Android.Packed.37839

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.192.origin
Android.DownLoader.652

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) s####.jom####.com:80
TCP(HTTP/1.1) api.appj####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) m.ting####.com:80
TCP(HTTP/1.1) nsc####.b####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) xyz.ting####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) acquisi####.wix.com:443
TCP(TLS/1.0) odr.moo####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) fcm####.go####.com:443
TCP(TLS/1.0) h####.b####.com.####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) cm.g.doublec####.net:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) ssum####.casalem####.com.####.net:443

DNS requests:

a####.ting####.com
a.y####.club
acquisi####.wix.com
adser####.go####.com
adser####.go####.nl
api.appj####.com
api.s####.b####.com
b####.s####.b####.com
b.y####.club
c####.mm####.com
c.c####.com
c.y####.club
cm.g.doublec####.net
d.y####.club
f####.google####.com
f####.gst####.com
fcm####.go####.com
fcm####.you####.com
googl####.g.doublec####.net
h####.b####.com
hm.b####.com
lh3.googleu####.com
m.ting####.com
nsc####.b####.com
odr.moo####.com
pag####.googles####.com
s13.c####.com
s22.c####.com
ssum####.casalem####.com
tpc.googles####.com
www.go####.com
xyz.ting####.com
z1.c####.com
z7.c####.com

HTTP GET requests:

gm.mm####.com/9.gif?abc=####&rnd=####
hm.b####.com/h.js?adaf295####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=898&ep=1641,1164&e...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=898&ep=22830,15092...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=898&ep=8123,8123&e...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=898&ep={"netAll":0...
hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=898&et=0&ja=0&ln=e...
m.ting####.com/
nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
pag####.googles####.com/pagead/js/r20180516/r20180504/show_ads_impl.js
pag####.googles####.com/pagead/show_ads.js
s####.jom####.com/static/api/css/share_style0_24.css
s####.jom####.com/static/api/img/share/icons_0_24.png?v=####
s####.jom####.com/static/api/js/base/tangram.js?v=####
s####.jom####.com/static/api/js/component/partners.js?v=####
s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
s####.jom####.com/static/api/js/share/api_base.js
s####.jom####.com/static/api/js/share/share_api.js?v=####
s####.jom####.com/static/api/js/trans/logger.js?v=####
s####.jom####.com/static/api/js/view/share_view.js?v=####
s####.jom####.com/static/api/js/view/view_base.js
s####.jom####.com/v.gif
xyz.ting####.com/js/tongji.js
xyz.ting####.com/wap
xyz.ting####.com/wap/
xyz.ting####.com/wap/image/alb.png
xyz.ting####.com/wap/image/arab/ch.png
xyz.ting####.com/wap/image/arab/image/bst.png
xyz.ting####.com/wap/image/arab/left1.jpg
xyz.ting####.com/wap/image/arab/right.jpg
xyz.ting####.com/wap/image/arab/sp.png
xyz.ting####.com/wap/image/arab/ss.png
xyz.ting####.com/wap/image/arab/style.css
xyz.ting####.com/wap/image/arab/tl.png
xyz.ting####.com/wap/image/arab/touch.css
xyz.ting####.com/wap/image/arab/wh.png
xyz.ting####.com/wap/image/arab/yd.png
xyz.ting####.com/wap/image/arab/yf.png
xyz.ting####.com/wap/image/dg.png
xyz.ting####.com/wap/image/dm.png
xyz.ting####.com/wap/image/eg.png
xyz.ting####.com/wap/image/fg.png
xyz.ting####.com/wap/image/fl.png
xyz.ting####.com/wap/image/goto.png
xyz.ting####.com/wap/image/hg.png
xyz.ting####.com/wap/image/home.png
xyz.ting####.com/wap/image/hy.png
xyz.ting####.com/wap/image/load.png
xyz.ting####.com/wap/image/pt.png
xyz.ting####.com/wap/image/rb.png
xyz.ting####.com/wap/image/sort.png
xyz.ting####.com/wap/image/ss.png
xyz.ting####.com/wap/image/tg.png
xyz.ting####.com/wap/image/ting.png
xyz.ting####.com/wap/image/top1.png
xyz.ting####.com/wap/image/touch.css
xyz.ting####.com/wap/image/touch.js
xyz.ting####.com/wap/image/user.png
xyz.ting####.com/wap/image/xby.png
xyz.ting####.com/wap/image/ydl.png
xyz.ting####.com/wap/image/yn.png
xyz.ting####.com/wap/index.php?action=####&moduleid=####&pid=####
xyz.ting####.com/wap/index.php?moduleid=####&action=####
xyz.ting####.com/wap/index.php?moduleid=####&action=####&pid=####
xyz.ting####.com/wap/index.php?moduleid=####&itemid=####
xyz.ting####.com/wap/index.php?moduleid=####&kw=####&mid=####&action=####

HTTP POST requests:

api.appj####.com/appjiagu

Modified file system:

Creates the following files:

/data/data/####/Download-journal
/data/data/####/Downloado
/data/data/####/Downloado-journal
/data/data/####/Log-journal
/data/data/####/Logo
/data/data/####/Logo-journal
/data/data/####/config.xml
/data/data/####/configo.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/index
/data/data/####/jiagu.lock
/data/data/####/libjiagu.so
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.android.dat
/data/media/####/.android.dat-journal
/data/media/####/com.erganadf.dex
/data/media/####/id
/data/media/####/logo.png
/data/media/####/rnak.pksgens.dex (deleted)

Miscellaneous:

Loads the following dynamic libraries:

jiagu
libjiagu

Uses the following algorithms to encrypt data:

DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CFB-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial