Android.RemoteCode.537

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.155.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) cm.pos.b####.com:80
TCP(HTTP/1.1) s.3####.cn:80
TCP(HTTP/1.1) a####.wagbr####.ta####.####.com:80
TCP(HTTP/1.1) ub####.baidust####.com:80
TCP(HTTP/1.1) s####.jom####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) i####.diyifa####.com:80
TCP(HTTP/1.1) cdn.t####.com:80
TCP(HTTP/1.1) 7ltfwuq####.wsclou####.com:80
TCP(HTTP/1.1) zha####.b####.com:80
TCP(HTTP/1.1) s7.q####.com:80
TCP(HTTP/1.1) a####.al####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) w7i01o4####.wsclou####.com:80
TCP(HTTP/1.1) js.pass####.qih####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) wild####.al####.com.####.net:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) q.t####.com:80
TCP(HTTP/1.1) b####.s####.com.cn:80
TCP(HTTP/1.1) s####.al####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) zt-adfi####.oss-cn-####.aliy####.com:80
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) i####.diyifa####.com:443
TCP(TLS/1.0) ub####.baidust####.com:443

DNS requests:

a####.al####.com
a1.al####.com
b####.s####.b####.com
b####.s####.com.cn
c####.baidust####.com
cdn.t####.com
cm.pos.b####.com
e####.diyifa####.com
f10.b####.com
f12.b####.com
gma.al####.com
hm.b####.com
i####.diyifa####.com
img.al####.com
img.diyifa####.com
img.safetys####.mobi
imgc####.qq.com
js.pass####.qih####.com
log.mm####.com
m.diyifa####.com
m.s####.ta####.com
mi.g####.qq.com
mo.m.ta####.com
pos.b####.com
qzones####.g####.cn
s####.al####.com
s####.e.qq.com
s####.re.ta####.com
s.3####.cn
s7.q####.com
t11.b####.com
t12.b####.com
text####.s####.ta####.com
ub####.baidust####.com
wn.pos.b####.com
zha####.b####.com
zt-adfi####.oss-cn-####.aliy####.com

HTTP GET requests:

7ltfwuq####.wsclou####.com/sms/wenhouzhufuduanxin/
7ltfwuq####.wsclou####.com/sms/wenhouzhufuduanxin/346811.htm
a####.al####.com/t/tanxclick.js
a####.al####.com/t/tanxmobile/tanxssp.js?_v=####
a####.wagbr####.ta####.####.com/?name=####&o=####&pid=####&templetId=###...
a####.wagbr####.ta####.####.com/acbeacon3
b####.s####.com.cn/s/blog_d94546290102wm5g.html
c####.baidust####.com/cpro/expire/time2.js
c####.baidust####.com/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
c####.baidust####.com/cpro/ui/noexpire/ws/css/base_f258e90.css
c####.baidust####.com/cpro/ui/noexpire/ws/css/ui_b99a586.css
c####.baidust####.com/cpro/ui/noexpire/ws/images/logo/close_9d33a11.png
c####.baidust####.com/cpro/ui/noexpire/ws/images/logo/logo-mob_94da672.png
c####.baidust####.com/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
c####.baidust####.com/cpro/ui/noexpire/ws/widget/logo_5b92275.js
c####.baidust####.com/cpro/ui/pr.js
c####.baidust####.com/sync.htm?cproid=####
cdn.t####.com/creation/html/2016/04/15/creation-31617daffi3Vs2BTB-127778...
cdn.t####.com/t/acookie/acbeacon2.html
cdn.t####.com/t/acookie/acbeacon3.html
cdn.t####.com/t/tanxclick.js
cdn.t####.com/t/tanxmobile/tanxssp.js?_v=####
cm.pos.b####.com/pixel?dspid=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?378db72####
i####.diyifa####.com/hbfjuz.js
js.pass####.qih####.com/11.0.1.js?e6f407c####
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_car_b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appcache
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/i...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&ari=####&cdo=####&dis...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cmi=####&dtm=####&pis...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&pss=####&ti=####&tcn=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&tlm=####&cpl=####&dc=...
q.t####.com/ex?i=####
q.t####.com/spfl?e=####&k=####&i=####&tanxssp_t=####
q.t####.com/wapl?i=####&cb=####&callback=####&userid=####&o=####&f=####&...
s####.al####.com/tfscom/TB1YqRjPFXXXXcLXFXXXXXXXXXX.html?tanxdspv=http:/...
s####.al####.com/tfscom/TB1kwfsPpXXXXaMXXXXXXXXXXXX.html?tanxdspv=http:/...
s####.jom####.com/static/api/css/share_style1_24.css
s####.jom####.com/static/api/img/share/icons_1_24.png?v=####
s####.jom####.com/static/api/js/base/tangram.js?v=####
s####.jom####.com/static/api/js/component/partners.js?v=####
s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
s####.jom####.com/static/api/js/share/api_base.js
s####.jom####.com/static/api/js/share/share_api.js?v=####
s####.jom####.com/static/api/js/view/share_view.js?v=####
s####.jom####.com/static/api/js/view/view_base.js
s.3####.cn/so/zz.gif?url=####&sid=####&token=####
s7.q####.com/static/ab77b6ea7f3fbf79.js
ub####.baidust####.com/media/v1/0f0002sEjqmHON3NNXP8Y0.jpg
w7i01o4####.wsclou####.com/m/css/base.css
w7i01o4####.wsclou####.com/m/img/icon.png
w7i01o4####.wsclou####.com/m/img/pageicon.png
w7i01o4####.wsclou####.com/m/img/sicon.png
w7i01o4####.wsclou####.com/m/img/top_line.png
w7i01o4####.wsclou####.com/m/js/base.js
w7i01o4####.wsclou####.com/m/js/bottom.js
wild####.al####.com.####.net/tfs/TB1K4sVLXXXXXbQaXXXXXXXXXXX-36-20.png
wild####.al####.com.####.net/tfscom/T1aIqjFqFaXXb1upjX.jpg
wn.pos.b####.com/adx.php?c=####
wn.pos.b####.com/adx.php?c=####&ext=####
zha####.b####.com/cse/search?s=####&entry=####&q=####
zt-adfi####.oss-cn-####.aliy####.com/1512/rt/gx.bin

HTTP POST requests:

s####.e.qq.com/activate
s####.e.qq.com/err
s####.e.qq.com/msg

Modified file system:

Creates the following files:

/data/data/####/.engine.apk
/data/data/####/.key.apk
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/WebViewSettings.xml
/data/data/####/android_pre.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/gx
/data/data/####/index
/data/data/####/libcrypt.so
/data/data/####/libloader.so
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/shell_pre.xml
/data/data/####/temp.jar
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/ApplicationCache.db-journal
/data/media/####/sys_nicholas.txt

Miscellaneous:

Executes next shell scripts:

cat /proc/version
cat /sys/class/net/wlan0/address
chmod 777 <Package Folder>/files/gxTmp
chmod 777 <Package Folder>/files/gxTmp/gx

Loads the following dynamic libraries:

crypt
libloader

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial