Android.Siggen.8203

Technical information

Malicious functions:

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) p15.q####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cdn.hm.p####.####.com:80
TCP(HTTP/1.1) p16.q####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) p5.y####.com:80
TCP(HTTP/1.1) td.m####.cn:80
TCP(HTTP/1.1) fo####.api.migua####.com:80
TCP(HTTP/1.1) t####.talking####.net:80
TCP(HTTP/1.1) api.migua####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
UDP(NTP) 1.cn.p####.####.org:123
UDP(NTP) 0.a####.p####.####.org:123
TCP(TLS/1.0) jic.talking####.com:443
TCP(TLS/1.0) ws1.xiangyu####.com:443
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

DNS requests:

0.a####.p####.####.org
1.cn.p####.####.org
7j####.c####.z0.####.com
api.migua####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.hm.p####.cn
cdn.migua####.com
fo####.api.migua####.com
i####.cn
jic.talking####.com
p15.q####.com
p16.q####.com
p17.q####.com
p18.q####.com
p5.y####.com
p6.q####.com
p9.y####.com
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.i####.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
t####.talking####.net
td.m####.cn
ws1.xiangyu####.com

HTTP GET requests:

api.migua####.com/game/token/token_api?device_id=####&ver_code=####&chan...
api.migua####.com/search_miguan_api/search/auto_keyword?os=####&sdkver=#...
api.migua####.com/search_miguan_api/search/searchresult?os=####&sdkver=#...
cdn.hm.p####.####.com/f/pkg/ph/000/004/592/5ad0a3c8h461248a.png
fo####.api.migua####.com/widgetapi/categoryapp_sort?os=####&sdkver=####&...
fo####.api.migua####.com/widgetapi/default_recommend?os=####&sdkver=####...
fo####.api.migua####.com/widgetapi/famous_recommend?os=####&sdkver=####&...
fo####.api.migua####.com/widgetapi/log/uploadhwtoken?os=####&sdkver=####...
fo####.api.migua####.com/widgetapi/widgetup/upgrade?os=####&sdkver=####&...
p15.q####.com/t0114af01191d112a75.png
p15.q####.com/t011a3d4e72987f882c.png
p15.q####.com/t011b2400f111ae1c67.png
p15.q####.com/t011ff49fdbe8a621c8.png
p15.q####.com/t01834b925652eba811.png
p15.q####.com/t01c51aada31e4c9459.png
p16.q####.com/t01718b94075d4066fc.png
p16.q####.com/t01933b63da5006c0cd.png
p16.q####.com/t01c4facaeb36f0c919.png
p5.y####.com/t011059332849c9a4ae.jpg
p5.y####.com/t01239bac8053d69fc2.jpg
p5.y####.com/t012cda0e6868ad4afd.png
p5.y####.com/t0133cd6691a58a149a.jpg
p5.y####.com/t0137fc64ba8fdd6c3c.jpg
p5.y####.com/t013b8843a517eec1bf.png
p5.y####.com/t0141b3a32b916af512.png
p5.y####.com/t015a273cd8869bc240.png
p5.y####.com/t015dc2667796a417a2.png
p5.y####.com/t0161c57f33b55cda1c.jpg
p5.y####.com/t01770674cfa9fb84f3.png
p5.y####.com/t018393ff46ccc09df2.png
p5.y####.com/t01855f9be0d6bf521d.png
p5.y####.com/t019eb4cc619cd9ac7b.png
p5.y####.com/t01a590f0873abe9973.png
p5.y####.com/t01ae35712aa11a38ab.png
p5.y####.com/t01aedb59bf9028faba.png
p5.y####.com/t01b480f7dbeb375332.png
p5.y####.com/t01bc3f5ae5507afdcb.jpg
p5.y####.com/t01c456ea79fe7f4e9c.png
p5.y####.com/t01ed96ae0462cff06b.png
sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_KvG284
sni.c####.q####.####.net/tdata_gLi931
t####.c####.q####.####.com/tdata_EDT356

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
t####.talking####.net/g/d?crc=####
td.m####.cn/api/collect/app/3c99d6d9a19c2699cbe29901bb0c04372
td.m####.cn/api/q/a/3c99d6d9a19c2699cbe29901bb0c04372
td.m####.cn/api/statis/3c99d6d9a19c2699cbe29901bb0c04372
td.m####.cn/api/statis/3c99d6d9a19c2699cbe29901bb0c04372/app-6532545452C...

Modified file system:

Creates the following files:

/data/data/####/07fdfbeb3c5d2b61f482cf8e7520c552.0.tmp
/data/data/####/07fdfbeb3c5d2b61f482cf8e7520c552.1.tmp
/data/data/####/1046cc32efa0de12fe9dfb592f37015c.0.tmp
/data/data/####/1046cc32efa0de12fe9dfb592f37015c.1.tmp
/data/data/####/1671e18c1e9ea39168cba3481a681c91.0.tmp
/data/data/####/1671e18c1e9ea39168cba3481a681c91.1.tmp
/data/data/####/3435da54f05b1c76606d4424601b64c6.0.tmp
/data/data/####/3435da54f05b1c76606d4424601b64c6.1.tmp
/data/data/####/4d3f19797738714b1b88cfba456e1734.0.tmp
/data/data/####/4d3f19797738714b1b88cfba456e1734.1.tmp
/data/data/####/64251fa81bb0543e2d1fe704efc8d18c.0.tmp
/data/data/####/64251fa81bb0543e2d1fe704efc8d18c.1.tmp
/data/data/####/6eea0e52e74a9718781bc59318f0c8ee.0.tmp
/data/data/####/6eea0e52e74a9718781bc59318f0c8ee.1.tmp
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml (deleted)
/data/data/####/TD_app_pefercen_profile.xml.bak (deleted)
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime.xml.bak (deleted)
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/app_info.db
/data/data/####/app_info.db-journal
/data/data/####/b8d0d42108a9df51f73cca77addc0437.0.tmp
/data/data/####/b8d0d42108a9df51f73cca77addc0437.1.tmp
/data/data/####/c6863122eb3a4a4bbec57cbfc30f933c.0.tmp
/data/data/####/c6863122eb3a4a4bbec57cbfc30f933c.1.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.miguan.folder_preferences.xml
/data/data/####/d48050791b1c396ec7c9f54f8e131da5.0.tmp
/data/data/####/d48050791b1c396ec7c9f54f8e131da5.1.tmp
/data/data/####/e24a57caa64a
/data/data/####/ebf9ba7eb3b5804780b602d9fc6a9b08.0.tmp
/data/data/####/ebf9ba7eb3b5804780b602d9fc6a9b08.1.tmp
/data/data/####/ec30df15e67856f639f41e80581a419f.0.tmp
/data/data/####/ec30df15e67856f639f41e80581a419f.1.tmp
/data/data/####/f6ca1149626fadeefff904ed8a5e6a4d.0.tmp
/data/data/####/f6ca1149626fadeefff904ed8a5e6a4d.1.tmp
/data/data/####/file_cache.xml
/data/data/####/gdaemon_20161017
/data/data/####/gx_sp.xml
/data/data/####/increment.db-journal
/data/data/####/init.pid
/data/data/####/init_c.pid
/data/data/####/install.app.xml
/data/data/####/journal.tmp
/data/data/####/log-journal
/data/data/####/map_values.xml
/data/data/####/mobclick_agent_cached_com.miguan.folder4
/data/data/####/mpush_app.db-journal
/data/data/####/mpush_gateway_preferences_file
/data/data/####/mpush_version_preferences_file
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/td.lock
/data/data/####/tdata_KvG284
/data/data/####/tdata_KvG284.jar
/data/data/####/tdata_gLi931
/data/data/####/tdata_gLi931.jar
/data/data/####/tdid.xml
/data/data/####/umeng_general_config.xml
/data/media/####/.tcookieid
/data/media/####/01d7eb88f68b4f8138ec66766db65560a3aa5b633ceac4....0.tmp
/data/media/####/0c799a5eae2f765b309100befe7db3153f4a8f3b27c003....0.tmp
/data/media/####/0d8e0c66208703d6811da6dd2df9933fff1c65234ded86....0.tmp
/data/media/####/100027c0b53052765f9b97f6d1c680cd1527d74dc7e3f4....0.tmp
/data/media/####/26fbb313705d1e18a02d56b9b09e69491cdee689c4b9a1....0.tmp
/data/media/####/2cd1aa13759733e2b0e58d4cc0c4c96b904e2d21d9d785....0.tmp
/data/media/####/31c20601e013091dc3e31f4a9cff921d4550da8e3d7f19....0.tmp
/data/media/####/4897fe3aadc3643e4d0aa79697da9ce8a5df307c8b45e6....0.tmp
/data/media/####/493caabc72513af37f6dbd28f24733cce6e2accb0e36b6....0.tmp
/data/media/####/4bc72ebdb427e68ce6efb952b3b22093e85b9f3156ad2e....0.tmp
/data/media/####/56bf5d60207ef23a2beb819fddf6f904161e0eb2f684ae....0.tmp
/data/media/####/632a41862903403870f63ef59bfb2640344aa5905fbed1....0.tmp
/data/media/####/652f951da68175020553f6e7f958a71c815a5940962f31....0.tmp
/data/media/####/67e318f0c6c7e71648a4ee43f15147514f2cc93d2cd3b4....0.tmp
/data/media/####/7fb20a672fba08c46239233091786754d2056bfc709dd0....0.tmp
/data/media/####/91e867643f61aabdb23a54f66848af88fb7540b327e900....0.tmp
/data/media/####/9712f2d618d2048f359ce14982e2f6ae2355ce59cbd828....0.tmp
/data/media/####/99ab05a4ff46492dcfd5decfae52ac9ced678e5c111f9e....0.tmp
/data/media/####/a6e2d0e3dc396937baff27ff40c25292fa8dcd21be50e9....0.tmp
/data/media/####/app.db
/data/media/####/b385026b8522508456dc78921c9373e8429741478ec59e....0.tmp
/data/media/####/b992f9872027a0d5baa4e142dacbe906a99d97489a24ee....0.tmp
/data/media/####/ba9940814834bca5272afe07dafc7f1e471dc18b0a1e25....0.tmp
/data/media/####/cd8e6de75bc8d9bb090d8694c30006a30ca98c15adaada....0.tmp
/data/media/####/cf68bbb9d15f8394e365cf1cc5e7c22ff485efdd56c26a....0.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.miguan.folder.db
/data/media/####/d8af329d715913b9d947663911234f5a3d358cf2933b57....0.tmp
/data/media/####/dc8cffed8d469f5d1ed24b576bbbbf5fee1530d1d153a0....0.tmp
/data/media/####/df729e72b92f84083718f01f7ad4cbc71894f1a55b7c12....0.tmp
/data/media/####/e0151a2befc886843dcfcd2303b653de741ce5917b6707....0.tmp
/data/media/####/f8a6f725612cad6e3f9cfaa51c3b4f1e3a3b934b50a289....0.tmp
/data/media/####/journal.tmp
/data/media/####/tdata_KvG284
/data/media/####/tdata_gLi931
/data/media/####/test.log

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24688 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop
mount

Loads the following dynamic libraries:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

1
AES-CBC-PKCS7Padding
AES-CFB-NoPadding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней