Android.Packed.47227

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.860.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sys.zhan####.com:80
TCP(HTTP/1.1) bo####.d.ire####.####.com:80
TCP(HTTP/1.1) log.tracki####.com:80
TCP(HTTP/1.1) src.r####.com:80
TCP(HTTP/1.1) ah2.zhan####.com:80
TCP(HTTP/1.1) b####.d.ire####.com:80
TCP(HTTP/1.1) log.ire####.com:80
TCP(HTTP/1.1) p####.zhan####.com:80
TCP(HTTP/1.1) b####.img.ire####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) doma####.zhangy####.com:80
TCP(HTTP/1.1) o####.d.ire####.com:80
TCP(HTTP/1.1) up####.v.bs####.cn:80
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) dj.palmes####.com:443
TCP(TLS/1.0) o####.d.zhangy####.####.com:443
TCP(TLS/1.0) s####.we####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) b####.img.zhangy####.####.com:443
TCP(TLS/1.0) se####.d.zhangy####.####.cn:443
TCP(TLS/1.0) api.up####.com:443
TCP(TLS/1.0) web.st####.zhangy####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) q.q####.cn:443
TCP(TLS/1.0) o####.d.ire####.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP(TLS/1.0) b####.d.ire####.com:443

DNS requests:

ah2.zhan####.com
an####.l####.com
api.up####.com
api.w####.com
av1.x####.com
b####.d.ire####.com
b####.img.ire####.com
b####.img.zhangy####.com
bo####.d.ire####.com
bo####.img.ire####.com
c####.x####.com
c####.x####.com
dc.l####.com
dj.palmes####.com
doma####.zhangy####.com
i.ugc.co####.cn
is.sn####.com
log.ire####.com
log.tracki####.com
o####.d.ire####.com
o####.d.zhangy####.com
oth####.d.zhangy####.com
p####.zhan####.com
q.q####.cn
s####.we####.com
sdk.c####.com
se####.d.zhangy####.com
seri####.d.zhangy####.com
src.r####.com
sys.zhan####.com
web.st####.zhangy####.com

HTTP GET requests:

ah2.zhan####.com/download_ext/dl_dyn_epub_free?pk=####&type=####&btype=#...
b####.d.ire####.com/group7/M00/04/44/CmQUNFsRBOGEOvMIAAAAAD3Cu7s40541334...
b####.d.ire####.com/group7/M00/19/FD/CmQUNFnnFxOEDbocAAAAAMRAbC440848498...
b####.img.ire####.com/group61/M00/13/E8/CmQUOF1bkfyEKrgaAAAAAMI53Kc11933...
b####.img.ire####.com/group61/M00/2E/22/CmQUOF2J8AeEPyBgAAAAAK8yPeU19103...
b####.img.ire####.com/group61/M00/30/D0/CmQUOV2QFBOEcBG4AAAAAAMcoHA69734...
b####.img.ire####.com/group61/M00/43/B8/CmQUOF27jgeEY-5KAAAAAGN-RSY11624...
b####.img.ire####.com/group61/M00/43/B8/CmQUOF27jhyEOGMsAAAAABne8vU29916...
b####.img.ire####.com/group61/M00/43/B8/CmQUOF27jieEZTH9AAAAAGfl6S822238...
b####.img.ire####.com/group61/M00/43/C0/CmQUOV27jhKEdOhhAAAAAFkYPI437447...
b####.img.ire####.com/group61/M00/43/C2/CmQUOV27jp2EBa1iAAAAAEqY_7w53225...
b####.img.ire####.com/group61/M00/44/55/CmQUOV273cKEb3ROAAAAAMPO04k36993...
b####.img.ire####.com/group61/M00/44/55/CmQUOV273kWEObz8AAAAAIPIKm489644...
b####.img.ire####.com/group61/M00/44/55/CmQUOV273oCEaxHYAAAAAF4P_NY76862...
b####.img.ire####.com/group61/M00/FF/17/CmQUOF06pQyEYcJHAAAAAGquExA99753...
bo####.d.ire####.####.com/group7/M00/03/D3/CmQUNFjmZF-EMEpCAAAAAH471M887...
bo####.d.ire####.####.com/group7/M00/04/4F/CmQUNFjmbyKEVcblAAAAAGFyKAo03...
bo####.d.ire####.####.com/group7/M00/8F/F3/CmQUNFrQamuEDgSSAAAAAFoB8VA90...
bo####.d.ire####.####.com/group7/M00/CB/50/CmQUilyUuPWEdNW2AAAAAFE_3vk38...
bo####.d.ire####.####.com/group7/M00/CB/7A/CmQUilzvwo2EauGVAAAAABF8zBE55...
bo####.d.ire####.####.com/group7/M00/CD/54/CmQUNFmyaBqEBEMYAAAAADz4wFo81...
bo####.d.ire####.####.com/group7/M00/D5/B3/CmQUNFpgdzaEZOS6AAAAADAgaZY23...
doma####.zhangy####.com/cloudconf/confs?random=####&p2=####&p3=####
log.tracki####.com/receive/gettime
o####.d.ire####.com/group8/M00/19/ED/wKgHil2oCeWEMuKCAAAAACoPoeo24726877...
p####.zhan####.com/cocoon/alias/gen?usr=####&rgt=####&p1=####&pc=####&p2...
p####.zhan####.com/cocoon/alias/gen?zyeid=####&usr=####&rgt=####&p1=####...
src.r####.com/kubo/dex/luomi_9.1.29.dex
up####.v.bs####.cn/group61/M00/43/B8/CmQUOF27jfWENwyNAAAAADqAoFY10399140...
up####.v.bs####.cn/group61/M00/43/BA/CmQUOF27jn-EMMAFAAAAANwKBes25999186...
up####.v.bs####.cn/group61/M00/43/BA/CmQUOF27jnWEdhwMAAAAALd0uz884536003...
up####.v.bs####.cn/group61/M00/43/BA/CmQUOF27jrKEa2MVAAAAANjP6fM76995313...
up####.v.bs####.cn/group61/M00/43/C2/CmQUOV27jr6EDUyoAAAAAECbPAk60777092...

HTTP POST requests:

ah2.zhan####.com/zyapi/bookstore/ad/boot
log.ire####.com/log-agent/log
log.ire####.com/log-agent/rlog
log.tracki####.com/receive/tkio/install
log.tracki####.com/receive/tkio/startup
sdk.c####.com/versiontapi.php?v=####&type=####
sys.zhan####.com/message/taskConfigure?package=####&zyeid=####&usr=####&...

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/0
/data/data/####/1572925308919_2225
/data/data/####/1572925308988.apk
/data/data/####/1572925309073_2225
/data/data/####/1572925309364_2225
/data/data/####/1572925310111_2225
/data/data/####/1572925311799.apk
/data/data/####/1572925312705_2326
/data/data/####/1572925312773_2225
/data/data/####/1572925312881_2225
/data/data/####/1572925313301_2326
/data/data/####/1572925313834_2225
/data/data/####/1572925314433.apk
/data/data/####/1572925314704_2326
/data/data/####/1572925314901_2326
/data/data/####/1572925315105.apk
/data/data/####/1572925315404.apk
/data/data/####/1572925315435.apk
/data/data/####/1572925343557_2225
/data/data/####/1572925343618_2225
/data/data/####/1572925347969_2225
/data/data/####/1572925373967_2225
/data/data/####/Alvin2.xml
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/ContextData.xml
/data/data/####/GeneralSetting.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/Reyun.db
/data/data/####/Reyun.db-journal
/data/data/####/TBFileDownload-journal
/data/data/####/TDCloudSettingsConfig50E9251AE9D74852BE9061C7154394DD.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol1.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime0.xml
/data/data/####/ax_c.xml
/data/data/####/classes.dex
/data/data/####/classes.dex (deleted)
/data/data/####/com.zhangyue.iReader.SharedPreferences.temp.xml
/data/data/####/com.zhangyue.iReader.SharedPreferences.xml
/data/data/####/com.zhangyue.iReader.SharedPreferences.xml.bak (deleted)
/data/data/####/com.zhangyue.iReader.bookstore.SP.xml
/data/data/####/com.zhangyue.module.ad.xml
/data/data/####/downloader.db-journal
/data/data/####/experience.db-journal
/data/data/####/gg.dex
/data/data/####/guide.db
/data/data/####/iReader.db-journal
/data/data/####/info.txt
/data/data/####/installedlist.plugin
/data/data/####/iv
/data/data/####/libjiagu1235636835.so
/data/data/####/mc182.dex
/data/data/####/mc_cache.xml
/data/data/####/multidex.version.xml
/data/data/####/pathinfo
/data/data/####/pluginweb_djsearch
/data/data/####/pluginweb_djsearch.diff.tmp
/data/data/####/pluginwebdiff_djad
/data/data/####/pluginwebdiff_djad.diff.tmp
/data/data/####/pluginwebdiff_djbookdetail.tmp
/data/data/####/pluginwebdiff_djbookstore
/data/data/####/pluginwebdiff_djbookstore.tmp
/data/data/####/pluginwebdiff_djcommon
/data/data/####/pluginwebdiff_djcommon.diff.tmp
/data/data/####/pluginwebdiff_djconfig
/data/data/####/pluginwebdiff_djconfig.diff.tmp
/data/data/####/pluginwebdiff_djconfig.tmp
/data/data/####/pluginwebdiff_djmine
/data/data/####/pluginwebdiff_djmine.diff.tmp
/data/data/####/pluginwebdiff_djmine.tmp
/data/data/####/salt
/data/data/####/schedule
/data/data/####/task.db-journal
/data/data/####/tdid.xml
/data/data/####/theme_bg1.xml
/data/data/####/theme_bg2.xml
/data/data/####/theme_bg3.xml
/data/data/####/theme_bg5.xml
/data/data/####/theme_bg_huyan.xml
/data/data/####/theme_bg_yejian6.xml
/data/data/####/theme_bg_yejian7.xml
/data/data/####/theme_bg_yejian8.xml
/data/data/####/theme_bg_yejian9.xml
/data/data/####/theme_layout_manhua.xml
/data/data/####/theme_layout_pad70.xml
/data/data/####/theme_layout_pad70_chuban.xml
/data/data/####/theme_layout_pad70_qingsuan.xml
/data/data/####/theme_layout_pad70_wangwen.xml
/data/data/####/theme_pager.xml
/data/data/####/theme_user.xml
/data/data/####/tracking_device_id_cache.xml
/data/data/####/tracking_install.xml
/data/data/####/tracking_interval.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/uparpu.db-journal
/data/data/####/uparpu_agent_log
/data/data/####/uparpu_sdk.xml
/data/data/####/webview.db-journal
/data/media/####/-1116253088.0.tmp
/data/media/####/-1452399205.0.tmp
/data/media/####/-1698161907.0.tmp
/data/media/####/-2034210987.0.tmp
/data/media/####/-2130732144.0.tmp
/data/media/####/-964896352.0.tmp
/data/media/####/.DS_Store
/data/media/####/.nomedia
/data/media/####/.yunba_device_id
/data/media/####/07554409ea5a8eb7be248fc8111f8a5f5ec7984c897b5d....0.tmp
/data/media/####/0cdf0fdfa86c9bcfd98f17790bcf4efc5f20df3aee797b....0.tmp
/data/media/####/1.zyesnext
/data/media/####/11280482.ix.tmp
/data/media/####/11280520.ix
/data/media/####/11282990.ix.tmp
/data/media/####/11283808.ix
/data/media/####/11284828.ix
/data/media/####/11289540.ix
/data/media/####/11291310.ix
/data/media/####/11542312.ix.tmp
/data/media/####/11558320.ix.tmp
/data/media/####/11595345.ix.tmp
/data/media/####/11638237.ix.tmp
/data/media/####/1164270803.0.tmp
/data/media/####/11664306.ix.tmp
/data/media/####/11787885.ix.tmp
/data/media/####/11823391.ix.tmp
/data/media/####/1208277376.0.tmp
/data/media/####/13cf69c402094b051af6c3c23fb75a442e950a7e0d7064....0.tmp
/data/media/####/1514583455.0.tmp
/data/media/####/1606157575
/data/media/####/1830448747.0.tmp
/data/media/####/1876211931.0.tmp
/data/media/####/1960120766.0.tmp
/data/media/####/1a9624c30b54bb681b701a3e5be7537eeb7ad0d30b906a....0.tmp
/data/media/####/2.zyesnext
/data/media/####/2112166374.0.tmp
/data/media/####/22a5cf5d1aa58311b753674b58c5ead26686f0b4171d72....0.tmp
/data/media/####/2337af8ed5b4a400f3ebade3f942a16bfc277c170f5696....0.tmp
/data/media/####/270a3f2a06cfc178d938e080e6a75285d5b7dfa5968ed0....0.tmp
/data/media/####/3.zyesnext
/data/media/####/308758f80f1934de8e82dc484400b991019a100947c633....0.tmp
/data/media/####/3269d592d58ea5f6cc7698d06cc5e343fcdaa2074e4b0f....0.tmp
/data/media/####/3e44eff34389047a60919ed8b75419d65279a11cca1cf7....0.tmp
/data/media/####/429cd3975aca0aea272fd1ae53d5beb928824aa2a13568....0.tmp
/data/media/####/4ff7316f02d9225b815b2af249ea82d7a617af0954198b....0.tmp
/data/media/####/5343fd86afb06dadeb24b112df5d07a6a04f470cdd7a27....0.tmp
/data/media/####/594584857
/data/media/####/5a132350332ac2258ce7a4d0f1a3ea9d7ae9f11ba63b00....0.tmp
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_0
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_1
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_11
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_13
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_20
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_26
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_27
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_6
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_8
/data/media/####/5aefa372c637d0c66ead84b188aad415i2341770364&124002_9
/data/media/####/702e22174392f62c861e9cf23bce056ab01100026e205e....0.tmp
/data/media/####/7f90d0cf4ac93469713429f34d506216ad5cc6b7e6ac3f....0.tmp
/data/media/####/80da77d835799ceb3628adf3698cdce4c63368faa0855a....0.tmp
/data/media/####/817e061e7c6fbed5f87317ee222319b99a57ed5cf11c47....0.tmp
/data/media/####/85e725ed2e933d9612ae4145d2c48363b619e4bdf4b7a0....0.tmp
/data/media/####/872c579e11b9d2520bf69d377c05a8db9d2ed1cc6c043e....0.tmp
/data/media/####/894c9ec2f98be06d3df861c7e6b7f896365a1b792ea658....0.tmp
/data/media/####/8d297eb2c07f9a35ba3995d37bb7840a77f1c716ffddf3....0.tmp
/data/media/####/92659ab18d76d46266b2d57e3141e2fc676eb3534766fd....0.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/a1364f5a4e778dcb06ad937c587a5807946cb0f0a173ce....0.tmp
/data/media/####/ac541fa49e6c8a3f0f14ff6e5fc9c0579a795dc7ab2cbf....0.tmp
/data/media/####/af9ae8dc45132ad8a77d8ca51970d71f8a7dd67e260b8c....0.tmp
/data/media/####/appCache_a6dc49d.zip.tmp
/data/media/####/b007a2a8853a15bdf221a58d4656957a99dee38fe7785a....0.tmp
/data/media/####/bf1b5bf9942a1c526221cb4699207a36e5a372c52912e8....0.tmp
/data/media/####/bookfeed.png
/data/media/####/c-1.zycp.tmp
/data/media/####/c-2.zycp.tmp
/data/media/####/c-3.zycp.tmp
/data/media/####/c15207b7dddd0500f577ad25a1e8f726165e3553216113....0.tmp
/data/media/####/c7a12033411072aaa98f3414d47f441a5b91a06b7b0215....0.tmp
/data/media/####/cd9c54d103dc9271c1f79ac34dd9198676b8110f39127a....0.tmp
/data/media/####/ce54cc10e2de62010c6b2672f0821e05cabc1076b09a1c....0.tmp
/data/media/####/chap_vote_after_1x
/data/media/####/chap_vote_after_2x
/data/media/####/chap_vote_after_3x
/data/media/####/chap_vote_before_1x
/data/media/####/chap_vote_before_2x
/data/media/####/chap_vote_before_3x
/data/media/####/chapvote.db-journal
/data/media/####/copyright.xhtml
/data/media/####/d0ce5a97bd4553e476eb2bd32be568dde0a7cd930fad2d....0.tmp
/data/media/####/d2c3a28403cd7fdd9fd9e1149e1cdc1ee6d4c730483693....0.tmp
/data/media/####/d3db3c3c9b48d6b2f086132da1b6bf34b970980b866748....0.tmp
/data/media/####/d781f09166bac5cf5381abc21f5ceba10a2308247d2812....0.tmp
/data/media/####/d9e96c9b094bb3d921df232205fc57122a5ba40c039e76....0.tmp
/data/media/####/discount.png
/data/media/####/discount_v.png
/data/media/####/e106133af38b5ea12bc1ee7c7ef38017684df14a5ef59d....0.tmp
/data/media/####/ec761ae1893f72f03256a697fdaa1fdb0c119d26d86f8e....0.tmp
/data/media/####/ed9dfb35004ea82b9ba594ea14fdb91f1786ebf0a8b064....0.tmp
/data/media/####/f9efc164a97889fb0de80ef2fb78b9ae72dae74cdd9eb8...7e32.0
/data/media/####/fff02616ecfd2dbeb6a1573d119762e64844382d40a70a....0.tmp
/data/media/####/ft_channel_channel_45e37f9.js
/data/media/####/ft_channel_static_css_c_58f8bbc.css
/data/media/####/ft_channel_static_css_second_2b1be85.css
/data/media/####/ft_common_android_down_9781c21.js
/data/media/####/ft_common_c_c708117.css
/data/media/####/ft_common_static_js_zybridge_android_d3b3106.js
/data/media/####/ft_common_static_js_zybridge_ios_3191181.js
/data/media/####/ft_common_uu_638b01b.js
/data/media/####/ft_common_zepto_5b96d2c.js
/data/media/####/ft_sign_static_css_sign_a2804e3.css
/data/media/####/ft_task_static_css_android_task_1f5e5ab.css
/data/media/####/ft_task_static_css_android_v3_base_24095ce.css
/data/media/####/ft_task_static_css_iphone_task_bbc2d8f.css
/data/media/####/ft_task_static_css_iphone_v3_base_208f0aa.css
/data/media/####/guide.gd
/data/media/####/ic_ad_left.png
/data/media/####/ic_ad_right.png
/data/media/####/ic_ad_skip.png
/data/media/####/idea.db-journal
/data/media/####/ireader2.db
/data/media/####/journal.tmp
/data/media/####/mob_analysis.sjbd
/data/media/####/mob_analysis_8e3278d3-80d2-4747-be6e-f765cc08f41b.iz
/data/media/####/mob_analysis_b07d8eb7-9d5c-4707-a69d-70fa13680736.iz
/data/media/####/order.xhtml
/data/media/####/order_btn_bg.png
/data/media/####/order_btn_bg_v.png
/data/media/####/order_content.xhtml
/data/media/####/order_h.xhtml
/data/media/####/order_v_h.xhtml
/data/media/####/public-0.zyres.tmp
/data/media/####/public-1.zyres
/data/media/####/totalbookdown.xhtml
/data/media/####/totalbookdown_bg.jpg
/data/media/####/totalbookdown_button.png
/data/media/####/《兽黑狂妃：皇叔逆天宠》.zyepub
/data/media/####/《剩女快穿33次》.jpg
/data/media/####/《剩女快穿33次》.zyepub
/data/media/####/《姐姐是演技派》.jpg
/data/media/####/《姐姐是演技派》.zyepub
/data/media/####/《总裁太会宠》.zyepub.tmp
/data/media/####/《总裁爹地蜜蜜宠》.zyepub.tmp
/data/media/####/《总裁的天价穷妻》.zyepub.tmp
/data/media/####/《报告王爷：王妃又劫色了》.zyepub.tmp
/data/media/####/《撩倒撒旦冷殿下》.zyepub.tmp
/data/media/####/《机灵萌宝：给爹地征个婚》.zyepub.tmp
/data/media/####/《独宠媚色皇妃》.jpg
/data/media/####/《独宠媚色皇妃》.zyepub
/data/media/####/《神医嫡女-1》.zyepub.tmp
/data/media/####/《绝世兵锋》.jpg
/data/media/####/《绝世兵锋》.zyepub
/data/media/####/《超级纨绔系统》.jpg
/data/media/####/《超级纨绔系统》.zyepub
/data/media/####/《魔帝狂宠妻，神医纨绔妃》.zyepub.tmp

Miscellaneous:

Executes the following shell scripts:

getprop
getprop net.dns1
getprop ro.build.version.emui
getprop ro.config.hw_notch_size
getprop ro.flyme.published
getprop ro.letv.release.version
getprop ro.miui.notch
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id

Loads the following dynamic libraries:

UiControl
libjiagu1235636835
mthook
patchMerge
tingReader

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial