Android.RemoteCode.8374

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) djhonz7####.cloudf####.net:80
TCP(HTTP/1.1) ip####.com:80
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) sd####.moen####.com:443
TCP(TLS/1.0) laun####.appsf####.com:443
TCP(TLS/1.0) chec####.cc:443
TCP(TLS/1.0) 360m####.com:443
TCP(TLS/1.0) a####.br####.io:443
TCP(TLS/1.0) o45####.in####.se####.io:443
TCP(TLS/1.0) cdn.br####.io:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) api.appsfly####.com.####.net:443
TCP(TLS/1.0) api.onesi####.com:443
TCP(TLS/1.0) gc####.appsf####.com:443
TCP(TLS/1.0) firebas####.crashly####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) log-re####.com:443
TCP(TLS/1.2) 1####.177.14.94:443
TCP(TLS/1.2) and####.a####.go####.com:443
TCP(TLS/1.2) firebas####.google####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 1####.250.150.101:443
TCP(TLS/1.2) 1####.250.150.113:443
TCP(TLS/1.2) chec####.cc:443
TCP api.pock####.in:443
UDP firebas####.google####.com:443
UDP rr2---s####.g####.com:443

DNS requests:

360m####.com
Arm.apkt####.com
a####.br####.io
and####.a####.go####.com
api.onesi####.com
api.pock####.in
cdn-set####.appsfly####.com
cdn.br####.io
chec####.cc
connect####.gst####.com
convers####.appsf####.com
djhonz7####.cloudf####.net
firebas####.crashly####.com
firebas####.google####.com
firebas####.google####.com
g####.face####.com
gc####.appsf####.com
ip####.com
laun####.appsf####.com
log-re####.com
o45####.in####.se####.io
p####.google####.com
rr2---s####.g####.com
sd####.moen####.com
st####.tin####.com

HTTP GET requests:

360m####.com:443/feature/config?api_version=####&app_id=####&app_version...
api.appsfly####.com.####.net:443/android/v1/7406c959a26166e60f3da324150b...
api.onesi####.com:443/apps/2e1521d1-387f-4d57-9997-a170c4d68940/android_...
cdn.br####.io:443/sdk/uriskiplist_v1.json
cdn.br####.io:443/sdk/uriskiplist_v2.json
chec####.cc:443/jd?a=####&av=####&cv=####&d=####&p=####&v=####&vc=####
djhonz7####.cloudf####.net/row_login_options_image.webp
djhonz7####.cloudf####.net/save_progress_illustration_english.webp
firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:148849657...
gc####.appsf####.com:443/install_data/v4.0/<Package>?devkey=####&device_...
ip####.com/json/

HTTP POST requests:

a####.br####.io:443/v1/close
a####.br####.io:443/v1/install
a####.br####.io:443/v1/open
api.onesi####.com:443/players
firebas####.google####.com:443/v1/firelog/legacy/batchlog
firebas####.google####.com:443/v1/projects/148849657400/namespaces/fireb...
firebas####.google####.com:443/v1/projects/148849657400/namespaces/firep...
firebas####.google####.com:443/v1/projects/onesignal-shared-public/insta...
firebas####.google####.com:443/v1/projects/pocketfmapp/installations
laun####.appsf####.com:443/api/v6.6/androidevent?app_id=####&buildnumber...
log-re####.com:443/report
o45####.in####.se####.io:443/api/6060999/envelope/
sd####.moen####.com:443/v1/getAndroidInboxMessages
sd####.moen####.com:443/v2/sdk/device/ZM16R1AKQFF35B44OUXB81TZ
sd####.moen####.com:443/v2/sdk/report/ZM16R1AKQFF35B44OUXB81TZ
sd####.moen####.com:443/v3/sdkconfig/android/ZM16R1AKQFF35B44OUXB81TZ

File system changes:

Creates the following files:

/data/data/####/.font5181-5181-0
/data/data/####/.jg.ac
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/.
/data/data/####/.
/data/data/####/0de94fc3-bc82-4795-bb38-032efdcd68cd.envelope
/data/data/####/176174b7194c17ee1918b75374653ebf.0.tmp
/data/data/####/176174b7194c17ee1918b75374653ebf.1
/data/data/####/176174b7194c17ee1918b75374653ebf.1.tmp
/data/data/####/333da90d3e684ae6b912dcda61c8c986.envelope
/data/data/####/33972f5415e372a88be91703b88d165928c1c3960737842...leted)
/data/data/####/33972f5415e372a88be91703b88d165928c1c3960737842...xz.apk
/data/data/####/33972f5415e372a88be91703b88d165928c1c3960737842...xz.dex
/data/data/####/541f8cc137d7a7ec1adee58ac9e79d12.0.tmp
/data/data/####/541f8cc137d7a7ec1adee58ac9e79d12.1.tmp
/data/data/####/54576575-da87-438a-b926-06718bce007c.envelope
/data/data/####/6c8fde86-250e-4085-b2a0-88fb6e35c96b.envelope
/data/data/####/6caf450fa35b08e2dea1a609c78e4886265ddb74a436267....0.tmp
/data/data/####/6caf450fa35b08e2dea1a609c78e4886265ddb74a436267...a9c4.0
/data/data/####/85d16c1ac5949469fe5f3c9d8408a2a8.0.tmp
/data/data/####/85d16c1ac5949469fe5f3c9d8408a2a8.1.tmp
/data/data/####/8a773cf87bfd4cb9a876ead5adc40399.envelope
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/BNC_Server_Request_Queue.xml
/data/data/####/CBGr2.xml
/data/data/####/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX0...Yz.xml
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MToxNDg4NDk2NTc0M...Q3.xml
/data/data/####/FirebasePerfSharedPrefs.xml
/data/data/####/FirebasePerfSharedPrefs.xml.bak
/data/data/####/GTPlayerPurchases.xml
/data/data/####/INSTALLATION
/data/data/####/MOEInteractions-journal
/data/data/####/OneSignal.db-journal
/data/data/####/OneSignalTriggers.xml
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToxNDg4NDk2...3.json
/data/data/####/PersistedInstallation1130097584tmp
/data/data/####/PersistedInstallation1905622045tmp
/data/data/####/PersistedInstallation904333479tmp
/data/data/####/androidx.work.workdb-journal
/data/data/####/appsflyer-data.xml
/data/data/####/appsflyer-data.xml.bak
/data/data/####/appsflyer-data.xml.bak (deleted)
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/b7dacff5d7994880b22378e5e976d4e9.envelope
/data/data/####/batch.db-journal
/data/data/####/bfb9d553aa6b4802b35ff72961dbd336.envelope
/data/data/####/branch_referral_shared_pref.xml
/data/data/####/branch_referral_shared_pref.xml.bak
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.dex;classes8.dex
/data/data/####/classes.oat
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/com.radio.pocketfm_preferences.xml
/data/data/####/com.radio.pocketfm_preferences.xml.bak
/data/data/####/d20d01cfe90c46b99b3af374cb915f5c.envelope
/data/data/####/d9a1d2239b1127e051d7f6abd99367a8b050a46feedefdf....0.tmp
/data/data/####/d9a1d2239b1127e051d7f6abd99367a8b050a46feedefdf...6cee.0
/data/data/####/f72122c2d4d9d3e62207daaa2a69f338.0.tmp
/data/data/####/f72122c2d4d9d3e62207daaa2a69f338.1.tmp
/data/data/####/f943e55cb9c74d77bb57d57ba8507fee.envelope
/data/data/####/frc_1;148849657400;android;92c785d79f1bfb47_fir...e.json
/data/data/####/frc_1;148849657400;android;92c785d79f1bfb47_fir...gs.xml
/data/data/####/frc_1;148849657400;android;92c785d79f1bfb47_fir...h.json
/data/data/####/frc_1;148849657400;android;92c785d79f1bfb47_fir...ml.bak
/data/data/####/frc_1;148849657400;android;92c785d79f1bfb47_fir...s.json
/data/data/####/generatefid.lock
/data/data/####/initialization_marker
/data/data/####/jgobfppppp (deleted)
/data/data/####/journal.bkp (deleted)
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/libjiagu_64.so
/data/data/####/pocketfm_database-journal (deleted)
/data/data/####/pref_moe.xml
/data/data/####/r2.xml
/data/data/####/report
/data/data/####/session.json
/data/data/####/start-time
/data/data/####/user-data
/data/data/####/user_pref.xml
/data/data/####/user_pref.xml.bak (deleted)
/data/media/####/crash.txt
/data/misc/####/primary.prof

Miscellaneous:

Loads the following dynamic libraries:

libjiagu_64

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
DES
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

DES
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial