Android.RemoteCode.7956

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) api.onesi####.com:443
TCP(TLS/1.0) 4ced22c####.us-ea####.aws.####.io:9243
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) cu8auc####.3z094n2####.com:443
TCP(TLS/1.0) ads-sdk####.unit####.uni####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.2) firebas####.google####.com:443
TCP(TLS/1.2) 1####.250.150.94:443
TCP arm.5####.cn:10001
TCP cu8auc####.3z094n2####.com:443

DNS requests:

4ced22c####.us-ea####.aws.####.io
and####.a####.go####.com
api.onesi####.com
arm.5####.cn
co####.unit####.uni####.com
conf####.unit####.uni####.com
cu8auc####.3z094n2####.com
f####.gst####.com
firebas####.google####.com
gmscomp####.google####.com
m####.go####.com
p####.google####.com
p.3z094n2####.com
pla####.google####.com

HTTP GET requests:

api.onesi####.com:443/apps/3a9737ba-1a72-464e-a396-23220e3e51b0/android_...
cu8auc####.3z094n2####.com:443/wp-content/uploads/2023/02/vlcsnap-2023-0...
unit####.edges####.net:443/webview/4.0.0/068dfe90aca99e3f4829d72e834a644...

HTTP POST requests:

ads-sdk####.unit####.uni####.com:443/webview/4.5.0/release/config.json
api.onesi####.com:443/players
p####.google####.com:443/v1/projects/onesignal-shared-public/installations

File system changes:

Creates the following files:

/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/00311685881518d8a7749700546fe8434e90dc7b11fd3c4...d08c.0
/data/data/####/0f5177d69a99e40b33701c1148b8291e26e92b7c7aac2e2....0.tmp
/data/data/####/3068cba6d6cd9560bb587a0ed24b9ae272d58542e2690fe....0.tmp
/data/data/####/37a381b1278c54014332ae53e6d099a17712676ba93b25f....0.tmp
/data/data/####/37a381b1278c54014332ae53e6d099a17712676ba93b25f...ff5b.0
/data/data/####/39ad9cca7328aa6755f6160056c843693e5f03281ee3329...3519.0
/data/data/####/5709d70c00e80e68aee2289fcffe24c01c73a03657cac1f....0.tmp
/data/data/####/5e0cc48e68bbba6b56b582697fd8baa1.0.tmp
/data/data/####/5e0cc48e68bbba6b56b582697fd8baa1.1
/data/data/####/5e2b0773c69dc9586ec94e3c3543c7d40646be7adc80567....0.tmp
/data/data/####/5e2b0773c69dc9586ec94e3c3543c7d40646be7adc80567...12fe.0
/data/data/####/670a2c8316689e9ddecd99ef817d706612146bb70a73cd8....0.tmp
/data/data/####/6a6020fdde9eebf6e120e48dcc294e89a9cf0bb535034b2...8ee5.0
/data/data/####/87ec20c4b71debcb25575e3d8d6ff09a.0.tmp
/data/data/####/87ec20c4b71debcb25575e3d8d6ff09a.1
/data/data/####/87ec20c4b71debcb25575e3d8d6ff09a.1.tmp
/data/data/####/8abc050ea64bee6a9456ebde277363f03aeefb19c736870...955d.0
/data/data/####/94911d5480590217bd6ac750dd121e46eb751609ea57701....0.tmp
/data/data/####/94911d5480590217bd6ac750dd121e46eb751609ea57701...a42f.0
/data/data/####/9dd0d58477a9de2adc1297ffcadfe2f6302da4dcb337b58...5ad3.0
/data/data/####/AHBhiWYLsJERDaB8pGBgvPDC5HA5w+pVysxUEOh1cr8=.xml
/data/data/####/AHBhiWYLsJERDaB8pGBgvPDC5HA5w+pVysxUEOh1cr8=.xml.bak
/data/data/####/EqEzSkpgYoan (deleted)
/data/data/####/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX0...Yz.xml
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo2OTQ5NzYxNTkxN...Ux.xml
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo2OTQ5NzYxNTkxN...ml.bak
/data/data/####/GTPlayerPurchases.xml
/data/data/####/OneSignal.db-journal
/data/data/####/OneSignalTriggers.xml
/data/data/####/PersistedInstallation.T05FU0lHTkFMX1NES19GQ01fQ...z.json
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo2OTQ5NzYx...x.json
/data/data/####/PersistedInstallation1182026393tmp
/data/data/####/PersistedInstallation1291030997tmp
/data/data/####/PersistedInstallation289264866tmp
/data/data/####/PersistedInstallation933397236tmp
/data/data/####/Talsec_SP.xml
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a5bf2b8b9904c45df073db94ab4f1b9d66f3ac754ed4cf6....0.tmp
/data/data/####/a5bf2b8b9904c45df073db94ab4f1b9d66f3ac754ed4cf6...72fb.0
/data/data/####/a79e11a77abd79e34853a4bf1e011de2f1f45be18708baa...6c6e.0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/b33e38aeb3e6f8a22fd096076b76efb578e5045699eb01a....0.tmp
/data/data/####/b33e38aeb3e6f8a22fd096076b76efb578e5045699eb01a...7de8.0
/data/data/####/b3bb8ef684dda056c5d7e12056d96bc11c867c6021ee390....0.tmp
/data/data/####/b7dc905e5e6290db8e4d47bf6a283ce4ad32fd569cc2586...de05.0
/data/data/####/bee9812c86537cf408596b644738397c793d5fc65dc8c5e...1db2.0
/data/data/####/c5e73ab110cb65f2c378a6794e504d92.0.tmp
/data/data/####/c5e73ab110cb65f2c378a6794e504d92.1
/data/data/####/c5e73ab110cb65f2c378a6794e504d92.1.tmp
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.kcstream.cing_preferences.xml
/data/data/####/d1a7f670f25643c10ca57c46aca153fcf7ed87a95084020....0.tmp
/data/data/####/d7fcbc75d73e25e94a6de4b8954040c5c95fc4bb82b79b1....0.tmp
/data/data/####/d7fcbc75d73e25e94a6de4b8954040c5c95fc4bb82b79b1...a8a4.0
/data/data/####/d9c6e1748b83d9cfe874abadf0ca554c8245ad862dae598....0.tmp
/data/data/####/d9c6e1748b83d9cfe874abadf0ca554c8245ad862dae598...0333.0
/data/data/####/da357a71357eb84bef7c866f2388967fa2b59c39c97bf2f....0.tmp
/data/data/####/da357a71357eb84bef7c866f2388967fa2b59c39c97bf2f...0a24.0
/data/data/####/dc6b02a6bffb95b5110894c0eb894c22a1903ad7c3b3440....0.tmp
/data/data/####/dc6b02a6bffb95b5110894c0eb894c22a1903ad7c3b3440...leted)
/data/data/####/dc7a74b44eb41f6cde968110512a63ffe6b08f21a6b7909....0.tmp
/data/data/####/e00e0f96e985e1438810cace59dfc2f0fae25c5c99fef4f....0.tmp
/data/data/####/e7a86c5ecfe93719d8c6022b19ccbbb8b70e1e6a61b7898...408b.0
/data/data/####/eb10559bd49b1b33942e37ee6eab2395bea61e61801ffde....0.tmp
/data/data/####/g3.xml
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/index
/data/data/####/journal
/data/data/####/journal.bkp (deleted)
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/metrics_guid
/data/data/####/notice.xml
/data/data/####/proc_auxv
/data/data/####/qwWnMiduuYEp (deleted)
/data/data/####/tcb
/data/data/####/the-real-index
/data/data/####/unityads-installinfo.xml
/data/media/####/.nomedia
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsTest.txt (deleted)
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/xbin/which busybox
/system/xbin/which su
busybox
getenforce
getprop init.svc.dempeventlog
getprop init.svc.dumpipclog
getprop init.svc.dumplogcat
getprop init.svc.dumplogcat-efs
getprop init.svc.filemon
getprop init.svc.gce_fs_monitor
getprop init.svc.goldfish-logcat
getprop init.svc.goldfish-setup
getprop init.svc.magisk_pfs
getprop init.svc.magisk_pfsd
getprop init.svc.magisk_service
getprop init.svc.qemud
getprop init.svc.vbox86-setup
getprop persist.magisk.hide
getprop qemu.sf.fake_camera
getprop ro.boot.hardware
getprop ro.build.product
getprop ro.build.selinux
getprop ro.debuggable
getprop ro.factorytest
getprop ro.hardware
getprop ro.hardware.audio.primary
getprop ro.hardware.virtual_device
getprop ro.kernel.androidboot.hardware
getprop ro.secure
ps
ps -A
ps -e

Loads the following dynamic libraries:

libclib
libjiagu
libnative-lib
libpolarssl
libsecurity

Uses the following algorithms to encrypt data:

RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

RSA-ECB-PKCS1Padding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Accesses camera interface.

Gets information about network.

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial