Android.RemoteCode.6521

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.221.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) analyt####.starsc####.com:80
TCP(HTTP/1.1) ab####.z.qing####.fm:80
TCP(HTTP/1.1) rec.z.qing####.fm:80
TCP(HTTP/1.1) s2.starsch####.com:80
TCP(HTTP/1.1) c####.h####.com:80
TCP(HTTP/1.1) s.s####.cn:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) p2p-####.starsc####.com:20006
TCP(HTTP/1.1) res.starsc####.com:80
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) a####.starsc####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) hdg####.doumob####.online:443
TCP(TLS/1.0) interac####.clo####.online:443
UDP 39.1####.118.206:3478
TCP p2p-####.starsc####.com:20007
UDP 39.1####.124.173:3479
UDP 1####.57.235.16:22000

DNS requests:

0####.000-####.b####.com
0####.000.b####.com
a####.starsc####.com
ab####.z.qing####.fm
analyt####.starsc####.com
and####.b####.qq.com
api.w####.com
asdasda####.5ee3####.cn
asdasda####.5ee3####.cn
c####.h####.com
hdg####.doumob####.online
interac####.clo####.online
is.0####.000.com
log.u####.com
p2p-####.starsc####.com
plb####.u####.com
pro####.z.qing####.fm
rec.z.qing####.fm
res.starsc####.com
s.s####.cn
s2.starsch####.com
sf3-ttc####.ps####.com
u####.u####.com

HTTP GET requests:

c####.h####.com/upload/SMSDKDEX_WC.jar
p2p-####.starsc####.com:20006/v1.0/upgrade?version=####&os_type=####&pkg...
res.starsc####.com/res/2019/04/26/09/2445/tab栏VIP@3x.png
res.starsc####.com/res/2019/04/26/09/2519/tab栏我的@3x.png
res.starsc####.com/res/2019/04/26/09/2541/tab栏直播@3x.png
res.starsc####.com/res/2019/04/26/09/2557/tab栏首页@3x.png
res.starsc####.com/res/2019/06/03/15/0413/58房产2.png
res.starsc####.com/res/2019/09/18/11/0651/1.png
res.starsc####.com/res/2019/10/09/14/1953/489cibn.png
res.starsc####.com/res/2019/10/09/14/2007/727cctv.png
res.starsc####.com/res/2019/10/09/14/2023/786weishi.png
res.starsc####.com/res/2019/10/09/14/2041/269dianying.png
res.starsc####.com/res/2019/10/09/14/2104/123x123.png
res.starsc####.com/res/2019/11/20/16/1550/拼多多-红包素材1120.jpg
res.starsc####.com/res/2020/01/08/14/5852/我爱男保姆.jpg
res.starsc####.com/res/2020/01/08/14/5948/姐妹兄弟.jpg
res.starsc####.com/res/2020/01/08/15/0015/黑狐之风影.jpg
res.starsc####.com/res/2020/01/08/15/0640/还是夫妻.jpg
res.starsc####.com/res/2020/01/08/15/0856/黑狐之风影.jpg
res.starsc####.com/res/2020/01/08/15/0918/伏击.jpg
res.starsc####.com/res/2020/01/08/16/3149/好家伙.jpg
res.starsc####.com/res/2020/01/10/17/0500/第8集.jpg
s.s####.cn/utils/idmap?appid=####
s.s####.cn/utils/j2ver?version=####&pkg=####&did=####&vendor=####
s2.starsch####.com/thumb/181/thumb@240_180.jpg?ft=####

HTTP POST requests:

ab####.z.qing####.fm/category/776
analyt####.starsc####.com/index.php?m=####&a=####&e=####&data=####
and####.b####.qq.com/rqd/async?aid=####
rec.z.qing####.fm/channel/416

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/3a2dee822ff9ac041f2fba4c29f67d18011aff67b004cf9....0.tmp
/data/data/####/3afb8e5ea6d3c29b2cc2336f9435b48ed05cc7aaba14e78....0.tmp
/data/data/####/3f7d0bc5eaa06e59b5a45d095d1a349a6a881c0496270ed....0.tmp
/data/data/####/403b281a65c489b75ca480be26badedd00df40db36ee09b....0.tmp
/data/data/####/6c82a1e0eb0780a4228fb8c18fa6ca2d87b8847866fb5ab....0.tmp
/data/data/####/7d0db3052af130505ebefa991d641df72775c0dc0cb1267....0.tmp
/data/data/####/860bc100c7023106a2d6e1224ebaf8b38623390160936ee....0.tmp
/data/data/####/8VnogRtG9JoQraEZcK03u7GMeqo.2017493135.tmp
/data/data/####/8e31b89093d5be2967429169105a044037758cd37feec25....0.tmp
/data/data/####/96d08472cd1f7e6db86f61aa62ec5923079930b6662b73a....0.tmp
/data/data/####/96d08472cd1f7e6db86f61aa62ec5923079930b6662b73a...70bc.0
/data/data/####/CUgTWWUxkKLN_WrP2LC1eXMmkBM.1487550080.tmp
/data/data/####/CvBpJESWI12dJ5yHpgfhHsh_g6o.-1270714225.tmp
/data/data/####/EDjfgRe3YO3rhZKWA4Z5_wUUS-M.-1830098541.tmp
/data/data/####/EJiudSWSu6sDDOkCZk6c9SciA28.-1883106366.tmp
/data/data/####/GNGxgV2uiOPg05ZfD7g7jX47Hh8.-1265533345.tmp
/data/data/####/J_N-fbteSJkdzZtWYSspRU5B-Z4.-1473857594.tmp
/data/data/####/K2RKZvczeKcCAT9XQZCd9q47fKM.595513979.tmp
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/TNd0Gg8RjnIHhwZrm_K_aY7-VjI.-79290886.tmp
/data/data/####/ViwbFu_Lc5uNR7REnbt-iM3CHMQ.-420889177.tmp
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__builtinversion__.jar
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/_miad_sdk_module_versions.xml
/data/data/####/ad_info_bean.xml
/data/data/####/androidx.work.workdb
/data/data/####/androidx.work.workdb-journal
/data/data/####/androidx.work.workdb-shm
/data/data/####/androidx.work.workdb-wal
/data/data/####/anxjEQLOp2Z4QShCNZGJDGPDcbI.-1193340235.tmp
/data/data/####/app_id.xml
/data/data/####/app_info.xml
/data/data/####/app_version.xml
/data/data/####/bizdata_db-journal
/data/data/####/browsers_info.xml
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/c668fa31ac470616b022ec3eaf5cbb130d80a09c4b3e4ac....0.tmp
/data/data/####/cbe43a4fbee0a5ffbd856f3c34677a96f94cdd91d1a8528....0.tmp
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/crashrecord.xml
/data/data/####/cvw3GEctSjYGD7pBttnHmVAGqyw.630739822.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc4NjY0MTEwNzQ2;
/data/data/####/dW1weF9zaGFyZV8xNTc4NjY0MTEyMTM4;
/data/data/####/dW1weF9zaGFyZV8xNTc4NjY0MTEyMTc3;
/data/data/####/deleteAdVideoWeekly.xml
/data/data/####/device_id_persistence_file_real
/data/data/####/device_info.xml
/data/data/####/dlcact.xml
/data/data/####/dopool_analytics.db-journal
/data/data/####/downloader.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&8.0.8_1578664110743_envelope.log
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/jsjSvgUHDzk9-WKGm0ikOSKoXsQ.386323466.tmp
/data/data/####/key_display_height.xml
/data/data/####/key_marketId.xml
/data/data/####/libjiagu694791032.so
/data/data/####/local_crash_lock
/data/data/####/mobads_aplist_status.xml
/data/data/####/multidex.version.xml
/data/data/####/outside_net_ip.xml
/data/data/####/pref_app.xml
/data/data/####/report.db-journal
/data/data/####/security_info
/data/data/####/server_time.xml
/data/data/####/share.db-journal
/data/data/####/share.xml
/data/data/####/shared_preferences_data_statistics.xml
/data/data/####/t2jFNCYpeUnDyYQIjDw5b0yw0As.1312411102.tmp
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/twCvrqUl9gr0bFP0BKm7-bMaKkw.-794713129.tmp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/wWtuFHIAaJsGgUpOT0OJ7u1tB_Y.270599501.tmp
/data/data/####/webview.db-journal
/data/data/####/weibo_sdk_aid1
/data/data/####/x8-4YKvA3ORh3bMPlICNDH-o0WA.-201293297.tmp
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/20c1175221b0144ff8633beb754b1c09.tmp
/data/media/####/SMSDKDEX_WC.jar
/data/media/####/f4554d5908708287d5de5cf773393ed5.tmp
/data/media/####/sakura
/data/media/####/temp_pkg_info.json

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls /sys/class/thermal

Loads the following dynamic libraries:

Bugly
encrypt
encryptAd
libgifimage
libimagepipeline
libjiagu694791032
p2p
securityenv
weibosdkcore

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RC4
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial