Android.Packed.43424

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.3887

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.50.63.227:8881
TCP(HTTP/1.1) c.g####.qq.com:80
TCP(HTTP/1.1) f####.caiji####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) 1####.75.142.89:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) v.g####.qq.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) p####.caiji####.com:80
TCP(HTTP/1.1) a####.b0.upa####.com:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) s####.caiji####.com:666
TCP(HTTP/1.1) 1####.75.29.14:8721
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) a####.caiji####.com:80
TCP(TLS/1.0) l####.58.com:443
TCP(TLS/1.0) c.5####.com.####.com:443
TCP(TLS/1.0) jump####.58.com:443
TCP(TLS/1.0) en####.lveha####.com:443
TCP(TLS/1.0) 2####.58.212.174:443
TCP(TLS/1.0) img.5####.com.####.com:443
TCP(TLS/1.0) trac####.58.com:443
TCP(TLS/1.0) yun.lveha####.com:443

DNS requests:

a####.b0.upa####.com
a####.caiji####.com
c.5####.com.cn
c.g####.qq.com
c.xz####.com
cdn.1####.wang
d####.wos####.com
en####.lveha####.com
f####.caiji####.com
img.5####.com.cn
imgc####.qq.com
j1.5####.com.cn
jump####.58.com
k####.kyli####.com
l####.58.com
mi.g####.qq.com
p####.caiji####.com
p####.ugd####.com
p.rqco####.com
qzones####.g####.cn
s####.caiji####.com
s####.e.qq.com
trac####.58.com
v.g####.qq.com
yun.lveha####.com

HTTP GET requests:

a####.b0.upa####.com/paramslist
c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
cdn.1####.wang/sc_160
k####.kyli####.com.####.com/1551450603291_utils.ttf
mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android03/js-release/1.0.0/nati...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
p.rqco####.com:8806/c/1552716079401
s####.tc.qq.com/gdt/0/DAAHwmkAUAALQABdBb921nCRBnUFml.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAOR64AUAALQABfBbQwgUAJEVym1Z.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAOR64AUAALQABfBbyZ-1DM0JvCjg.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAOR64AUAALQABhBbemCUCJ3_8lh5.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAOR64AUAALQABjBben4rBGFQ9HQn.jpg/0?ck=####

HTTP POST requests:

a####.caiji####.com/v2/load/mobile
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
f####.caiji####.com/v3/task/mobile
p####.caiji####.com/klv2/sdkkl/mobile
p.rqco####.com:8806/p/1552716125805
s####.caiji####.com:666/v1/config
s####.e.qq.com/activate
s####.e.qq.com/click
s####.e.qq.com/msg
v.g####.qq.com/gdt_stats.fcg

File system changes:

Creates the following files:

/data/data/####/.8240db86-fbab-46bf-9a2f-adc2ddf6d727
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/BrowserPreference.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/DA3B41CDDADB221DD69CD25D56AE42D5.jar
/data/data/####/DA3B41CDDADB221DD69CD25D56AE42D5.tmp
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/app_spf_scli.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/close.png
/data/data/####/cwnamd
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.xml
/data/data/####/default_sp.xml
/data/data/####/defaultpref1.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/edd940252447a73fc462459aa8f7a534
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/imagedb
/data/data/####/imagedb-journal
/data/data/####/img-cache.zip
/data/data/####/index
/data/data/####/load_MTAwMF8xMjAxXzEyODAwMzAw;.xml
/data/data/####/mobclick_agent_cached_protect.eye.filterv25
/data/data/####/oddbd.xml
/data/data/####/pl_sp.xml
/data/data/####/rws_sp.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sp_iconfig.xml
/data/data/####/spfn_MTAwMF8xMjAxXzEyODAwMzAw;.xml
/data/data/####/tray.db-journal
/data/data/####/umengOnEvent.db
/data/data/####/umengOnEvent.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/adv
/data/media/####/config
/data/media/####/deviceId
/data/media/####/master
/data/media/####/master.lock
/data/media/####/my.properties
/data/media/####/my.properties.lock

Miscellaneous:

Loads the following dynamic libraries:

tongdun_db

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS7Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial