Android.Packed.31053

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSend.1848.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) www.quanzh####.com:8088
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) www.m####.com:8088
TCP(HTTP/1.1) i####.api.bi####.net:10001
TCP(HTTP/1.1) v####.api.eeric####.com:80
TCP(HTTP/1.1) wn.zhifa####.net.####.net:80
TCP(HTTP/1.1) www.huangda####.com:80
TCP(HTTP/1.1) a.cs####.top:8090
TCP(TLS/1.0) gv1.x####.com:443
TCP bg.vas####.cn:8090

DNS requests:

a####.u####.com
a.cs####.top
bg.vas####.cn
c####.api.bi####.net
gv1.x####.com
i####.api.bi####.net
i####.api.bi####.net
i.t####.com
pv.s####.com
re####.api.bi####.net
v####.api.eeric####.com
wn.zhifa####.net
www.huangda####.com
www.m####.com
www.quanzh####.com

HTTP GET requests:

a.cs####.top:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=#...
www.huangda####.com/active!activeLog.action?provider=####&clickId=####&m...
www.huangda####.com/resource!resource?resTypes=####&appid=####&channel=#...

HTTP POST requests:

v####.api.eeric####.com/api/payment/mobileInit.html
v####.api.eeric####.com/api/payment/updateinit_v2
www.huangda####.com/shop/shop_upload_log
www.m####.com:8088/sdk-selector/log/sdkPay
www.m####.com:8088/sdk-selector/sdk/select
www.quanzh####.com:8088/MakeJoyJson/JsonRead

Modified file system:

Creates the following files:

<Package Folder>/app_twservice/tw.dex
<Package Folder>/app_wyzf_plg/5.2.0.jar
<Package Folder>/databases/MA_epay_db
<Package Folder>/databases/MA_epay_db-journal
<Package Folder>/databases/bil_db
<Package Folder>/databases/bil_db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/1501849450739_2107
<Package Folder>/files/####/1501849450764_2107
<Package Folder>/files/####/1501849450821_2107
<Package Folder>/files/####/1501849450840_2107
<Package Folder>/files/####/1501849450859_2107
<Package Folder>/files/####/1501849451280_2107
<Package Folder>/files/####/1501849451612_2107
<Package Folder>/files/####/1501849459103_2252
<Package Folder>/files/####/1501849459811_2252
<Package Folder>/files/####/1501849468929_2324
<Package Folder>/files/####/1501849468968_2324
<Package Folder>/files/####/1501849468968_2324 (deleted)
<Package Folder>/files/####/1501849487950_2324
<Package Folder>/files/####/1501849488139_2324
<Package Folder>/files/####/1501849494181_2449
<Package Folder>/files/####/1501849494218_2449
<Package Folder>/files/####/bdcong
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/qz
<Package Folder>/files/####/yy.txt
<Package Folder>/files/.imprint
<Package Folder>/files/56.jar
<Package Folder>/files/56.md
<Package Folder>/files/libexec.so
<Package Folder>/files/mj.apk
<Package Folder>/files/mj.dex
<Package Folder>/files/mj.dex (deleted)
<Package Folder>/files/mobclick_agent_cached_<Package>8
<Package Folder>/files/pay.dex (deleted)
<Package Folder>/files/pay.jar
<Package Folder>/files/pay.md
<Package Folder>/files/umeng_it.cache
<Package Folder>/pspace/nexor.jar
<Package Folder>/pspace/prim.jar
<Package Folder>/shared_prefs/3521668acb8d3a1a04964513d0f7eb368...le.xml
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TDpref_game.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml.bak (deleted)
<Package Folder>/shared_prefs/TDpref_longtime3.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/b_setting.xml
<Package Folder>/shared_prefs/b_share.xml
<Package Folder>/shared_prefs/data.xml
<Package Folder>/shared_prefs/data.xml.bak
<Package Folder>/shared_prefs/ma_call.xml
<Package Folder>/shared_prefs/ma_data.xml
<Package Folder>/shared_prefs/ma_epay_share.xml
<Package Folder>/shared_prefs/ma_epay_share.xml.bak
<Package Folder>/shared_prefs/ma_phone.xml
<Package Folder>/shared_prefs/ma_phone.xml.bak
<Package Folder>/shared_prefs/nnt_data.xml
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/sdk.xml
<Package Folder>/shared_prefs/share_ecd.xml
<Package Folder>/shared_prefs/share_version.xml
<Package Folder>/shared_prefs/shared_file.xml
<Package Folder>/shared_prefs/shared_file.xml.bak (deleted)
<Package Folder>/shared_prefs/sp_name_config20049507.xml
<Package Folder>/shared_prefs/sp_name_config20049507.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/wyzf_config20049507.xml
<Package Folder>/shared_prefs/wyzf_config20049507.xml.bak
<SD-Card>/.exit
<SD-Card>/.tcookieid
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/qshp_3003_2274.zip
<SD-Card>/gooogle/userid.cfg

Miscellaneous:

Executes next shell scripts:

cat /sys/block/mmcblk0/device/cid
getprop
getprop ro.product.cpu.abi

Loads the following dynamic libraries:

game
libexec

Uses the following algorithms to encrypt data:

DES
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5PADDING

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about incoming/outgoing calls.

Gains access to information about sent/received SMS messages.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial