Android.DownLoader.4158

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.127.origin
Android.Xiny.20

Downloads the following detected threats from the Internet:

Android.Xiny.20

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) x####.tc.qq.com:80
TCP(HTTP/1.1) img.cool####.cn:80
TCP(HTTP/1.1) r.eli####.cn:80
TCP(HTTP/1.1) fupi####.biaoqin####.com.####.cn:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) v.qq.com.####.net:80
TCP(HTTP/1.1) fuciyua####.biaoqin####.com.####.cn:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) yes.yuchan####.com.cn:80
TCP(HTTP/1.1) uploads####.biaoqin####.com:80
TCP(HTTP/1.1) fuciyua####.biaoqin####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) u####.biaoqin####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(TLS/1.0) x####.tc.qq.com:443
TCP(TLS/1.0) t####.qq.com:443
TCP(TLS/1.0) ty.cap####.qq.com:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) ui.ptlo####.qq.com:443
TCP(TLS/1.0) ssl.cap####.qq.com:443
TCP(TLS/1.0) v.qq.com.####.net:443
TCP(TLS/1.0) pin####.qq.com:443
TCP(TLS/1.0) cap####.g####.com.####.com:443
TCP(TLS/1.0) bt####.qq.com:443
TCP(TLS/1.0) v####.qq.com.####.net:443
TCP(TLS/1.0) pay.v####.qq.com:443
TCP(TLS/1.0) aserver####.m.ta####.com:443
TCP(TLS/1.0) p####.tc.qq.com:443

DNS requests:

a####.u####.com
a.appj####.com
api.y####.com
bt####.qq.com
cap####.g####.com
car####.chu####.com
f####.qq.com
fuciyua####.biaoqin####.com
fuciyua####.biaoqin####.com
fuciyua####.biaoqin####.com
fuciyua####.biaoqin####.com
fupi####.biaoqin####.com
i.g####.cn
img.cool####.cn
imgc####.qq.com
m.v.q####.com
mo####.b####.com
oc.u####.com
p####.q####.cn
pay.v####.qq.com
pin####.qq.com
pv.s####.com
q.q####.cn
r.eli####.cn
ssl.cap####.qq.com
t####.qq.com
thi####.q####.cn
ty.cap####.qq.com
u####.biaoqin####.com
ui.ptlo####.qq.com
uploads####.biaoqin####.com
v####.qq.com
v.q####.com
vm.g####.cn
yes.yuchan####.com.cn

HTTP GET requests:

fuciyua####.biaoqin####.com.####.cn/works/0/102050.jpg
fuciyua####.biaoqin####.com.####.cn/works/0/108320.jpg
fuciyua####.biaoqin####.com.####.cn/works/1/102051.jpg
fuciyua####.biaoqin####.com.####.cn/works/2/102092.jpg
fuciyua####.biaoqin####.com.####.cn/works/2/108312.jpg
fuciyua####.biaoqin####.com.####.cn/works/3/108313.jpg
fuciyua####.biaoqin####.com.####.cn/works/4/36184.jpg
fuciyua####.biaoqin####.com.####.cn/works/4/36194.jpg
fuciyua####.biaoqin####.com.####.cn/works/5/102025.jpg
fuciyua####.biaoqin####.com.####.cn/works/6/102046.jpg
fuciyua####.biaoqin####.com.####.cn/works/6/108286.jpg
fuciyua####.biaoqin####.com.####.cn/works/6/108346.jpg
fuciyua####.biaoqin####.com.####.cn/works/6/36316.jpg
fuciyua####.biaoqin####.com.####.cn/works/6/95656.jpg
fuciyua####.biaoqin####.com.####.cn/works/7/102047.jpg
fuciyua####.biaoqin####.com.####.cn/works/7/108347.jpg
fuciyua####.biaoqin####.com.####.cn/works/8/102058.jpg
fuciyua####.biaoqin####.com.####.cn/works/8/108348.jpg
fuciyua####.biaoqin####.com.####.cn/works/8/81838.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/101659.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/102049.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/102059.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/108349.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/40249.jpg
fuciyua####.biaoqin####.com.####.cn/works/9/78959.jpg
fuciyua####.biaoqin####.com/commentlist?work=####&type=####&pagesize=###...
fuciyua####.biaoqin####.com/config/adcontrol.json?plat=####&ver=####&uid...
fuciyua####.biaoqin####.com/fuciyuan/v1//videov1main_1.json?plat=####&ve...
fuciyua####.biaoqin####.com/fuciyuan/v1/comic1_1.json?plat=####&ver=####...
fuciyua####.biaoqin####.com/fuciyuan/v1/comic3_1.json?plat=####&ver=####...
fuciyua####.biaoqin####.com/fuciyuan/v1/comic4_1.json?plat=####&ver=####...
fuciyua####.biaoqin####.com/fuciyuan/v1/comic6_1.json?plat=####&ver=####...
fuciyua####.biaoqin####.com/fuciyuan/v1/comichot_1.json?plat=####&ver=##...
fuciyua####.biaoqin####.com/fuciyuan/v1/comicmain_1.json?plat=####&ver=#...
fuciyua####.biaoqin####.com/fuciyuan/v1/sections/108349.json?plat=####&v...
fuciyua####.biaoqin####.com/fupic/v1/fupicmain_1.json?plat=####&ver=####...
fuciyua####.biaoqin####.com/fupic/v1/pics/hot/1.json?plat=####&ver=####&...
fuciyua####.biaoqin####.com/user0.jpg
fupi####.biaoqin####.com.####.cn/16/16.jpg
fupi####.biaoqin####.com.####.cn/167/167.jpg
fupi####.biaoqin####.com.####.cn/269/269.jpg
fupi####.biaoqin####.com.####.cn/272/272.jpg
fupi####.biaoqin####.com.####.cn/288/288.jpg
fupi####.biaoqin####.com.####.cn/419/419.jpg
fupi####.biaoqin####.com.####.cn/48/48.jpg
fupi####.biaoqin####.com.####.cn/596/596.jpg
fupi####.biaoqin####.com.####.cn/97/97.jpg
fupi####.biaoqin####.com.####.cn/channels/17/17.jpg
fupi####.biaoqin####.com.####.cn/channels/21/21.jpg
fupi####.biaoqin####.com.####.cn/channels/27/27.jpg
fupi####.biaoqin####.com.####.cn/channels/28/28.jpg
fupi####.biaoqin####.com.####.cn/channels/30/30.jpg
fupi####.biaoqin####.com.####.cn/channels/34/34.jpg
fupi####.biaoqin####.com.####.cn/channels/40/40.jpg
fupi####.biaoqin####.com.####.cn/channels/43/43.jpg
fupi####.biaoqin####.com.####.cn/channels/44/44.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/103/103.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/104/104.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/110/110.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/114/114.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/16/16.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/28/28.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/47/47.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/91/91.jpg
fupi####.biaoqin####.com.####.cn/fuciyuanvideopic/94/94.jpg
gdv.a.s####.com/cityjson?ie=####
img.cool####.cn/2011/gou.jar
thi####.q####.cn/qqapp/1105063893/263DEC9FB2787512F635C427DBF48451/100
thi####.q####.cn/qqapp/1105063893/3E2B587E8C8935B698BA90A0F71EDFB5/100
thi####.q####.cn/qqapp/1105063893/4B34F4D4B278CEA6D5D8B06368512226/100
thi####.q####.cn/qqapp/1105063893/629A9A0E181B7F6EAC14C863CA49A95D/100
thi####.q####.cn/qqapp/1105063893/69C1D3A3EF68630C4809B648C0983771/100
thi####.q####.cn/qqapp/1105063893/9E7BE5A0F0C0D81F4DDEAAE64CB244F6/100
thi####.q####.cn/qqapp/1105063893/EB4C95467B5E875A323363382CB04AAF/100
thi####.q####.cn/qqapp/1105864215/69B9586CF3697FBF6E0AECC639465DFE/100
thi####.q####.cn/qqapp/1105864215/A5A16C6BBFF6539260EAB144020A94EB/100
thi####.q####.cn/qqapp/1105864215/F0071CFEE2D7EA5FFB3E5564DABE6CC5/100
uploads####.biaoqin####.com/upic/15505463016182977003.jpg?x-oss-process=...
v.qq.com.####.net/cover/q/qoy263ioaan7g0e.html?vid=####
v.qq.com.####.net/detail/q/qoy263ioaan7g0e.html?vid=####
v.qq.com.####.net/vcover_hz_pic/0/bqjqhd2ym6slani1491989796/0
v.qq.com.####.net/vcover_hz_pic/0/ndd165x9imhawbd1480443253/0
v.qq.com.####.net/vcover_hz_pic/0/p5yfnziow4uwunf1489997172/0
v.qq.com.####.net/vcover_hz_pic/0/s8m2i4jpyzko3wxt1472457791.jpg/0
v.qq.com.####.net/vcover_hz_pic/0/srrq91kwr1fc34mt1444830170.jpg/0
v.qq.com.####.net/vcover_hz_pic/0/w9galx5d4dm0udot1472461405.jpg/0
v.qq.com.####.net/x/cover/qoy263ioaan7g0e.html?vid=####
x####.tc.qq.com/qqlive/img/jpgcache/files/qqvideo/q/qoy263ioaan7g0e.jpg
yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####

HTTP POST requests:

a####.u####.com/app_logs
a.appj####.com/ad-service/ad/mark
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
r.eli####.cn/k1?requestId=####&g=####&ua=####
u####.biaoqin####.com/uplog?ver=####&uid=####&sid=####&app=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/Alvin2.xml
/data/data/####/AppInfo.xml
/data/data/####/AppStore.xml
/data/data/####/ContextData.xml
/data/data/####/PlayerUIApk.apk
/data/data/####/W_Key.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/a.xml
/data/data/####/analytics_agent_header_.xml
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/funvcomic.db-journal
/data/data/####/index
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_mobi.k8dd5.a077d820
/data/data/####/mobclick_agent_online_setting_mobi.k8dd5.a077d8.xml
/data/data/####/mobi.k8dd5.a077d8_preferences.xml
/data/data/####/mobi.k8dd5.a077d8_preferences.xml.bak
/data/data/####/st.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/-1002467377.jpg
/data/media/####/-1012169281.
/data/media/####/-1057758762.jpg
/data/media/####/-1072650289.jpg
/data/media/####/-1126457235.jpg
/data/media/####/-1169701791.jpg
/data/media/####/-1180627701.jpg
/data/media/####/-1198330942.jpg
/data/media/####/-1231450730
/data/media/####/-1233300367.jpg
/data/media/####/-1235684515
/data/media/####/-1310633941.jpg
/data/media/####/-1316071898.jpg
/data/media/####/-141390891.jpg
/data/media/####/-1424516500.jpg
/data/media/####/-1455792010.jpg
/data/media/####/-1477708605.jpg
/data/media/####/-1542017270.jpg
/data/media/####/-1560594742.jpg
/data/media/####/-1646140817.jpg
/data/media/####/-1681232273.jpg
/data/media/####/-1682803569
/data/media/####/-1690600982.jpg
/data/media/####/-1707115662.
/data/media/####/-1708731618
/data/media/####/-1756789128.jpg
/data/media/####/-1775287651
/data/media/####/-1845058417.jpg
/data/media/####/-1919660356.jpg
/data/media/####/-1924673482.jpg
/data/media/####/-194963048.jpg
/data/media/####/-1962717524.jpg
/data/media/####/-1973126425.
/data/media/####/-2008884561.jpg
/data/media/####/-219359438.jpg
/data/media/####/-230059249.jpg
/data/media/####/-298096393
/data/media/####/-314702808.jpg
/data/media/####/-444709048.jpg
/data/media/####/-4592857.
/data/media/####/-520544822.jpg
/data/media/####/-549173973.jpg
/data/media/####/-574715288.jpg
/data/media/####/-650551062.jpg
/data/media/####/-704721528.jpg
/data/media/####/-722291284.jpg
/data/media/####/-736042746.
/data/media/####/-791763376.jpg
/data/media/####/-809186453.jpg
/data/media/####/-939192693.jpg
/data/media/####/1006482990.jpg
/data/media/####/1079183983.jpg
/data/media/####/1180914236
/data/media/####/1196807892
/data/media/####/129126817.jpg
/data/media/####/1396015500.jpg
/data/media/####/1410450208.jpg
/data/media/####/1568612281
/data/media/####/1658472444.jpg
/data/media/####/1681409273.jpg
/data/media/####/1685455603.
/data/media/####/174723736.
/data/media/####/1821153667
/data/media/####/187710210.jpg
/data/media/####/2042578519
/data/media/####/284125900.jpg
/data/media/####/305646890.
/data/media/####/306215854.
/data/media/####/4.8_gou.jar.tmp
/data/media/####/415252476.jpg
/data/media/####/49741814.jpg
/data/media/####/671083567.jpg
/data/media/####/786241241.
/data/media/####/870001167.jpg
/data/media/####/974137779.
/data/media/####/990167062.jpg
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/restime.dat

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

glg
libjiagu
luajava

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial