Android.DownLoader.3944

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.371.origin

Downloads the following detected threats from the Internet:

Android.Backdoor.371.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) a####.doud####.com:80
TCP(HTTP/1.1) doud####.com:80
TCP(HTTP/1.1) doud####.com:8080
TCP(HTTP/1.1) a####.p####.com:80
TCP(HTTP/1.1) cdn.p####.com:80
TCP(HTTP/1.1) d####.fl####.com:80
TCP(HTTP/1.1) pan.b####.com:80
TCP(TLS/1.0) pan.b####.com:443

DNS requests:

0.oklasnf####.d####.com
a####.doud####.com
a####.p####.com
a####.u####.com
cdn.p####.com
d####.fl####.com
doud####.com
pan.b####.com

HTTP GET requests:

a####.doud####.com/a4d7bfeed0556e351450428584122.dex
a####.p####.com/data/?type=####&category=####&rnd=####
a####.p####.com/data/campaign/?platform=####&rnd=####
cdn.p####.com/data//border/atticus/thumb/apophenia_overlay_stretch.png
cdn.p####.com/data//border/bezels/thumb/alited_normal_stretch.png
cdn.p####.com/data//border/film/thumb/ball_screen_stretch.png
cdn.p####.com/data//border/grunge/thumb/candy_multiply_stretch.jpg
cdn.p####.com/data//border/icebaby/thumb/deerest_normal_stretch.png
cdn.p####.com/data//border/ink/thumb/blackeiht_overlay_stretch.jpg
cdn.p####.com/data//border/nature/thumb/autumn_multiply_stretch.jpg
cdn.p####.com/data//border/pattern/thumb/ants_screen_stretch.jpg
cdn.p####.com/data//border/patterns/thumb/apophenia_overlay_stretch.png
cdn.p####.com/data//border/redacted/thumb/3carnivore_normal_stretch.png
cdn.p####.com/data//border/ripped_paper/thumb/arton_multiply_stretch.jpg
cdn.p####.com/data//border/rounded_corner/thumb/blob_normal_stretch.png
cdn.p####.com/data//border/squared/thumb/bsquare_layer_stretch.png
cdn.p####.com/data//border/white_ripped/thumb/arton_lighten_stretch.jpg
cdn.p####.com/data//effect/atomic/atomic.pxs
cdn.p####.com/data//effect/creative/artfunkle.pxs
cdn.p####.com/data//effect/soft/camille.pxs
cdn.p####.com/data//effect/subtle/adrian.pxs
cdn.p####.com/data//effect/too_old/agatha.pxs
cdn.p####.com/data//effect/unicolor/amy.pxs
cdn.p####.com/data//effect/vintage/borg.pxs
cdn.p####.com/data//font/dotted/thumbnail.png
cdn.p####.com/data//font/grunge/thumbnail.png
cdn.p####.com/data//font/handwritten/thumbnail.png
cdn.p####.com/data//font/novelty/thumbnail.png
cdn.p####.com/data//font/retro/thumbnail.png
cdn.p####.com/data//font/sans/thumbnail.png
cdn.p####.com/data//font/serif/thumbnail.png
cdn.p####.com/data//overlay/acquest/thumb/bond_overlay.jpg
cdn.p####.com/data//overlay/artmodern/thumb/algorithm_overlay.jpg
cdn.p####.com/data//overlay/bokeh/thumb/birds_lighten.jpg
cdn.p####.com/data//overlay/candyminimal/thumb/blueberry_overlay.jpg
cdn.p####.com/data//overlay/canvas/thumb/carbon_overlay.jpg
cdn.p####.com/data//overlay/chem_burn/thumb/alien_lighten.jpg
cdn.p####.com/data//overlay/color_correction/thumb/blue_multiply.png
cdn.p####.com/data//overlay/colour/thumb/blush_softlight.jpg
cdn.p####.com/data//overlay/colourlovers/thumb/deepbluesea_lighten.jpg
cdn.p####.com/data//overlay/echo/thumb/11283_overlay.jpg
cdn.p####.com/data//overlay/fireworks/thumb/amaze_lighten.jpg
cdn.p####.com/data//overlay/flags/thumb/1brazil_overlay.png
cdn.p####.com/data//overlay/flame/thumb/explode_softlight.jpg
cdn.p####.com/data//overlay/frostlicious/thumb/blaze_overlay.jpg
cdn.p####.com/data//overlay/gibson/thumb/alpha_softlight.jpg
cdn.p####.com/data//overlay/grunge/thumb/adorned_multiply.jpg
cdn.p####.com/data//overlay/impala/thumb/atmosphere_overlay.jpg
cdn.p####.com/data//overlay/leaking_hd/thumb/after_screen.jpg
cdn.p####.com/data//overlay/leaks/thumb/blush_add.jpg
cdn.p####.com/data//overlay/light/thumb/echo_overlay.jpg
cdn.p####.com/data//overlay/light_paint/thumb/co_add.jpg
cdn.p####.com/data//overlay/mermaid/thumb/beached_overlay.jpg
cdn.p####.com/data//overlay/neon/thumb/1337_add.png
cdn.p####.com/data//overlay/olga/thumb/adam_multiply.jpg
cdn.p####.com/data//overlay/paper/thumb/barock_multiply.jpg
cdn.p####.com/data//overlay/patterns/thumb/brightlyplumed_hardlight.png
cdn.p####.com/data//overlay/retro_poster/thumb/beam_multiply.jpg
cdn.p####.com/data//overlay/skyfell/thumb/anathema_overlay.png
cdn.p####.com/data//overlay/smashed/thumb/cas_overlay.jpg
cdn.p####.com/data//overlay/smoke/thumb/above_multiply.jpg
cdn.p####.com/data//overlay/solaris/thumb/backyard_hardlight.png
cdn.p####.com/data//overlay/space/thumb/Jabbah_lighten.jpg
cdn.p####.com/data//overlay/tie_dye/thumb/apple_multiply.jpg
cdn.p####.com/data//overlay/vignette/thumb/ball_multiply.jpg
cdn.p####.com/data//overlay/wavelengths/thumb/apex_multiply.png
cdn.p####.com/data//sticker/abstract/thumb/adapt.png
cdn.p####.com/data//sticker/accessories/thumb/authoritah.png
cdn.p####.com/data//sticker/amore/thumb/adore.png
cdn.p####.com/data//sticker/antiquarian/thumb/airplane.png
cdn.p####.com/data//sticker/antique/thumb/cycle.png
cdn.p####.com/data//sticker/birthday/thumb/birthday_01.png
cdn.p####.com/data//sticker/comic/thumb/aarrgh.png
cdn.p####.com/data//sticker/effects/thumb/bluefirework.png
cdn.p####.com/data//sticker/food/thumb/burger.png
cdn.p####.com/data//sticker/graffiti/thumb/aight.png
cdn.p####.com/data//sticker/hot_rod/thumb/blaze1.png
cdn.p####.com/data//sticker/inspiration/thumb/adventure.png
cdn.p####.com/data//sticker/kawaii/thumb/alanspuppy.png
cdn.p####.com/data//sticker/love/thumb/bouquet.png
cdn.p####.com/data//sticker/marks/thumb/blood.png
cdn.p####.com/data//sticker/mortimer/thumb/brute.png
cdn.p####.com/data//sticker/motivation_black/thumb/motivation_black01.png
cdn.p####.com/data//sticker/motivation_white/thumb/motivation_white01.png
cdn.p####.com/data//sticker/nature/thumb/bumblebee.png
cdn.p####.com/data//sticker/newyear_fun/thumb/newyear1.png
cdn.p####.com/data//sticker/newyear_fun2/thumb/newyear_fun2_1.png
cdn.p####.com/data//sticker/pride/thumb/bi_pride.png
cdn.p####.com/data//sticker/pride_2/thumb/1love.png
cdn.p####.com/data//sticker/quote/thumb/invent.png
cdn.p####.com/data//sticker/shapes/thumb/blueberrysquare.png
cdn.p####.com/data//sticker/snowkiss/thumb/80s.png
cdn.p####.com/data//sticker/summer/thumb/bucket.png
cdn.p####.com/data//sticker/supernovas/thumb/apex.png
cdn.p####.com/data//sticker/symbols/thumb/blue_club.png
cdn.p####.com/data//sticker/tattitude/thumb/alight.png
cdn.p####.com/data//sticker/tattoos/thumb/3star.png
cdn.p####.com/data//sticker/xmas/thumb/xmas1.png
cdn.p####.com/data//sticker/xmas2/thumb/xmas2_1.png
cdn.p####.com/data//sticker/zodiac/thumb/aquarius.png
doud####.com/update.html?version=####
pan.b####.com/s/18E2tH

HTTP POST requests:

a####.u####.com/app_logs
d####.fl####.com/aap.do
doud####.com:8080/adCenter/ad/get
doud####.com:8080/adCenter/app/get
doud####.com:8080/adCenter/seo/get

File system changes:

Creates the following files:

/data/data/####/.flurryagent.5fc7bde8
/data/data/####/.imprint
/data/data/####/adrian.pxs
/data/data/####/agatha.pxs
/data/data/####/amy.pxs
/data/data/####/artfunkle.pxs
/data/data/####/atomic.pxs
/data/data/####/borg.pxs
/data/data/####/camille.pxs
/data/data/####/campaigns.json
/data/data/####/dbname
/data/data/####/dbname-journal
/data/data/####/ddcp.dex
/data/data/####/ddspname.xml
/data/data/####/installed.json
/data/data/####/libmacawjni.so
/data/data/####/libutil.so
/data/data/####/pixlr.express.xml
/data/data/####/server.json
/data/data/####/sharedPreferencesName.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/media/####/.nomedia
/data/media/####/.thumbdata3--1967290299
/data/media/####/11283_overlay.jpg
/data/media/####/1337_add.png
/data/media/####/1542619205535.jpg
/data/media/####/1542619259486.jpg
/data/media/####/1542619259652.jpg
/data/media/####/1542619259748.jpg
/data/media/####/1542619259937.jpg
/data/media/####/1542619260048.jpg
/data/media/####/1542619260169.jpg
/data/media/####/1542619260233.jpg
/data/media/####/1542619260285.jpg
/data/media/####/1542619260376.jpg
/data/media/####/1542619260464.jpg
/data/media/####/1542619260605.jpg
/data/media/####/1542619260737.jpg
/data/media/####/1542619261006.jpg
/data/media/####/1542619261099.jpg
/data/media/####/1542619261211.jpg
/data/media/####/1542619261324.jpg
/data/media/####/1brazil_overlay.png
/data/media/####/1love.png
/data/media/####/3carnivore_normal_stretch.png
/data/media/####/3star.png
/data/media/####/80s.png
/data/media/####/Jabbah_lighten.jpg
/data/media/####/aarrgh.png
/data/media/####/above_multiply.jpg
/data/media/####/adam_multiply.jpg
/data/media/####/adapt.png
/data/media/####/adore.png
/data/media/####/adorned_multiply.jpg
/data/media/####/adventure.png
/data/media/####/after_screen.jpg
/data/media/####/aight.png
/data/media/####/airplane.png
/data/media/####/alanspuppy.png
/data/media/####/alien_lighten.jpg
/data/media/####/alight.png
/data/media/####/alited_normal_stretch.png
/data/media/####/alpha_softlight.jpg
/data/media/####/amaze_lighten.jpg
/data/media/####/anathema_overlay.png
/data/media/####/ants_screen_stretch.jpg
/data/media/####/apex.png
/data/media/####/apex_multiply.png
/data/media/####/apophenia_overlay_stretch.png
/data/media/####/apple_multiply.jpg
/data/media/####/aquarius.png
/data/media/####/arton_lighten_stretch.jpg
/data/media/####/arton_multiply_stretch.jpg
/data/media/####/atmosphere_overlay.jpg
/data/media/####/authoritah.png
/data/media/####/autumn_multiply_stretch.jpg
/data/media/####/backyard_hardlight.png
/data/media/####/ball_multiply.jpg
/data/media/####/ball_screen_stretch.png
/data/media/####/barock_multiply.jpg
/data/media/####/beached_overlay.jpg
/data/media/####/beam_multiply.jpg
/data/media/####/bi_pride.png
/data/media/####/birds_lighten.jpg
/data/media/####/blackeiht_overlay_stretch.jpg
/data/media/####/blaze1.png
/data/media/####/blaze_overlay.jpg
/data/media/####/blob_normal_stretch.png
/data/media/####/blood.png
/data/media/####/blue_club.png
/data/media/####/blue_multiply.png
/data/media/####/blueberry_overlay.jpg
/data/media/####/blueberrysquare.png
/data/media/####/bluefirework.png
/data/media/####/blush_add.jpg
/data/media/####/blush_softlight.jpg
/data/media/####/bond_overlay.jpg
/data/media/####/bouquet.png
/data/media/####/brightlyplumed_hardlight.png
/data/media/####/brute.png
/data/media/####/bsquare_layer_stretch.png
/data/media/####/bucket.png
/data/media/####/bumblebee.png
/data/media/####/candy_multiply_stretch.jpg
/data/media/####/carbon_overlay.jpg
/data/media/####/cas_overlay.jpg
/data/media/####/co_add.jpg
/data/media/####/core.dex
/data/media/####/cycle.png
/data/media/####/deepbluesea_lighten.jpg
/data/media/####/deerest_normal_stretch.png
/data/media/####/echo_overlay.jpg
/data/media/####/explode_softlight.jpg
/data/media/####/invent.png
/data/media/####/newyear1.png
/data/media/####/newyear_fun2_1.png
/data/media/####/thumbnail.png
/data/media/####/xmas1.png
/data/media/####/xmas2_1.png

Miscellaneous:

Loads the following dynamic libraries:

libutil

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial