Android.RemoteCode.651

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.32

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) a####.wagbr####.t####.####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) log.mm####.com:80
TCP(HTTP/1.1) www.ta####.com:80
TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
TCP(HTTP/1.1) wild####.al####.com.####.net:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) ev####.u####.com:80
TCP(HTTP/1.1) a####.al####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) t.al####.com:80
TCP(HTTP/1.1) h5####.p####.cn:80
TCP(HTTP/1.1) js.u####.51.la:80
TCP(HTTP/1.1) a.c####.com:80
TCP(HTTP/1.1) gxb.mm####.com:80
TCP(HTTP/1.1) at.al####.com:80
TCP(HTTP/1.1) m.ta####.com:80
TCP(HTTP/1.1) hm2.c####.com:80
TCP(TLS/1.0) huhu-12####.f####.myqc####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) t####.renyan####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) re####.al####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) us-aebr####.ali####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) m.ta####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443

DNS requests:

a####.al####.com
a.c####.com
af####.ali####.com
af####.ali####.com
afpt####.ali####.com
app.jjl-####.com
at.al####.com
c####.mm####.com
c.c####.com
ev####.u####.com
fee.feiyunh####.com
fou####.ali####.com
g####.c####.com
g.al####.com
gm.mm####.com
gxb.mm####.com
h5####.p####.cn
h5.m.ta####.com
hm2.c####.com
huhu-12####.f####.myqc####.com
i####.51.la
img.al####.com
int.d####.s####.####.cn
ip.ta####.com
js.u####.51.la
log.mm####.com
m.ta####.com
new.c####.com
pass####.u####.com
re####.al####.com
s.c####.com
s.u####.com
s22.c####.com
s5.c####.com
t####.renyan####.com
t.al####.com
tce.ta####.com
w.c####.com
www.c####.com
www.ta####.com
www.u####.com
z1.c####.com
z13.c####.com

HTTP GET requests:

a####.al####.com/??kissy/####
a####.al####.com/ali-mod/??um-ubdc####
a####.al####.com/ali-mod/??umsite-####
a####.al####.com/alilog/??s/8.5.8/aplus_std.js?v=####
a####.al####.com/alilog/aplus_cplugin/0.4.4/monitor.js
a####.al####.com/alilog/aplus_cplugin/0.4.4/toolkit.js
a####.al####.com/alilog/mlog/aplus_v2.js
a####.al####.com/alilog/oneplus/entry.js?t=####
a####.al####.com/alilog/s/8.5.8/plugin/aplus_client.js
a####.al####.com/alilog/s/8.5.8/plugin/aplus_spmact.js
a####.al####.com/code/npm/@ali/??straw/1####
a####.al####.com/code/npm/@ali/init-kissy-pc/0.0.11/index.js
a####.al####.com/dt/tracker/3.4.10/tracker.Tracker.js
a####.al####.com/dt/tracker/3.4.11/tracker.performanceTrackerPlugin.js
a####.al####.com/g/mm/afp-cdn/JS/k.js
a####.al####.com/kissy/k/6.2.4/??base-mi####
a####.al####.com/kissy/k/6.2.4/??promise####
a####.al####.com/sd/sufei/0.2.4/app/common/sufei-kissy.js
a####.al####.com/secdev/entry/index.js?t=####
a####.al####.com/secdev/sufei_data/3.6.2/index.js
a####.al####.com/tbc/global/0.0.8/index-min.css
a####.al####.com/um-f2e/alicare/0.0.40/umeng_message.js
a####.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.css
a####.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.js
a####.al####.com/um-f2e/assets/1.0.9/doc-write-html/index.js
a####.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.css?r=####
a####.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.js
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56000332&sp=1&c...
a.c####.com/dplusTrack/?data=####&img=####&ip=####&dataver=####&_=####
a.c####.com/dplusTrack/?data=ey####&img=####&ip=####&dataver=####&_=####
at.al####.com/t/font_472294_6z2llm7grb7.ttf
at.al####.com/t/font_726646_sb729fiqbqf.ttf
c.c####.com/core.php?web_id=####&t=####
c.c####.com/dplus.php?id=####
c.c####.com/stat.php?id=####&web_id=####&show=####
ev####.u####.com/event/ubdc2018baoming?utm_source=####
ev####.u####.com/static/css/common.css?v=####
ev####.u####.com/static/css/drop-down.css
ev####.u####.com/static/css/event.css?v=####
ev####.u####.com/static/images/logo-120_30.png
ev####.u####.com/static/js/Modernizr.js
ev####.u####.com/static/js/common.js
ev####.u####.com/static/js/jquery-1.11.0.min.js
ev####.u####.com/static/js/jquery-ui.min.js
ev####.u####.com/static/js/jquery.gallery.js
ev####.u####.com/static/js/jquery.min.js
ev####.u####.com/static/js/select-widget-min.js
ev####.u####.com/static/upload/5b31f214311b8.png
ev####.u####.com/static/upload/image/20180703/1530596583212357.png
gm.mm####.com//fsp.1.3?appcacheTime=####&connectTime=####&delay=####&dom...
gm.mm####.com/mm.req.load?page=####&info=####&stack=####&filename=####&m...
gm.mm####.com/mm.req.load?page=http://www.umeng.com/ubdc2018?&utm_source...
gxb.mm####.com/gxb.gif?si=####&ref=####&lang=####&bw=####&bh=####&pu=###...
h5####.p####.cn/Play/H6Category?t=####
h5####.p####.cn/Play/H6Home
hm2.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&s...
ip.ta####.com/service/getIpInfo2.php?ip=####
js.u####.51.la/19560175.js
log.mm####.com/eg.js
log.mm####.com/v.gif?logtype=####&title=####&pre=####&scr=####&cna=####&...
m.ta####.com/?sprefer=####
sh.wagbr####.alibaba####.com/
sh.wagbr####.alibaba####.com/api/user/publicHeader?_ksTS=####&callback=#...
sh.wagbr####.alibaba####.com/api/user/publicHeader?callback=####
sh.wagbr####.alibaba####.com/common/js/footer/footer.js
sh.wagbr####.alibaba####.com/common/js/nav/ihome.js
sh.wagbr####.alibaba####.com/r.php?spm=a211g2.181323.945298.1.5c633604b6...
sh.wagbr####.alibaba####.com/r.php?spm=a211g2.181323.945299.1.5c633604M6...
sh.wagbr####.alibaba####.com/stat/website.php?web_id=####
sh.wagbr####.alibaba####.com/tms/html/block/assets/iconfont
sh.wagbr####.alibaba####.com/tms/html/block/ubdc/gcss
sh.wagbr####.alibaba####.com/tms/html/www/script/alicare
sh.wagbr####.alibaba####.com/tms/jsonp/www/data/products?callback=####&r...
sh.wagbr####.alibaba####.com/tms/jsonp/www/data/solutions?callback=####&...
sh.wagbr####.alibaba####.com/tms/script/block/header/nav
sh.wagbr####.alibaba####.com/ubdc/customcss?v=####
sh.wagbr####.alibaba####.com/ubdc2018?&utm_source=####&mm_unid=####&jlog...
sh.wagbr####.alibaba####.com/v1/images/an_download.gif
sh.wagbr####.alibaba####.com/v1/images/ios_download.gif
sh.wagbr####.alibaba####.com/v1/images/login/bqline.gif
sh.wagbr####.alibaba####.com/v1/images/login/button01.gif
sh.wagbr####.alibaba####.com/v1/images/login/button02.gif
sh.wagbr####.alibaba####.com/v1/images/login/button03.gif
sh.wagbr####.alibaba####.com/v1/images/login/button04.gif
sh.wagbr####.alibaba####.com/v1/images/login/button05.gif
sh.wagbr####.alibaba####.com/v1/images/login/button06.gif
sh.wagbr####.alibaba####.com/v1/images/login/button07.gif
sh.wagbr####.alibaba####.com/v1/images/login/check.jpg
sh.wagbr####.alibaba####.com/v1/images/login/leftback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/logo.gif
sh.wagbr####.alibaba####.com/v1/images/login/titleback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/toolback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/topback.jpg
sh.wagbr####.alibaba####.com/v1/images/qr/qr.php?siteid=####
sh.wagbr####.alibaba####.com/v1/images/validate.php
sh.wagbr####.alibaba####.com/v1/login.php?siteid=####
t.al####.com/t/gettime?callback=####
wild####.al####.com.####.net/tfs/TB11IOTCgmTBuNjy1XbXXaMrVXa-1301-695.png
wild####.al####.com.####.net/tfs/TB11XTwa9CWBuNjy0FhXXb6EVXa-631-154.png
wild####.al####.com.####.net/tfs/TB15zpnXuuSBuNjy1XcXXcYjFXa-2880-800.jpg
wild####.al####.com.####.net/tfs/TB16jHBaVOWBuNjy0FiXXXFxVXa-839-86.png
wild####.al####.com.####.net/tfs/TB1FY2uaYGYBuNjy0FoXXciBFXa-181-181.png
wild####.al####.com.####.net/tfs/TB1HXRmXuuSBuNjy1XcXXcYjFXa-190-190.gif
wild####.al####.com.####.net/tfs/TB1M9B7qTtYBeNjy1XdXXXXyVXa-58-58.jpg
wild####.al####.com.####.net/tfs/TB1T4DKa4GYBuNjy0FnXXX5lpXa-176-176.png
wild####.al####.com.####.net/tfs/TB1YVTwa9CWBuNjy0FhXXb6EVXa-623-167.png
wild####.al####.com.####.net/tfs/TB1YYLMa4GYBuNjy0FnXXX5lpXa-982-105.png
wild####.al####.com.####.net/tfs/TB1YroqmQyWBuNjy0FpXXassXXa-2880-800.jpg
wild####.al####.com.####.net/tfs/TB1ZYLMa4GYBuNjy0FnXXX5lpXa-218-218.png
wild####.al####.com.####.net/tfs/TB1hb2uaYGYBuNjy0FoXXciBFXa-4-58.png
wild####.al####.com.####.net/tfs/TB1nl3daYGYBuNjy0FoXXciBFXa-228-80.jpg
wild####.al####.com.####.net/tfs/TB1p4eiFTtYBeNjy1XdXXXXyVXa-2880-800.jpg
wild####.al####.com.####.net/tfs/TB1qVD7dXOWBuNjy0FiXXXFxVXa-2880-800.jpg
wild####.al####.com.####.net/tfs/TB1wPbsaYGYBuNjy0FoXXciBFXa-176-176.png
wild####.al####.com.####.net/tfs/TB1wpfOFuuSBuNjy1XcXXcYjFXa-2880-800.png
wild####.al####.com.####.net/tfs/TB1wtHJaY9YBuNjy0FgXXcxcXXa-133-133.png
wild####.al####.com.####.net/tfs/TB1zbGnB3mTBuNjy1XbXXaMrVXa-667-550.png
www.ta####.com/
www.ta####.com/markets/umplus/block/assets/iconfont
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

Modified file system:

Creates the following files:

/data/data/####/EOZTzhVG.jar
/data/data/####/csfwcqm.jwgq.rwool.qprju_preferences.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/device_id.xml.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/f_000055
/data/data/####/f_000056
/data/data/####/index
/data/data/####/libus.so
/data/data/####/libvia_pay.so
/data/data/####/multidex.version.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/journal.tmp

Miscellaneous:

Loads the following dynamic libraries:

mmssh
us
via_pay

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial