Android.Packed.45128

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.455.origin
Android.DownLoader.675.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 0####.h####.com:80
TCP(HTTP/1.1) api.tui####.b####.com:80
TCP(HTTP/1.1) f.you####.com:80
TCP(HTTP/1.1) b.scoreca####.com.####.net:80
TCP(HTTP/1.1) statson####.pu####.b####.com:80
TCP(HTTP/1.1) ff.t####.com.####.com:80
TCP(HTTP/1.1) geo.gridsum####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 2####.h####.com:80
TCP(HTTP/1.1) 1####.h####.com:80
TCP(HTTP/1.1) mo####.api.hun####.com:80
TCP(HTTP/1.1) com####.hun####.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) mo####.log.hun####.com:80
TCP(HTTP/1.1) x.da.hun####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP t1.jz####.com:7803
TCP t1.jz####.com:7801
TCP t1.jz####.com:7103
TCP t1.jz####.com:7102
TCP p2.jz####.com:7103
TCP t1.jz####.com:7101
TCP 2####.108.23.105:5287
TCP p2.jz####.com:7102
TCP t1.jz####.com:7802
TCP p2.jz####.com:7802

DNS requests:

0####.h####.com
1####.h####.com
2####.h####.com
3####.h####.com
4####.h####.com
a####.tui####.b####.com
a####.u####.com
api####.a####.com
api.tui####.b####.com
au.u####.co
au.u####.com
b.scoreca####.com
com####.hun####.com
f.you####.com
ff.t####.com
geo.gridsum####.com
i5.hun####.com
mo####.api.hun####.com
mo####.log.hun####.com
oc.u####.com
p1.jz####.com
p2.jz####.com
p3.jz####.com
sa7.tui####.b####.com
statson####.pu####.b####.com
t1.jz####.com
t2.jz####.com
t3.jz####.com
x.da.hun####.com

HTTP GET requests:

0####.h####.com/preview/cms_icon/2019/5/17/05/20190517110217125.jpg
0####.h####.com/preview/cms_icon/2019/5/20/05/20190520233027334.jpg
1####.h####.com/preview/cms_icon/2019/5/23/05/20190523151736367.gif
1####.h####.com/preview/sp_images/2019/5/17/yinle/130271/5642387/2019051...
1####.h####.com/s1/2016/yuanxiao/icon/caidan.png
1####.h####.com/s1/2016/yuanxiao/icon/dubo.png
1####.h####.com/s1/2016/yuanxiao/icon/yugao.png
2####.h####.com/preview/cms_icon/2019/5/17/05/20190517110702262.jpg
2####.h####.com/preview/cms_icon/2019/5/17/05/20190517112909481.jpg
2####.h####.com/preview/cms_icon/2019/5/17/05/20190517114001734.jpg
2####.h####.com/preview/cms_icon/2019/5/17/05/20190517115946977.jpg
2####.h####.com/preview/cms_icon/2019/5/17/05/20190517143002186.jpg
2####.h####.com/preview/cms_icon/2019/5/23/05/20190523215037150.jpg
2####.h####.com/preview/cms_icon/2019/5/23/05/20190523231332857.jpg
2####.h####.com/preview/cms_icon/2019/5/23/05/20190523233603242.jpg
2####.h####.com/preview/cms_icon/auto_gif/2019/05/22/85108615649313745.gif
b.scoreca####.com.####.net/p2?c1=####&c2=####&ns_ap_an=####&ns_ap_pn=###...
com####.hun####.com/mobile_comment/top?userId=####&osVersion=####&subjec...
f.you####.com/cdn?id=####
ff.t####.com.####.com/d/3wvg.png
ff.t####.com.####.com/d/43wk.jpg
ff.t####.com.####.com/d/44z6.png
ff.t####.com.####.com/d/44z7.jpg
ff.t####.com.####.com/d/451c.jpg
ff.t####.com.####.com/d/451k.jpg
ff.t####.com.####.com/d/455w.jpg
geo.gridsum####.com/v2/g.aspx
mo####.api.hun####.com/channel/getDetail?userId=####&osVersion=####&devi...
mo####.api.hun####.com/channel/getList?userId=####&osVersion=####&device...
mo####.api.hun####.com/comment/read?userId=####&osVersion=####&device=##...
mo####.api.hun####.com/mobile/getCategorys?userId=####&osVersion=####&de...
mo####.api.hun####.com/mobile/getRsaKey
mo####.api.hun####.com/mobile/iconLink?userId=####&osVersion=####&device...
mo####.api.hun####.com/mobile/p2pSwitch?userId=####&osVersion=####&devic...
mo####.api.hun####.com/v2/video/getSource?userId=####&osVersion=####&dev...
mo####.api.hun####.com/v2/video/getVideoInfo?userId=####&osVersion=####&...

HTTP POST requests:

a####.u####.com/app_logs
api.tui####.b####.com/rest/2.0/channel/4520712296135580477
api.tui####.b####.com/rest/2.0/channel/channel
mo####.log.hun####.com/data.cgi
oc.u####.com/check_config_update
res####.a####.com/v3/log/init
statson####.pu####.b####.com/pushlog
x.da.hun####.com/json/app/boot

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/15586467581310.jar
/data/data/####/15586467583759.jar
/data/data/####/E_ID356507059351895.db
/data/data/####/E_ID356507059351895.db-journal
/data/data/####/GridsumCommon.xml
/data/data/####/MGTVCommon.xml
/data/data/####/MV3Plugin.ini
/data/data/####/cSPrefs.xml
/data/data/####/coni_io_356507059351895.xml
/data/data/####/dbVersion.xml
/data/data/####/db_d.db-journal
/data/data/####/i.xml
/data/data/####/i_fac_pre356507059351895.xml
/data/data/####/i_finfo_pre356507059351895.xml
/data/data/####/i_fionf_pre356507059351895.xml
/data/data/####/iac_io_356507059351895.xml
/data/data/####/iappInfo_io_356507059351895.xml
/data/data/####/iinfo_io_356507059351895.xml
/data/data/####/itrategy_io_356507059351895.xml
/data/data/####/last_know_location.xml
/data/data/####/mobclick_agent_online_setting_ruichixin.free.cl...es.xml
/data/data/####/plugin-deploy.jar
/data/data/####/plugin-deploy.key
/data/data/####/pst.xml
/data/data/####/ruichixin.free.clearly.videoes.push_sync.xml
/data/data/####/ruichixin.free.clearly.videoes.xml
/data/data/####/ruichixin.free.clearly.videoes_preferences.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/media/####/.cuid
/data/media/####/.nomedia
/data/media/####/1j9x0pubo66afjij0r67bfoby.tmp
/data/media/####/26x4o87oxapb30b1tb7m0yw1r.tmp
/data/media/####/2jj7pejv2zrc7dp1ejo6k8nmx.tmp
/data/media/####/2m74utu38s3g7chau081v6suo.tmp
/data/media/####/2qr04jyzs0woy4shord62rplo.tmp
/data/media/####/3wvg.png.dat
/data/media/####/43wk.jpg.dat
/data/media/####/44z6.png.dat
/data/media/####/44z7.jpg.dat
/data/media/####/451c.jpg.dat
/data/media/####/451k.jpg.dat
/data/media/####/455w.jpg.dat
/data/media/####/4clctnnjtk7gh5tus16w5ds0d.tmp
/data/media/####/4dc6p9ik99u17d4dzs558x7ud.tmp
/data/media/####/53koh270r87s6whc7rx2tpuow.tmp
/data/media/####/54eoacmu0i5rto2peymf7umpy.tmp
/data/media/####/59wurnfs86we8gv3bixb5dvv9.tmp
/data/media/####/5i4qol6xi126aftpi6j8pil3s.tmp
/data/media/####/5y7hr4nihri58j6xuv0xfmg32.tmp
/data/media/####/6o8s28o3na5g8wvy91cf21jj8.tmp
/data/media/####/71b4wlo0r5rhg7gee4mlsph3c.tmp
/data/media/####/7dc4tr9dwqq3dijxv2ee68y1j.tmp
/data/media/####/7k2tpkixrz6p93l0rimr3dto2.tmp
/data/media/####/apps
/data/media/####/journal.tmp
/data/media/####/lightapp_V4.db
/data/media/####/lightapp_V4.db-journal
/data/media/####/pushlappv2.db
/data/media/####/pushlappv2.db-journal
/data/media/####/pushstat_4.4.db
/data/media/####/pushstat_4.4.db-journal

Miscellaneous:

Loads the following dynamic libraries:

bdpush_V2_2
bspatch
libmv3_common
libmv3_jni
libmv3_jni_4.0
libmv3_mpplat
libmv3_platform
libmv3_playerbase
yfnet_mongotv

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1PADDING
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

DES
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial