Android.Hidden.12238

Technical information

Malicious functions:

Removes app icon from the screen.

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(TLS/1.0) a####.u####.com.####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) lf3-cdn####.byteg####.com.####.com:443
TCP(TLS/1.0) 1####.250.74.67:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) dl####.b####.com.####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) im####.y####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) popunif####.cn-zhan####.aliy####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) api.y####.com:443
TCP(TLS/1.0) ccs.u####.com.####.com:443
TCP(TLS/1.0) 2####.58.207.238:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) msh####.b####.com:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 1####.250.74.46:443
TCP(TLS/1.2) 1####.250.74.67:443
TCP(TLS/1.2) 1####.250.74.68:443
TCP api.y####.com:443
TCP ms####.m.u####.com:80
TCP im####.y####.com:443
TCP ms####.m.u####.com:443

DNS requests:

a####.u####.com
amdc####.m.ta####.com
and####.b####.qq.com
and####.google####.com
api.map.b####.com
api.y####.com
ccs.u####.com
dl####.b####.com
down####.y####.com
dypn####.aliy####.com
f####.gst####.com
gmscomp####.google####.com
im####.y####.com
lf3-cdn####.byteg####.com
m####.b####.com
m####.w####.cn
m.y####.com
msh####.b####.com
of####.u####.com
p####.google####.com
rr6---s####.g####.com
rr9---s####.g####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
ut####.u####.com
www.google####.com

HTTP GET requests:

msh####.b####.com:443/p/1/rs/250/985057761/1740024734/a452927cbb57891914...

HTTP POST requests:

al####.u####.com:443/umpx_push_launch
al####.u####.com:443/umpx_push_register
al####.u####.com:443/umpx_share
al####.u####.com:443/unify_logs
al####.u####.com:443/zcfg
and####.b####.qq.com:443/rqd/async?aid=####
api.map.b####.com:443/sdkcs/verify
ccs.u####.com.####.com:443/aa
def####.duals####.cn.####.com:443/v2/offmsg/req
msh####.b####.com:443/c/11/z/250/985057761/1740024734/a452927cbb57891914...
msh####.b####.com:443/c/11/z/250/985057761/1740024740/88dd094f0293403bc3...
msh####.b####.com:443/c/11/z/250/985057761/1740024746/6b5c4c1197a07e6c7e...
msh####.b####.com:443/c/11/z/250/985057761/1740024751/ff3b3664cc727de872...
msh####.b####.com:443/c/11/z/250/985057761/1740024757/ededea7bd0942b4cd5...
msh####.b####.com:443/c/11/z/250/985057761/1740024762/4e49d35a1df98a2168...
msh####.b####.com:443/f/2/jc/250/985057761/1740024734/a452927cbb57891914...
msh####.b####.com:443/p/1/auh/250/985050001/1740024730/0ba474ca98624a911...
msh####.b####.com:443/p/1/r/250/985057761/1740024735/023045eaed9bde1e0c7...
msh####.b####.com:443/p/1/r/250/985057761/1740024736/14efc711eede8cdd80d...
msh####.b####.com:443/s/3/gd/250/985057761/1740024733/cdb6effb0124138e68...
msh####.b####.com:443/s/5/aio/250/985057761/1740024731/143c7cbcd1cc9abdf...
new-####.u####.com:443/api/postZdata/v4
popunif####.cn-zhan####.aliy####.com:443/

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/020944b9bde6d8385f41ee5af1371910c061362e2195b33...a4cb.0
/data/data/####/07bbaa75fb360b58_0
/data/data/####/07bbaa75fb360b58_1
/data/data/####/0c2817a1d6abe1e7_0
/data/data/####/0e1a67b73fc9a4cc_0
/data/data/####/0e1a67b73fc9a4cc_1
/data/data/####/1004
/data/data/####/1247cf664298578481fbe3adeac9b30ecaa62bc38889106...4ebc.0
/data/data/####/1b15d12ba4a78099_0
/data/data/####/23eaf34356937230_0
/data/data/####/2a7d1e473b5b52d07ce0940b3843b28076c7e9d103c7ab2...1b4c.0
/data/data/####/30122ac2ca5b75ad_0
/data/data/####/367b55d4049c2e86_0
/data/data/####/367b55d4049c2e86_1
/data/data/####/39799c151232c3fd_0
/data/data/####/3df8b68a19217bbe92120860662ca3489faf1c513fdc276...ca56.0
/data/data/####/3f473c320898d0f3_0
/data/data/####/3f6b1672c1fc7c21_0
/data/data/####/4040a18830dbfda0_0
/data/data/####/428e26935c6532651b19d62c3f86188c2c4b2540d804cf8...c1bd.0
/data/data/####/44048f179fa9d1455ff41a3095a8afb8ef5f86b709c7209...7ef1.0
/data/data/####/4564d9270993b3207eaa2f8f0bc3193a6cf3b965c79fef5...eadf.0
/data/data/####/464b76979c9190bc_0
/data/data/####/464b76979c9190bc_1
/data/data/####/4730b9a50f2aafec894fa6d1f3484a7544fe0682a0677a3....0.tmp
/data/data/####/4730b9a50f2aafec894fa6d1f3484a7544fe0682a0677a3...86eb.0
/data/data/####/4db54b6f2ab4b3ad149a2b8782f77bacdf3885c69c2eba8...86a3.0
/data/data/####/4f0870b0e3883897_0
/data/data/####/4f0870b0e3883897_1
/data/data/####/58bc1857da54988381355562435c97afca9d536965043b0...d383.0
/data/data/####/58edcaf88d4aa802_0
/data/data/####/675f48f9b5ee606be65643740667dc49332fa1f736e33e2...606e.0
/data/data/####/6920fcda9d7e72fec4867d279c43fc6c54a016b087a3466...8866.0
/data/data/####/7a3d50b157acda9d_0
/data/data/####/7c8cc95350553563_0
/data/data/####/7c8cc95350553563_1
/data/data/####/83cbabc6c414850fc68cd82c4adec4b587b03a15660066d...8869.0
/data/data/####/8855aedd82617f2f_0
/data/data/####/88a2be0a98c87657fb06d3f63a98bb8ebf0189474eb0767...72f8.0
/data/data/####/8c864962f3403f6a_0
/data/data/####/8c864962f3403f6a_1
/data/data/####/9022b0b4183cbe6d_0 (deleted)
/data/data/####/9553e59103ca7e21_0 (deleted)
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/AUTH_APP_INFO.xml
/data/data/####/AUTH_DEVICEINFO.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Cookies-journal
/data/data/####/ErrCLogInfo.html
/data/data/####/KVCache.xml
/data/data/####/Map_Privacy.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/SP_AROUTER_CACHE.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a0df166055fbcf83_0
/data/data/####/a0df166055fbcf83_1
/data/data/####/a61515dd4d9b4ec8e56c4a3ca4b332b983f176e984b8d57...2a0a.0
/data/data/####/a7ff5dcb3d025026_0
/data/data/####/account.xml
/data/data/####/account.xml.bak
/data/data/####/accountInfo.xml
/data/data/####/accs.db-journal
/data/data/####/ad_auth.xml
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/b16e4586c9643f43_0
/data/data/####/b16e4586c9643f43_1
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/c327be639976287261cf7204e7c7c859cd495859c8a7a7f...3abb.0
/data/data/####/cae86be9a7df9594_0
/data/data/####/cae86be9a7df9594_1
/data/data/####/ce1c341f5d169822_0
/data/data/####/channel_umeng_common_config.xml
/data/data/####/channel_umeng_common_config.xml.bak
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.dex;classes8.dex
/data/data/####/classes.dex;classes9.dex
/data/data/####/com.vivo.push_preferences.appconfig_v1.xml
/data/data/####/com.vivo.push_preferences.xml
/data/data/####/com.yjyz.uc_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/cu_auth.xml
/data/data/####/d031cddb9481c26f269e1808514ec48efa4326469fccc33...ea57.0
/data/data/####/d16f227a19beb034_0
/data/data/####/d16f227a19beb034_1
/data/data/####/d7a25f931af3226acb58df4566fcc1c956c7daadfa77ab4...8c8b.0
/data/data/####/db80b5191b80455d_0
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/device.xml
/data/data/####/dfc4cd7f511af6c4_0
/data/data/####/dfc4cd7f511af6c4_1
/data/data/####/e7af350b874dc4cc_0
/data/data/####/e7f419023811cd0089c85c695add67b1e3c7ae85c524be0...22b7.0
/data/data/####/edf93f8460b112c93e184a7e52811ed91ccd15eebe12bff...912e.0
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f04a1b812ecf069e_0
/data/data/####/febba98ee7a3a20a7a686455f38b043cd6d7dbc9ea7395d....0.tmp
/data/data/####/https_m.yjzf.com_0.localstorage-journal
/data/data/####/i==1.2.0&&3.11.3_1740024729427_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/jgobfppppp (deleted)
/data/data/####/journal
/data/data/####/leroadcfg.xml
/data/data/####/leroadcfg.xml.bak
/data/data/####/leroadmshieldcfg.xml
/data/data/####/libjiagu_64.so
/data/data/####/local_crash_lock
/data/data/####/logger.db
/data/data/####/logger.db-journal
/data/data/####/map_pref.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/monitor.db
/data/data/####/monitor.db-journal
/data/data/####/msfffppcfg.xml
/data/data/####/msfffppcfg.xml.bak
/data/data/####/msfffppcfg.xml.bak (deleted)
/data/data/####/msgzpfc.xml
/data/data/####/msgzpfc.xml.bak
/data/data/####/msre.db-journal
/data/data/####/msre_po_rt.xml
/data/data/####/msre_po_rt.xml.bak
/data/data/####/msvolcano.db-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/p==6.5.6&&3.11.3_1740024725375_dW1weF9wdXNoX3Jl...y;.log
/data/data/####/p==6.5.6&&3.11.3_1740024735668_dW1weF9wdXNoX2xh...=;.log
/data/data/####/proc_auxv
/data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
/data/data/####/prv_config.xml
/data/data/####/s==7.3.4&&3.11.3_1740024724638_dW1weF9zaGFyZQ==;.log
/data/data/####/sec_gd_config_mshield.xml
/data/data/####/sec_gd_config_mshield.xml.bak
/data/data/####/share.db-journal
/data/data/####/ssoconfigs.xml
/data/data/####/t==9.5.2&&3.11.3_1740024725061_dW5pZnlfbG9ncw==;.log
/data/data/####/tableLogo.xml
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uc_config_data.xml
/data/data/####/uc_config_data.xml.bak
/data/data/####/ujuz_agent.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_push_ut.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_push.xml
/data/data/####/umeng_push.xml.bak
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/z==1.2.0&&3.11.3_1740024723178_emNmZw==;.log
/data/media/####/.g_b_d_v
/data/media/####/.g_m_b_s
/data/media/####/.gdidv
/data/media/####/.icosc
/data/media/####/.x_b_d
/data/misc/####/primary.prof
/data/user_de/####/move_to_de_records.xml

Miscellaneous:

Executes the following shell scripts:

getprop ro.build.version.security_patch
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libBaiduMapSDK_base_v7_6_1
libBugly_Native
libalicomphonenumberauthsdk_core
libaliyunaf
libjiagu_64
libpl_droidsonroids_gif
libpns-2.13.2.1-LogOnlineStandardCuumRelease_alijtca_plus
libtiny_magic
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
DESede-CBC-NoPadding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней