Android.Packed.56120

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.840.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.217.20.170:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) st####.dc####.net.cn:443
TCP(TLS/1.2) 1####.217.16.35:443
TCP(TLS/1.2) 1####.217.20.170:443
TCP(TLS/1.2) and####.cli####.go####.com:443

DNS requests:

and####.cli####.go####.com
and####.google####.com
instant####.google####.com
m####.go####.com
st####.dc####.net.cn

HTTP POST requests:

st####.dc####.net.cn:443/collect/crash

File system changes:

Creates the following files:

/data/data/####/.cl
/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_pid
/data/data/####/15b1d59c16c5d4dd17b16b7c3a38f4f4
/data/data/####/1647e66633e8e26971bfb56798e65225
/data/data/####/2770d0a2cbf9b11bd26caf8a14bed446
/data/data/####/3af6025f816f6870055085ffa333c4d9
/data/data/####/50d4d352c9d9a880c7746c7584b3ab9b
/data/data/####/67476f2b3a67f4919102cfad5b1a7686
/data/data/####/69c6e8debf47e3d37d97c0c4d8216ec2
/data/data/####/70a2e346b391c0693854eec7bc00bcfc
/data/data/####/808aa570a9bc2c25f50c2d679c09870b
/data/data/####/81582a4fb9aa728fdd9bdf42891d5aa4
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__UNI__CA73569.xml
/data/data/####/a6d02ca6ec554218c561574a55279eb1
/data/data/####/af82f2655ec713c8b16545f2ede7f6a4
/data/data/####/c9185c6bc5815569bdefbc7e04c7fa78
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.oat
/data/data/####/com.yfuuk.ukdg_preferences.xml
/data/data/####/crash_dump.log
/data/data/####/dc53b46e0d380d9eb502908258b7ca47
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e7c15731d85ac2bc724a5990892a1ce4
/data/data/####/ebfabaa87c934a02e5df4f191bb35037
/data/data/####/grp.prop
/data/data/####/lib39285EFA.so
/data/data/####/libAMapSDK_MAP_v8_1_0.so
/data/data/####/libBaiduSpeechSDK.so
/data/data/####/libc++_shared.so
/data/data/####/libgetuiext3.so
/data/data/####/libgifimage.so
/data/data/####/libimagepipeline.so
/data/data/####/libjiagu.so
/data/data/####/liblamemp3.so
/data/data/####/libnative-filters.so
/data/data/####/libnative-imagetranscoder.so
/data/data/####/libpl_droidsonroids_gif.so
/data/data/####/libso.so
/data/data/####/libstatic-webp.so
/data/data/####/libweexcore.so
/data/data/####/libweexjsb.so
/data/data/####/libweexjss.so
/data/data/####/libweexjst.so
/data/data/####/metrics_guid
/data/data/####/pdr.xml
/data/data/####/proc_auxv
/data/data/####/weex_default_settings.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 41 42 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 43 44 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 45 48 1 /data/user/0/<Package>/app_crash/crash_dump.log

Uses the following algorithms to encrypt data: