Android.RemoteCode.3948

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.907
Android.Triada.248.origin
Android.Triada.464.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.hyhon####.cn:80
TCP(HTTP/1.1) i####.api.qiazhiw####.cn:10003
TCP(HTTP/1.1) 1####.55.93.104:9004
TCP(HTTP/1.1) bf####.8p####.com:11039
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10201
TCP(HTTP/1.1) dex.oss-ap-####.aliy####.com:80
TCP(HTTP/1.1) wn.qiazhiw####.cn.####.net:80
TCP(HTTP/1.1) dn.tc####.com:80
TCP(HTTP/1.1) apc.wjm####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) 1####.78.31.198:8030
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) api.97####.com:8280
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10103
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ja####.huita####.com:10091
TCP(HTTP/1.1) c####.jzp####.cn:80
TCP(HTTP/1.1) nc####.6tf####.com:15032
TCP(HTTP/1.1) fy.bigb####.com:6099
TCP(HTTP/1.1) ji####.jieme####.com:8152
TCP(HTTP/1.1) l####.bigb####.com:6099
TCP(HTTP/1.1) v####.api.eeric####.com:80
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10001
TCP(HTTP/1.1) ny.liz####.com:666
TCP(TLS/1.0) 2####.58.212.238:443
TCP(TLS/1.0) if.jw####.cn:443

DNS requests:

4y####.um0####.com
a####.u####.com
apc.wjm####.com
api.97####.com
api.a####.com
api.ila####.com
bf####.8p####.com
c####.api.qiazhiw####.cn
c####.hyhon####.cn
c####.jzp####.cn
dex.oss-ap-####.aliy####.com
dn.tc####.com
fy.bigb####.com
hx.wjm####.com
i####.api.qiazhiw####.cn
i####.api.qiazhiw####.cn
if.jw####.cn
ja####.huita####.com
jb####.qh####.com
ji####.dl####.com
ji####.jieme####.com
l####.bigb####.com
nc####.6tf####.com
ny.liz####.com
oc.u####.com
pv.s####.com
sdk.api.qiazhiw####.cn
tm####.dae####.com
v####.api.eeric####.com
wn.qiazhiw####.cn
z####.heyc####.net
z56####.evh####.com

HTTP GET requests:

c####.hyhon####.cn/OK/QWE002
c####.hyhon####.cn/OK/QWE015
c####.jzp####.cn/op/masrvot.zip
dex.oss-ap-####.aliy####.com/dex/20190306/wup.apk?79####
dn.tc####.com/dnfile/wmp/WG3N20181029LD31020.jar
gdv.a.s####.com/cityjson?ie=####
q####.a####.com/jieplginf/djmdeta29
wn.qiazhiw####.cn.####.net/update/up03169499

HTTP POST requests:

a####.u####.com/app_logs
apc.wjm####.com/core/user/initPay
apc.wjm####.com/fetchMobileService/fetchMobile
apc.wjm####.com/inte/upResult
apc.wjm####.com/inte/upSdkCrashLog
apc.wjm####.com/inte/upSmsCollection
api.97####.com:8280/core/hb
bf####.8p####.com:11039/fevqe
bf####.8p####.com:11039/qysvz
fy.bigb####.com:6099/aps/
i####.api.qiazhiw####.cn:10003/v2/chis2
ja####.huita####.com:10091/wisdom/marking
ji####.jieme####.com:8152/ryf_webserver/payment/checkupdate.html
l####.bigb####.com:6099/aps/
nc####.6tf####.com:15032/down
nc####.6tf####.com:15032/install
nc####.6tf####.com:15032/quest
nc####.6tf####.com:15032/run
ny.liz####.com:666/slsdk/getdata.aspx
ny.liz####.com:666/slsdk/settings.aspx
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
sdk.api.qiazhiw####.cn:10001/v2/bag/monitor?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/sdk/init2?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/update/check?app_id=####&t=####
sdk.api.qiazhiw####.cn:10103/v3/order/get?app_id=####&t=####
sdk.api.qiazhiw####.cn:10103/v3/order/scoreget?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/report2?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/report?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v3/sdk/report?appId=####&t=####
v####.api.eeric####.com/api/payment/mobileInit.html
v####.api.eeric####.com/api/payment/payDynamic.html
z####.heyc####.net/getlist
z####.heyc####.net/xlogin

File system changes:

Creates the following files:

/data/data/####/.DEVICES
/data/data/####/.imprint
/data/data/####/1553224933833
/data/data/####/1553224941766
/data/data/####/1553224948297
/data/data/####/1553224961174
/data/data/####/1553224975156
/data/data/####/1553224989051
/data/data/####/38DD8B96194AE9A9E42BDA0DE378C3BC.xml
/data/data/####/BB329387E35EC64A285EDFFB32DC6E12.xml
/data/data/####/BE64377A23A0130F6C5A82350310E31E.xml
/data/data/####/C8THFoXc_uIwukyFQvcbFw==
/data/data/####/DA71801AE4546BE0D909948137905ED9.xml
/data/data/####/EF1F19F5DB18554471C7A30661B046BC.xml
/data/data/####/F29B5FE74986CD64B2DDAEDD2A58B7AA.xml
/data/data/####/JiePay.xml
/data/data/####/L27kSbckQ3hqGvV2-DhgKzlymAo=.new
/data/data/####/RnjR2G7BODYjSKS3Rwp-2w==.new
/data/data/####/SCZj7Amg3fYj6B5xknRb6A==.new
/data/data/####/XinZF.xml
/data/data/####/XinZF_conf.xml
/data/data/####/XinZFsmspay.db
/data/data/####/XinZFsmspay.db-journal
/data/data/####/action.db-journal
/data/data/####/b6dNLK3doY_-8gcBuEBlcy-7ZsA=.new
/data/data/####/bpR7CjGmhwmL8kF5
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ciEv0QC_sBOXtjB_5lNEuA==
/data/data/####/com.mnsy.aldivfffd.com.one.sdk.c.amsg.db-journal
/data/data/####/com.mnsy.aldivfffd.com.sdk.a.a_mseg.db
/data/data/####/com.mnsy.aldivfffd.com.sdk.a.a_mseg.db-journal
/data/data/####/com.mnsy.aldivfffd.xml
/data/data/####/com.mnsy.aldivfffd.xml.bak (deleted)
/data/data/####/com.mnsy.aldivfffd_preferences.xml
/data/data/####/config50083.xml
/data/data/####/cuwnewnk.jar
/data/data/####/dpi
/data/data/####/engc.jar
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/game_res
/data/data/####/game_res.zip
/data/data/####/gxuobg_f.zip
/data/data/####/hid.db
/data/data/####/jiepay_config.xml
/data/data/####/jiepayplugin.apk
/data/data/####/jiepayplugin.apkdata
/data/data/####/jiepaysmspay.db
/data/data/####/jiepaysmspay.db-journal
/data/data/####/js_ad_bundle_data.xml
/data/data/####/libbjhre.so
/data/data/####/libbjhre.so-32
/data/data/####/libbjhre.so-64
/data/data/####/libzddin.so
/data/data/####/libzddin.so-32
/data/data/####/libzddin.so-64
/data/data/####/loccalCache.xml
/data/data/####/lqz_DzeNW37eAOdB.zip
/data/data/####/mdcbHdD2Nf04riW4JCMXrKe05hQAj9EL.new
/data/data/####/new_md.jar
/data/data/####/oD3LN6JiIsC6iO-m_f02prCr6gE=.new
/data/data/####/onePay.xml
/data/data/####/onlineconfig_agent_online_setting_com.mnsy.aldivfffd.xml
/data/data/####/ooe3PQfBGxf5Xuwat9eEYSiH0BI=.new
/data/data/####/prdopt.xml
/data/data/####/qlY7uu95p4JInQZ0G0q7qA==.new
/data/data/####/rdata_comuflwhzd.new
/data/data/####/rnbnr.png
/data/data/####/shunpay_config
/data/data/####/svygf.png
/data/data/####/tdargs.xml
/data/data/####/tmpbl.jar
/data/data/####/tools8977.xml
/data/data/####/tquegktk.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uid.f
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/up03169499
/data/data/####/up03169499.jar
/data/data/####/webview.db-journal
/data/data/####/wup.apk.ap (deleted)
/data/data/####/wup.apk.apk
/data/data/####/wup.apk.apk.json
/data/data/####/x04mbEnH1a3pgWQpGKq3-p5oh4k=.new
/data/data/####/xQjN30myiirTMzVy.new
/data/data/####/yd_config_c.xml
/data/data/####/zdfc.jar
/data/data/####/zlixWPHjD10NG3Skikx3bDz21W2gu2Eb_FlkMgG37dpM2RtzJ-journal
/data/media/####/.bsgo
/data/media/####/.nid
/data/media/####/.uuid
/data/media/####/.uunique.new
/data/media/####/2BAAE4C6E55394898E6143512B2111D4.temp
/data/media/####/2BAAE4C6E55394898E6143512B2111D4.zip
/data/media/####/A4C02CF39CD95E518E9D827E7EE1A05E
/data/media/####/A4C02CF39CD95E518E9D827E7EE1A05E.temp
/data/media/####/ACD6A93C1D94AC8B4260F22ECCEF912C.temp
/data/media/####/C6179E2B50154E9F7AD9CEBA24BD35FF
/data/media/####/log
/data/media/####/msg
/data/media/####/order
/data/media/####/status
/data/media/####/tag2.dat92f0c7d9-3030-432c-b253-4921fa4bc602.tmp

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh
cat /proc/version
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
cat /sys/class/net/wlan0/address
getprop
getprop ro.board.platform
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.version
getprop ro.yunos.version
ls -l /dev
ls -l /dev/block
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuctl/apps
ls -l /dev/cpuctl/apps/bg_non_interactive
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/log
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ps

Loads the following dynamic libraries:

cocos2dcpp
core
libbjhre
libzddin
n24b61
shunpay

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Contains functionality for automatic SMS sending.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Parses information from SMS.

Gets information about sent/received SMS.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial