Android.RemoteCode.479

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.127.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.205.160.63:80
TCP(HTTP/1.1) img.thebeas####.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(TLS/1.0) api.growi####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) api.s####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) x####.com:443
TCP(TLS/1.0) d506####.cdn.uc####.####.cn:443
TCP(TLS/1.0) img.thebeas####.com:443
TCP(TLS/1.0) hs-pa####.b0.a####.com:443
TCP(TLS/1.0) t####.growi####.com:443
TCP(TLS/1.0) api.thebeas####.com:443
TCP(TLS/1.0) t.growi####.com:443
TCP umengj####.m.ta####.com:80
TCP 1####.205.160.76:443

DNS requests:

ag####.m.ta####.com
api.growi####.com
api.s####.com
api.thebeas####.com
as####.growi####.com
e.crashly####.com
hs-pa####.s####.com
i####.cn
img.thebeas####.com
l####.tbs.qq.com
log.u####.com
msg.umengc####.com
s####.u####.com
sett####.crashly####.com
st####.thebeas####.com
t####.growi####.com
t.growi####.com
umengj####.m.ta####.com
x####.com

HTTP GET requests:

img.thebeas####.com/apppictures/2017-08-23/e77bb85354de40eabb04171bc7b6d...
img.thebeas####.com/apppictures/2018-04-20/d0e214c07210fa12efb3a7016932f...
img.thebeas####.com/apppictures/2018-06-01/1486d91d8fa1c6909e4c78a373819...
img.thebeas####.com/apppictures/2018-06-01/6c3981172c40522a194e20a56c856...
img.thebeas####.com/apppictures/2018-06-04/9d7cf375acb5e0018f62109b2359d...
img.thebeas####.com/apppictures/2018-06-05/c318da24a480c283e07160af28b1d...
img.thebeas####.com/apppictures/2018-06-08/4377307b83bbb1fccb1c56b657b21...
img.thebeas####.com/apppictures/2018-06-08/7d2068cb28631ebc09264221d0b6c...
img.thebeas####.com/apppictures/2018-06-08/cb7d4769db5c2328bb413ade8d25d...
img.thebeas####.com/apppictures/2018-06-08/d4f3a354e7ba8038a756724935dc1...
img.thebeas####.com/apppictures/2018-06-11/19c867997af34111112751a979232...
img.thebeas####.com/apppictures/2018-06-11/6c417806fac8eb6d848e794182aeb...
img.thebeas####.com/apppictures/2018-06-12/126a4dcd286076c8b83bd11952e40...
img.thebeas####.com/apppictures/2018-06-12/4210e8f8d8ee755469e070e098602...
img.thebeas####.com/apppictures/2018-06-13/252f478e1445d399ad4fbdc089042...
img.thebeas####.com/apppictures/2018-06-13/273a6b93601fb1de0eeab9a1ba2a2...
img.thebeas####.com/apppictures/2018-06-13/3798ce642eaba128b45b114a6897f...
img.thebeas####.com/apppictures/2018-06-13/3faf606da530cbd09255731bcb2a2...
img.thebeas####.com/apppictures/2018-06-13/6a123d007a82beb8b752d6884ca78...
img.thebeas####.com/apppictures/2018-06-13/e56178d91fe309e31625477fcb767...
img.thebeas####.com/file/app_image/13c51bf303944ff9b39400b6953efe82.jpg@...
img.thebeas####.com/file/app_image/6fe3e4a1409844ab9e508d24f1571622.jpg
img.thebeas####.com/file/app_image/87d04aed90e844b5983f6a3ca0e53c17.jpg@...
img.thebeas####.com/image/20170306174359901067.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20170306175322295305.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20170424141822051510.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20170425160315839263.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20171030183652922658.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180125131427892541.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180205191236569881.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180305163057284845.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180402152650146297.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180411114833890225.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180423203928892057.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180423225022914334.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180424145717573298.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180424201723919829.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180425113020591327.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180427132537777270.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180427141647726962.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180427142535543594.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180502191214385390.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180502191354815619.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180503180552811410.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180503180715025437.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180505000840282947.jpeg@4e_0o_0l_345h_330w_9...
img.thebeas####.com/image/20180505000942520725.jpeg@4e_0o_0l_345h_330w_9...
img.thebeas####.com/image/20180507130159150320.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180507130446691749.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180509172152268642.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180510210408434642.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180510210412501549.jpg@4e_0o_0l_721h_690w_90...
img.thebeas####.com/image/20180510210414783157.jpg@4e_0o_0l_721h_690w_90...
img.thebeas####.com/image/20180510210416517493.jpg@4e_0o_0l_721h_690w_90...
img.thebeas####.com/image/20180510210424284490.jpg@4e_0o_0l_721h_690w_90...
img.thebeas####.com/image/20180510210429975631.jpg@4e_0o_0l_721h_690w_90...
img.thebeas####.com/image/20180510210937274148.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180514164137991176.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180515192316097968.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180515192543979540.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180518140150772239.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180522113643990564.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180522172223789736.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180531154315486771.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180531181132809686.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180601113943686990.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180605182912779580.JPG@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180605185324777287.jpeg@720w_90q.webp
img.thebeas####.com/image/20180607174701124777.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/image/20180607175408455224.jpg@4e_0o_0l_345h_330w_90...
img.thebeas####.com/imagePro/PROD001018469/PROD001018469_1_1487319586453...

HTTP POST requests:

l####.tbs.qq.com/ajax?c=####&k=####

Modified file system:

Creates the following files:

/data/data/####/-zr1PaUOLovXtHFyHvJrAKioNco.461553159.tmp
/data/data/####/.jg.ic
/data/data/####/07fd1dd74a05f3be8eb933e15f61c41bfb16c2d114203e4....0.tmp
/data/data/####/11ct7yRSRsCLYAABTdQc4O7P2cI.1482790911.tmp
/data/data/####/131fd9bd2d7bb78f386c26a8370266cbfbc1e84f9e34bb5....0.tmp
/data/data/####/1526454777620.log
/data/data/####/159pQVcgLnoeAaGahCG2fC-ExM0.669249742.tmp
/data/data/####/1_-XOYXI985wh8wGhdV-KimnsrQ.-399851174.tmp
/data/data/####/242274723904757296
/data/data/####/2823d0f6280c3a8bf997563346fc143f7b4610284e77bc5....0.tmp
/data/data/####/2FtPCxxqNoNyCndeB88zpKl9FwM.1093389050.tmp
/data/data/####/2c14d7de719f7c2bc32ad722d31d5200f8f8a3d1d4c01a1....0.tmp
/data/data/####/40P-wHhI1Cjha5SZZvLPxJ7tw1k.-1423212777.tmp
/data/data/####/4fZ7IlHnB_S-y-zCLC7K4-I8H1Q.-1235211289.tmp
/data/data/####/53720c82698f984e7c08c6cc9695a35c7bfa1d20748940f....0.tmp
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1BeginSession.cls_temp
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1BeginSession.json
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionApp.cls_temp
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionApp.json
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionDevice.cls_temp
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionDevice.json
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionOS.cls_temp
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionOS.json
/data/data/####/5AFBD9F301DC-0001-080A-767006EA3FD1SessionUser.cls_temp
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1BeginSession.cls_temp
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1BeginSession.json
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionApp.cls_temp
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionApp.json
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionDevice.cls_temp
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionDevice.json
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionOS.cls_temp
/data/data/####/5AFBD9F7003F-0001-087A-767006EA3FD1SessionOS.json
/data/data/####/5b69d1569c6a194d1b7047cd2003d313167a580de94f37f....0.tmp
/data/data/####/5kCb5yqIUn0aTnL7IvsXnhTHufM.-978710714.tmp
/data/data/####/72b90ade0c71858b39431f25905dd02498ce70d1c2526ca....0.tmp
/data/data/####/7Vujqy2GU5louQmcXgj3Y0fxbMw.1871612764.tmp
/data/data/####/7d3SBzXR6jqsxgJk51rXurYFN-Y.-286217908.tmp
/data/data/####/84f04cc9f3fe9da76af786413bc6e6045b913e742cc6012....0.tmp
/data/data/####/9PoInnx4ZEiuncXm-QIeCeCGZOg.511351659.tmp
/data/data/####/9ed33cf08bc8e328f956eccab4ece3e6daad1eca7d58ef7....0.tmp
/data/data/####/ACCS_BIND.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/AHXiwpkMdIitzY54Kwz2zGhg7w8.-2142391439.tmp
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DAa0-e4KI0uaH0t7KwTZpvZ6qgA.579655123.tmp
/data/data/####/DaemonServer
/data/data/####/EChP5E_0FMEPV9FAbFJaE-1Uia0.-1088889158.tmp
/data/data/####/EVdCEKfwRvvmStAJBtBLAnvQwuM.1904532923.tmp
/data/data/####/EhvGHwiYh7QAaeEDN8qmSqRIdsU.-1904285036.tmp
/data/data/####/F5kC7EhAzXadigyq9clEwXqXg4k.-1882975545.tmp
/data/data/####/GYBRw4nmcy3ZSc1QzIf4U8A8Db0.1872504835.tmp
/data/data/####/HeYS6dcVENUD12VB5pfUtgg1TIs.776773003.tmp
/data/data/####/J3zsa0MSEFUZLC6fVqfN1vhszSA.-2114706510.tmp
/data/data/####/Jd0J3o5qaPyT8-acB2GZPruu3oA.69090113.tmp
/data/data/####/Jflikaktvw-JHQ10ehV4FHMnA1w.-333958119.tmp
/data/data/####/KpWJPl8sXq2I1nYMDF6Qp_6yiEs.-1956969152.tmp
/data/data/####/LoS_Us6V4QRCZ-7RKoYgCkCwLPU.-264625499.tmp
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/OC1Bhj6z1Edd9-nB1R_q8lIzopI.19931404.tmp
/data/data/####/Q6pFNot81YhmOMxhImxmcxIWgA0.1493638527.tmp
/data/data/####/QKmZdxJEQrhzCmJwdSpsWTWD7cU.807364241.tmp
/data/data/####/Qb99TJPHkGbMI10Zih7HEUn6rzY.-1211623947.tmp
/data/data/####/RbOq22AJXYpJxWb0TdAUdqh1kGQ.-1260742640.tmp
/data/data/####/SBFRuLdJA8BhHmxJN3CpMHSTy_w.926987036.tmp
/data/data/####/SJ1AaEOvcdxSUfNP-Oxks864yII.54055483.tmp
/data/data/####/Sh2kwPXJbg36UrTQJ0OT2KR7s9Q.965993159.tmp
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/WYo7GCtxSgbJjepEE_6ZUoJSjuY.1021616730.tmp
/data/data/####/ZVoJMfgFG6fZGGuqQxuYas_G0-s.727851168.tmp
/data/data/####/_LauBX_xVn7qqop4sdrYXh3bTv4.1782311660.tmp
/data/data/####/a67g1Rx5XBmJK4AX0SiPhIopsiU.920265925.tmp
/data/data/####/a93d99bf0cd1c313db6b59b16a10e9a6747dd922c3f4112....0.tmp
/data/data/####/ab15d0c16a7d1e4396ba1479868e7ac9b4358c66fecde37....0.tmp
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/b1nEaY5gKEkZkntCFDr251OQ6yU.-146011463.tmp
/data/data/####/bHxVY8eh1IcP3sQZ_kaPuZ2T_tk.481284785.tmp
/data/data/####/bde1b6f094edc610080250138f9b9a4ebfb1b795ba052ba....0.tmp
/data/data/####/c76d8975b68f78419b3c2f599e62e06e09a9131455aa950....0.tmp
/data/data/####/cLDHNsxDmav73V4ROdf__4wJNPE.-1257694189.tmp
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.thebeastshop.thebeast;channel.growing.db
/data/data/####/com.thebeastshop.thebeast;channel.growing.db-journal
/data/data/####/com.thebeastshop.thebeast_preferences.xml
/data/data/####/com.thebeastshop.thebeast_preferences.xml.bak
/data/data/####/core_info
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/debug.conf
/data/data/####/eOKKJTkHrZNTansI4B6tWIECKug.1790092809.tmp
/data/data/####/ec9a202ded6e3950544ff0116f2480ce48fab981544c33b....0.tmp
/data/data/####/eudemon
/data/data/####/ewMmkDGvkH8Dsf-P_d5OG21-25A.-667641982.tmp
/data/data/####/f2bd653f53b6eb25d66c8e45b91edae21568accfb01967d....0.tmp
/data/data/####/f94a948af71602b6066bf19a6a79f5f84d64808cc01a103....0.tmp
/data/data/####/fUPWz4aIHtAvwvNKKHWBHqkGFd4.-459182779.tmp
/data/data/####/fd6ad94b4906f0de447c1b2809e8288d3b3522551b83031....0.tmp
/data/data/####/growing.db
/data/data/####/growing.db-journal
/data/data/####/growing_persist_data.xml
/data/data/####/growing_profile.xml
/data/data/####/growingio_diagnose.xml
/data/data/####/hb2uyLTBUaNlDOtinKlk8rJ086w.77497323.tmp
/data/data/####/hgV4fRWBS6yTQQ0qjNGxRKh_u3U.550384070.tmp
/data/data/####/huYqwHfUQsorw_u5CV2sRjjN0u8.-1181496357.tmp
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
/data/data/####/jL2GYGLdoZKeUFtS3FjlxSdAuko.875661523.tmp
/data/data/####/jb_sp.xml
/data/data/####/journal.tmp
/data/data/####/leLLGQBh8Ldy7DD53LQwCtlNCkA.645042473.tmp
/data/data/####/libjiagu1784909077.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/nhYJuLN9IG_6p4OruksjopJcFCA.-1085392867.tmp
/data/data/####/plSg05vQz1F06R4KKeEmlbPwk2E.-1544368760.tmp
/data/data/####/pqkotK_WwcbtileEixVVZMIGR7M.-1999691549.tmp
/data/data/####/qjLQnKLpmNc5m7J2vBozM_L06OE.1475916544.tmp
/data/data/####/sa_1955e7f8-a1f3-4d30-816d-20e494b8a248_1526454775072.tap
/data/data/####/sa_7e05bfca-1a13-48ac-8238-53ba130fc27e_1526454772457.tap
/data/data/####/sa_e497897a-9239-46ba-b8c9-c3ea7d2a8e08_1526454771641.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/sobot_chat_20180516_log.txt
/data/data/####/sobot_config.xml
/data/data/####/talkingdata_file_prefence.xml
/data/data/####/talkingdata_file_prefence.xml.bak
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdid.xml
/data/data/####/tv7oP45iFitrIsn2v8wF3_DOPQ8.198736946.tmp
/data/data/####/umeng_socialize.xml
/data/data/####/vds_hybrid.min.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/x9Z5sCQpzBrx312XleEc4fnjNUc.820274349.tmp
/data/data/####/xptRfTWjf9ibbE8nM0UfwRbTHqY.-359059686.tmp
/data/data/####/yNzeIJZTj1oAEpz9xRHY_WXsWwE.1991992422.tmp
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/137483fbf98a4784928e819ed847bd1a
/data/media/####/535ead0380174462b9f826dfe2b3b22c
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/accs_election
/data/media/####/d584a839b149486884a2f38b4aba0224
/data/media/####/deviceToken
/data/media/####/phone_uuid.tmp

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5719fa69e0f55aa011000150","utdid":"WvvZ9G/KfpEDAGdzx1HVfj2q","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu1784909077.so
getprop ro.product.cpu.abi
sh

Loads the following dynamic libraries:

gifimage
imagepipeline
libjiagu1784909077
tnet-3.1

Uses the following algorithms to encrypt data:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial