Android.Packed.43427

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.860.origin
Android.DownLoader.861.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) m.d####.site:8080
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.zhuishu####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) src.r####.com.####.com:80
TCP(HTTP/1.1) goldenl####.com:3000
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(TLS/1.0) nsc####.b####.com:443
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) hiph####.wsh####.com:443
TCP(TLS/1.0) pass####.b####.com:443
TCP(TLS/1.0) t####.b####.com:443
TCP(TLS/1.0) tb1.bdst####.com:443
TCP(TLS/1.0) als.b####.com:443
TCP(TLS/1.0) ssls####.jom####.com:443
TCP(TLS/1.0) fc-####.cdn.bc####.####.com:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) i####.b####.com:443

DNS requests:

a####.man.aliy####.com
a####.u####.com
ad####.m.ta####.com
ada####.m.ta####.com
als.b####.com
an####.l####.com
and####.b####.qq.com
api.zhuishu####.com
au.u####.co
au.u####.com
fc-####.cdn.bc####.com
feed####.u####.com
g####.b####.com
g####.bdst####.com
goldenl####.com
hiph####.b####.com
hm.b####.com
i####.b####.com
log.u####.com
m.d####.site
nsc####.b####.com
oc.u####.com
pass####.b####.com
s####.u####.com
sdk.c####.com
src.r####.com
sta####.zhuishu####.com
t####.b####.com
tb1.bdst####.com
tb2.bdst####.com
y####.al####.com

HTTP GET requests:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
api.zhuishu####.com/book/51a6ab52070d8ed65f000010
api.zhuishu####.com/book/533d8a9d1b626911600087a2
api.zhuishu####.com/book/5533475d271af03a5bd29df4
api.zhuishu####.com/book/by-categories?gender=####&minor=####&major=####...
api.zhuishu####.com/btoc/577b53ffa3d28cdb512442cf?view=####
api.zhuishu####.com/ranking/564547c694f1c6a144ec979b
api.zhuishu####.com/ranking/564d853484665f97662d0810
api.zhuishu####.com/toc?view=####&book=####
et2-na6####.wagbr####.ali####.####.com/bar/get/591c5404717c1959f7000d24/...
gl####.w.kunl####.####.com/agent/http://img.1391.com/api/v1/bookcenter/c...
goldenl####.com:3000/checkupdate
goldenl####.com:3000/v4/getconf
src.r####.com.####.com/kubo/dex/hh_9.0_145.dex

HTTP POST requests:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
and####.b####.qq.com/rqd/async?aid=####
hk.wagbr####.non####.####.com/saveWb.json
m.d####.site:8080/book_cnt?fromBookShelf=####
oc.u####.com/check_config_update
sdk.c####.com/versiontapi.php?v=####&type=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1004
/data/data/####/1552725094858.log
/data/data/####/21c22f492aba3de8.lock
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/MultiDex.lock
/data/data/####/Q0VSVC5SU0EK.txt8df
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/ap.Lock
/data/data/####/ax_c.xml
/data/data/####/bugly_db_-journal
/data/data/####/com.biquge.book.noverls_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/data-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/gg.dex
/data/data/####/index
/data/data/####/jie_noverls_book_sharedpreferences.xml
/data/data/####/libjiagu-1469321884.so
/data/data/####/libsgmainso-5.1.103.so.tmp.2271
/data/data/####/local_crash_lock
/data/data/####/lock.lock
/data/data/####/mc145.dex
/data/data/####/mc_cache.xml
/data/data/####/mobclick_agent_online_setting_com.biquge.book.noverls.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/security_info
/data/data/####/sp.lock
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/1aii384xrvi6a1xi0yizr7tz8.0.tmp
/data/media/####/1jrgry5wqyo0ydw6n87m25ysj.0.tmp
/data/media/####/1p80b25fl6wtq8mjy47s90f52.0.tmp
/data/media/####/1y5ruwhks7rac1cu9tsjqzxon.0.tmp
/data/media/####/2cwqy50r3a4yck37jp40chz2r.0.tmp
/data/media/####/2hebd3o5qwnt5xcm3ep6bhzey.0.tmp
/data/media/####/2r1gjrjngrzcxdge0h9yl48h0.0.tmp
/data/media/####/340xh37olectej0hzcl1vu7wg.0.tmp
/data/media/####/3933udu9y1ykcs78d2hdd4zlm.0.tmp
/data/media/####/3hd82xkqlxgbc4l9cslw31tgg.0.tmp
/data/media/####/440gyg19eqlb2lwpe0i0b1pa7.0.tmp
/data/media/####/4b1vq11q5g4pwaoqpz2uvugy3.0.tmp
/data/media/####/4en7b3r7nj8eyxdqughx927k9.0.tmp
/data/media/####/4gz9ue471yl6v8ieug4l3udjd.0.tmp
/data/media/####/4i0vvb9za2b8ca4xqga0qk3r1.0.tmp
/data/media/####/4ndhxf9vpsxi4po7qkufyrgoa.0.tmp
/data/media/####/4vcbabboxrqqx83eipt8adrgt.0.tmp
/data/media/####/525qsujsj7rdsgh2ph0x1g9g0.0.tmp
/data/media/####/5pyupsyxt0aciq2w3h2ocvice.0.tmp
/data/media/####/62kbyo1mis90gc16tda5nh1yy.0.tmp
/data/media/####/66j1ewn4m9m92oyqkm62yjuk4.0.tmp
/data/media/####/6c709c11d2d46a7b
/data/media/####/6nmld0ws3k3yaezdigvnucavp.0.tmp
/data/media/####/6pdgae8fben3cipkdsuhzdnnx.0.tmp
/data/media/####/7k0qrcuwq58e7ox197nw606il.0.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/TWl4VG9j572R5ri45LmL5oiY5b6h5aSp5LiLXzVhMms1WT...ZhT2U=
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat
/data/media/####/journal.tmp

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
getprop

Loads the following dynamic libraries:

Bugly
bspatch
libjiagu-1469321884
sgmainso-5.1
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial