Android.RemoteCode.7821

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Prompts to install third-party apps.

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) gameove####.fireba####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) 1####.251.1.95:443
TCP(TLS/1.0) rr3---s####.g####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 64.2####.161.95:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) rr1---s####.g####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) rr7---s####.g####.com:443
TCP(TLS/1.0) 74.1####.131.95:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) 64.2####.161.95:443
TCP(TLS/1.2) 1####.251.1.95:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) pla####.google####.com:443
UDP p####.google####.com:443
UDP 85.1####.117.141:443
UDP rr1---s####.g####.com:443
UDP 64.2####.161.95:443
TCP e####.ar####.com:10005
UDP 1####.194.73.95:443

DNS requests:

and####.a####.go####.com
and####.cli####.go####.com
app-mea####.com
connect####.gst####.com
e####.ar####.com
firebas####.google####.com
gameove####.fireba####.com
gmscomp####.google####.com
m####.go####.com
md####.google####.com
p####.google####.com
pla####.google####.com
pla####.googleu####.com
rr1---s####.g####.com
rr3---s####.g####.com
rr7---s####.g####.com

HTTP GET requests:

gameove####.fireba####.com:443/.ws?ns=####&v=####

File system changes:

Creates the following files:

/data/data/####/03874ce1-c38c-4032-81f9-b56939ea90e8
/data/data/####/4ef7dca2-c4dc-4747-a6af-555568168f5a
/data/data/####/5098f565-432d-48af-9a0a-813475b8bd0a
/data/data/####/BackgroundLogger.db-journal
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjE1NzE4NDEzM...gw.xml
/data/data/####/M3B8oh0BG7EforCfBtdigj7XM00
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToyMjE1NzE4...w.json
/data/data/####/PersistedInstallation1657833517tmp
/data/data/####/accounts_valuestore.pb.lock
/data/data/####/ad_id_valuestore.pb.lock
/data/data/####/ad_id_valuestore.pb.tmp
/data/data/####/app_update_metadata_valuestore.pb.lock
/data/data/####/background_counters.db-journal
/data/data/####/background_system_job_valuestore.pb.tmp
/data/data/####/cache_performance_summary.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/classes2.dex.flock (deleted)
/data/data/####/com.google.InstanceId.properties
/data/data/####/com.google.android.gcm.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.clearcut_client#com.andr...ing.pb
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.libraries.mdi.sync#com.andro...3492-3
/data/data/####/com.google.android.libraries.onegoogle#com.andr...1034-0
/data/data/####/com.google.android.libraries.onegoogle#com.andr...ing.pb
/data/data/####/counters.db-journal
/data/data/####/data_loader_readlogs_cache_metadata_valuestore.pb.lock
/data/data/####/dataloader_failure_valuestore.pb.lock
/data/data/####/download_service-journal
/data/data/####/download_service_preferences_key.xml
/data/data/####/download_service_preferences_key.xml.bak (deleted)
/data/data/####/event_generator.xml
/data/data/####/event_generator_6.xml
/data/data/####/event_tasks_valuestore.pb.tmp
/data/data/####/eventlog.store1201112368.log
/data/data/####/eventlog.store1526881220.log
/data/data/####/eventlog.store1870574930.log
/data/data/####/eventlog.store1990340353.log
/data/data/####/eventlog.store2013058031.log
/data/data/####/eventlog.store2056408649.log
/data/data/####/eventlog.store550416639.log
/data/data/####/experiment-flags-process-stable
/data/data/####/experiment-flags-regular-null-account
/data/data/####/finsky.xml
/data/data/####/frosting.db-journal
/data/data/####/gameover-ce9c6-default-rtdb.firebaseio.com.443
/data/data/####/generatefid.lock
/data/data/####/gfbfv11146703993old
/data/data/####/gfbfv137591659old
/data/data/####/gfbfv1534184238old
/data/data/####/gmscompliance.pb
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/hygiene_valuestore.pb
/data/data/####/hygiene_valuestore.pb.tmp
/data/data/####/installed_apks_valuestore.pb.tmp
/data/data/####/installer_data_v2.db
/data/data/####/language_split_per_app_valuestore.pb.lock
/data/data/####/localappstate.db-journal
/data/data/####/logs_upload_attempt.log
/data/data/####/main_scheduler_preferences_valuestore.pb.tmp
/data/data/####/main_system_job_valuestore.pb
/data/data/####/main_system_job_valuestore.pb.tmp
/data/data/####/multi_proc.pb.lock
/data/data/####/on_device_app_data_cache_valuestore.pb.tmp
/data/data/####/p_com.android.vending902952475.apk
/data/data/####/p_config.en1951849825.apk
/data/data/####/p_config.x86_64530544350.apk
/data/data/####/pai_apps.db-journal
/data/data/####/payload_valuestore.pb
/data/data/####/payload_valuestore.pb.tmp
/data/data/####/phenotype.db
/data/data/####/phenotype.db-journal
/data/data/####/phenotype.db-journal (deleted)
/data/data/####/phenotype.db-shm (deleted)
/data/data/####/phenotype.db-wal
/data/data/####/phenotype.db-wal (deleted)
/data/data/####/phonesky_header_valuestore.pb.lock
/data/data/####/phonesky_header_valuestore.pb.tmp
/data/data/####/play_metalog.log
/data/data/####/play_module_service_shared_prefs.xml
/data/data/####/proc_auxv
/data/data/####/proc_background.pb.tmp
/data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
/data/data/####/quick_launch_counters.db-journal
/data/data/####/resource_data.db
/data/data/####/scheduler_background-journal
/data/data/####/scheduler_main-journal
/data/data/####/scheduler_main-journal (deleted)
/data/data/####/selfupdate_scheduler.xml
/data/data/####/selfupdate_scheduler.xml.bak (deleted)
/data/data/####/store_update_checker_valuestore.pb
/data/data/####/store_update_checker_valuestore.pb.tmp
/data/data/####/streamdatastore.db-journal
/data/data/####/temp-experiment-flags-process-stable
/data/data/####/temp-experiment-flags-regular-null-account
/data/data/####/unified_sync_accounts_valuestore.pb
/data/data/####/unified_sync_accounts_valuestore.pb.tmp
/data/data/####/verify_apps.db-journal
/data/misc/####/primary.prof
/data/user_de/####/com.google.android.libraries.performance.pri...3574-4

Miscellaneous:

Executes the following shell scripts:

cmd package compile -m speed-profile --check-prof true com.android.vending

Loads the following dynamic libraries:

libArmEpicVm

Uses the following algorithms to encrypt data:

RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

RSA-ECB-PKCS1Padding

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about active device administrators.

Gets information about installed apps.

Gets information about accounts associated with the device.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial