Android.RemoteCode.8463

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.23.247.140:8888
TCP(HTTP/1.1) 39.1####.226.196:8801
TCP(HTTP/1.1) 1####.23.148.191:8802
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) cdn.k####.com.####.net:80
TCP(HTTP/1.1) 1####.23.148.191:8801
TCP(HTTP/1.1) 1####.23.247.140:7777
TCP(TLS/1.0) 2####.58.207.202:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) 2####.58.207.234:443
TCP(TLS/1.0) 1####.250.74.67:443
TCP(TLS/1.0) i####.doub####.com.####.cn:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.2) 1####.250.74.78:443
TCP(TLS/1.2) 2####.58.211.10:443
TCP(TLS/1.2) 2####.58.207.234:443
TCP(TLS/1.2) 1####.250.74.67:443
TCP(TLS/1.2) 1####.250.74.110:443
TCP(TLS/1.2) 1####.250.74.164:443
TCP for####.do####.com:443
UDP p####.google####.com:443
TCP i####.doub####.com.####.com:443
TCP img1-do####.b0.a####.com:443
TCP api.web.36####.com:443
TCP 39.1####.150.217:9998
TCP i####.doub####.com:443

DNS requests:

and####.b####.qq.com
api.web.36####.com
cdn.k####.com
h.t####.qq.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
ip.ta####.com
m####.do####.com
p####.google####.com
rr6---s####.g####.com
rr9---s####.g####.com

HTTP GET requests:

cdn.k####.com.####.net/update/sdk/task_164.jar
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####

HTTP POST requests:

and####.b####.qq.com:443/rqd/async?aid=####
h.t####.qq.com:443/kv

File system changes:

Creates the following files:

/data/data/####/044fcc37b8ec07a269d56cd63590d96e87d9d654b821fe4....0.tmp
/data/data/####/06e29a14e0460a0eecdaaec9df96d1bb10a835f8e2f03ef....0.tmp
/data/data/####/06e29a14e0460a0eecdaaec9df96d1bb10a835f8e2f03ef...5414.0
/data/data/####/0afd426425de1c9d918760ff7fa3c4ca60c4629333ea745....0.tmp
/data/data/####/0afd426425de1c9d918760ff7fa3c4ca60c4629333ea745...e97c.0
/data/data/####/0d7dac8ff26f65e2598578359d54d89c4527ce91def222e....0.tmp
/data/data/####/0d7dac8ff26f65e2598578359d54d89c4527ce91def222e...54f9.0
/data/data/####/1004
/data/data/####/1373037256.dex
/data/data/####/1373037256.dex.flock (deleted)
/data/data/####/1373037256.jar.ab04210df573be1507691bc5b569031f
/data/data/####/2063315211.dex
/data/data/####/2063315211.dex.flock (deleted)
/data/data/####/2063315211.jar
/data/data/####/2063315211.jar.temp
/data/data/####/25dfec1a8a5020257b0e7b8084877d2682c7c52bc3ab7fe...6b6d.0
/data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
/data/data/####/320b89721465f38bf86743d11e9217930f71cfbe094b57c....0.tmp
/data/data/####/320b89721465f38bf86743d11e9217930f71cfbe094b57c...cc0b.0
/data/data/####/3b7371c07eefca10f31786447962b669
/data/data/####/46e5125e9bfc5729ac0a025b96037f93041df52ae1dd8af...9e3a.0
/data/data/####/4aa3b90bbccb7de628ac626ba703c6c87601407862f9617....0.tmp
/data/data/####/4aa3b90bbccb7de628ac626ba703c6c87601407862f9617...9624.0
/data/data/####/5f37aaf9d7d16bb9c8656bc1948b73543d07c97828e926f....0.tmp
/data/data/####/5f37aaf9d7d16bb9c8656bc1948b73543d07c97828e926f...2aaa.0
/data/data/####/5fc4679d5085924f445665fc8322586f73c309ab01ce273....0.tmp
/data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
/data/data/####/71a22f124f40ded5ecf5a66a86221b9da68cd4c825769f9...ce81.0
/data/data/####/7ce2c8e3ae028b86853b8fb6206a681e
/data/data/####/833d77546768cfc05d233730150c9e3b5abfc15c60207d9....0.tmp
/data/data/####/833d77546768cfc05d233730150c9e3b5abfc15c60207d9...11f8.0
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Utils.xml
/data/data/####/a511318619ee7010f10d150aa6b641d6d4c3098541e80cb...b2f1.0
/data/data/####/ad01734949428885
/data/data/####/ad01734949433519
/data/data/####/ad01734949439816
/data/data/####/adcde4f30065b68507fffc131021ba7f68
/data/data/####/b680807bdefbb9f683f4dd9a07070edafbb6fcdeeed2d85....0.tmp
/data/data/####/b680807bdefbb9f683f4dd9a07070edafbb6fcdeeed2d85...e726.0
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
/data/data/####/crashrecord.xml
/data/data/####/crypto.KEY_256.xml
/data/data/####/dd835831cd8915cc9a3d2f7a4a24b11e4a790a2b50533b9....0.tmp
/data/data/####/dd835831cd8915cc9a3d2f7a4a24b11e4a790a2b50533b9...98e1.0
/data/data/####/e744ea592a0b151041bb17a76bb22c1bd45900923084c62....0.tmp
/data/data/####/e744ea592a0b151041bb17a76bb22c1bd45900923084c62...2527.0
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592....0.tmp
/data/data/####/f51614d2be6f0a96672ddaacdbb175967b64347fe914592...0a82.0
/data/data/####/fad93ce129b645a419204a6726694dd8b04894312723502....0.tmp
/data/data/####/fad93ce129b645a419204a6726694dd8b04894312723502...bea9.0
/data/data/####/fdf868acee18af3d7ae8a59d654686bc50667c5f397eae9....0.tmp
/data/data/####/fdf868acee18af3d7ae8a59d654686bc50667c5f397eae9...e541.0
/data/data/####/hawk.kva
/data/data/####/hawk.kvb
/data/data/####/journal
/data/data/####/local_crash_lock
/data/data/####/log1012183871734949423007
/data/data/####/log1012183871734949426276
/data/data/####/log1012183871734949442850
/data/data/####/log1012183871734949452015
/data/data/####/log1012183871734949489569
/data/data/####/log3fc3bbbca0bb5bab4f67aaad8676bc33
/data/data/####/log57b2099e0308b5b8aa07e23e6dcdd5b1
/data/data/####/log87a9964acbe02d6da356f1b76f0ed299
/data/data/####/logd99028583b29b7bf034ba8c16ea5fbad
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/plugin_file.name
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak (deleted)
/data/data/####/tvbox.v3.db-journal
/data/data/####/tvbox.v3.db.lck
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/sh -c getprop
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/files/.kad
getprop
logcat -d -v threadtime
sh

Loads the following dynamic libraries:

libBugly_Native
libconceal
libijkffmpeg
libijksdl
libjp
libplayer
libquickjs-android-wrapper

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial