Android.Packed.36212

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.675.origin

Prompts to install third-party applications.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) mig.eve.mdt.####.com:8080
TCP(HTTP/1.1) d.zxl####.com.####.com:80
TCP(HTTP/1.1) and####.rqd.qq.com:80
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) mazu-####.3g.qq.com:80
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP t3.jz####.com:7103
TCP t1.jz####.com:7101
TCP t1.jz####.com:7102
TCP mazu-####.3g.qq.com:443

DNS requests:

and####.rqd.qq.com
d.zxl####.com
m####.g####.com
mazu-####.3g.qq.com
mig.eve.mdt.####.com
mig.str.mdt.####.com
oth.str.mdt.####.com
t####.3g.qq.com
t1.jz####.com
t2.jz####.com
t3.jz####.com

HTTP GET requests:

d.zxl####.com.####.com/d/42cx.apk
d.zxl####.com.####.com/d/42d2.jpg
s####.tc.qq.com/gjsmall/dpsw/cdn/32a75e145ffe7e47c469894058b59756.png
s####.tc.qq.com/gjsmall/dpsw/cdn/787abd6b3afde6d51e8b5e544ba10422.png
s####.tc.qq.com/gjsmall/dpsw/cdn/83b81024131ad23a59131e3d5835d56d.png
s####.tc.qq.com/gjsmall/dpsw/cdn/ba78f2a567c736b8ce1f66a9ad7e03a0.png
t####.3g.qq.com/wifi/cw.html

HTTP POST requests:

and####.rqd.qq.com/analytics/async
mazu-####.3g.qq.com/
mig.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####

Modified file system:

Creates the following files:

/data/data/####/183.xml
/data/data/####/267.xml
/data/data/####/40463.dat
/data/data/####/40562.dat
/data/data/####/40566.dat
/data/data/####/40613.dat
/data/data/####/872ec93d755747af247cda8466ec7c73.0
/data/data/####/Beacon_sig_1.lock
/data/data/####/ConfigInfo.xml
/data/data/####/DENGTA_META.xml
/data/data/####/DualSimConfigInfo.xml
/data/data/####/DualSimService.xml
/data/data/####/SettingInfo.xml
/data/data/####/TMSPropertiesAntitheftProperty.xml
/data/data/####/TMSPropertiesIpDialProperty.xml
/data/data/####/TMSPropertiesNetInterfaceManager.xml
/data/data/####/TMSPropertiesnetworkload.xml
/data/data/####/TMSPropertiesoperator_data_sync_setting.xml
/data/data/####/WLOGIN_DEVICE_INFO.xml
/data/data/####/WiFiDeskAssistantSettingInfo.xml
/data/data/####/WiFiServcieDB.db-journal
/data/data/####/WiFiSilentDownloadConfig.xml
/data/data/####/WiFi_3.3.0_184200_1014845408_fst.dat
/data/data/####/WiFi_3.3.0_184200_1014845408_itd.dat
/data/data/####/account_misc.xml
/data/data/####/beacon_db-journal
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/cf8f58f6b3ffe9ebea5e5b485a204ac5.0
/data/data/####/com.tencent.wifimanager-1.apk.classes1567683029.zip
/data/data/####/com.tencent.wifimanager.back.BackEngine_2310.dat
/data/data/####/conch_cache.xml
/data/data/####/daemon_config.xml
/data/data/####/dtcof.xml
/data/data/####/e904886b41370da783cdcd799c0ee3d1.0
/data/data/####/f0b06b0175d16254311e3124f41e3450.0
/data/data/####/fea_tunnel_en.db-journal
/data/data/####/fixnt.xml
/data/data/####/freq_ctrl_profile2.xml
/data/data/####/freq_ctrl_profile4.xml
/data/data/####/freq_ctrl_profile5.xml
/data/data/####/freq_ctrl_profile6.xml
/data/data/####/j_dd_fl.dat
/data/data/####/journal.tmp
/data/data/####/kv_profile_sp_name.xml
/data/data/####/local_crash_lock
/data/data/####/map_contact_id_
/data/data/####/mdzoe_config.xml
/data/data/####/mdzoe_statis.xml
/data/data/####/meriExt.db-journal
/data/data/####/meri_config.xml
/data/data/####/multidex.version.xml
/data/data/####/mutil_process
/data/data/####/name_file
/data/data/####/name_file-journal
/data/data/####/native_record_lock
/data/data/####/p_lock
/data/data/####/pi_info_en.db-journal
/data/data/####/plugintask_statis.xml
/data/data/####/prfle_cnfg_dao.xml
/data/data/####/qqsecure.db
/data/data/####/qqsecure.db-journal
/data/data/####/rqd.xml
/data/data/####/rqd.xml.bak
/data/data/####/rqd.xml.bak (deleted)
/data/data/####/security_info
/data/data/####/sk.xml
/data/data/####/wifidm
/data/data/####/wlogin_device.dat
/data/data/####/x_rb_j_al_ct_2.dat
/data/data/####/x_rp_dt_j.dat
<Package Folder>/databases/db_d.db
<Package Folder>/databases/db_d.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/15108353207920.jar
<Package Folder>/files/15108353218110.jar
<Package Folder>/shared_prefs/coni_io_<IMEI>.xml
<Package Folder>/shared_prefs/i.xml
<Package Folder>/shared_prefs/iac_io_<IMEI>.xml
<Package Folder>/shared_prefs/iappInfo_io_<IMEI>.xml
<Package Folder>/shared_prefs/iinfo_io_<IMEI>.xml
<Package Folder>/shared_prefs/itrategy_io_<IMEI>.xml
<SD-Card>/.tmfs/com.tencent.wifimanager_db.sqlite-journal
<SD-Card>/.tmfs/filesafe_deamon.d
<SD-Card>/DCIM/####/sk_g.dat
<SD-Card>/DCIM/.probe
<SD-Card>/Download/####/42d2.jpg.dat
<SD-Card>/Download/####/g_42cx.apk.tmp
<SD-Card>/mofu_cats.dat
<SD-Card>/tencent/####/meta.dat
<SD-Card>/tencent/####/wtlogin_20171116.log

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop androVM.vbox_dpi
/system/bin/sh -c getprop gsm.sim.state
/system/bin/sh -c getprop gsm.sim.state2
/system/bin/sh -c getprop qemu.sf.fake_camera
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.debuggable
/system/bin/sh -c getprop ro.genymotion.version
/system/bin/sh -c getprop ro.secure
/system/bin/sh -c type su
chmod 0771 /data/data/com.tencent.wifimanager/applib
chmod 755 /data/data/com.tencent.wifimanager/files/wifidm
getprop androVM.vbox_dpi
getprop gsm.sim.state
getprop gsm.sim.state2
getprop qemu.sf.fake_camera
getprop ro.board.platform
getprop ro.debuggable
getprop ro.genymotion.version
getprop ro.secure
grep wifidm
pgrep wifidm
pidof wifidm
ps
ps wifidm
sh
sh -c ps | grep wifidm

Uses the following algorithms to decrypt data:

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial