Android.Mixi.117

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.672.origin
Android.Mixi.16.origin
Android.Mixi.32.origin
Android.Xiny.73.origin

Downloads the following detected threats from the Internet:

Android.Spy.1704

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sl.zhang####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) hiph####.wsh####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) 1####.217.17.46:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5226

DNS requests:

7j####.c####.z0.####.com
c####.g####.ig####.com
c-h####.g####.com
d####.zhuo####.com
down####.zhuo####.com
g.hiph####.b####.com
gp.lik####.com
gp.miaoxi####.com
h####.b####.com
pm.zhuo####.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sl.zhang####.com
www.koapk####.com
www.okyes####.com

HTTP GET requests:

d####.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=#...
d####.zhuo####.com/Api/getStartFigure?packId=####
d####.zhuo####.com/Api/playGift?titleId=####&packId=####
d####.zhuo####.com/upload//b.hiphotos.bdimg.com/wisegame/pic/item/462dd4...
d####.zhuo####.com/upload//c.hiphotos.bdimg.com/wisegame/pic/item/61087b...
d####.zhuo####.com/upload//d.hiphotos.bdimg.com/wisegame/pic/item/4b3434...
d####.zhuo####.com/upload//d.hiphotos.bdimg.com/wisegame/pic/item/88f81a...
d####.zhuo####.com/upload//d.hiphotos.bdimg.com/wisegame/pic/item/c3ec08...
d####.zhuo####.com/upload//download.zhuoyian.com/upload/08DDFCD9AC157B63...
d####.zhuo####.com/upload//download.zhuoyian.com/upload/37D1AA67AC157B62...
d####.zhuo####.com/upload//download.zhuoyian.com/upload/64223430AC157B63...
d####.zhuo####.com/upload//download.zhuoyian.com/upload/64281E4FAC157B63...
d####.zhuo####.com/upload//download.zhuoyian.com/upload/ED90BF1AAC157B63...
d####.zhuo####.com/upload//e.hiphotos.bdimg.com/wisegame/pic/item/4ddda3...
d####.zhuo####.com/upload//g.hiphotos.bdimg.com/wisegame/pic/item/0863f6...
d####.zhuo####.com/upload//g.hiphotos.bdimg.com/wisegame/pic/item/baf9d7...
d####.zhuo####.com/upload//h.hiphotos.bdimg.com/wisegame/pic/item/b42a60...
d####.zhuo####.com/upload/08DDFCD9AC157B63445C5E3411AC11EA.jpg
d####.zhuo####.com/upload/08DDFCDAAC157B633CD7914081AF495A.jpg
d####.zhuo####.com/upload/10360CD1FFFFFFE23EEF9993877424E5.png
d####.zhuo####.com/upload/10360CD1FFFFFFE24BACD1851599EB68.png
d####.zhuo####.com/upload/10360CD1FFFFFFE2644BA22C4910017C.png
d####.zhuo####.com/upload/10360CD2FFFFFFE20E4EAC7F697E4C85.png
d####.zhuo####.com/upload/10360CD2FFFFFFE24F1ECD2F4BE1E796.png
d####.zhuo####.com/upload/B39A6CEFFFFFFFE26FFFB3834FE51B50.jpg
d####.zhuo####.com/upload/D2D08F4Fnull666C58A03FC58BBA.apk
d####.zhuo####.com/upload/ED90BF1AAC157B6369EEEFF1AD90B643.jpg
d####.zhuo####.com/upload/ED90BF1BAC157B6303AED69C561F9A8E.jpg
d####.zhuo####.com/upload/ED90BF1BAC157B63549CBEFB2A2950F9.jpg
gp.miaoxi####.com/cr/sv/getGoFile?name=####
gp.miaoxi####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=...
hiph####.wsh####.com/wisegame/pic/item/0863f6246b600c33814335c1194c510fd...
qin####.com.www.####.com/tdata_EDT369
sl.zhang####.com/apk/des_libneo321.zip
sl.zhang####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
sl.zhang####.com/rtf/408b845b63828fe074b39ecd1cba374c.slze
sl.zhang####.com/rtf/42108637bf1aa8173608aa9259693c1b.slze
sl.zhang####.com/rtf/43048420199e0767a10a7a1a25e65e32.slze
sl.zhang####.com/rtf/611939f8c2ec5798458a1b43c5d12c08.slze
sl.zhang####.com/rtf/6172e4a32338b1deed308f899acf3ce1.slze
sl.zhang####.com/rtf/640adb88b11aaa31cef58f201f381b03.slze
sl.zhang####.com/rtf/8063d9d8538ce6248951fd430b6c7632.slze
sl.zhang####.com/rtf/95039bf01df7c9832986cba2bad47076.slze
t####.c####.q####.####.com/config/hz-hzv3.conf
t####.c####.q####.####.com/tdata_SzD730
t####.c####.q####.####.com/tdata_ZCi456

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
d####.zhuo####.com/Api/AddActivate
d####.zhuo####.com/Api/GetNewVersion
d####.zhuo####.com/Api/UnifiedAccess
d####.zhuo####.com/Api/package
d####.zhuo####.com/Api/playDetail
gp.miaoxi####.com/cr/sv/getEPList
sdk.o####.p####.####.com/api.php?format=####&t=####
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####

File system changes:

Creates the following files:

/data/data/####/.md
/data/data/####/1548158269640_libneo32.so
/data/data/####/20160121.xml
/data/data/####/201708041650.apk
/data/data/####/201708041650.dex
/data/data/####/408.jar
/data/data/####/421.jar
/data/data/####/430.jar
/data/data/####/58D6D09AADCD5690D884B42DA1E1526D
/data/data/####/5A2DEEC9B12BF55348CA0900586E918E
/data/data/####/5youxizhongxing1102DB8520H46
/data/data/####/611.jar
/data/data/####/617.jar
/data/data/####/640.jar
/data/data/####/7F289ED17D94AAB0C0E627FF76A010F4
/data/data/####/800f681bc5b4
/data/data/####/806.jar
/data/data/####/86FC38B4D08448D47AC9D835E2341921
/data/data/####/950.jar
/data/data/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
/data/data/####/D051B0E574F199B89AB4F9632843584B
/data/data/####/D7CB250A86A38C079925FCE27FFB9422
/data/data/####/DB7EB1CE34E4E63060FEF71B573D9BBA
/data/data/####/DownloandFile_db-journal
/data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
/data/data/####/ZYASDKPOIEJMFKL##@!!!.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml (deleted)
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1548158268706
/data/data/####/abc.zip
/data/data/####/ae.xml
/data/data/####/ae.xml.bak
/data/data/####/baseactivity_share_name.xml
/data/data/####/basefragment_share_name.xml
/data/data/####/bdownloaders.db
/data/data/####/bdownloaders.db-journal
/data/data/####/c201708041650.apk
/data/data/####/classes.dex
/data/data/####/com.zhuoyian.youxizhongxing11012golden2
/data/data/####/com.zhuoyian.youxizhongxing110_preferences.xml
/data/data/####/duspf6030945.xml
/data/data/####/gdaemon_20161017
/data/data/####/gpdu
/data/data/####/gx_sp.xml
/data/data/####/hftJcw46N.jar
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libcuid.so
/data/data/####/ntmp22782337
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/rtr.db
/data/data/####/rtr.db-journal
/data/data/####/run.pid
/data/data/####/samsung112.jar
/data/data/####/swith1014.db
/data/data/####/swith1014.db-journal
/data/data/####/tdata_SzD730
/data/data/####/tdata_SzD730.jar
/data/data/####/tdata_ZCi456
/data/data/####/tdata_ZCi456.jar
/data/data/####/test
/data/data/####/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.timestamp
/data/media/####/0863f6246b600c33814335c1194c510fd9f9a185.jpg
/data/media/####/715119f29f736652abd3f673bc8acf54.0
/data/media/####/Alloy Plane.apk
/data/media/####/ED90BF1AAC157B6369EEEFF1AD90B643.jpg
/data/media/####/ED90BF1BAC157B6303AED69C561F9A8E.jpg
/data/media/####/ED90BF1BAC157B63549CBEFB2A2950F9.jpg
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.zhuoyian.youxizhongxing110.db
/data/media/####/journal.tmp
/data/media/####/tdata_SzD730
/data/media/####/tdata_ZCi456
/data/media/####/test.log
/data/media/####/test1548158272812

Miscellaneous:

Executes the following shell scripts:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
app_process /system/bin com.android.commands.pm.Pm path <Package>
awk {print $9}
cat /sys/class/net/wlan0/address
chmod 0771 <Package Folder>/.syslib-
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 770 <Package Folder>/files/.play/test
getenforce
grep 2317
grep 2996
grep 3617
grep 4360
grep 5163
grep 6275
grep 7165
logcat -d -v time
md5 /data/app/<Package>-1.apk
mount
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Loads the following dynamic libraries:

1548158269640_libneo32
com_zhuoyian_youxizhongxing110
getuiext2
libjni-comymrefpackagesjrrbaidu

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial