Android.Joker.115

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Joker.63.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) rp-na####.ron####.com:80
TCP(HTTP/1.1) api.htp.hubc####.####.cn:45600
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) s####.cn.ron####.com:443
TCP 1####.168.110.254:38665
TCP 1####.92.33.224:8612

DNS requests:

a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
api.htp.hubc####.####.cn
api.map.b####.com
msg.umengc####.com
nav.cn.ron####.com
s####.cn.ron####.com

HTTP GET requests:

api.htp.hubc####.####.cn:45600/mb/external/pkg?platform=####&appid=####&...

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=#...
a####.u####.com/app_logs
rp-na####.ron####.com/navipush.json

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/COUNTLY_STORE.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/RongPush.xml
/data/data/####/Statistics.xml
/data/data/####/accs.db-journal
/data/data/####/adhubsdk_config.xml
/data/data/####/agoo.pid
/data/data/####/authStatus_com.example.weijiaxiao.xml
/data/data/####/authStatus_com.example.weijiaxiao;channel.xml
/data/data/####/authStatus_com.example.weijiaxiao;ipc.xml
/data/data/####/authStatus_io.rong.push.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/libcuid.so
/data/data/####/libjiagu-449521365.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/rong_version.db
/data/data/####/rong_version.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yh.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/1582817553615.log
/data/media/####/1582817555126.log
/data/media/####/1582817556975.log
/data/media/####/1582817557939.log
/data/media/####/1582817559044.log
/data/media/####/1582817559940.log
/data/media/####/1582817560717.log
/data/media/####/1582817561710.log
/data/media/####/1582817563044.log
/data/media/####/1582817564305.log
/data/media/####/1582817565271.log
/data/media/####/1582817566229.log
/data/media/####/1582817567481.log
/data/media/####/1582817568260.log
/data/media/####/1582817569017.log
/data/media/####/1582817569739.log
/data/media/####/1582817570630.log
/data/media/####/1582817571401.log
/data/media/####/1582817572290.log
/data/media/####/1582817573305.log
/data/media/####/1582817574019.log
/data/media/####/1582817574707.log
/data/media/####/1582817575642.log
/data/media/####/1582817576338.log
/data/media/####/1582817577093.log
/data/media/####/1582817578280.log
/data/media/####/1582817579097.log
/data/media/####/1582817580061.log
/data/media/####/1582817581463.log
/data/media/####/1582817582550.log
/data/media/####/1582817583423.log
/data/media/####/1582817584489.log
/data/media/####/1582817585287.log
/data/media/####/1582817586163.log
/data/media/####/1582817587291.log
/data/media/####/1582817588531.log
/data/media/####/1582817589841.log
/data/media/####/1582817590681.log
/data/media/####/1582817591976.log
/data/media/####/1582817593081.log
/data/media/####/1582817593958.log
/data/media/####/1582817594813.log
/data/media/####/1582817596109.log
/data/media/####/1582817597119.log
/data/media/####/1582817598086.log
/data/media/####/1582817599009.log
/data/media/####/1582817599740.log
/data/media/####/1582817600414.log
/data/media/####/1582817601652.log
/data/media/####/1582817602609.log
/data/media/####/1582817603770.log
/data/media/####/1582817604602.log
/data/media/####/1582817605381.log
/data/media/####/1582817606049.log
/data/media/####/1582817607229.log
/data/media/####/1582817608495.log
/data/media/####/1582817609408.log
/data/media/####/1582817610318.log
/data/media/####/1582817611052.log
/data/media/####/1582817612072.log
/data/media/####/1582817613108.log
/data/media/####/1582817613860.log
/data/media/####/1582817614763.log
/data/media/####/1582817615965.log
/data/media/####/1582817616993.log
/data/media/####/1582817617863.log
/data/media/####/1582817618693.log
/data/media/####/1582817619547.log
/data/media/####/1582817620651.log
/data/media/####/1582817621515.log
/data/media/####/1582817622275.log
/data/media/####/1582817623096.log
/data/media/####/1582817623925.log
/data/media/####/1582817624835.log
/data/media/####/1582817625533.log
/data/media/####/1582817626279.log
/data/media/####/1582817629204.log
/data/media/####/77f54db4ddd44c3db37d34f736179b0a
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/journal
/data/media/####/journal.tmp

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5664e231e0f55a11b4000818","utdid":"XlfhC9cjaAoDAGdzx1HDS5Ak","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
ls -l /system/bin/su
sh

Loads the following dynamic libraries:

BaiduMapSDK_base_v4_5_0
RongIMLib
libjiagu-449521365
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial