Android.RemoteCode.8460

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) www.mu####.cc:80
TCP(HTTP/1.1) www.m####.top:80
TCP(HTTP/1.1) 39.1####.226.196:8801
TCP(HTTP/1.1) du####.fun:80
TCP(HTTP/1.1) i####.doub####.com:80
TCP(HTTP/1.1) 629h####.743for####.com:80
TCP(HTTP/1.1) cdn.k####.com.####.net:80
TCP(HTTP/1.1) ys.changme####.com:80
TCP(HTTP/1.1) 1####.23.148.191:8802
TCP(HTTP/1.1) 1####.23.247.140:8888
TCP(HTTP/1.1) a####.rin####.com:80
TCP(HTTP/1.1) c####.xn--m7r####.tk:80
TCP(HTTP/1.1) i####.x####.com:80
TCP(HTTP/1.1) 1####.77.181.150:8888
TCP(HTTP/1.1) 1####.62.61.51:6888
TCP(HTTP/1.1) www.w####.net:80
TCP(HTTP/1.1) op.ys####.cn:80
TCP(HTTP/1.1) 1####.62.63.181:8080
TCP(HTTP/1.1) v.l####.cn:80
TCP(HTTP/1.1) 1####.23.148.191:8801
TCP(HTTP/1.1) 1####.77.181.150:7777
TCP(HTTP/1.1) m5nj####.743for####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) cf.69####.xyz:80
TCP(HTTP/1.1) v.r####.cn:80
TCP(TLS/1.0) wx.y.g####.####.com:443
TCP(TLS/1.0) 2####.58.211.10:443
TCP(TLS/1.0) 1####.250.74.74:443
TCP(TLS/1.0) obs.gdu####.com.####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) 1####.250.74.67:443
TCP(TLS/1.0) www.x####.com:443
TCP(TLS/1.0) 2####.239.38.223:443
TCP(TLS/1.0) 1####.217.21.170:443
TCP(TLS/1.0) i####.doub####.com.####.cn:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) v####.obs.cn-ea####.####.com:443
TCP(TLS/1.0) e91f####.qiuc####.tech:443
TCP(TLS/1.0) 2####.239.32.223:443
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.2) 1####.250.74.68:443
TCP(TLS/1.2) 1####.250.74.170:443
TCP(TLS/1.2) 1####.250.74.35:443
TCP(TLS/1.2) 1####.217.21.170:443
TCP(TLS/1.2) 1####.250.74.46:443
TCP d####.oss-cn-####.byt####.store:443
TCP i####.g####.com.####.net:443
TCP g####.xyz:443
UDP 2####.239.32.223:443
TCP www.me####.cn:443
TCP for####.do####.com:443
TCP 1####.248.200.65:443
TCP www.panse####.me:443
TCP api.web.36####.com:443
TCP a.w.bili####.com:443
TCP seagm-m####.seag####.com:443
TCP www.dm####.com:443
TCP www.hkybq####.com:443
TCP we####.q####.cn.####.com:443
TCP dl.panse####.me:443
TCP 9e67####.yzz####.com:443
TCP vip.w####.cn:5200
TCP vod####.i####.q####.####.com:443
TCP www.b####.me:443
TCP hiph####.jom####.com:443
TCP im####.we####.nl:443
TCP c####.xn--m7r####.tk:443
TCP apiappd####.68.gy:5689
TCP i####.doub####.com:443
TCP d####.cloudf####.18####.xyz:443
TCP 47.1####.114.71:9998
TCP www.kk####.com:443
TCP www.w####.net:443
UDP 2####.255.255.250:1900
TCP du####.fun:443
TCP p####.pro:443
TCP opencdn####.jom####.com:443
TCP img1-do####.b0.a####.com:443
TCP a####.com:443
TCP www.li####.cc:443
TCP y####.fun:443
TCP i####.doub####.com.####.com:443

DNS requests:

4k.4####.cn
a####.com
a####.rin####.com
and####.b####.qq.com
api.bili####.com
api.pull####.com
api.web.36####.com
apiappd####.68.gy
c####.xn--m7r####.tk
cdn.k####.com
d####.cc
d####.cc
d####.cloudf####.18####.xyz
d####.oss-cn-####.byt####.store
dl.panse####.me
du####.fun
f####.do####.com
fs-im-####.7moor####.com
g####.b####.com
g####.xyz
h.t####.qq.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.g####.com
i####.x####.com
im####.b####.com
im####.we####.nl
ip.ta####.com
lab####.com
m####.do####.com
m####.xn--yet####.top
m.y####.com
obs.gdu####.com
op.ys####.cn
p####.pro
p####.yzzyim####.com
pla####.google####.com
rr6---s####.g####.com
rr9---s####.g####.com
seagm-m####.seag####.com
so.xn--m7r####.tk
v####.obs.cn-ea####.####.com
v.l####.cn
v.r####.cn
vip.w####.cn
w####.x####.cf
we####.q####.cn
wog####.33####.xyz
wog####.88####.xyz
www.b####.me
www.dm####.com
www.hkybq####.com
www.kk####.com
www.li####.cc
www.m####.fun
www.m####.top
www.me####.cn
www.mu####.cc
www.muo####.top
www.panse####.me
www.w####.lol
www.w####.net
www.x####.com
www.x####.net
www.xn--sss####.com
wx.y.g####.cn
y####.fun
ys.changme####.com
z####.cloudf####.18####.xyz

HTTP GET requests:

629h####.743for####.com/
a####.rin####.com/api/video/search?key=####&page=####
c####.xn--m7r####.tk/
c####.xn--m7r####.tk/czzysearch.php?wd=####
c####.xn--m7r####.tk/index.php/vod/search.html?wd=####
cdn.k####.com.####.net/update/sdk/task_164.jar
cf.69####.xyz/s----------.html?wd=####
du####.fun/index.php/vod/search.html?wd=####
e91f####.qiuc####.tech:443/GE/CC/VALIDATOR?key=####&url=####
e91f####.qiuc####.tech:443/search?exact=####&format=####&page=####&q=###...
i####.doub####.com/05840000673D5EC4C7BFE9128B90623A
i####.doub####.com/05840000673D5EC4C7BFE9128B90623A?x-oss-process=####
i####.x####.com/api.php/v2.vod/androidsearch10086?page=####&wd=####
m5nj####.743for####.com/tv
m5nj####.743for####.com/tv/
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
obs.gdu####.com.####.com:443/upload/movie/20241120/vod27140256.webp
v####.obs.cn-ea####.####.com:443/2024-12-23/17_66271_NBY-533efc403e491e8...
v####.obs.cn-ea####.####.com:443/2024-12-23/17_66300_NBY-799d42cbeb1839b...
www.m####.top/index.php/vod/search.html?wd=####
www.mu####.cc/index.php/vod/search.html?wd=####
www.w####.net/
wx.y.g####.####.com:443/music/photo_new/T053XD000030PYEa1btd6p.png
ys.changme####.com/api.php/provide/search_result_more?time=####&pageSize...

HTTP POST requests:

and####.b####.qq.com:443/rqd/async?aid=####
h.t####.qq.com:443/kv
op.ys####.cn/v2/home/search
v.l####.cn/v2/home/search
v.r####.cn/v2/home/search
v.r####.cn/v2/home/vod_details
www.x####.com:443/e/search/index.php

File system changes:

Creates the following files:

/data/data/####/044fcc37b8ec07a269d56cd63590d96e87d9d654b821fe4...c4d7.0
/data/data/####/05b39ba75bcaa694eac710b4a5d6cb86d44e3136c2c6db9....0.tmp
/data/data/####/05b39ba75bcaa694eac710b4a5d6cb86d44e3136c2c6db9...f692.0
/data/data/####/06e29a14e0460a0eecdaaec9df96d1bb10a835f8e2f03ef...5414.0
/data/data/####/0afd426425de1c9d918760ff7fa3c4ca60c4629333ea745....0.tmp
/data/data/####/0d7dac8ff26f65e2598578359d54d89c4527ce91def222e...54f9.0
/data/data/####/1004
/data/data/####/1373037256.dex
/data/data/####/1373037256.dex.flock (deleted)
/data/data/####/1373037256.jar
/data/data/####/1373037256.jar.ab04210df573be1507691bc5b569031f
/data/data/####/2063315211.dex
/data/data/####/2063315211.dex.flock (deleted)
/data/data/####/2063315211.jar
/data/data/####/2063315211.jar.temp
/data/data/####/25dfec1a8a5020257b0e7b8084877d2682c7c52bc3ab7fe...6b6d.0
/data/data/####/290fbfe8b1eb5c2c485b176400a8f78ce87875a6b4352ac...486a.0
/data/data/####/2d73691b460b502543f6d1a71b28d77d1b3f9442652585b....0.tmp
/data/data/####/2d73691b460b502543f6d1a71b28d77d1b3f9442652585b...0ad2.0
/data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
/data/data/####/2d9a85b9cafaf2987dac2bfe365e47055de8e85b9181cbd....0.tmp
/data/data/####/2d9a85b9cafaf2987dac2bfe365e47055de8e85b9181cbd...e4d0.0
/data/data/####/320b89721465f38bf86743d11e9217930f71cfbe094b57c....0.tmp
/data/data/####/320b89721465f38bf86743d11e9217930f71cfbe094b57c...cc0b.0
/data/data/####/3b7371c07eefca10f31786447962b669
/data/data/####/46e5125e9bfc5729ac0a025b96037f93041df52ae1dd8af....0.tmp
/data/data/####/4aa3b90bbccb7de628ac626ba703c6c87601407862f9617...9624.0
/data/data/####/4bcd31bc7a78d06c084962e6a44fbd3ad7755a919ab1d4a...bf1c.0
/data/data/####/554a03045efae721ed1791a7356d390614cd5c59f33b7f8....0.tmp
/data/data/####/554a03045efae721ed1791a7356d390614cd5c59f33b7f8...88a7.0
/data/data/####/5907fbe51233bcf6a6be1c86f165d1dcc0adb76a6ed462e...ccea.0
/data/data/####/5f37aaf9d7d16bb9c8656bc1948b73543d07c97828e926f...2aaa.0
/data/data/####/5fc4679d5085924f445665fc8322586f73c309ab01ce273....0.tmp
/data/data/####/5fc4679d5085924f445665fc8322586f73c309ab01ce273...5f60.0
/data/data/####/6961fdf82d63dfe0c01dd69da59eaa61dace64f5f7aa710....0.tmp
/data/data/####/6961fdf82d63dfe0c01dd69da59eaa61dace64f5f7aa710...9c93.0
/data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
/data/data/####/71a22f124f40ded5ecf5a66a86221b9da68cd4c825769f9...ce81.0
/data/data/####/7ce2c8e3ae028b86853b8fb6206a681e
/data/data/####/833d77546768cfc05d233730150c9e3b5abfc15c60207d9...11f8.0
/data/data/####/8d863d3be5279ed01c056dacdd4c701db46a910f1ef7dbc....0.tmp
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/LocalConfigSharePreference.xml
/data/data/####/Utils.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a511318619ee7010f10d150aa6b641d6d4c3098541e80cb...b2f1.0
/data/data/####/ac9af6499eb7558dcc9e2a02985cbcfded8e7e9e41c9dc3....0.tmp
/data/data/####/ac9af6499eb7558dcc9e2a02985cbcfded8e7e9e41c9dc3...34c5.0
/data/data/####/acf41baa456b134f5730277c09198eed320fe0da4f0a271...5ec9.0
/data/data/####/ad59860421734947820146
/data/data/####/ad59860421734947823515
/data/data/####/ad59860421734947826808
/data/data/####/ad59860421734947830567
/data/data/####/ad_config.xml
/data/data/####/ad_config.xml.bak
/data/data/####/b5d7508389c103dc46560ef8602efddfab425162f4bcaa3....0.tmp
/data/data/####/b5d7508389c103dc46560ef8602efddfab425162f4bcaa3...0a74.0
/data/data/####/b680807bdefbb9f683f4dd9a07070edafbb6fcdeeed2d85...e726.0
/data/data/####/b6d94ac2b7e15c5aa6b84d8a6e127a5a9309477a4ed6201....0.tmp
/data/data/####/ba99c59adc9d5b7874446524f22e5b7f.dex
/data/data/####/ba99c59adc9d5b7874446524f22e5b7f.dex.flock (deleted)
/data/data/####/ba99c59adc9d5b7874446524f22e5b7f.jar
/data/data/####/bd36396cfe4445350f34d07b25143966f8a09a185c423dd...af5b.0
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/cb2e6e2d2f9f85285a18bcaf0e7cf60f33c4d8d1c608028...4b71.0
/data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
/data/data/####/com.huawei.himovceie_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/crypto.KEY_256.xml
/data/data/####/d0a5a2d7fbb72614ae27f22f71782ce31aa615cecf0ac05...bff8.0
/data/data/####/d318e63d844e448a026fa50a86fb44b4a2ab88f14e08da0...68fc.0
/data/data/####/dd835831cd8915cc9a3d2f7a4a24b11e4a790a2b50533b9...98e1.0
/data/data/####/drpy2.min.js
/data/data/####/e39b1e480ee3ef447c725297a1d4793d43f5399f4f4613b....0.tmp
/data/data/####/e39b1e480ee3ef447c725297a1d4793d43f5399f4f4613b...d8cb.0
/data/data/####/e744ea592a0b151041bb17a76bb22c1bd45900923084c62...2527.0
/data/data/####/ee04d9930861b6b20db3937bf67b01f5f3676639ba4ad98...0309.0
/data/data/####/f084032abf58b51e2ba7661000b4a84a10e7b5373abe8ea...27da.0
/data/data/####/f435ae4e52b78f8cbdf5fda638444dbd9ea42ad2647f0c2...9048.0
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592....0.tmp
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592...0a82.0
/data/data/####/f5a44cd8c4fa175fa749e989b2566b804aed8408d81620a...5996.0
/data/data/####/fad93ce129b645a419204a6726694dd8b04894312723502....0.tmp
/data/data/####/fad93ce129b645a419204a6726694dd8b04894312723502...bea9.0
/data/data/####/fbae2c308f9dad00f360164952b9fdea2ac1125b592b9d6....0.tmp
/data/data/####/fbae2c308f9dad00f360164952b9fdea2ac1125b592b9d6...674c.0
/data/data/####/fdf868acee18af3d7ae8a59d654686bc50667c5f397eae9...e541.0
/data/data/####/gbk.js
/data/data/####/hawk.kva
/data/data/####/hawk.kvb
/data/data/####/jinja.js
/data/data/####/journal
/data/data/####/json5.js
/data/data/####/load_time.xml
/data/data/####/local_crash_lock
/data/data/####/log0c48da3653d2a5ca7c9bf510c6aa9574
/data/data/####/log1012171871734947817980
/data/data/####/log1012171871734947832911
/data/data/####/log1012171871734947873883
/data/data/####/log1012171871734947879690
/data/data/####/log375b8a6d7a18bfbb0fc855f052afe4cd
/data/data/####/log8b6d78b844c9c5ed3f313f9a9f72ab34
/data/data/####/logbd357f7479d007ab9f3975060ea7a951
/data/data/####/logbddf941b8f87bc13f641756bf89c9ed5
/data/data/####/logeb0d2cca1212cb4740201bb7fe1b3fc4
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/node-rsa.js
/data/data/####/okgo.db-journal
/data/data/####/pako.min.js
/data/data/####/plugin_file.name
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak
/data/data/####/spUtils.xml
/data/data/####/tvbox.v3.db-journal
/data/data/####/tvbox.v3.db.lck
/data/data/####/woggSite
/data/data/####/模板.js
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/sh -c getprop
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/files/.kad
chmod 777 /data/user/0/<Package>/cache/woggSite
getprop
logcat -d -v threadtime
sh

Loads the following dynamic libraries:

libBugly_Native
libconceal
libffmpegJNI
libgit-platinum
libijkffmpeg
libijksdl
libjp
libmitv
libplayer
libquickjs-android-wrapper

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Gets information about network.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial