Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.309
- Android.Xiny.240.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) e.angs####.com:5284
- TCP(HTTP/1.1) 1####.159.18.80:8000
- TCP(HTTP/1.1) i####.cn.com:80
- TCP(HTTP/1.1) sd####.cm####.com:80
- TCP(HTTP/1.1) drm.cm####.com:80
- TCP(HTTP/1.1) app####.m####.cn:8080
- TCP(HTTP/1.1) 2####.111.8.140:8080
- TCP(HTTP/1.1) 1####.89.97.82:8000
- TCP(HTTP/1.1) e.angs####.com:6284
- TCP(HTTP/1.1) 1####.159.18.80:8001
- TCP(HTTP/1.1) s####.cmv####.cn.####.com:8080
- TCP(HTTP/1.1) aser####.1####.cn:80
- TCP(HTTP/1.1 X-OF-Signature: 897IyTKpFCo9qECrS7NwX69PK6k= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980QicXYQalp6bPjHvL platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 841933499642895 imsi: 460079592386029 signer: 897IyTKpFCo9qECrS7NwX69PK6k= sdkSessionId: 02KZ7wJ7oYfd platFormId: 03 Content-Length: 546 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=8E0889887B01A1824120AC8B8614F971 Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%4002KZ7wJ7oYfd%2Ctel%4013903265500%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40608716061083%2CchannelId%4042725043%2CinstallFlag%400%2CstartFlag%402%2Cpacker%40%2Cuuid%40af6d717dd32e42568eb19f964760c17a%2Cimei%40841933499642895%2Cimsi%40460079592386029%2CmacAddr%400229beace4ad%2Cbrand%40alps%2Cmodel%40HTC%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A58%2CeventInvokeTime%401%2CeventType%401%2CeventId%40E0001) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: LWZMIxj1+VKocmutIxexdhQyWVM= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980vCshkgTbLqKTu8hH platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 373898807495672 imsi: 460004575634236 signer: LWZMIxj1+VKocmutIxexdhQyWVM= sdkSessionId: xMGyuXGgLZNQ platFormId: 03 Content-Length: 603 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=A8EF258931320DAEAC96C7A67D369730 Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%40xMGyuXGgLZNQ%2Ctel%4013981053642%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40689116070656%2CchannelId%4042718018%2CinstallFlag%401%2CstartFlag%401%2Cpacker%40%2Cuuid%40af7ff59a6e954a84abcd7a0f70f04a28%2Cimei%40373898807495672%2Cimsi%40460004575634236%2CmacAddr%40d82ddb48b598%2Cbrand%40Lanix%2Cmodel%40Ilium+L1000%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A52%2CeventInvokeTime%4023%2CeventId%40E0009_1%2CloginAccount%4013981053642%2CloginMode%402%2CeventType%409) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: QmU24ojRfv413lpRA8J0ZuqiP0o= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980QicXYQalp6bPjHvL platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 841933499642895 imsi: 460079592386029 signer: QmU24ojRfv413lpRA8J0ZuqiP0o= sdkSessionId: 02KZ7wJ7oYfd platFormId: 03 Content-Length: 546 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Accept-Encoding: gzip data=sdkSessionId%4002KZ7wJ7oYfd%2Ctel%4013903265500%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40608716061083%2CchannelId%4042725043%2CinstallFlag%401%2CstartFlag%401%2Cpacker%40%2Cuuid%40af6d717dd32e42568eb19f964760c17a%2Cimei%40841933499642895%2Cimsi%40460079592386029%2CmacAddr%400229beace4ad%2Cbrand%40alps%2Cmodel%40HTC%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A46%2CeventInvokeTime%401%2CeventType%401%2CeventId%40E0001) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: YRFD7Gwwvdr+4fJoBwOwXZVd3mI= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980vCshkgTbLqKTu8hH platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 373898807495672 imsi: 460004575634236 signer: YRFD7Gwwvdr+4fJoBwOwXZVd3mI= sdkSessionId: xMGyuXGgLZNQ platFormId: 03 Content-Length: 555 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Accept-Encoding: gzip data=sdkSessionId%40xMGyuXGgLZNQ%2Ctel%4013981053642%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40689116070656%2CchannelId%4042718018%2CinstallFlag%401%2CstartFlag%401%2Cpacker%40%2Cuuid%40af7ff59a6e954a84abcd7a0f70f04a28%2Cimei%40373898807495672%2Cimsi%40460004575634236%2CmacAddr%40d82ddb48b598%2Cbrand%40Lanix%2Cmodel%40Ilium+L1000%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A45%2CeventInvokeTime%401%2CeventType%401%2CeventId%40E0001) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: bBQk0I7665H4Qn2kG8/iWfZSrHM= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980QicXYQalp6bPjHvL platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 841933499642895 imsi: 460079592386029 signer: bBQk0I7665H4Qn2kG8/iWfZSrHM= sdkSessionId: 02KZ7wJ7oYfd platFormId: 03 Content-Length: 594 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=6739AD9ED9E398F5B8EB3E985E52F6A8 Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%4002KZ7wJ7oYfd%2Ctel%4013903265500%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40608716061083%2CchannelId%4042725043%2CinstallFlag%401%2CstartFlag%401%2Cpacker%40%2Cuuid%40af6d717dd32e42568eb19f964760c17a%2Cimei%40841933499642895%2Cimsi%40460079592386029%2CmacAddr%400229beace4ad%2Cbrand%40alps%2Cmodel%40HTC%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A52%2CeventInvokeTime%4023%2CeventId%40E0009_1%2CloginAccount%4013903265500%2CloginMode%402%2CeventType%409) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: g60w7i5jzw18TGaXy60Eg7ibZf0= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980vCshkgTbLqKTu8hH platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 373898807495672 imsi: 460004575634236 signer: g60w7i5jzw18TGaXy60Eg7ibZf0= sdkSessionId: xMGyuXGgLZNQ platFormId: 03 Content-Length: 603 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=7A84EA3D9CC6DA55385CBA4F07ECCC47 Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%40xMGyuXGgLZNQ%2Ctel%4013981053642%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40689116070656%2CchannelId%4042718018%2CinstallFlag%400%2CstartFlag%402%2Cpacker%40%2Cuuid%40af7ff59a6e954a84abcd7a0f70f04a28%2Cimei%40373898807495672%2Cimsi%40460004575634236%2CmacAddr%40d82ddb48b598%2Cbrand%40Lanix%2Cmodel%40Ilium+L1000%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A47%3A04%2CeventInvokeTime%4054%2CeventId%40E0009_1%2CloginAccount%4013981053642%2CloginMode%402%2CeventType%409) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: q3uw/3XRuqP9F/VW2+IB0rNwKDo= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980QicXYQalp6bPjHvL platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 841933499642895 imsi: 460079592386029 signer: q3uw/3XRuqP9F/VW2+IB0rNwKDo= sdkSessionId: 02KZ7wJ7oYfd platFormId: 03 Content-Length: 594 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=FF221C935816746E69FF99B9476BB2F9 Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%4002KZ7wJ7oYfd%2Ctel%4013903265500%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40608716061083%2CchannelId%4042725043%2CinstallFlag%400%2CstartFlag%402%2Cpacker%40%2Cuuid%40af6d717dd32e42568eb19f964760c17a%2Cimei%40841933499642895%2Cimsi%40460079592386029%2CmacAddr%400229beace4ad%2Cbrand%40alps%2Cmodel%40HTC%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A47%3A04%2CeventInvokeTime%4054%2CeventId%40E0009_1%2CloginAccount%4013903265500%2CloginMode%402%2CeventType%409) sd####.cm####.com:80
- TCP(HTTP/1.1 X-OF-Signature: u5uQQecEZXTB5LFy+0U107aVw74= X-OF-Key: Signature-OF-RSAUtils OS_TYPE: 1 Accept: application/xml Response-Type: xml GameType: 6 Iccid: 8980vCshkgTbLqKTu8hH platform: Android apiVersion: 2.5 SDKVersion: 28002 imei: 373898807495672 imsi: 460004575634236 signer: u5uQQecEZXTB5LFy+0U107aVw74= sdkSessionId: xMGyuXGgLZNQ platFormId: 03 Content-Length: 555 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Host: sdklog.cmgame.com Connection: Keep-Alive Cookie: JSESSIONID=BF27198FADBF16FBE1E11FB609D7624F Cookie2: $Version=1 Accept-Encoding: gzip data=sdkSessionId%40xMGyuXGgLZNQ%2Ctel%4013981053642%2Cuid%40%2CsdkType%401%2CsdkVer%4028002%2ClogVer%402.1%2CserviceType%406%2CcpId%40799087%2CcontentId%40689116070656%2CchannelId%4042718018%2CinstallFlag%400%2CstartFlag%402%2Cpacker%40%2Cuuid%40af7ff59a6e954a84abcd7a0f70f04a28%2Cimei%40373898807495672%2Cimsi%40460004575634236%2CmacAddr%40d82ddb48b598%2Cbrand%40Lanix%2Cmodel%40Ilium+L1000%2Coperator%401%2CnetworkType%404%2CapnType%400%2CisProxyGateway%402%2CinvokeTime%402020-12-07+17%3A46%3A58%2CeventInvokeTime%401%2CeventType%401%2CeventId%40E0001) sd####.cm####.com:80
- TCP(TLS/1.0) gv1.x####.com:443
DNS requests:
- app####.m####.cn
- aser####.1####.cn
- commu####.7####.com
- d.angs####.com
- drm.cm####.com
- e.angs####.com
- gv1.x####.com
- i####.cn.com
- mt####.go####.com
- pa.angs####.com
- pg.x####.com
- s####.cmv####.cn
- sd####.cm####.com
- wap.cm####.com
HTTP GET requests:
- drm.cm####.com/egsb/game/getclientProvince?tel=####&iccid=####&imsi=####
- drm.cm####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
- drm.cm####.com/egsb/verification/checkSDKModuleUpdate?sdkVersion=####&co...
- i####.cn.com/a/3f565628a54ead6c51c0987c43b0fff91
- s####.cmv####.cn.####.com:8080/MiguPay.SO30.Lib_082226_9BC201CE716D9B354...
- s####.cmv####.cn.####.com:8080/MiguPay.Sdk30.Lib_12003084_3BFFC37E286588...
HTTP POST requests:
- app####.m####.cn:8080/migusdk/tl/tcttl
- app####.m####.cn:8080/migusdk/verification/checkSdkUpdate
- aser####.1####.cn/educloud3/api/k12/getApplicationDetail
- drm.cm####.com/egsb/dataPlan/privateSwith
- drm.cm####.com/egsb/discount/getPreQueryResult
- drm.cm####.com/egsb/game/getPaymentCapability
- drm.cm####.com/egsb/gshare/switches
- drm.cm####.com/egsb/message/queryPushMessages
- drm.cm####.com/egsb/otherPay/querySMSInterceptorConf
- drm.cm####.com/egsb/thirdPay/queryThirdPayInfo
- e.angs####.com:5284/android.frontserver/pcsvc
- e.angs####.com:6284/android.frontserver/pcsvc
- sd####.cm####.com/behaviorLogging/eventLogging/accept?
File system changes:
Creates the following files:
- /data/data/####/1B3A2967E5FD862EFD957606C65C8122
- /data/data/####/2186.dex
- /data/data/####/2186.dex (deleted)
- /data/data/####/2887A00B589C85A5FF5607D7EB45E7C8
- /data/data/####/30592A6B8B0C769E3F7FDE6E1A033DF5
- /data/data/####/44A81AE2E098443CF479B984289F9FCA;account_file.xml
- /data/data/####/ED.ini
- /data/data/####/F85C58A2196623557E8A00D8A4680702
- /data/data/####/MiguPay.Sdk30.Lib_12003049_2b7f4055276371c21c62...02.cod
- /data/data/####/MiguPay.Sdk30.Lib_12003049_2b7f4055276371c21c62...02.dat
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/Zshu
- /data/data/####/Zshu.dex
- /data/data/####/Zshu.jar
- /data/data/####/abc.dex
- /data/data/####/abc.jar
- /data/data/####/abc.jar.temp
- /data/data/####/abc.jpg
- /data/data/####/abc.jpg.temp
- /data/data/####/abc.jpg.temp (deleted)
- /data/data/####/b.dex
- /data/data/####/b.jar
- /data/data/####/b.jar.temp
- /data/data/####/b.jpg
- /data/data/####/b.jpg.temp
- /data/data/####/b.jpg.temp (deleted)
- /data/data/####/cc.dat
- /data/data/####/com.zhangdong.tankio.ol.qingning_preferences.xml
- /data/data/####/kb_idle.ini
- /data/data/####/libjiagu.so
- /data/data/####/libmgRun_05.22.09_01.so
- /data/data/####/libmiguED.so
- /data/data/####/mgAS.dat
- /data/data/####/mgSS.dat
- /data/data/####/mgid.dat
- /data/data/####/miguGameBillingRequestMonitor.xml
- /data/data/####/nn.dex (deleted)
- /data/data/####/nn.jaru
- /data/data/####/nn_app.xml
- /data/data/####/nn_data_s.xml
- /data/data/####/pref_file.xml
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/sdk_prefs
- /data/data/####/talkingdata_app.db
- /data/data/####/talkingdata_app.db-journal
- /data/data/####/talkingdata_app_process_preferences_file
- /data/data/####/talkingdata_app_version_preferences_file
- /data/data/####/td_database_push
- /data/data/####/td_pefercen_profile.xml
- /data/data/####/tdandroidgame
- /data/data/####/tdid.xml
- /data/data/####/xcngame.xml
- /data/data/####/{6109AB2B-769CFABF}_{A58F9A96-AC2A8297}.P2
- /data/data/####/{A58F9A96-AC2A8297}.P1
- /data/data/####/{A58F9A96-AC2A8297}.P3
- /data/data/####/{BE2355DB-D785E335}.PC1
- /data/media/####/.tcookieid
- /data/media/####/ShareData.txt
- /data/media/####/deviceId
- /data/media/####/pushDB.txt
- /data/media/####/pushTime.txt
- /data/media/####/pushTotal.txt
- /data/media/####/sdk_prefs.txt
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- cat /sys/block/mmcblk0/device/cid
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 <Package Folder>/files/abc.jar
- chmod 777 <Package Folder>/files/b.jar
- su
- which su
Loads the following dynamic libraries:
- iconv
- libjiagu
- libmiguED
- megjb
- tankio
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- desede-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
- desede-CBC-PKCS5Padding
Uses elevated priveleges.
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
