Android.RemoteCode.8461

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.sou####.com:80
TCP(HTTP/1.1) 1####.23.247.140:8888
TCP(HTTP/1.1) op.ys####.cn:80
TCP(HTTP/1.1) 39.1####.226.196:8801
TCP(HTTP/1.1) 47.1####.200.223:8801
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) cdn.k####.com.####.net:80
TCP(HTTP/1.1) 47.99.1####.252:80
TCP(HTTP/1.1) 47.1####.200.223:8802
TCP(HTTP/1.1) v.r####.cn:80
TCP(HTTP/1.1) 1####.77.181.150:7777
TCP(HTTP/1.1) 1####.77.181.150:8888
TCP(TLS/1.0) obs.gdu####.com.####.com:443
TCP(TLS/1.0) 1####.250.74.35:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) wjm.ke####.com:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) www.czzyv####.com:443
TCP(TLS/1.0) i####.wwe####.com:446
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) y####.fun:443
TCP(TLS/1.0) 1####.250.74.10:443
TCP(TLS/1.0) i####.doub####.com.####.cn:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 1####.250.74.68:443
TCP(TLS/1.2) 1####.250.74.174:443
TCP(TLS/1.2) 1####.250.74.99:443
TCP 9e67####.yzz####.com:443
TCP for####.do####.com:443
UDP p####.google####.com:443
TCP i####.doub####.com.####.com:443
TCP g####.xyz:443
TCP lz.q####.top:443
TCP img1-do####.b0.a####.com:443
TCP api.8ut####.com.####.net:443
TCP www.cf####.com:443
TCP g####.ci:443
TCP mobi####.bz.m####.com:443
TCP i####.doub####.com:443
TCP y####.fun:443
TCP 1####.25.254.31:9999
TCP v.t####.qq.com:443
TCP cj####.com:443
TCP sc####.top:443

DNS requests:

api.8ut####.com
api.cn####.com
api.pull####.com
cdn.k####.com
cj####.com
f####.cc
fs-im-####.7moor####.com
g####.ci
g####.xyz
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.wwe####.com
i####.wwe####.com
ip.ta####.com
lz.q####.top
m####.do####.com
mobi####.bz.m####.com
n####.cn####.com
obs.gdu####.com
op.ys####.cn
p####.google####.com
p####.yzzyim####.com
rr6---s####.g####.com
rr9---s####.g####.com
sc####.top
v.q####.com
v.r####.cn
vcover-####.p####.q####.cn
wjm.ke####.com
www.cf####.com
www.czzyv####.com
www.google####.com
www.sou####.com
y####.fun

HTTP GET requests:

cdn.k####.com.####.net/update/sdk/task_164.jar
i####.wwe####.com:446/12231700212536123bb/2024/12/08/555b4db68fbaa547608...
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
obs.gdu####.com.####.com:443/upload/movie/20241101/vod35750087.webp
wjm.ke####.com:443/75c95507183fbb22dc00f427c139693a/20241223180007/decry...
wjm.ke####.com:443/fcfb5acf1e2169940de23962b642a95c/20241223180204/decry...
www.sou####.com/
www.sou####.com/index.php/ajax/suggest?mid=####&wd=####&limit=####
www.sou####.com/rss.xml?wd=####
www.sou####.com/search.php?searchword=####

HTTP POST requests:

op.ys####.cn/v2/home/search
v.r####.cn/v2/home/search

File system changes:

Creates the following files:

/data/data/####/.config
/data/data/####/.hptc_kache_uawei.himovceie
/data/data/####/014f086aeca735ddf94da615362087807d17f6908e7a6f8....0.tmp
/data/data/####/014f086aeca735ddf94da615362087807d17f6908e7a6f8...53b2.0
/data/data/####/044fcc37b8ec07a269d56cd63590d96e87d9d654b821fe4....0.tmp
/data/data/####/06e29a14e0460a0eecdaaec9df96d1bb10a835f8e2f03ef....0.tmp
/data/data/####/06e29a14e0460a0eecdaaec9df96d1bb10a835f8e2f03ef...5414.0
/data/data/####/0afd426425de1c9d918760ff7fa3c4ca60c4629333ea745...e97c.0
/data/data/####/0d7dac8ff26f65e2598578359d54d89c4527ce91def222e....0.tmp
/data/data/####/0d7dac8ff26f65e2598578359d54d89c4527ce91def222e...54f9.0
/data/data/####/1004
/data/data/####/1373037256.dex
/data/data/####/1373037256.dex.flock (deleted)
/data/data/####/1373037256.jar.ab04210df573be1507691bc5b569031f
/data/data/####/2063315211.dex
/data/data/####/2063315211.dex.flock (deleted)
/data/data/####/2063315211.jar
/data/data/####/2063315211.jar.temp
/data/data/####/25dfec1a8a5020257b0e7b8084877d2682c7c52bc3ab7fe...6b6d.0
/data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
/data/data/####/314ca06e8024c420113d61a28a8ec2e6148b6e72fdbeea9....0.tmp
/data/data/####/314ca06e8024c420113d61a28a8ec2e6148b6e72fdbeea9...c5a9.0
/data/data/####/320b89721465f38bf86743d11e9217930f71cfbe094b57c...cc0b.0
/data/data/####/357d5647af5a9a39da70f2f2f704224f.dex
/data/data/####/357d5647af5a9a39da70f2f2f704224f.dex.flock (deleted)
/data/data/####/357d5647af5a9a39da70f2f2f704224f.jar
/data/data/####/360.js
/data/data/####/3b7371c07eefca10f31786447962b669
/data/data/####/46e5125e9bfc5729ac0a025b96037f93041df52ae1dd8af....0.tmp
/data/data/####/46e5125e9bfc5729ac0a025b96037f93041df52ae1dd8af...9e3a.0
/data/data/####/4aa3b90bbccb7de628ac626ba703c6c87601407862f9617....0.tmp
/data/data/####/4aa3b90bbccb7de628ac626ba703c6c87601407862f9617...9624.0
/data/data/####/5f37aaf9d7d16bb9c8656bc1948b73543d07c97828e926f...2aaa.0
/data/data/####/5fc4679d5085924f445665fc8322586f73c309ab01ce273....0.tmp
/data/data/####/5fc4679d5085924f445665fc8322586f73c309ab01ce273...5f60.0
/data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
/data/data/####/71a22f124f40ded5ecf5a66a86221b9da68cd4c825769f9....0.tmp
/data/data/####/71a22f124f40ded5ecf5a66a86221b9da68cd4c825769f9...ce81.0
/data/data/####/7ce2c8e3ae028b86853b8fb6206a681e
/data/data/####/833d77546768cfc05d233730150c9e3b5abfc15c60207d9....0.tmp
/data/data/####/833d77546768cfc05d233730150c9e3b5abfc15c60207d9...11f8.0
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Utils.xml
/data/data/####/a511318619ee7010f10d150aa6b641d6d4c3098541e80cb....0.tmp
/data/data/####/a511318619ee7010f10d150aa6b641d6d4c3098541e80cb...b2f1.0
/data/data/####/ad_config.xml
/data/data/####/ad_config.xml.bak
/data/data/####/b680807bdefbb9f683f4dd9a07070edafbb6fcdeeed2d85....0.tmp
/data/data/####/b680807bdefbb9f683f4dd9a07070edafbb6fcdeeed2d85...e726.0
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/cat.js
/data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
/data/data/####/crashrecord.xml
/data/data/####/crypto.KEY_256.xml
/data/data/####/dd835831cd8915cc9a3d2f7a4a24b11e4a790a2b50533b9....0.tmp
/data/data/####/dd835831cd8915cc9a3d2f7a4a24b11e4a790a2b50533b9...98e1.0
/data/data/####/drpy2.min.js
/data/data/####/e744ea592a0b151041bb17a76bb22c1bd45900923084c62...2527.0
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592....0.tmp
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592...0a82.0
/data/data/####/fad93ce129b645a419204a6726694dd8b04894312723502...bea9.0
/data/data/####/fdf868acee18af3d7ae8a59d654686bc50667c5f397eae9....0.tmp
/data/data/####/fdf868acee18af3d7ae8a59d654686bc50667c5f397eae9...e541.0
/data/data/####/gbk.js
/data/data/####/hawk.kva
/data/data/####/hawk.kvb
/data/data/####/journal
/data/data/####/jsencrypt.js
/data/data/####/local_crash_lock
/data/data/####/log8253e91b909426f70dfea374f2378483
/data/data/####/native_record_lock
/data/data/####/node-rsa.js
/data/data/####/okgo.db-journal
/data/data/####/openkuyun.js
/data/data/####/opennongmin.js
/data/data/####/pako.min.js
/data/data/####/plugin_file.name
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak
/data/data/####/spUtils.xml
/data/data/####/tvbox.v3.db-journal
/data/data/####/tvbox.v3.db.lck
/data/data/####/模板.js
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/sh -c getprop
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/files/.kad
chmod 777 /data/user/0/<Package>/files/TVBox/.config
getprop
sh

Loads the following dynamic libraries:

libBugly_Native
libconceal
libffmpegJNI
libijkffmpeg
libijksdl
libjp
libplayer
libquickjs-android-wrapper

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Gets information about network.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial