Android.DownLoader.5146

Technical information

Malicious functions:

Downloads the following detected threats from the Internet:

Android.Joker.835

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) trackdo####.startap####.com:443
TCP(TLS/1.0) sdk-exc####.startap####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) infoe####.startap####.com:443
TCP(TLS/1.0) firebas####.crashly####.com:443
TCP(TLS/1.0) s####.go####.com:443
TCP(TLS/1.0) funnel-####.startap####.com:443
TCP(TLS/1.0) alr####.oss-cn-####.aliy####.com:443
TCP(TLS/1.2) firebas####.google####.com:443
TCP(TLS/1.2) 64.2####.165.102:443
UDP firebas####.google####.com:443

DNS requests:

adimpre####.startap####.com
adsmeta####.startap####.com
alr####.oss-cn-####.aliy####.com
app-mea####.com
dts.startap####.com
f####.google####.com
f####.gst####.com
firebas####.crashly####.com
firebas####.google####.com
funnel-####.startap####.com
i####.startap####.com
im####.startap####.com
infoe####.startap####.com
s####.go####.com
sdk-exc####.startap####.com
trackdo####.startap####.com
www.google####.com

HTTP GET requests:

alr####.oss-cn-####.aliy####.com:443/Journey
firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:630402966...
funnel-####.startap####.com:443/InApp/resources/back_.png
funnel-####.startap####.com:443/InApp/resources/back_dark.png
funnel-####.startap####.com:443/InApp/resources/browser_icon_dark.png
funnel-####.startap####.com:443/InApp/resources/close_button.png
funnel-####.startap####.com:443/InApp/resources/empty_star.png
funnel-####.startap####.com:443/InApp/resources/filled_star.png
funnel-####.startap####.com:443/InApp/resources/forward_.png
funnel-####.startap####.com:443/InApp/resources/forward_dark.png
funnel-####.startap####.com:443/InApp/resources/half_star.png
funnel-####.startap####.com:443/InApp/resources/info_ex_l.png
funnel-####.startap####.com:443/InApp/resources/info_ex_s.png
funnel-####.startap####.com:443/InApp/resources/info_l.png
funnel-####.startap####.com:443/InApp/resources/info_s.png
funnel-####.startap####.com:443/InApp/resources/logo.png
funnel-####.startap####.com:443/InApp/resources/x_dark.png
infoe####.startap####.com:443/adsmetadata/api/v1.0/getadsmetadata?produc...
s####.go####.com:443/view/chat-message-pro-fgr/home
sdk-exc####.startap####.com:443/1.5/gethtmlad?productId=####&testMode=##...
trackdo####.startap####.com:443/adimpression/api/v1.0/adimp?d=####&isPub...
trackdo####.startap####.com:443/adimpression/api/v1.0/adimp?d=####&ts=##...
trackdo####.startap####.com:443/adimpression/api/v1.0/adimp?d=IAAAA####&...
trackdo####.startap####.com:443/trackdownload/api/1.0/trackdownload?prod...

HTTP POST requests:

firebas####.google####.com:443/v1/projects/apple-message-e2fa4/installat...
infoe####.startap####.com:443/infoevent/api/v1.0/info
infoe####.startap####.com:443/tracking/infoEvent

File system changes:

Creates the following files:

/data/data/####/.jg.ac
/data/data/####/072e8f7171a1080f_0
/data/data/####/265b9fe2fff6adb9_0
/data/data/####/53d888319c47aaf1_0
/data/data/####/53d888319c47aaf1_1
/data/data/####/6954f62db7cb2f79_0
/data/data/####/72de26b0aaf0f059_0
/data/data/####/7586e8529d2d871a_0
/data/data/####/8904340bda67b77d_0
/data/data/####/9e1797f1686ca7e0_0
/data/data/####/9e1797f1686ca7e0_1
/data/data/####/Cookies-journal
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzA0MDI5NjYzM...Tc.xml
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo2MzA0MDI5...c.json
/data/data/####/PersistedInstallation1075376633tmp
/data/data/####/PersistedInstallation669410796tmp
/data/data/####/StartApp-790ba54ab8e69f2f.xml
/data/data/####/StartApp-9b9bfdb86df82dad.xml
/data/data/####/StartApp-d6864f2502af7851-journal
/data/data/####/StartappAdInfoMetadata
/data/data/####/StartappAdsMetadata
/data/data/####/StartappBannerMetadata
/data/data/####/StartappCacheMetadata
/data/data/####/StartappMetadata
/data/data/####/StartappSplashMetadata
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/back_.png
/data/data/####/back_dark.png
/data/data/####/browser_icon_dark.png
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/close_button.png
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/com.journey.messagepro_preferences.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml.bak
/data/data/####/com.startapp.sdk.xml
/data/data/####/com.startapp.sdk.xml.bak
/data/data/####/d1c3c04a2780a5a6_0
/data/data/####/db81e8688066ede2_0
/data/data/####/dfabde774a9e7a5f_0
/data/data/####/e3b3f42421b2fb61_0
/data/data/####/e3b3f42421b2fb61_0 (deleted)
/data/data/####/e806869fc3e59ddf_0
/data/data/####/empty_star.png
/data/data/####/f4fc73538e24d8d1_0
/data/data/####/fcd6cd24c851ec8c_0
/data/data/####/fd27d25c9ddb5881_0
/data/data/####/filled_star.png
/data/data/####/forward_.png
/data/data/####/forward_dark.png
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/half_star.png
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/initialization_marker (deleted)
/data/data/####/libjiagu.so
/data/data/####/libjiagu_64.so
/data/data/####/logo.png
/data/data/####/metrics_guid
/data/data/####/report
/data/data/####/shared_prefs_sdk_ad_prefs
/data/data/####/start-time
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/userlog.tmp
/data/data/####/x_dark.png
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/netcfg

Loads the following dynamic libraries:

libjiagu_64

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Sample from Google Play Store.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial