Android.Packed.36884

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) x####.tc.qq.com:80
TCP(HTTP/1.1) l####.g####.qq.com:80
TCP(HTTP/1.1) a####.o2.qq.com:80
TCP(HTTP/1.1) www.a.sh####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) g####.qq.com.####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) dr.g####.qq.com:80
TCP(HTTP/1.1) t####.qq.com:80
TCP(HTTP/1.1) qq.com.edges####.net:80
TCP(TLS/1.0) t####.qq.com:443
TCP(TLS/1.0) 2####.58.212.206:443
TCP(TLS/1.0) ui.ptlo####.qq.com:443
TCP(TLS/1.0) ty.cap####.qq.com:443
TCP(TLS/1.0) mbd.n.sh####.com:443
TCP(TLS/1.0) ti####.jom####.com:443
TCP(TLS/1.0) cdn.app.pin####.####.com:443
TCP(TLS/1.0) xui.ptlo####.qq.com:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) t####.jom####.com:443
TCP(TLS/1.0) o####.we####.qq.com:443
TCP(TLS/1.0) als.b####.com:443
TCP(TLS/1.0) ssl.cap####.qq.com:443
TCP(TLS/1.0) ss0.b####.com:443
TCP(TLS/1.0) v.qq.com.####.net:443
TCP(TLS/1.0) pin####.qq.com:443
TCP(TLS/1.0) 59.1####.43.126:443
TCP(TLS/1.0) huatuos####.we####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) ssl.ptlo####.qq.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) p####.tc.qq.com:443

DNS requests:

a####.o2.qq.com
als.b####.com
cap####.g####.com
cdn.app.pin####.top
dr.g####.qq.com
ext.b####.com
f10.b####.com
f11.b####.com
f12.b####.com
g####.bdst####.com
g####.g####.cn
g####.qq.com
gam####.qq.com
h####.b####.com
hpd.b####.com
huatuos####.we####.com
i####.g####.com
imgc####.qq.com
itea####.qq.com
j####.aq.qq.com
j####.qq.com
j####.qq.com
l####.g####.qq.com
l####.g####.qq.com
m####.g####.com
m.b####.com
mbd.b####.com
o####.we####.qq.com
ossweb####.qq.com
p####.qq.com
pi####.qq.com
pin####.qq.com
ping####.qq.com
r####.wx.qq.com
s.bdst####.com
ss0.b####.com
ss1.b####.com
ss2.b####.com
ssl.cap####.qq.com
ssl.ptlo####.qq.com
t####.qq.com
t####.qq.com
ti####.b####.com
ti####.b####.com
ty.cap####.qq.com
ui.ptlo####.qq.com
v.q####.com
w####.qq.com
www.b####.com
xui.ptlo####.qq.com

HTTP GET requests:

a####.o2.qq.com/php/show.php?loc_id=####&func_type=####&v=####&ran=####
dr.g####.qq.com/dr.php
g####.qq.com.####.com/?ADTAG=I####
g####.qq.com.####.com/act/media/20120601457/data.js?ran=####
l####.g####.qq.com/comm-cgi-bin/login/LoginReturnInfo.cgi?callback=####&...
l####.g####.qq.com/easnew/go/eas.php?click_type=####&e_code=####&o2_mid=...
ping####.qq.com/pingd?dm=####&url=####&rdm=####&rurl=####&rarg=####&pvid...
qq.com.edges####.net/favicon.ico
qq.com.edges####.net/map/
s####.tc.qq.com/cdn_djl.js
s####.tc.qq.com/connect/zh_CN/htmledition/js/wxLogin.js
s####.tc.qq.com/ping.js
t####.qq.com/collect?pj=####&dm=####&url=####&arg=####&rdm=####&rurl=###...
www.a.sh####.com/
x####.tc.qq.com/act/a20161115tyf/js/rank.js
x####.tc.qq.com/comm-htdocs/js/game_area/yxzj_SQ_server_select.js
x####.tc.qq.com/cp/a20161115tyf/page1.shtml
x####.tc.qq.com/cp/a20161115tyf/style.css
x####.tc.qq.com/file/o2/20180403/9395004141291877152274430723040.1522744...
x####.tc.qq.com/images/comm/sign.js
x####.tc.qq.com/images/game/portal2012/colorBelt1.jpg
x####.tc.qq.com/images/game/portal2012/sprites.jpg?d=####
x####.tc.qq.com/images/game/portal2012/sprites.jpg?v=####
x####.tc.qq.com/images/js/dr/dr.js
x####.tc.qq.com/images/js/eas/eas.js
x####.tc.qq.com/images/js/foot.js
x####.tc.qq.com/images/js/jquery/jquery-1.9.1.min.js
x####.tc.qq.com/images/js/milo/ams/atm.js?2013####
x####.tc.qq.com/images/js/milo/biz/dialog-min.js?2013####
x####.tc.qq.com/images/js/milo/biz/dialog.js?2013####
x####.tc.qq.com/images/js/milo/biz/login.js?2013####
x####.tc.qq.com/images/js/milo/biz/roleselector.js?2013####
x####.tc.qq.com/images/js/milo/milo.js
x####.tc.qq.com/images/js/milo/util/multiselector.js?2013####
x####.tc.qq.com/images/js/swfobject.js
x####.tc.qq.com/images/js/title.js
x####.tc.qq.com/images/js/topfiles/ost1410/logo.png
x####.tc.qq.com/images/js/topfiles/ost1410/ost-bg.png
x####.tc.qq.com/images/js/topfiles/ost1410/ost.min.css?ran=####
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/bg.jpg
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/code.png
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/down_bg.jpg
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/fiter.png
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/flash_bg.jpg
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/js/main.js
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/logo.png
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/now.png
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/sp.png
x####.tc.qq.com/images/yxzj/cp/a20161115tyf/time.png
x####.tc.qq.com/joke/Koala/Koala.min.1.3.3.js
x####.tc.qq.com/joke/Koala/Qfast1.0.1.js
x####.tc.qq.com/joke/Koala/plusfx1.0.min.js
x####.tc.qq.com/js/aq_common.js
x####.tc.qq.com/v/ptag/ptag_1.2.js
x####.tc.qq.com/www/austin/map/QBlogo.png
x####.tc.qq.com/www/austin/map/app_kbs.png
x####.tc.qq.com/www/austin/map/contit_bg.png
x####.tc.qq.com/www/austin/map/guanjia_logo_22.png
x####.tc.qq.com/www/austin/map/iconA1.png
x####.tc.qq.com/www/austin/map/iconA5.png
x####.tc.qq.com/www/austin/map/iconA7.png
x####.tc.qq.com/www/austin/map/iconB1.png
x####.tc.qq.com/www/austin/map/iconB10.png
x####.tc.qq.com/www/austin/map/iconB3.png
x####.tc.qq.com/www/austin/map/iconB5.png
x####.tc.qq.com/www/austin/map/iconB7.png
x####.tc.qq.com/www/austin/map/line_bg.png
x####.tc.qq.com/www/austin/map/tag_bg.png
x####.tc.qq.com/www/chrometips/notification2017_v0118.js
x####.tc.qq.com/www/images/qq2012/aiodown.jpg
x####.tc.qq.com/www/images/qq2012/aiodownicon2.png
x####.tc.qq.com/www/images/qq2012/mapAio.jpg
x####.tc.qq.com/www/images/qq2012/mapTime.jpg
x####.tc.qq.com/www/images/qq2012/mapuser_xyz.png
x####.tc.qq.com/www/images/qq2012/qqbg_1.0.png
x####.tc.qq.com/www/images/qq2012/skin/QQnavBgBlue.png
x####.tc.qq.com/www/images/qq2012/skin/kuaijierukou.png
x####.tc.qq.com/www/images/qq2012/skin/navIcon.png
x####.tc.qq.com/www/images/qqmap/TxMap.png
x####.tc.qq.com/www/pics/hv1/38/160/2199/143030813.png
x####.tc.qq.com/www/pics/hv1/64/192/1151/74892799.jpg
x####.tc.qq.com/www/pics/hv1/87/202/1092/71058897.jpg
x####.tc.qq.com/www/pics/hv1/9/97/1276/82996644.jpg

Modified file system:

Creates the following files:

/data/data/####/ApplicationCache.db-journal
/data/data/####/WebpageIcons.db-journal
/data/data/####/checker
/data/data/####/count.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/https_m.baidu.com_0.localstorage-journal
/data/data/####/https_mbd.baidu.com_0.localstorage-journal
/data/data/####/index
/data/data/####/kr.xml
/data/data/####/lz.xml
/data/data/####/pt.jar
/data/data/####/sv.xml
/data/data/####/t_u.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xe.jar
/data/media/####/V2.8.7.txt

Miscellaneous:

Uses the following algorithms to decrypt data:

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial