Android.Backdoor.1512

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.657.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ecook-e####.b0.a####.com:80
TCP(HTTP/1.1) a.e####.cn:80
TCP(HTTP/1.1) c####.360.cn:80
TCP(HTTP/1.1) t####.zhiz####.com:80
TCP(HTTP/1.1) we####.com.wz4.####.xyz:80
TCP(HTTP/1.1) u####.bfsspad####.8l####.com:80
TCP(HTTP/1.1) c.appj####.com:80
TCP(HTTP/1.1) ap####.adi####.com:80
TCP(HTTP/1.1) ga####.lotu####.com:80
TCP(HTTP/1.1) rtb.m####.net:80
TCP(HTTP/1.1) dpa.helianh####.com:80
TCP(HTTP/1.1) pic.e####.cn:80
TCP(HTTP/1.1) i####.360bu####.com.####.com:80
TCP(HTTP/1.1) cm.adi####.com:80
TCP(HTTP/1.1) j####.jd.com:80
TCP(HTTP/1.1) dsp.zhiz####.com:80
TCP(HTTP/1.1) dsp.tou####.com:80
TCP(HTTP/1.1) api.e####.cn:80
TCP(HTTP/1.1) 1####.26.247.23:80
TCP(HTTP/1.1) ga####.lotu####.com:88
TCP(HTTP/1.1) 47.97.2####.214:80
TCP(HTTP/1.1) api.map.b####.com:80
TCP(HTTP/1.1) o####.ad####.cn:80
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) api.e####.cn:443

DNS requests:

a.e####.cn
ap####.adi####.com
api.e####.cn
api.map.b####.com
c####.360.cn
c.appj####.com
cm.adi####.com
dpa.helianh####.com
dsp.tou####.com
dsp.zhiz####.com
e####.e####.cn
ga####.lotu####.com
i####.360bu####.com
j####.jd.com
o####.ad####.cn
on####.lotu####.com
pic.e####.cn
plb####.u####.com
res####.a####.com
rtb.m####.net
t####.zhiz####.com
u####.bfsspad####.8l####.com
u####.u####.com
we####.com.wz4.####.xyz

HTTP GET requests:

a.e####.cn/public/getClickUrlList.shtml?lng=####&sd=####&screenheight=##...
a.e####.cn/public/getClickUrlPoList.shtml?lng=####&sd=####&screenheight=...
a.e####.cn/public/getCommonBannerAd.shtml?height=####&width=####&lng=###...
a.e####.cn/public/getCommonStartUpAd.shtml?height=####&width=####&lng=##...
a.e####.cn/public/isDebugAd.shtml?ts=####&appid=####&sign=####
a.e####.cn/public/rab.shtml?id=####&network=####&machine=####
a.e####.cn/public/showUrlVisit.shtml?os=####&osversion=####&appversion=#...
ap####.adi####.com/tj?key=####&rd=####&req=####&token=####
ap####.adi####.com/tj?key=####&rd=####&req=YWR####&token=####
api.e####.cn/public/getSecondaryHomeData.shtml?machine=####&version=####...
cm.adi####.com/?t=####&code=####&pcode=####&bid=####&ext=####
cm.adi####.com/?t=####&d=####&k=####&rd=####&c=####&code=####&pcode=####...
dpa.helianh####.com/webapi/apply/ope/1?uid=####&adid=####&adclass=####&a...
dsp.tou####.com/api/ruangao/ads/show?extra=####&price=####
dsp.tou####.com/api/ruangao/ads/show?extra=I####&price=####
dsp.tou####.com/api/ruangao/ads/show?extra=b####&price=####
dsp.tou####.com/api/ruangao/ads/show?extra=w####&price=####
dsp.zhiz####.com/track/pixel?op=####&ct=####&price=####&ext=####
ecook-e####.b0.a####.com/file/ecook.apk
i####.360bu####.com.####.com/img/jfs/t24502/98/1675304011/88125/604bc7b0...
i####.360bu####.com.####.com/img/jfs/t26086/60/152854521/34638/df735ab3/...
j####.jd.com/s/?n=####&p=####&adId=####
o####.ad####.cn/agent/openDisplay.do?st=####&m_lat=####&uuidEncType=####...
pic.e####.cn/web/11998013.jpg
pic.e####.cn/web/246831498.jpg!m720
pic.e####.cn/web/254839784.jpg!m720
pic.e####.cn/web/257826853.jpg
pic.e####.cn/web/258565083.jpg!s1
pic.e####.cn/web/258794635.jpg
pic.e####.cn/web/259171463.jpg!s1
pic.e####.cn/web/259643604.jpg!m720
pic.e####.cn/web/260324425.jpg!m720
pic.e####.cn/web/260407543.jpg!m720
pic.e####.cn/web/260904833.jpg!s4
pic.e####.cn/web/261222592.jpg
pic.e####.cn/web/261222592.jpg!s4
pic.e####.cn/web/261505234.jpg!m3
pic.e####.cn/web/261507950.jpg!m3
pic.e####.cn/web/261507993.jpg!m720
pic.e####.cn/web/261507994.jpg!m720
pic.e####.cn/web/261507995.jpg
pic.e####.cn/web/261507995.jpg!m720
pic.e####.cn/web/261507996.jpg!m720
pic.e####.cn/web/261507997.jpg!m720
pic.e####.cn/web/261507998.jpg
pic.e####.cn/web/261507998.jpg!m720
pic.e####.cn/web/261507999.jpg!m720
pic.e####.cn/web/261508000.jpg!m720
pic.e####.cn/web/261508002.jpg!m720
pic.e####.cn/web/261508003.jpg!m720
pic.e####.cn/web/261508004.jpg!m720
pic.e####.cn/web/261508005.jpg!m720
pic.e####.cn/web/261508006.jpg!m720
pic.e####.cn/web/261508007.jpg!m720
pic.e####.cn/web/261508080.jpg!m720
pic.e####.cn/web/261611661.jpg
pic.e####.cn/web/8291833.jpg!s1
rtb.m####.net/vw?info=####&wp=####
t####.zhiz####.com/mac.do?turl=####&zzat=####&siteid=####&zzid=####&adx=...
t####.zhiz####.com/mad.do?zzat=####&siteid=####&zzid=####&pr=####&adx=##...
u####.bfsspad####.8l####.com/adShow?v=####&b=####&i=####&r=####&bid=####...
we####.com.wz4.####.xyz/

HTTP POST requests:

api.map.b####.com/location/ip?ak=####&coor=####
c####.360.cn/stra_packet
c.appj####.com/ad/splash/stats.html
ga####.lotu####.com/?st=####&sv=####&tm=####&sid=GyA####&apn=####&ct=###...
ga####.lotu####.com:88/?mid=####&st=####&sv=####&tm=####&sid=GyA####&apn...

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jgrpa.xml
/data/data/####/.log.lock
/data/data/####/.log.rpa
/data/data/####/02d86592277d03c7f2104bcaae869266.0.tmp
/data/data/####/02d86592277d03c7f2104bcaae869266.1.tmp
/data/data/####/0cabe8a47f8ba1a37840102e7a6ec261.0.tmp
/data/data/####/0cabe8a47f8ba1a37840102e7a6ec261.1.tmp
/data/data/####/31c01779192fa9ba756593b30a308614.0.tmp
/data/data/####/31c01779192fa9ba756593b30a308614.1.tmp
/data/data/####/42eb60dd1c2532283af1890d8656c160.0.tmp
/data/data/####/42eb60dd1c2532283af1890d8656c160.1.tmp
/data/data/####/43efef085ea359132d0ac52b5a076d18.0.tmp
/data/data/####/43efef085ea359132d0ac52b5a076d18.1.tmp
/data/data/####/4c362dfc69772628a589bc519dbde4c1.0.tmp
/data/data/####/4c362dfc69772628a589bc519dbde4c1.1.tmp
/data/data/####/4dd701e7443ad043211e94efb256c584.0.tmp
/data/data/####/4dd701e7443ad043211e94efb256c584.1.tmp
/data/data/####/5252c6d2618fcac46deb609780fa5b6f.0.tmp
/data/data/####/5252c6d2618fcac46deb609780fa5b6f.1.tmp
/data/data/####/609b142a069ab93d5f83b00742ba17f7.0.tmp
/data/data/####/609b142a069ab93d5f83b00742ba17f7.1.tmp
/data/data/####/615816c81eb6719b48f44e54d2f8ff1d.0.tmp
/data/data/####/615816c81eb6719b48f44e54d2f8ff1d.1.tmp
/data/data/####/657f712da31b9c79557abe4a33c5f305.0.tmp
/data/data/####/657f712da31b9c79557abe4a33c5f305.1.tmp
/data/data/####/679ff4d5fa266a8cac81778cfcc2a8d9.0.tmp
/data/data/####/679ff4d5fa266a8cac81778cfcc2a8d9.1.tmp
/data/data/####/726a0d3fe9fd433e3a65903bfd4bd0b3.0.tmp
/data/data/####/726a0d3fe9fd433e3a65903bfd4bd0b3.1.tmp
/data/data/####/7408da08e9e23e7d69b4c6916834b390.0.tmp
/data/data/####/7408da08e9e23e7d69b4c6916834b390.1.tmp
/data/data/####/8229023eafd1deb1de1cc8f61d563a4e.0.tmp
/data/data/####/8229023eafd1deb1de1cc8f61d563a4e.1.tmp
/data/data/####/8442ae67a33d3f5c102494127fd367e3.0.tmp
/data/data/####/8442ae67a33d3f5c102494127fd367e3.1.tmp
/data/data/####/86d29ab119e1b925f1e66d3c99eb80e4.0.tmp
/data/data/####/86d29ab119e1b925f1e66d3c99eb80e4.1.tmp
/data/data/####/9306b52e0746899fc6374e041a444c27.0.tmp
/data/data/####/9306b52e0746899fc6374e041a444c27.1.tmp
/data/data/####/AdloadStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Ji.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a4af6768a43e51a66f171568ae23c59d.0.tmp
/data/data/####/a4af6768a43e51a66f171568ae23c59d.1.tmp
/data/data/####/a7519c067b92b928aaced94d05c121ac.0.tmp
/data/data/####/a7519c067b92b928aaced94d05c121ac.1.tmp
/data/data/####/a==7.3.1&&1.30.33_1533644770020_envelope.log
/data/data/####/ad_show_time.xml
/data/data/####/afcb5cd36c3739d962300aea7f5ca0b6.0.tmp
/data/data/####/afcb5cd36c3739d962300aea7f5ca0b6.1.tmp
/data/data/####/b1f6dd4b2075ca884dad4edcccbd8ad4.0.tmp
/data/data/####/b1f6dd4b2075ca884dad4edcccbd8ad4.1.tmp
/data/data/####/c5bb19f90be0d8030e8f18ccaa4f0766.0.tmp
/data/data/####/c5bb19f90be0d8030e8f18ccaa4f0766.1.tmp
/data/data/####/c5d61bbe27a9b28d41aff25c8249d40a.0.tmp
/data/data/####/c5d61bbe27a9b28d41aff25c8249d40a.1.tmp
/data/data/####/cc2da97727315f2ff3deae3c0241f020.0.tmp
/data/data/####/cc2da97727315f2ff3deae3c0241f020.1.tmp
/data/data/####/cc4b8f03220bdf1d8e23e3ba36e86b42.0.tmp
/data/data/####/cc4b8f03220bdf1d8e23e3ba36e86b42.1.tmp
/data/data/####/channelpref.xml
/data/data/####/cn.ecook.xml
/data/data/####/collectiondatabase
/data/data/####/collectiondatabase-journal
/data/data/####/d3b14f26ee82feb885a79378e6536dcc.0.tmp
/data/data/####/d3b14f26ee82feb885a79378e6536dcc.1.tmp
/data/data/####/d==7.3.1&&1.30.33_1533644770320_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644773940_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644777570_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644781790_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644788440_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644789870_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644791680_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644798560_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644802400_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644803790_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644806970_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644812430_envelope.log
/data/data/####/d==7.3.1&&1.30.33_1533644817490_envelope.log
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db20ae03b04991bafd0ade954fc1a741.0.tmp
/data/data/####/db20ae03b04991bafd0ade954fc1a741.1.tmp
/data/data/####/e118bc80e24dd310cfde2072e066ec3d.0.tmp
/data/data/####/e118bc80e24dd310cfde2072e066ec3d.1.tmp
/data/data/####/e3bbb642ac5de13aea811392cad58221.0.tmp
/data/data/####/e3bbb642ac5de13aea811392cad58221.1.tmp
/data/data/####/e9ffcd36241c8ab3990c93cd758afd4b.0.tmp
/data/data/####/e9ffcd36241c8ab3990c93cd758afd4b.1.tmp
/data/data/####/ecookdatabase
/data/data/####/ecookdatabase-journal
/data/data/####/ed78b0f4391699f30e185006bf205d9e.0.tmp
/data/data/####/ed78b0f4391699f30e185006bf205d9e.1.tmp
/data/data/####/efa69ba0acdb9d7458fa86878cfc41b9.0.tmp
/data/data/####/efa69ba0acdb9d7458fa86878cfc41b9.1.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f2e35ffcc4ed83019f4edc46ad8fc982.0.tmp
/data/data/####/f2e35ffcc4ed83019f4edc46ad8fc982.1.tmp
/data/data/####/f6b98eb15a0138ee79cd693b3ff0855e.0.tmp
/data/data/####/f6b98eb15a0138ee79cd693b3ff0855e.1.tmp
/data/data/####/f89af8e0abd28094c32d5a8b027ce358.0.tmp
/data/data/####/f89af8e0abd28094c32d5a8b027ce358.1.tmp
/data/data/####/index
/data/data/####/info.xml
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu-56656565.so
/data/data/####/lonLat.xml
/data/data/####/lotuseed.apps
/data/data/####/lotuseed.s
/data/data/####/lotuseed.task
/data/data/####/lotuseed_global.xml
/data/data/####/material.db
/data/data/####/material.db-journal
/data/data/####/multidex.version.xml
/data/data/####/recipe.db-journal
/data/data/####/recipedatabase
/data/data/####/recipedatabase-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/13hmlklgmi041umr61fyuqele.tmp
/data/media/####/1533644772530.apk
/data/media/####/1aw1edc7blq9xvs9jmjwmjnat.tmp
/data/media/####/1o8sy88lt8tintzj47cof32e7.tmp
/data/media/####/1tv3p192e35ifwlwcmact8gqr.tmp
/data/media/####/26l2vlg3rdqtql3tlrczijt8f.tmp
/data/media/####/2mfjk9el3pk36h1xmtv1m5hkk.tmp
/data/media/####/2y15uw7pdyq0gf4d4ffuu11xw.tmp
/data/media/####/3274g95sdk40nfenhqfo6i94u.tmp
/data/media/####/32g30xgq2mmdi2eof8h8r5gww.tmp
/data/media/####/3fyol43fscqtj0mocxzj6nkza.tmp
/data/media/####/3g6rzbw91zr8kfag0gsb6bst6.tmp
/data/media/####/3ymhf9gd1b9tox25exbyn27hc.tmp
/data/media/####/4iffu357sxd09hxw0dsomgerl.tmp
/data/media/####/4lwd9ajvazxbwbux78pmxzmh0
/data/media/####/4mbe4f33vnfmzdrzxqabxde0c.tmp
/data/media/####/4qxvsdcse6grvho2qadhnhufe.tmp
/data/media/####/4vgd9xotm8jesz1a8eo9c8hnz.tmp
/data/media/####/5906n8np69p8qmb8gy9cdutlg.tmp
/data/media/####/5em92xculfcz7fq227296w1nn.tmp
/data/media/####/5pw7gorozm4tnlqhc2g92zx13.tmp
/data/media/####/5rgutdlcjhymb81wui2x7dt0d.tmp
/data/media/####/60bk0iqvorqsjccp3m31s00lh.tmp
/data/media/####/62b50y9xhmbuthngvkge3jae.tmp
/data/media/####/64ur4m4y0lj8qm214d9ef68rd.tmp
/data/media/####/6g95rqzlg91m00a74imv3cr89.tmp
/data/media/####/6rul590e7adiyp67p6vfjazeb.tmp
/data/media/####/6vawos34gbj46ys5u28vc0exc.tmp
/data/media/####/769hq4ur2y0oo7oqqz2tlqgik.tmp
/data/media/####/7bq2wdz78xl1xjsu1is2eo8pp.tmp
/data/media/####/7g786y36p8pr1jiw1yncuzicy.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/frd39mmq8ef6civbxxxu6qaw.tmp
/data/media/####/jrndt0n9gzh1agafv9z5q4ki.tmp
/data/media/####/lotuseed.devid
/data/media/####/r08m05ujv6l45a072j1wk3fl.tmp
/data/media/####/ry0s2abb5uy950ihh03rnypq.tmp
/data/media/####/yuevmbxphcf78pf6vuzxp7bb.tmp

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu-56656565.so
ls /
ls /sys/class/thermal
ps

Loads the following dynamic libraries:

libjiagu-56656565

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to camera interface.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial