Android.Packed.37178

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.396.origin
Android.DownLoader.576.origin
Android.DownLoader.675.origin
Android.DownLoader.698.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) statson####.pu####.b####.com:80
TCP(HTTP/1.1) api.e####.com:80
TCP(HTTP/1.1) adm.e####.com:80
TCP(HTTP/1.1) cha####.api.d####.com:80
TCP(HTTP/1.1) bookweb####.e####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) h####.b####.com:80
TCP(HTTP/1.1) t####.e####.com:8900
TCP(TLS/1.0) s####.map.b####.com:443
TCP(TLS/1.0) 1####.217.20.78:443
TCP s1.u####.com:7701
TCP agentch####.api.d####.com:5287
TCP k2.yo####.com:7502
TCP k1.yo####.com:7501
TCP k2.yo####.com:7503
TCP s3.u####.com:7703
TCP s1.u####.com:7801
TCP p3.i####.com:7803
TCP s1.u####.com:7702
TCP s1.u####.com:7802

DNS requests:

adm.e####.com
agentch####.api.d####.com
api.e####.com
bookweb####.e####.com
cha####.api.d####.com
h####.b####.com
k1.yo####.com
k2.yo####.com
k3.yo####.com
loc.map.b####.com
mt####.go####.com
p1.i####.com
p2.i####.com
p3.i####.com
s####.map.b####.com
s1.u####.com
s2.u####.com
s3.u####.com
statson####.pu####.b####.com
t####.e####.com

HTTP GET requests:

api.e####.com/api/bookapp/hot_word.m?p=####&cid=####&version=####&os=###...
api.e####.com/api/bookapp/save_reg.m?cid=####&version=####&os=####&udid=...
api.e####.com/api/bookapp/show_webview.m?cid=####&version=####&os=####&u...
api.e####.com/api/bookapp/status_control.m?city=####&osv=####&av=####&sp...
bookweb####.e####.com/v12/contentExtract.m?udid=####&os=####&osv=####&av...

HTTP POST requests:

adm.e####.com/apksupload
cha####.api.d####.com/rest/2.0/channel/4609494254332194975
cha####.api.d####.com/rest/2.0/channel/channel
h####.b####.com/app.gif
loc.map.b####.com/sdk.php
statson####.pu####.b####.com/pushlog
t####.e####.com:8900/up

Modified file system:

Creates the following files:

/data/data/####/CMRequire.dat
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVVersion.cfg
/data/data/####/ResPack.rs
/data/data/####/VerDatset.dat
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/arch.xml
/data/data/####/authStatus_com.nvren.ydu.ap.xml
/data/data/####/com.nvren.ydu.ap.push_sync.xml
/data/data/####/com.nvren.ydu.ap.xml
/data/data/####/com.nvren.ydu.ap_preferences.xml
/data/data/####/common_prefs.xml
/data/data/####/dbVersion.xml
/data/data/####/easouBook.db
/data/data/####/easouBook.db-journal
/data/data/####/es.db-journal
/data/data/####/es_pf.xml
/data/data/####/eventInfo.db
/data/data/####/eventInfo.db-journal
/data/data/####/fcut_appInfo_pre.xml
/data/data/####/fcut_conf_pre.xml
/data/data/####/fcut_trategy_pre.xml
/data/data/####/firll.dat
/data/data/####/local.db
/data/data/####/local.db-journal
/data/data/####/localEasouBook.db
/data/data/####/localEasouBook.db-journal
/data/data/####/mapstyle.sty
/data/data/####/plugin-deploy.jar
/data/data/####/plugin-deploy.key
/data/data/####/po_download.db-journal
/data/data/####/pst.xml
/data/data/####/qui_download.db-journal
/data/data/####/satellitestyle.sty
/data/data/####/trafficstyle.sty
/data/data/####/u.dbv5
/data/data/####/u.dbv5-journal
/data/data/####/user_log_3_67c8f_1525448059341
/data/data/####/ver.dat
/data/data/####/ybappInfo_pre.xml
/data/data/####/ybconf_pre.xml
/data/data/####/yo_fconf_pre.xml
/data/data/####/yoappInfo_pre.xml
/data/data/####/yoconf_pre.xml
/data/data/####/yop_download.db-journal
/data/data/####/yotrategy_pre.xml
/data/media/####/-151057785-215059944
/data/media/####/.cuid
/data/media/####/1505214389-575691547
/data/media/####/1525448058293u.jar
/data/media/####/1525448058520q.jar
/data/media/####/1525448058692u.jar
/data/media/####/1525448063246b.jar
/data/media/####/1859496155-1607106828
/data/media/####/590358002-575691547
/data/media/####/Arch-journal
/data/media/####/alipay_msp.apk
/data/media/####/apps
/data/media/####/au-journal
/data/media/####/bookBackup.db
/data/media/####/bookBackup.db-journal
/data/media/####/conlts.dat
/data/media/####/lightapp_V4.db
/data/media/####/lightapp_V4.db-journal
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/pushlappv2.db
/data/media/####/pushlappv2.db-journal
/data/media/####/pushstat_4.1.db
/data/media/####/pushstat_4.1.db-journal

Miscellaneous:

Loads the following dynamic libraries:

BaiduMapSDK_v3_3_0_15
bdpush_V2_1
locSDK5

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial