Android.RemoteCode.8420

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 39.1####.226.196:8801
TCP(HTTP/1.1) 47.1####.197.183:8802
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) 47.1####.197.183:8801
TCP(HTTP/1.1) 1####.23.247.140:8888
TCP(HTTP/1.1) cdn.k####.com.####.net:80
TCP(HTTP/1.1) p####.ott####.1####.com:80
TCP(HTTP/1.1) 1####.77.181.150:7777
TCP(HTTP/1.1) all.vod.1####.com:80
TCP(HTTP/1.1) sz####.tp####.cn:93
TCP(HTTP/1.1) c####.ik####.cn.####.net:80
TCP(HTTP/1.1) yt.17ugo####.bo####.net:80
TCP(HTTP/1.1) 1####.77.181.150:8888
TCP(TLS/1.0) c####.net:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) bea####.gcp.g####.com:443
TCP(TLS/1.0) res####.u####.com.####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) os2####.u####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) bea####.g####.com:443
TCP(TLS/1.0) gmscomp####.google####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) 74.1####.205.95:443
TCP(TLS/1.2) 1####.177.14.106:443
TCP(TLS/1.2) 64.2####.164.95:443
TCP(TLS/1.2) 1####.177.14.95:443
TCP(TLS/1.2) 64.2####.162.94:443
UDP bea####.g####.com:443
UDP 1####.250.74.78:443
TCP 1####.24.78.241:9998
UDP bea####.gcp.g####.com:443

DNS requests:

aiz####.c01.l####.####.com
all.vod.1####.com
android####.go####.com
bea####.g####.com
bea####.gcp.g####.com
c####.ik####.cn
c####.net
cdn.k####.com
cn####.u####.com
f####.gst####.com
gmscomp####.google####.com
ip.ta####.com
os####.u####.com
p####.google####.com
p####.ott####.1####.com
res####.u####.com
rr2---s####.g####.com
sz####.tp####.cn
ucc.u####.com
ut####.u####.com
vod.yt.1####.com
www.gst####.com

HTTP GET requests:

all.vod.1####.com/vod2/20240718/1301002-0710/segment-19.ts
all.vod.1####.com/vod2/20240718/1301002-0710/segment-20.ts
all.vod.1####.com/vod2/20240718/1301002-0710/segment-23.ts
all.vod.1####.com/vod2/20240718/1301002-0710/segment-24.ts
c####.ik####.cn.####.net/app/image/20240403/4e2b02aa-5ec6-4ba7-b96a-6c7c...
c####.net:443/api/cz88/ip/base?ip=####
cdn.k####.com.####.net/update/sdk/task_164.jar
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
p####.ott####.1####.com/restn/prod.m3u8?xmt=####&uuid=####
res####.u####.com.####.com:443/resolve
sz####.tp####.cn:93/date/exitAd.png
sz####.tp####.cn:93/date/hqg.png
sz####.tp####.cn:93/date/ugw.png
sz####.tp####.cn:93/dsch/urlcfg.txt
yt.17ugo####.bo####.net/vod2/20240718/1301002-0710/segment-19.ts
yt.17ugo####.bo####.net/vod2/20240718/1301002-0710/segment-20.ts
yt.17ugo####.bo####.net/vod2/20240718/1301002-0710/segment-23.ts

HTTP POST requests:

new-####.u####.com:443/anti/postZdata
os2####.u####.com:443/unify_logs
os2####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/1373037256.dex
/data/data/####/1373037256.dex.flock (deleted)
/data/data/####/1373037256.jar
/data/data/####/1373037256.jar.ab04210df573be1507691bc5b569031f
/data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
/data/data/####/3835634856.dex
/data/data/####/3835634856.dex.flock (deleted)
/data/data/####/3835634856.jar
/data/data/####/3835634856.jar.temp
/data/data/####/3b7371c07eefca10f31786447962b669
/data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
/data/data/####/7ce2c8e3ae028b86853b8fb6206a681e
/data/data/####/Hawk2.xml
/data/data/####/Hawk2.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ad_config.xml
/data/data/####/ad_config.xml.bak
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
/data/data/####/cconfig_sharedpreference.xml
/data/data/####/com.aesq.yh_preferences.xml
/data/data/####/crypto.KEY_256.xml
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/exitAd.png
/data/data/####/favch.db
/data/data/####/favch.db-journal
/data/data/####/hqg.png
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/plugin_file.name
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak
/data/data/####/t==9.7.3&&1.0.40.1_1722948799875_dW5pZnlfbG9ncw==;.log
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_preloadx5_check_cfg_file.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/ugw.png
/data/data/####/um_policy_grant.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/urlcfg.txt
/data/data/####/z==1.2.0&&1.0.40.1_1722948755718_emNmZw==;.log
/data/data/####/z==1.2.0&&1.0.40.1_1722948792202_emNmZw==;.log
/data/media/####/forcetv_iptv.txt
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/tbslog.txt
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/files/.kad
chmod 777 /data/user/0/<Package>/app_ch2/exitAd.png
chmod 777 /data/user/0/<Package>/app_ch2/hqg.png
chmod 777 /data/user/0/<Package>/app_ch2/ugw.png
chmod 777 /data/user/0/<Package>/app_ch2/urlcfg.txt
getprop ro.product.cpu.abi
ls /
ls /sys/class/thermal
sh

Loads the following dynamic libraries:

libconceal
libijkffmpeg
libijksdl
libp3p
libplayer
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RC4
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Gets information about network.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial