Android.Packed.35355

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.589.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdnapph####.b0.a####.com:80
TCP(HTTP/1.1) co####.o####.cn:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) t####.qq.com:80
TCP(HTTP/1.1) cdn.img.h####.####.com:80
TCP(HTTP/1.1) t####.qq.com:8080
TCP(HTTP/1.1) i####.uo####.top:80
TCP(TLS/1.0) ti####.c####.l####.####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) st####.suiyue####.com.####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP t####.qq.com:80
TCP t####.qq.com:8080

DNS requests:

cdn.app.uo####.top
cdn.img.h####.top
co####.o####.cn
h####.b####.com
hm.b####.com
i####.uo####.top
pi####.qq.com
qn.cdn.reso####.####.cn
st####.suiyue####.com
t####.qq.com
www.go####.com

HTTP GET requests:

cdn.img.h####.####.com/upload/201711/30/img/20171130182651140.png
cdnapph####.b0.a####.com/sfile/201711/16/all/cp_V2.9.8.txt
co####.o####.cn/OACG_Comic.php?m=####&a=####
co####.o####.cn/qmresource/css/catogory.css?version=####
co####.o####.cn/qmresource/css/global-sj.css
co####.o####.cn/qmresource/css/index.css?version=####
co####.o####.cn/qmresource/css/swiper.css
co####.o####.cn/qmresource/image/biao1.jpg
co####.o####.cn/qmresource/image/biao2.jpg
co####.o####.cn/qmresource/image/biao3.jpg
co####.o####.cn/qmresource/image/biao4.jpg
co####.o####.cn/qmresource/image/biao5.jpg
co####.o####.cn/qmresource/image/biao6.jpg
co####.o####.cn/qmresource/image/fen_biao.jpg
co####.o####.cn/qmresource/image/fen_biao1.jpg
co####.o####.cn/qmresource/image/fen_biao4.jpg
co####.o####.cn/qmresource/image/fen_cha.jpg
co####.o####.cn/qmresource/image/fen_sou.png
co####.o####.cn/qmresource/image/hot.png
co####.o####.cn/qmresource/image/more.jpg
co####.o####.cn/qmresource/js/global-sj.js
co####.o####.cn/qmresource/js/jquery-2.1.4.min.js
co####.o####.cn/qmresource/js/recommend.js?version=####
co####.o####.cn/qmresource/js/swiper.js

HTTP POST requests:

i####.uo####.top/gt_ibaf/a/y/y
i####.uo####.top/nh_kkdn/lzo/ts
i####.uo####.top/nh_kvz/xrt/p
i####.uo####.top/oh_kj/hkz/did
i####.uo####.top/qhf_dkb/z
i####.uo####.top/slet_iwbi/s/pcj
i####.uo####.top/uoet_ia/b/dk
i####.uo####.top/ut_iu/ql/pm
i####.uo####.top/wbgt_ilq/tv/e
i####.uo####.top/zlvt_ilv/be/ku/xw
t####.qq.com/203.205.151.233:80/
t####.qq.com:8080/203.205.151.233:8080/

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/f_00003f
<Package Folder>/cache/####/f_000040
<Package Folder>/cache/####/index
<Package Folder>/cache/V2.9.8.txt
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1510835478205
<Package Folder>/files/libcuid.so
<Package Folder>/files/nr.jar
<Package Folder>/files/vf.jar
<Package Folder>/shared_prefs/.tpns.xml.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/comic_sp.xml
<Package Folder>/shared_prefs/count.xml
<Package Folder>/shared_prefs/device_id.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/tpush.shareprefs.xml
<Package Folder>/shared_prefs/user_profile_sp.xml
<Package Folder>/shared_prefs/user_token_sp.xml
<Package Folder>/shared_prefs/vbz.xml
<Package Folder>/shared_prefs/webConfig_data.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/b08ffbe76bc53
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp

Miscellaneous:

Executes next shell scripts:

sh <Package Folder>/lib/libxguardian.so <Package>,2100158372; 55213 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.47 , mf : unknown , apn : %s }}] 0 18

Loads the following dynamic libraries:

crash_analysis
tpnsSecurity

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial