Android.Packed.31605

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.2078
Android.DownLoader.589.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ipswitc####.fmscach####.ou####.com:80
TCP(HTTP/1.1) ws.meme####.com:6010
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) hwt.playe####.cn:80
TCP(HTTP/1.1) sa.meme####.com:80
TCP(HTTP/1.1) api.meme####.com:80
TCP(HTTP/1.1) img.su####.com.####.com:80
TCP(HTTP/1.1) ws.meme####.com:80
TCP(HTTP/1.1) api.meme####.com:6010
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) u####.meme####.com:80
TCP(TLS/1.0) c####.im.ta####.com:443

DNS requests:

a####.u####.com
and####.b####.qq.com
api.meme####.com
c####.im.ta####.com
hwt.playe####.cn
img.su####.com
loc.map.b####.com
p####.ws.su####.com
sa.meme####.com
u####.meme####.com
ws.meme####.com

HTTP GET requests:

api.meme####.com/activity/packet_list
api.meme####.com/activity/room_packet?room_id=####&qd=####
api.meme####.com/app/index
api.meme####.com/appload/load_page?qd=####
api.meme####.com/properties/list
api.meme####.com/public/blackword_list/0
api.meme####.com/public/blackword_list/1
api.meme####.com/public/inform?size=####&type=####
api.meme####.com/public/poster/2
api.meme####.com/public/room_admin/34659613
api.meme####.com/public/room_by_ids?ids=####
api.meme####.com/public/room_guards?id1=####
api.meme####.com/public/room_list?page=####&sort=####&live=####&size=####
api.meme####.com/public/room_list?sort=####&page=####&live=####&live_typ...
api.meme####.com/public/room_list?sort=####&page=####&live=####&size=###...
api.meme####.com/public/room_sofa/34659613
api.meme####.com/public/room_star/34659613
api.meme####.com/public/room_star?id1=####
api.meme####.com/public/room_viewer/34659613?page=####&size=####
api.meme####.com/public/t_hex
api.meme####.com/show/bell_gift_list
api.meme####.com/show/cars_list
api.meme####.com/show/gift_list
api.meme####.com/show/gift_list?app_live=####
api.meme####.com/starraceinfo2016/star?room_id=####
api.meme####.com/statistic/welcome_event?date=####&button=####&qd=####&i...
api.meme####.com/zone/mission_num
api.meme####.com:6010/socket.io/?EIO=####&uid=####&f=####&app=####&rom=#...
api.meme####.com:6010/socket.io/?EIO=####&uid=####&f=####&sid=####&app=#...
sa.meme####.com/api/vtrack/config/Android.conf
u####.meme####.com/authcode/geettest

HTTP POST requests:

hwt.playe####.cn/code/all
hwt.playe####.cn/jzbdt/bbv/qk/imsq
hwt.playe####.cn/jzbdt/lqx/tmfj
hwt.playe####.cn/jzbdt/tyt/s
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/cache/AllRoomList
<Package Folder>/cache/BANNER
<Package Folder>/cache/BELL_GIFT_LIST
<Package Folder>/cache/CHEST_GIFT_LIST
<Package Folder>/cache/FastFavStarSort
<Package Folder>/cache/GIFT_LIST
<Package Folder>/cache/KEY_WORD
<Package Folder>/cache/MISSION_COUNT
<Package Folder>/cache/MOBILE_GIFT_LIST
<Package Folder>/cache/MOUNT_MALL
<Package Folder>/cache/MixRoomList
<Package Folder>/cache/MobileRoomList
<Package Folder>/cache/PLAZA_DATA
<Package Folder>/cache/PROPERTIES_LIST
<Package Folder>/cache/RECENTLY_VIEW_STAR_LIST
<Package Folder>/cache/RECHARGE_AWARD
<Package Folder>/cache/RED_PACKET_LIST
<Package Folder>/cache/RTMP_BACKUP_IP
<Package Folder>/cache/SENSITIVE_WORD
<Package Folder>/cache/SOFA_MAP
<Package Folder>/cache/last_cache_time
<Package Folder>/databases/UmengLocalNotificationStore.db-journal
<Package Folder>/databases/bugly_db_-journal
<Package Folder>/databases/sensorsdata
<Package Folder>/databases/sensorsdata-journal
<Package Folder>/databases/show.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/user_message_record.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/firll.dat
<Package Folder>/files/####/ofl.config
<Package Folder>/files/####/ofl_location.db
<Package Folder>/files/####/ofl_location.db-journal
<Package Folder>/files/####/ofl_statistics.db
<Package Folder>/files/####/ofl_statistics.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/flag
<Package Folder>/files/libcuid.so
<Package Folder>/files/local_crash_lock
<Package Folder>/files/mobclick_agent_cached_<Package>1002
<Package Folder>/files/my.jar
<Package Folder>/files/security_info
<Package Folder>/files/shuzilm.db
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/yg.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_prefs.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/Zego_live_demo2.xml
<Package Folder>/shared_prefs/com.sensorsdata.analytics.android...PI.xml
<Package Folder>/shared_prefs/dsi.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/sensorsdata.xml
<Package Folder>/shared_prefs/sfe.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/wv.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/66165ce8d3fa4a90b31d1fa94edd33fb.tmp
<SD-Card>/Android/####/_driver.dat
<SD-Card>/Android/####/_system.dat
<SD-Card>/Android/####/config.dat
<SD-Card>/Android/####/fa431a077674e1cbe64d2f9aa5c94353.tmp.tmp
<SD-Card>/Android/####/lut
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/baidu/####/conlts.dat
<SD-Card>/baidu/####/ller.dat
<SD-Card>/baidu/####/ls.db
<SD-Card>/baidu/####/ls.db-journal
<SD-Card>/test.0

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop androVM.vbox_dpi
/system/bin/sh -c getprop gsm.sim.state
/system/bin/sh -c getprop gsm.sim.state2
/system/bin/sh -c getprop qemu.sf.fake_camera
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.debuggable
/system/bin/sh -c getprop ro.genymotion.version
/system/bin/sh -c getprop ro.secure
/system/bin/sh -c type su
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop androVM.vbox_dpi
getprop gsm.sim.state
getprop gsm.sim.state2
getprop qemu.sf.fake_camera
getprop ro.board.platform
getprop ro.debuggable
getprop ro.genymotion.version
ls /dev/socket
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid

Loads the following dynamic libraries:

Bugly
du
game
gif
libjiagu
locSDK6a
openal
zegoavkit
zegoavkit2_jni

Uses special library to hide executable bytecode.

Gains access to camera interface.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial