.kap####.com
nbsdk-b####.al####.com
plb####.u####.com
s####.e.qq.com
s13.c####.com
s22.c####.com
ss####.mogu####.com
tt.kyli####.com
ttt.arg####.com
u####.u####.com
u####.umengc####.com
wb.110.ta####.com
www.ka####.com
y####.al####.com
z1.c####.com
z7.c####.com

HTTP GET requests:

362b3d8####.oss-cn-####.aliy####.com/h.html?id=id=1####&web_id=####
ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
apk.91h####.com/apk/p_le_39.png
apk.91h####.com/apk/urlparse_66369_a.zip
bb.dugeshe####.com/yhws/channel/zy/zyikd.html
c.c####.com/z_stat.php?id=####&web_id=####
crea####.j####.com/cnzz/1272835208.html
crea####.j####.com/cnzz/1274025515.html
cx.v####.com.####.com/es/htpdd/css/index.css
cx.v####.com.####.com/es/htpdd/css/item.css
cx.v####.com.####.com/es/htpdd/css/loading.css
cx.v####.com.####.com/es/htpdd/img/hongbao.png
cx.v####.com.####.com/es/htpdd/img/search.png
cx.v####.com.####.com/es/htpdd/index.html?cid=####
cx.v####.com.####.com/es/htpdd/js/Tools.js
cx.v####.com.####.com/es/htpdd/js/echo.js
cx.v####.com.####.com/es/htpdd/js/index.js
cx.v####.com.####.com/es/htpdd/js/sy.js
cx.v####.com.####.com/es/htpddjs/css/index.css
cx.v####.com.####.com/es/htpddjs/css/item.css
cx.v####.com.####.com/es/htpddjs/css/loading.css
cx.v####.com.####.com/es/htpddjs/img/hongbao.png
cx.v####.com.####.com/es/htpddjs/img/search.png
cx.v####.com.####.com/es/htpddjs/index.html?cid=####
cx.v####.com.####.com/es/htpddjs/js/Tools.js
cx.v####.com.####.com/es/htpddjs/js/echo.js
cx.v####.com.####.com/es/htpddjs/js/index.js
cx.v####.com.####.com/es/htpddjs/js/sy.js
cx.v####.com.####.com/lh/smart/common/wg_1.js
cx.v####.com.####.com/lh/smart/inv/pxinteraction_lx_up_81001.html?td_cha...
cx.v####.com.####.com/lh/smart/smartpull_400537.js
dd.arg####.com/yhws/channel/mj/jfma.html
dps.wt####.com:8085/js/blhc9/yz.js
hjq.91h####.com/hjq/servers/Korean_Info.ashx?method=####&os=####&version...
ip.ta####.com/service/getIpInfo.php?ip=####
js.lotu####.com/lsd.js
k####.kyli####.com.####.com/
k####.kyli####.com.####.com/1541576969414_utils.ttf
k####.kyli####.com.####.com/style/css/kangindex20180922.css
k####.kyli####.com.####.com/style/images/line01.png
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
ope####.m.ta####.com/gw-open/mtop.taobao.tbk.sdk.config/1.0/?data=####
ss####.mogu####.com/singlefun/jspullup/recentjspullup?ggid=####&cid=####...
ttt.arg####.com/getStatus?id=MgV9####&h=####
ttt.arg####.com/getStatus?id=cMev####&h=####
ttt.arg####.com/getStatus?id=cMevUFOW+uA=&h=/cx.v5cam.com/es/htpdd/index...
ttt.arg####.com/z_stat.js?m=tM5zv####&h=####
ttt.arg####.com/z_stat.js?m=tM5zvuDzWco=&h=/cx.v5cam.com/es/htpdd/index....
ttt.arg####.com/z_stat.js?m=wTglz####

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&deviceId=####&pla...
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
api.kxcon####.com:666/v1/config
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/event3.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
hjq.91h####.com/hjq/ip/getmyip?sign=####&ime=####&nwtime=####&os=####&m=...
kl.kyli####.com/klv2/sdkkl/mobile
l####.tbs.qq.com/ajax?c=####&k=####
mt.kap####.com/v1/st
na61-####.wagbr####.ali####.####.com/api/update.do
na61-####.wagbr####.non####.####.com/saveWb.json
s####.e.qq.com/activate
s####.e.qq.com/launch
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
tt.kyli####.com/v2/task/mobile

File system changes:

Creates the following files:

/data/data/####/-1147628818
/data/data/####/06c293053ba299208548ae9134dab73e.0.tmp
/data/data/####/06c293053ba299208548ae9134dab73e.1.tmp
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/0a56c6d6bda22ad262fa1b551e779d74.0.tmp
/data/data/####/0a56c6d6bda22ad262fa1b551e779d74.1.tmp
/data/data/####/0b3c453023aed648b69109a6403e5542.0.tmp
/data/data/####/0b3c453023aed648b69109a6403e5542.1.tmp
/data/data/####/16c35cb4cdf8946414220a00f5bb21ac.0.tmp
/data/data/####/16c35cb4cdf8946414220a00f5bb21ac.1.tmp
/data/data/####/1d77ea041509fe06.lock
/data/data/####/1fa1947927eaa84a42b44f01d7723b1b.0.tmp
/data/data/####/1fa1947927eaa84a42b44f01d7723b1b.1.tmp
/data/data/####/21c22f492aba3de8.lock
/data/data/####/320f03c25e3a2686d55a13cb77f312f1.0.tmp
/data/data/####/320f03c25e3a2686d55a13cb77f312f1.1.tmp
/data/data/####/322ccbcd42175d3ef4c8f1c30d720e85.0.tmp
/data/data/####/322ccbcd42175d3ef4c8f1c30d720e85.1.tmp
/data/data/####/36fa2c5ae25ffc19153d55e96a7b0f36.0.tmp
/data/data/####/36fa2c5ae25ffc19153d55e96a7b0f36.1.tmp
/data/data/####/471397940.dex
/data/data/####/471397940.jar
/data/data/####/5a0cfdb4f40d26be2cc6371c16167fe1.0.tmp
/data/data/####/5a0cfdb4f40d26be2cc6371c16167fe1.1.tmp
/data/data/####/5cd4828bf90674d16ad9ff4a7d82d6a5.0.tmp
/data/data/####/5cd4828bf90674d16ad9ff4a7d82d6a5.1.tmp
/data/data/####/6f46fedeb40ef89194d6c26572da4786
/data/data/####/6f6bad3e4a3231b8041242dd1b6f8332.0.tmp
/data/data/####/6f6bad3e4a3231b8041242dd1b6f8332.1.tmp
/data/data/####/721d9bb7fba6632ac0e597990ab96364.0.tmp
/data/data/####/721d9bb7fba6632ac0e597990ab96364.1.tmp
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/96acd0af0ce515c36c5c174df9afd443.0.tmp
/data/data/####/96acd0af0ce515c36c5c174df9afd443.1.tmp
/data/data/####/9bf195f5a6a0a79bfa26905a23a900da.0.tmp
/data/data/####/9bf195f5a6a0a79bfa26905a23a900da.1.tmp
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/AlibcLinkPartner.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/SGMANAGER_DATA2
/data/data/####/SGMANAGER_DATA2 (deleted)
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/aliTradeConfigSP.xml
/data/data/####/android-util.zip
/data/data/####/ap.Lock
/data/data/####/app_spf_scli.xml
/data/data/####/authStatus_com.leku.hmsq;remote.xml
/data/data/####/auth_sdk_device.xml
/data/data/####/b3034fb6b9f686b59f86ca60b9e4c8cf.0.tmp
/data/data/####/b3034fb6b9f686b59f86ca60b9e4c8cf.1.tmp
/data/data/####/b8c3608afa1816d3928c2f86698963ea.0.tmp
/data/data/####/b8c3608afa1816d3928c2f86698963ea.1.tmp
/data/data/####/c1cde01f932e9347095abc6529ec87a8.0.tmp
/data/data/####/c1cde01f932e9347095abc6529ec87a8.1.tmp
/data/data/####/c8b3c34996ffdeddf5b63fc6ad66104e.0.tmp
/data/data/####/c8b3c34996ffdeddf5b63fc6ad66104e.1.tmp
/data/data/####/com.leku.hmsq-1.apk.classes2.dex
/data/data/####/com.leku.hmsq-1.apk.classes3.dex
/data/data/####/com.leku.hmsq_preferences.xml
/data/data/####/core_info
/data/data/####/corelib.tmp.jar
/data/data/####/cwnamd
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTU3Mzg4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTU4ODEz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTY1NTg5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTY2ODMw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTYwNDE1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTc2MTI1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTc3NjUx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTcyNjMy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTgwNzc1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTk3MDIz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTkxODQ0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMTkzNDkz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMjA2NDAx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMjAwNTUy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0NDQwMjIwNTQ0;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dcSharedPreferences.dat.xml
/data/data/####/default.xml
/data/data/####/defaultpref1.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/e185ef0bea91f6c171b9be2f47e62b26.0.tmp
/data/data/####/e185ef0bea91f6c171b9be2f47e62b26.1.tmp
/data/data/####/eaab3a4e8f27294da618a2f23f7d9054.0.tmp
/data/data/####/eaab3a4e8f27294da618a2f23f7d9054.1.tmp
/data/data/####/evernote_jobs.db
/data/data/####/evernote_jobs.db-journal
/data/data/####/evernote_jobs.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0c61b5e74a80fc96be041a3e7eb02b2.0.tmp
/data/data/####/f0c61b5e74a80fc96be041a3e7eb02b2.1.tmp
/data/data/####/f24cdb71a8ed512cd9f12bcef7be997b.0.tmp
/data/data/####/f24cdb71a8ed512cd9f12bcef7be997b.1.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/fc4094ea37f76eb2fd7ec4ad0b4b5e72.0.tmp
/data/data/####/fc4094ea37f76eb2fd7ec4ad0b4b5e72.1.tmp
/data/data/####/firll.dat
/data/data/####/gdt_plugin.dex
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_suid
/data/data/####/hjtv.xml
/data/data/####/hmsq.xml
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/http_cx.v5cam.com_0.localstorage-journal
/data/data/####/http_www.kang97.com_0.localstorage-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/libsgsecuritybodyso-5.1.25.so.tmp
/data/data/####/load_MTAwMF8xMjAxXzExMDAwMjAw;.xml
/data/data/####/lock.lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/odddk.xml
/data/data/####/p.l
/data/data/####/pl_sp.xml
/data/data/####/plugin_v3_471397940.jar.lock
/data/data/####/plugins.xml
/data/data/####/rws_sp.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/share.db
/data/data/####/share.db-journal
/data/data/####/sp.lock
/data/data/####/sp_config.xml
/data/data/####/sp_iconfig.xml
/data/data/####/spf_configss.xml
/data/data/####/spf_configss.xml.bak
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/timestamp
/data/data/####/tmp-com.leku.hmsq-1.apk.classes-1616722407.zip
/data/data/####/tmp-com.leku.hmsq-1.apk.classes1521582845.zip
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/data/####/use_MTAwMF8xMjAxXzExMDAwMjAw;.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.jsDex.apk
/data/media/####/.nomedia
/data/media/####/.urlparse.zip
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a607d2f7f11240b199e56d9d29d49378
/data/media/####/b3777832e1194b55ae7ebfe040acca4f
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat
/data/media/####/urlparse.js

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:56fcdf9f67e58e6e4c000cee","utdid":"XA5JXCEqQi4DAGdzx1Ga6Vv2","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
getprop ro.product.cpu.abi
grep 5757
ls -l /system/bin/su
ls /sys/class/thermal
mount
ps
sh

Loads the following dynamic libraries:

locSDK7b
optimize
sgmainso-5.1
sgsecuritybodyso-5.1
tnet-3.1
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial