Android.DownLoader.4666

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.242.origin
Android.Xiny.1513
Android.Xiny.240.origin

Downloads the following detected threats from the Internet:

Android.Xiny.1513

Prompts to install third-party apps.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) hd.a####.com:80
TCP(HTTP/1.1) d####.z####.com.cn:80
TCP(HTTP/1.1) 1####.159.103.205:8090
TCP(HTTP/1.1) 1####.78.31.198:8030
TCP(HTTP/1.1) v####.rhhztih####.club:80
TCP(HTTP/1.1) x####.zhaifum####.com:88
TCP(HTTP/1.1) f.peiz####.cn:5284
TCP(HTTP/1.1) pa.yunj####.cn:8002
TCP(HTTP/1.1) 1####.139.160.154:5559
TCP(HTTP/1.1) adl.a####.net:5285
TCP(HTTP/1.1) lp.lapia####.com:6099
TCP(HTTP/1.1) ji####.jieme####.com:8152
TCP(HTTP/1.1) 1####.13.65.87:12346
TCP(HTTP/1.1) 1####.159.152.136:8090
TCP(HTTP/1.1) ap.bigb####.com:6099
TCP(HTTP/1.1) a####.on####.club:80
TCP(TLS/1.0) tu.70####.com:443
TCP(TLS/1.0) j####.com:443
TCP(TLS/1.0) ti####.c####.l####.####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) www.qiushib####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) cdn.dc####.net.cn:443
TCP(TLS/1.0) i####.51.la:443
TCP(TLS/1.0) 1####.217.168.238:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.217.168.202:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) api.qrse####.com:443
TCP(TLS/1.0) img.pic-i####.com:443
TCP(TLS/1.0) www.q####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP d.angs####.com:9270

DNS requests:

a####.on####.club
adl.a####.net
and####.google####.com
ap.bigb####.com
api.qiazhiw####.cn
api.qrse####.com
cdn.dc####.net.cn
d####.z####.com.cn
d.angs####.com
dd.bigb####.com
f.peiz####.cn
hm.b####.com
i####.51.la
img.70####.com
img.pic-i####.com
instant####.google####.com
j####.com
ji####.dl####.com
ji####.jieme####.com
l####.bigb####.com
lp.lapia####.com
pa.yunj####.cn
plb####.u####.com
rpg.pic-i####.com
st####.qiushib####.com
tu.70####.com
tz.7####.me
u####.u####.com
v####.rhhztih####.club
www.q####.com
www.qiushib####.com
x####.zhaifum####.com

HTTP GET requests:

a####.on####.club/fileupload/4356fc9d78033b29.jar
adl.a####.net:5285/dd/a/dl?appId=####
d####.z####.com.cn/abc/down/update.apk
hd.a####.com/jieplginf/djmdeta29x
v####.rhhztih####.club/video/奇怪的姐姐/qgdjiejie1.png
v####.rhhztih####.club/video/奸臣/5613cbb653334547931810827c453c09.mp4
v####.rhhztih####.club/video/奸臣/jianchen1.png
v####.rhhztih####.club/video/奸臣/jianchen2.png
v####.rhhztih####.club/video/奸臣/jianchen3.png
v####.rhhztih####.club/video/奸臣/jianchen4.png
v####.rhhztih####.club/video/奸臣/jianchenH.png
v####.rhhztih####.club/video/年轻的母亲3/nqdmq4_1.png
v####.rhhztih####.club/video/欲体焚情/149.png
v####.rhhztih####.club/video/热情的邻居/reqingdelinju1.png
v####.rhhztih####.club/video/甜美的性爱/tianmidexingai1.png
v####.rhhztih####.club/video/聚会的目的/juhuidemud1.png
x####.zhaifum####.com:88/video/奇怪的姐姐/qgdjiejie1.png
x####.zhaifum####.com:88/video/奸臣/5613cbb653334547931810827c453c09.mp4
x####.zhaifum####.com:88/video/奸臣/jianchen1.png
x####.zhaifum####.com:88/video/奸臣/jianchen2.png
x####.zhaifum####.com:88/video/奸臣/jianchen3.png
x####.zhaifum####.com:88/video/奸臣/jianchen4.png
x####.zhaifum####.com:88/video/奸臣/jianchenH.png
x####.zhaifum####.com:88/video/年轻的母亲3/nqdmq4_1.png
x####.zhaifum####.com:88/video/欲体焚情/149.png
x####.zhaifum####.com:88/video/热情的邻居/reqingdelinju1.png
x####.zhaifum####.com:88/video/甜美的性爱/tianmidexingai1.png
x####.zhaifum####.com:88/video/聚会的目的/juhuidemud1.png

HTTP POST requests:

ap.bigb####.com:6099/aps/
f.peiz####.cn:5284/android.frontserver/pcsvc
ji####.jieme####.com:8152/ryf_webserver/payment/checkupdate.html
lp.lapia####.com:6099/aps/
pa.yunj####.cn:8002/pps

File system changes:

Creates the following files:

/data/dalvik-cache/####/storage@emulated@0@goog1e@data@z.jar@cl...leted)
/data/dalvik-cache/####/storage@emulated@0@goog1e@data@z.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
/data/data/####/.imprint
/data/data/####/0107a73a80c404bc_0
/data/data/####/01b874f13affe82f_0
/data/data/####/03ed4dab72bac0b9_0
/data/data/####/063eb478de214eeb_0
/data/data/####/07108a06f193dce6_0
/data/data/####/0934badb2294b158_0
/data/data/####/0b7f323c93e6029b_0
/data/data/####/0e794f16962c8ff0_0
/data/data/####/111f9ef116aa8a7a_0
/data/data/####/111f9ef116aa8a7a_1
/data/data/####/1639fa7e6232f945_0
/data/data/####/197ea5aa7ab7311e_0
/data/data/####/197ea5aa7ab7311e_s
/data/data/####/19fb8f9990007e3b_0
/data/data/####/1a25db8147e1412a_0
/data/data/####/1caec1bfbdc2dad0_0
/data/data/####/1cd67df1a89a0b3e_0
/data/data/####/1eff5ecb598e2db5_0
/data/data/####/1f6a0ae627d1eeef_0
/data/data/####/1f6a0ae627d1eeef_1
/data/data/####/1f755b8abfbc7ad9_0
/data/data/####/1f755b8abfbc7ad9_1
/data/data/####/204a96cec4b24392_0
/data/data/####/28eeb5f5595dc84c_0
/data/data/####/2bfc330975107198_0
/data/data/####/2dc223d06d03a9d3_0
/data/data/####/30d9fb8d3e90a7a0_0
/data/data/####/31132ccf7af96b09_0
/data/data/####/346cc56b124f4e12_0
/data/data/####/346cc56b124f4e12_1
/data/data/####/35f694d36ce7f566_0
/data/data/####/378c3d4badba1515_0
/data/data/####/3e8a5613b59e4c49_0
/data/data/####/3e8a5613b59e4c49_1
/data/data/####/3ea8206b535085f8_0
/data/data/####/3ea8206b535085f8_1
/data/data/####/42c356ecdcbc4e3f_0
/data/data/####/4443df6eba04a997_0
/data/data/####/4700b8ae13290737_0
/data/data/####/4700b8ae13290737_1
/data/data/####/4d4e2f0ba2ec87e2_0
/data/data/####/4dc59b0898dc717f_0
/data/data/####/53fb59d5cc175424_0
/data/data/####/606f2c25936a9af9_0
/data/data/####/60aa2e308b7858b4_0
/data/data/####/65bbbb9da2d860d2_0
/data/data/####/671cb7f03d054d47_0
/data/data/####/673ab21375b41fd0_0
/data/data/####/691553d6228831cf_0
/data/data/####/69db1384e35272ae_0
/data/data/####/6cf902d5e4188a30_0
/data/data/####/6e7f62dec1b01ded_0
/data/data/####/6ea683eb0383d97c_0
/data/data/####/7114ef5afa73e341_0
/data/data/####/745b157084404779_0
/data/data/####/745b157084404779_1
/data/data/####/795983bde1f25469_0
/data/data/####/79604c0209284e58_0
/data/data/####/7a14b0038ccf519f_0
/data/data/####/7f2817f5976496ff_0
/data/data/####/85c8d1336aa5dd78_0
/data/data/####/85c8d1336aa5dd78_1
/data/data/####/8770948da0d9771013a48c88a206dc37.0.tmp
/data/data/####/8770948da0d9771013a48c88a206dc37.1
/data/data/####/8c725aa82a827926_0
/data/data/####/8e7894daa9753eac_0
/data/data/####/90edd5df4dc17d31_0
/data/data/####/91650c390b4aa83a_0
/data/data/####/9dc3062b7ba80553_0 (deleted)
/data/data/####/9ef1f93d730e9202_0
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/JiePay.xml
/data/data/####/NorPay_SP.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/XinZF.xml
/data/data/####/XinZF_conf.xml
/data/data/####/XinZF_conf.xml.bak
/data/data/####/XinZFsmspay.db
/data/data/####/XinZFsmspay.db-journal
/data/data/####/a2c20de4cfe07899_0
/data/data/####/a4b645a09e1352ed9a43ff469655db6d_3_1_5.dex
/data/data/####/a4b645a09e1352ed9a43ff469655db6d_3_1_5.dex.flock (deleted)
/data/data/####/a4b645a09e1352ed9a43ff469655db6d_3_1_5.zip
/data/data/####/a4b645a09e1352ed9a43ff469655db6d_3_1_5.zip.tmp
/data/data/####/a84dba92c7af9ef2_0
/data/data/####/a84dba92c7af9ef2_1
/data/data/####/aa6dd1005e9f97d5_0
/data/data/####/ad8ec3fbf6942158_0
/data/data/####/adf815bfe3306082_0
/data/data/####/aea447e3af5ef287_0
/data/data/####/b04d76d1c0d9fdb9_0
/data/data/####/b831e7efdbb0d9ba_0
/data/data/####/be4b633d382506ea_0
/data/data/####/be4b633d382506ea_1
/data/data/####/be7648bb0d5ffc13_0
/data/data/####/buntutu.dex
/data/data/####/buntutu.dex.flock (deleted)
/data/data/####/buntutu_data_s.xml
/data/data/####/c126fcc4e4a4de05_0
/data/data/####/c16f9d90459b6d00_0
/data/data/####/c2c6349ded9ad447_0
/data/data/####/c7e7046954e6a1be_0
/data/data/####/c97900ba5eb8f342_0
/data/data/####/ca3d6406e57f5979_0
/data/data/####/ca3d6406e57f5979_1
/data/data/####/ca534f1d6bea8020_0
/data/data/####/cb5c0d0e1f665dce_0
/data/data/####/cbcd91a24bfb1530_0
/data/data/####/cfc7b3082259e9a2_0
/data/data/####/cfeca29909872a1e_0
/data/data/####/d7389b7d24b08dca_0
/data/data/####/d73c9c881187de6f_0
/data/data/####/d73c9c881187de6f_1
/data/data/####/d7df563f46671643_0
/data/data/####/d85480a10081923e_0
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTU4OTA3MzU0;
/data/data/####/da01660fa1a9bae2_0
/data/data/####/da1474150f0b54c2_0
/data/data/####/db2dbc3b4a572a15_0
/data/data/####/dc3659f58954870d_0
/data/data/####/ddcadc8ae94590b4_0
/data/data/####/de1a3dd187b17088_0
/data/data/####/e07156fdc2e75c72_0
/data/data/####/e07156fdc2e75c72_1
/data/data/####/e0977fed9d5a009c_0
/data/data/####/e0977fed9d5a009c_1
/data/data/####/e0b5ce4538bdc6fa_0
/data/data/####/e0b5ce4538bdc6fa_1
/data/data/####/e1f45238a8b66d19_0
/data/data/####/e22ef47e26ed6a19_0
/data/data/####/e22ef47e26ed6a19_1
/data/data/####/e2b499944edaab9f_0
/data/data/####/e2b499944edaab9f_1
/data/data/####/e59a1301606b7984_0
/data/data/####/e7f58ebd584b96ff_0
/data/data/####/e84d0603892d5c31_0
/data/data/####/eb1eb625d09517f9_0
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f125506b8de4c4b5_0
/data/data/####/f4e51fe0a114de9e5149e689e7bc1432.0.tmp
/data/data/####/f4e51fe0a114de9e5149e689e7bc1432.1
/data/data/####/f6ad4a81e1cd97ab_0
/data/data/####/f98ef1e67b670a6c_0
/data/data/####/f9d8a86f14090592_0
/data/data/####/fb89b7b330ed0815_0
/data/data/####/fb89b7b330ed0815_1
/data/data/####/fc45878528392246_0
/data/data/####/fd1f184e39e390e0_0
/data/data/####/ff2abedc5d417d76_0
/data/data/####/fqakb.lnzb.eujjb_preferences.xml
/data/data/####/fqakb.lnzb.eujjb_preferences.xml.bak
/data/data/####/https_www.qiitv.com_0.localstorage-journal
/data/data/####/https_www.qiushibaike.com_0.localstorage-journal
/data/data/####/i==1.2.0&&1.0.0_1570558907501_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/jiepay_config.xml
/data/data/####/jiepay_config.xml.bak
/data/data/####/jiepayplugin.apk
/data/data/####/jiepayplugin.dex
/data/data/####/jiepayplugin.dex.flock (deleted)
/data/data/####/jiepaysmspay.db
/data/data/####/jiepaysmspay.db-journal
/data/data/####/journal.tmp
/data/data/####/kb_idle.ini
/data/data/####/lpeg.dex
/data/data/####/lpeg.dex.flock (deleted)
/data/data/####/lpeg.jar
/data/data/####/metrics_guid
/data/data/####/mm_nw_app.xml
/data/data/####/mobclick_agent_user_fqakb.lnzb.eujjb.xml
/data/data/####/one.dex
/data/data/####/one.dex.flock (deleted)
/data/data/####/onePayV3.xml
/data/data/####/orbgi.dex
/data/data/####/orbgi.dex.flock (deleted)
/data/data/####/orbgi.jar
/data/data/####/proc_auxv
/data/data/####/t==8.0.0&&1.0.0_1570558913182_envelope.log
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uid.f
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/ydutl.cf
/data/data/####/yunUid.f
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.umm.dat
/data/media/####/1B3A2967E5FD862EFD957606C65C8122
/data/media/####/30592A6B8B0C769E3F7FDE6E1A033DF5
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/buntutu.jaru
/data/media/####/kb_idle.ini
/data/media/####/plugin.apk
/data/media/####/update.apk
/data/media/####/z.jar
/data/media/####/{BE2355DB-D785E335}.PC1
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/storage/emulated/0/buntutu_r/buntutu.jar --oat-fd=34 --oat-location=/data/user/0/com.android.wifimanager/app__mmnwn/buntutu.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/storage/emulated/0/buntutu_r/buntutu.jar --oat-fd=36 --oat-location=/data/user/0/com.android.wifimanager/app__mmnwn/buntutu.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_jar/lpeg.jar --oat-fd=58 --oat-location=/data/user/0/<Package>/app_dex/lpeg.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_jar/orbgi.jar --oat-fd=56 --oat-location=/data/user/0/<Package>/app_dex/orbgi.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/jiepayplugin.apk --oat-fd=122 --oat-location=/data/user/0/<Package>/files/jiepayplugin.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/jiepayplugin.apk --oat-fd=74 --oat-location=/data/user/0/<Package>/files/jiepayplugin.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/md/a4b645a09e1352ed9a43ff469655db6d_3_1_5.zip --oat-fd=72 --oat-location=/data/user/0/<Package>/app_jar/a4b645a09e1352ed9a43ff469655db6d_3_1_5.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/one.dex --oat-fd=127 --oat-location=/data/user/0/<Package>/app_dex/one.dex --compiler-filter=speed
/system/bin/log -p d -t su /dev/com.android.settings/.socket3442
/system/bin/log -p d -t su /dev/com.android.settings/.socket3877
/system/bin/log -p d -t su 10065 /system/bin/app_process32 executing 0 /system/bin/sh using binary /system/bin/sh : sh
/system/bin/log -p d -t su 10066 /system/bin/app_process64 executing 0 /system/bin/sh using binary /system/bin/sh : sh
/system/bin/log -p d -t su child exited
/system/bin/log -p d -t su client exited 0
/system/bin/log -p d -t su connecting client 3425
/system/bin/log -p d -t su connecting client 3620
/system/bin/log -p d -t su connecting client 3864
/system/bin/log -p d -t su db allowed
/system/bin/log -p d -t su remote args: 1
/system/bin/log -p d -t su remote pid: 3425
/system/bin/log -p d -t su remote pid: 3620
/system/bin/log -p d -t su remote pid: 3864
/system/bin/log -p d -t su remote pts_slave:
/system/bin/log -p d -t su remote req pid: 3203
/system/bin/log -p d -t su remote req pid: 3817
/system/bin/log -p d -t su remote uid: 10065
/system/bin/log -p d -t su remote uid: 10066
/system/bin/log -p d -t su sending code
/system/bin/log -p d -t su starting daemon client 10065 10065
/system/bin/log -p d -t su starting daemon client 10066 10066
/system/bin/log -p d -t su su invoked.
/system/bin/log -p d -t su waiting for child exit
/system/bin/log -p d -t su waiting for user
/system/bin/log -p e -t su sqlite3 open /data/user_de/0/com.android.settings/databases/su.sqlite failure: 14
/system/bin/log -p e -t su unlink (/dev/com.android.settings/.socket3877) failed with 2: No such file or directory
/system/bin/su
app_process system/bin com.google.provider.vendor.tool.Main /storage/emulated/0/goog1e/data/plugin.apk
cat /sys/block/mmcblk0/device/cid
ls -l /system/bin/su
ls /
sh
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/wlan0/address

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

DES-CBC-PKCS5Padding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial