Android.RemoteCode.7294

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.314.origin

Contains typical banking trojan/virus code.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 2####.73.129.195:28018
TCP(HTTP/1.1) s1.cn####.com:80
TCP(HTTP/1.1) alldo####.sweetco####.com.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) wa.bu####.vip:80
TCP(HTTP/1.1) 1####.77.67.185:28018
TCP(HTTP/1.1) pro.wildpet####.com:80
TCP(HTTP/1.1) cl.ads####.cn:80
TCP(HTTP/1.1) p####.ugd####.com.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) api.z####.com:80
TCP(HTTP/1.1) 52.2####.173.174:80
TCP(HTTP/1.1) ip####.com:80
TCP(HTTP/1.1) www.jd.com.####.com:80
TCP(HTTP/1.1) co####.ssp.adoc####.com:80
TCP(HTTP/1.1) ap####.math####.cn:80
TCP(HTTP/1.1) api.a####.ads####.cn:80
TCP(HTTP/1.1) 14.17.1####.182:80
TCP(HTTP/1.1) 1####.76.103.4:28018
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) lo.bu####.vip:80
TCP(HTTP/1.1) 1####.74.90.25:38018
TCP(HTTP/1.1) pro.wildpet####.com:201
TCP(HTTP/1.1) sd.bu####.vip:80
TCP(HTTP/1.1) p####.api.adoc####.com:80
TCP(HTTP/1.1) f####.st####.z####.com:80
TCP(TLS/1.0) securit####.sp####.mig.####.net:443
TCP(TLS/1.0) 2####.107.1.100:443
TCP(TLS/1.0) mi.g####.qq.com:443
TCP(TLS/1.0) lbs.net####.im:443
TCP(TLS/1.0) 1####.74.90.25:31828
TCP(TLS/1.0) www.jd.com.####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) cnc.dsa.bd####.com:443
TCP(TLS/1.0) 64.2####.161.95:443
TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
TCP(TLS/1.0) sy.cl####.com:443
TCP(TLS/1.0) q####.tc.qq.com:443
TCP(TLS/1.0) l####.cmpass####.com:9443
TCP(TLS/1.0) analy####.map.qq.com:443
TCP(TLS/1.0) di####.b####.net:443
TCP(TLS/1.0) alldo####.linx####.com.####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) fir####.h####.org:5665
TCP(TLS/1.0) u.j####.com:443
TCP(TLS/1.0) as####.xiaozu####.net:443
TCP(TLS/1.0) dfzxi####.dftou####.com.####.com:443
TCP(TLS/1.0) qy-swa####.qi####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) ap1.qi####.com:443
TCP(TLS/1.0) 1####.217.168.234:443
TCP(TLS/1.0) gl####.jd.com.####.com:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 2####.85.233.113:443
TCP(TLS/1.2) 64.2####.161.95:443
TCP l####.net####.im:8080
TCP 2####.17.184.62:33899
TCP 1####.118.121.174:33900

DNS requests:

a####.man.aliy####.com
amdc####.m.ta####.com
analy####.map.qq.com
and####.b####.qq.com
ap####.math####.cn
ap1.qi####.com
api.a####.ads####.cn
api.z####.com
api16-a####.pa####.io
as####.xiaozu####.net
cde.sweetco####.com
cl.ads####.cn
co####.ssp.adoc####.com
dfzxi####.dftou####.com
dig.b####.net
dm.byted####.com
dm.ps####.com
dm.tou####.com
dwf.linx####.com
dxp.b####.com
dy.cn.wildpet####.xyz
f####.st####.z####.com
fir####.h####.org
gl####.jd.com
h####.b####.com
i####.me
ip####.com
l####.cmpass####.com
l####.net####.im
l####.tbs.qq.com
lbs.net####.im
lo.bu####.vip
m####.go####.com
mi.g####.qq.com
newap####.math####.cn
p####.api.adoc####.com
p####.ugd####.com
pang####.sn####.com
plb####.u####.com
pro.wildpet####.com
q####.qq.com
qy-swa####.qi####.com
r####.bu####.vip
r####.bu####.vip
res####.a####.com
s####.e.qq.com
s1.cn####.com
s9.c####.com
sd.bu####.vip
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
sy.cl####.com
t####.m.qq.com
to####.ctobsn####.com
u####.u####.com
u.j####.com
umen####.m.ta####.com
umengj####.m.ta####.com
w####.jd.com
wa.bu####.vip

HTTP GET requests:

alldo####.sweetco####.com.####.com/rhsdk/js/default2.html
ap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
api.z####.com/v1/advert/config?platform=####&versionCode=####&timestamp=...
co####.ssp.adoc####.com/api/v2/SDKActiveConfig?version=####&channelCode=...
co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
f####.st####.z####.com/php12123/074163237731eb8feae0e1f1a1fb80a6.jpg
f####.st####.z####.com/php12123/20190319/1d0ad428ee3db572f8d7dc9caf5318a...
f####.st####.z####.com/php12123/42766f6619e6e5c812ee3a3573587cc0.png
f####.st####.z####.com/php12123/508443a2aa7dc9235b6fed1dfdfcc594.jpg
f####.st####.z####.com/php12123/54df5a6cc393e75adfe3e8a903f4823d.png
f####.st####.z####.com/php12123/641c178a68f953dec8b9eb39d6a4c4d5.png
f####.st####.z####.com/php12123/81c1bc4e1321b330e3a14a20556d1d05.png
f####.st####.z####.com/php12123/8efe4c5c314baf02d77c1929e4056797.png
f####.st####.z####.com/php12123/90de874afe3c4a14321ab534bde128f6.png
f####.st####.z####.com/php12123/b976a921c3c24be1d85a84aa7748e782.png
f####.st####.z####.com/php12123/c490c3279a36cdbeaa45fbd3475e8c14.png
f####.st####.z####.com/php12123/cc8be51abbbd6e129b1bbd6f316948d9.png
f####.st####.z####.com/php12123/cdb30a907b09862d617fe702bbf2c39d.png
ip####.com/json/?lang=####
lo.bu####.vip/v1/log/track?key=####&mtype=####&device_####&pkg=####&subi...
p####.api.adoc####.com/ip
p####.ugd####.com.####.com/gdt/0/EABHLX7AQ4AeAAAAQ1_BgBkBSBokEe-Z1.jpg/0...
s1.cn####.com/assets/36de2548755455k214ab/yysl.jpg
www.jd.com.####.com/

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
api.a####.ads####.cn/thirdparty/sapi/chn
api.z####.com/app/version/android-upgrade
api.z####.com/push-tag/list
api.z####.com/tab-conf/app-column-conf
api.z####.com/tab-conf/app-sys-conf
api.z####.com/tab-conf/uuid
api.z####.com/tips/index
api.z####.com/v1/advert/list
api.z####.com/v1/news/list
api.z####.com/v1/news/type
cl.ads####.cn/cqapi/control/postrest
l####.tbs.qq.com/ajax?c=####&k=####
newap####.math####.cn/titan/monitor/device_info
pro.wildpet####.com/dycn/update
pro.wildpet####.com:201/proxy/get?e=####&r=####
res####.a####.com/v3/weather/weatherInfo
s####.e.qq.com/activate
s####.e.qq.com/launch
sd.bu####.vip/v1/project/sdk
wa.bu####.vip/v1/wake/list

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.turing.dat
/data/data/####/0dadfda5d5929468_0
/data/data/####/1002
/data/data/####/1004
/data/data/####/105498_auMini_1
/data/data/####/1416f4da233ec65233b16f4a6f686f16
/data/data/####/18147953967553.0
/data/data/####/1b7a5b134dc65f108c26eacd241d268a
/data/data/####/1b7a5b134dc65f108c26eacd241d268a.temp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/1dfe31185d654d13_0
/data/data/####/22jhY8GqTkjUG97Qoo3JnF8iHaM.377833890.tmp
/data/data/####/37150623939016.0
/data/data/####/38149751704416.0
/data/data/####/3f4a192daa14aa2a_0
/data/data/####/4af7b77718d8f9d0_0
/data/data/####/75147085132269.0
/data/data/####/8816fe3740cb15e2_0 (deleted)
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/BUGLY_COMMON_VALUES.xml.bak
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/EPLgwve4222gGRZB92xNiiLt6h0.1962886510.tmp
/data/data/####/EPLgwve4222gGRZB92xNiiLt6h0.cnt
/data/data/####/ESTeupzo0a40wTVVCmChcXz_sXc.1057883132.tmp
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/N-36LOhbgwidzYz1PCNWaz4U4jk.778437728.tmp
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596.xml.bak
/data/data/####/NIMSDK_Config_f7274dbc6d1b56317a1437bb9d42f596_...51.xml
/data/data/####/PROXYDATA.xml
/data/data/####/PTPcqv0pdxJvYISDHN-ftuCDlbI.cnt
/data/data/####/QBEtCxCjoz5Pz-GDd1YV4BbqLwY.904341124.tmp
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Unicorn.f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/V7Rha1I7ZGCW0X0lwEw6hATLkrI.158311189.tmp
/data/data/####/VNrBGRc5zPXj_9-3W2pFD7Y0ydU.1360954348.tmp
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ZH503.dex
/data/data/####/ZH503.dex.flock (deleted)
/data/data/####/ZH503.jar
/data/data/####/ZXBN3UKDL7JZAxq85p3GcbH95eM.cnt
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/___rb.p12___
/data/data/####/__cid__v1__.dat
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__local_stat_full_cache.json
/data/data/####/__rbpr_up18__
/data/data/####/__send_data_1614710713672
/data/data/####/a6d6e4a7cafe62e342c8d78e76f8571b
/data/data/####/a720d24ec977941b_0
/data/data/####/a720d24ec977941b_1
/data/data/####/a77f3a923af93153_0
/data/data/####/accs.db-journal
/data/data/####/adinitdex.xml
/data/data/####/agoo.pid
/data/data/####/appuserid.xml
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/be18eddcba8c4e79e761c913fbe81d34
/data/data/####/bugly_db_-journal
/data/data/####/c0586a10777146560765a69231d89beb.xml
/data/data/####/c20b273e45430165_0
/data/data/####/cdu_st_-1897404729
/data/data/####/cdu_st_-1963733048
/data/data/####/cdu_st_-724289219
/data/data/####/cdu_st_-752754616
/data/data/####/cdu_st_1495260626
/data/data/####/cdu_st_1606883332
/data/data/####/cdu_st_465275389
/data/data/####/cdu_st_759790841
/data/data/####/channel_umeng_common_config.xml
/data/data/####/chuanglan_report_2.2.1.db
/data/data/####/chuanglan_report_2.2.1.db-journal
/data/data/####/com.qiyukf.analytics.xml
/data/data/####/com.qq.e.sdkconfig.xml
/data/data/####/com.qq.e.sdkconfig.xml.bak
/data/data/####/com.wswy.wzcx.BETA_VALUES.xml
/data/data/####/com.wswy.wzcx_preferences.xml
/data/data/####/comxcxid.xml
/data/data/####/config
/data/data/####/core_info
/data/data/####/core_umeng_common_config.xml
/data/data/####/crashrecord.xml
/data/data/####/ct_account_api_sdk.xml
/data/data/####/d5ab650655ea1d06_0 (deleted)
/data/data/####/dH-2X_6c8M5jbuJcHgNouIeVBEM.1490117497.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNjE0NzEwNzAyMjYx;
/data/data/####/data.m
/data/data/####/de6fc6e6d00bdf773ac85456213ada55.temp
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e79350219.apk
/data/data/####/e79350219_o
/data/data/####/e79350219_o.flock (deleted)
/data/data/####/eAfLZGqOEOCbjWqwjzwN8mtjv2A.769937707.tmp
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdt_config.cfg
/data/data/####/gdt_download.db
/data/data/####/gdt_download.db-journal
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak
/data/data/####/i==1.2.0&&3.8.5_1614710702373_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/km01
/data/data/####/km09_4855.so (deleted)
/data/data/####/km09_4855.so_tmp (deleted)
/data/data/####/km13
/data/data/####/kms_02ext
/data/data/####/kw_134122
/data/data/####/kw_134122_tmp
/data/data/####/libCtaApiLib.so
/data/data/####/libMMANDKSignature.so
/data/data/####/libShanYCore.so
/data/data/####/libcocklogic-1.1.3.so
/data/data/####/libcuid.so
/data/data/####/libgifimage.so
/data/data/####/libimagepipeline.so
/data/data/####/libkm05.so
/data/data/####/libkm05_64.so
/data/data/####/libnative-filters.so
/data/data/####/libnative-imagetranscoder.so
/data/data/####/libnms.so
/data/data/####/libtnet-3.1.14.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libturingau.so
/data/data/####/libwaud (deleted)
/data/data/####/libyaqcore_gdtadv.so
/data/data/####/libyaqstub_gdtadv.so
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/mpdc_105498_1
/data/data/####/msg.db-journal
/data/data/####/native_record_lock (deleted)
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/pp-Pl0vwwRC9G47uAHMHH2DheUg.440336835.tmp
/data/data/####/pref.xml
/data/data/####/preload
/data/data/####/proc_auxv
/data/data/####/qiyu_save_f7274dbc6d1b56317a1437bb9d42f596.xml
/data/data/####/qwYtE4kHo3To-3iCJ0em3btNXJI.cnt
/data/data/####/sS7lLthtJgndrnxTWiGJc6Gmuq0.cnt
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sdkinit.xml
/data/data/####/sdkinit.xml.bak
/data/data/####/security_info
/data/data/####/shanyan_share_data.xml
/data/data/####/shanyan_share_data.xml.bak
/data/data/####/simple-main-req.dat
/data/data/####/snssdk_openudid.xml
/data/data/####/spUtils.xml
/data/data/####/sp_push_time.xml
/data/data/####/ssoconfigs.xml
/data/data/####/t==8.1.2&&3.8.5_1614710703332_envelope.log
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/the-real-index
/data/data/####/trace_circle.data
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/tt_sp_app_list.xml
/data/data/####/tt_sp_app_list.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/turingfd_conf_105498_auMini.xml
/data/data/####/turingfd_conf_105498_auMini.xml.bak
/data/data/####/turingfd_conf_105498_auMini.xml.bak (deleted)
/data/data/####/turingfd_protect_105498_47_auMini.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/udQpvXNXa7dVB2hDO7hMl5WkbGc.1417754198.tmp
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umengc.db
/data/data/####/unicorn#cheese#
/data/data/####/update_lc
/data/data/####/upz_5
/data/data/####/w1Bxe8GT4INDF87VRHVupqpKdJk.cnt
/data/data/####/wBrand.xml
/data/data/####/weizhangapp.xml
/data/data/####/xdtversion.xml
/data/data/####/xoGyCbYSjGXH_qHfb3Dh2Mh_Zsc.cnt
/data/data/####/yHGL1r4CYmwjZGOG_DhPRmHX-E4.cnt
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid2
/data/media/####/.nid
/data/media/####/.timestamp
/data/media/####/.turing.dat
/data/media/####/.umm.dat
/data/media/####/1614710712699.db
/data/media/####/7cf2d07e0695cda903fed63505d90a27.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/f8d93127ca73cbf244d74fd14633297c.tmp
/data/media/####/meta.dat
/data/media/####/tbslog.txt
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/proc/4855/exe
/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/e79350219.apk --oat-fd=117 --oat-location=/data/user/0/<Package>/files/e79350219_o --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tda/ZH503.jar --oat-fd=135 --oat-location=/data/user/0/<Package>/files/tda/ZH503.dex --compiler-filter=speed
/system/bin/df
/system/bin/getprop
/system/lib/arm/houdini /data/user/0/<Package>/files/kms_02ext /data/user/0/<Package>/files/kms_02ext --ru89 0 /data/user/0/<Package>/files/debuggerd_real
/system/lib/arm/houdini <Package Folder>/files/kw_134122 <Package Folder>/files/kw_134122 3 267791
chmod 777 /data/user/0/<Package>/cache/Download
getprop
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
logcat -d -v threadtime
ls -l /system/xbin/su
ls /
ls /sys/class/thermal
mount
sh -c <Package Folder>/files/kw_134122 3 267791 &
sh -c cat /proc/4877/maps

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial