Android.RemoteCode.7960

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) gr-i####.c####.ufi####.com:80
TCP(HTTP/1.1) api.lig####.com:80
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) gr-i####.c####.ufi####.com:443
TCP(TLS/1.0) g####.com:443
TCP(TLS/1.0) api.lig####.com:443
TCP(TLS/1.0) 1####.250.150.94:443
TCP(TLS/1.0) 64.2####.161.139:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) rr5---s####.g####.com:443
TCP(TLS/1.0) rr16---####.g####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.2) 1####.250.150.94:443
TCP(TLS/1.2) app-mea####.com:443
TCP(TLS/1.2) md####.google####.com:443
TCP(TLS/1.2) 64.2####.161.139:443
TCP arm.z####.cn:10016
TCP arm.z####.cn:10020
TCP arm.z####.cn:10007
TCP api.lig####.com:443
UDP p####.google####.com:443
UDP md####.google####.com:443

DNS requests:

and####.b####.qq.com
and####.cli####.go####.com
api.lig####.com
app-mea####.com
app.api.cx####.cn
arm.z####.cn
digital####.google####.com
firebas####.google####.com
g####.com
gr-i####.c####.ufi####.com
md####.google####.com
p####.google####.com
pla####.googleu####.com
rr16---####.g####.com
rr18---####.g####.com
rr5---s####.g####.com
www.google####.com

HTTP GET requests:

api.lig####.com/static/indexbanner.png
g####.com:443/mt-xiaocheng/TG/raw/科学工具/弹窗5
gr-i####.c####.ufi####.com/upload/image/202107182351071491.jpg
gr-i####.c####.ufi####.com/upload/image/202107182356571776.png
gr-i####.c####.ufi####.com/upload/image/202107190025201989.png
gr-i####.c####.ufi####.com/upload/image/202107190027121575.jpg
gr-i####.c####.ufi####.com/upload/image/202107190028581457.png
gr-i####.c####.ufi####.com/upload/image/202107190033181824.png
gr-i####.c####.ufi####.com/upload/image/202107190044201877.png
gr-i####.c####.ufi####.com/upload/image/202107190105421376.jpg
gr-i####.c####.ufi####.com/upload/image/202107190106451434.jpg
gr-i####.c####.ufi####.com/upload/image/202107191531071825.png
gr-i####.c####.ufi####.com/upload/image/202107191535211749.png
gr-i####.c####.ufi####.com/upload/image/202107191542071198.png
gr-i####.c####.ufi####.com/upload/image/202107191543561816.png
gr-i####.c####.ufi####.com/upload/image/202107191545451036.png
gr-i####.c####.ufi####.com/upload/image/202107191548081683.jpg
gr-i####.c####.ufi####.com/upload/image/202107191554331348.jpg
gr-i####.c####.ufi####.com/upload/image/202210050025281921.jpg
gr-i####.c####.ufi####.com/upload/image/202210050032391287.jpg
gr-i####.c####.ufi####.com/upload/image/202210050034101137.jpg
gr-i####.c####.ufi####.com/upload/image/202210050038211608.jpg
gr-i####.c####.ufi####.com/upload/image/202210050046251708.png
gr-i####.c####.ufi####.com/upload/image/202210050047541535.jpg
gr-i####.c####.ufi####.com/upload/image/202210050050001819.jpg
gr-i####.c####.ufi####.com:443/upload/image/suning-alipay.png
gr-i####.c####.ufi####.com:443/upload/image/suning-wechat.png

File system changes:

Creates the following files:

/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/08fd66debe6e9f331996a8fc110e92a733854569a7cc273....0.tmp
/data/data/####/1004
/data/data/####/1b57cc87f0ad51945e1fef76b7c4f5e5d86df7a8ee9a694....0.tmp
/data/data/####/1b57cc87f0ad51945e1fef76b7c4f5e5d86df7a8ee9a694...f6c2.0
/data/data/####/1c272fc2b34cde6e3424d147781f9b9ae69d1c9dd73dcc4....0.tmp
/data/data/####/1c272fc2b34cde6e3424d147781f9b9ae69d1c9dd73dcc4...leted)
/data/data/####/85160662c4c5ed61e1ab238db0fda0c5c5f3e2b9e832e0f....0.tmp
/data/data/####/8806617b61bab9ae57104df744b677524634cc1b1645f5a....0.tmp
/data/data/####/8806617b61bab9ae57104df744b677524634cc1b1645f5a...2658.0
/data/data/####/905484e13a53b19d29eb2df32322f92b4a8f28be3022904....0.tmp
/data/data/####/905484e13a53b19d29eb2df32322f92b4a8f28be3022904...cf17.0
/data/data/####/9568ce1b5eb68ae0814a6d5af222f5916181c3d71046fc7....0.tmp
/data/data/####/9568ce1b5eb68ae0814a6d5af222f5916181c3d71046fc7...leted)
/data/data/####/9e8b1a52044a7fbbbc99392a1dc63ae88778db384b3016a....0.tmp
/data/data/####/9edc1b99d0f1af09d30a382052794c45dc5842ce813622d...3386.0
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/SnHLpneBbaYS (deleted)
/data/data/####/a338fbac1416adf6efe09025eda1640769e4d8752cafcfa....0.tmp
/data/data/####/a338fbac1416adf6efe09025eda1640769e4d8752cafcfa...78c2.0
/data/data/####/b1527a9776464edce5f3a4f4b811fe4feb9988894c141b3....0.tmp
/data/data/####/b1527a9776464edce5f3a4f4b811fe4feb9988894c141b3...leted)
/data/data/####/bd38b7cbf7a7f64b222b0fc42f12e751543ba31427ddb83...leted)
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/crashrecord.xml
/data/data/####/e82a90a390f035046578ef538694029161dba2879708942....0.tmp
/data/data/####/e82a90a390f035046578ef538694029161dba2879708942...d4b6.0
/data/data/####/ghpxvpQnhouQ (deleted)
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/native_record_lock
/data/data/####/proc_auxv
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
getprop

Loads the following dynamic libraries:

libBugly_Native
libarm
libjiagu
libmmkv

Uses the following algorithms to encrypt data:

RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial