Android.RemoteCode.8011

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Proxy.47.origin
Android.RemoteCode.108.origin
Android.RemoteCode.345.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) dct.g####.com:80
TCP(HTTP/1.1) 8.2####.89.234:80
TCP(HTTP/1.1) d####.100u####.com.####.net:80
TCP(HTTP/1.1) 1####.128.85.140:80
TCP(HTTP/1.1) pp.showg####.com.####.com:80
TCP(HTTP/1.1) p.cli####.net:80
TCP(HTTP/1.1) www.d####.xyz:80
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) www.qq####.ltd:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) lp.xl####.com:443
TCP(TLS/1.0) dy.kr.wildpet####.info:443
TCP(TLS/1.0) app-api####.adenjo####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) o####.azh####.com:9190
TCP(TLS/1.0) z.ttp####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) md####.google####.com:443
TCP 43.1####.62.182:800
UDP md####.google####.com:443
TCP 47.1####.227.5:9010
TCP 1####.129.100.105:1906
TCP l####.lb.na.####.com:6065
UDP 64.2####.163.95:443

DNS requests:

and####.a####.go####.com
and####.google####.com
app-api####.adenjo####.com
c####.dc.100u####.com
d####.100u####.com
dc.g####.com
dct.g####.com
dy.kr.wildpet####.info
l####.lb.na.####.com
lp.xl####.com
md####.google####.com
o####.azh####.com
p.cli####.net
pla####.google####.com
pp.showg####.com
u.y####.com
www.d####.xyz
www.qq####.ltd
z.ttp####.com

HTTP GET requests:

d####.100u####.com.####.net/sdkfile/afe11a833b396ca1b6e7b65d5a75c5fe.jar...
d####.100u####.com.####.net/sdkfile/c3c451fcd7e9a5da2f711ebb4800d6ee.apk...
dct.g####.com/d/bcc/v2/o/630746a59b8c3ca8af384c650c01d2fb
dct.g####.com/d/bcc/v2/s/26d8fdf325918fc58da889a131b9ffde
dct.g####.com/d/t/252/r/607e6860d1b42.t
dct.g####.com/d/t/277/r/62f1c593db420.t
dct.g####.com/d/t/285/r/61f35fc5688a3.t
dct.g####.com/d/t/290/r/640feb095bfe6.t
dct.g####.com/loadable/r/6294893ab7797.l
p.cli####.net/s2.php?d=####&v=####&c=####&t=####&ver=####
pp.showg####.com.####.com/mm
www.qq####.ltd:443//CHANNEL_QW_809/md5.txt
www.qq####.ltd:443/isneedtrue.txt
z.ttp####.com:443/api/gateway?channel=####&type=####&

HTTP POST requests:

app-api####.adenjo####.com:443/v1/os/get
app-api####.adenjo####.com:443/v1/ts/get
d####.100u####.com.####.net/sdk
d####.100u####.com.####.net:443/reportcomp
dy.kr.wildpet####.info:443/dykr/update
lp.xl####.com:443/v1/ls/get
o####.azh####.com:9190/downSdkEncryption
p.cli####.net/api.php
p.cli####.net/gst.php
p.cli####.net/sal.php
p.cli####.net/v4.php
p.cli####.net/vereport.php
www.d####.xyz/Orders/getlive?channel=####&Slevi=####&anmac=####&anosv=##...

File system changes:

Creates the following files:

/data/data/####/.atmp9.dex
/data/data/####/.atmp9.dex.flock (deleted)
/data/data/####/.atmp9.jar
/data/data/####/.atmp_8.log
/data/data/####/.bin_.dx_258_3.dex
/data/data/####/.bin_.dx_258_3.dex.flock (deleted)
/data/data/####/.bin_.dx_258_3.dx
/data/data/####/.dx_258_3.dx
/data/data/####/.hqcfg
/data/data/####/002bdfab0e8debb0c1a1740cc4dca167
/data/data/####/02260edcc5f2392033f793d048f4f7ad7d73.dex
/data/data/####/02260edcc5f2392033f793d048f4f7ad7d73.dex.flock (deleted)
/data/data/####/02260edcc5f2392033f793d048f4f7ad7d73.jar
/data/data/####/0b32636f21ace6e1ded46bb6fdd5961c
/data/data/####/0fc4e9efde1f7266b5296cfa83393258
/data/data/####/1241290240.apk
/data/data/####/1241290240.apk.temp
/data/data/####/1241290240.dex
/data/data/####/1241290240.dex.flock (deleted)
/data/data/####/141005221.dex
/data/data/####/141005221.dex.flock (deleted)
/data/data/####/141005221.jar
/data/data/####/141005221.jar.temp
/data/data/####/1682501000222
/data/data/####/180de10f89c71677ddbfd6ee0801fc7e
/data/data/####/1b4ffb3d42414128b8cefaf22e55147d.dex
/data/data/####/1b4ffb3d42414128b8cefaf22e55147d.dex.flock (deleted)
/data/data/####/1b4ffb3d42414128b8cefaf22e55147d.jar
/data/data/####/2023_04_26readzibaoliangmemo.xml
/data/data/####/20b0b8631d234bd09ee45bdc6eace5e6.dex
/data/data/####/20b0b8631d234bd09ee45bdc6eace5e6.dex.flock (deleted)
/data/data/####/20b0b8631d234bd09ee45bdc6eace5e6.jar
/data/data/####/28d4089db35f40fc8e14b06d06bef50c
/data/data/####/2b7f421ca26b9430ed8b970acb07af9718f184414dd0245...57fd7e
/data/data/####/35ba6663804d498194f7af02aad12d9a
/data/data/####/3ee6a38b7818d6544c02464a09ffa947
/data/data/####/3fdcd0f6c9f5402e976f77ba8e3ac0aa.dex
/data/data/####/3fdcd0f6c9f5402e976f77ba8e3ac0aa.dex.flock (deleted)
/data/data/####/3fdcd0f6c9f5402e976f77ba8e3ac0aa.jar
/data/data/####/4139b49e3fd256cf698d25fb933d5a5e
/data/data/####/417763fda617744a324747f1cd1d94cf.d
/data/data/####/45586aa387299b6a39e8ea1e21518a14
/data/data/####/5949e053978f4bba9ba0c1fc3cffe57f
/data/data/####/5aff8540731f4086b56999596b7fb048
/data/data/####/5b42e7a7b1a149f8887b0eee46de102d
/data/data/####/6d2d73d2006275ded37a07865ea1c7d5b1fea7cbc43e0e8...c57f62
/data/data/####/72dad664d404a82514148aa4a3fe0954
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/74cbd0aa070921fe25f84f85653b9281
/data/data/####/7ce44cd97d054db0b7364cbfd8455e76
/data/data/####/7e58c9df8f4b8225081d3acf7de66a68
/data/data/####/7ec276be8a5a4595bad8eb8af8b45e82
/data/data/####/7ed4bbfa0d0e4e6f371df85570217a63
/data/data/####/843cab144b1952ce33e2a628b60ff1b118f184414dd0245...57fd7e
/data/data/####/9032f6b606412ab9267eec28c20fc561
/data/data/####/925cbadc567cead7ed600ca7df194bf1.d
/data/data/####/94fbaeb352a25e24bdf6c04ba7ec1930e74fdca60c0fc14...607906
/data/data/####/9c96275091254f31a9140407a0e1e791.dex
/data/data/####/9c96275091254f31a9140407a0e1e791.dex.flock (deleted)
/data/data/####/9c96275091254f31a9140407a0e1e791.jar
/data/data/####/9edc12c92461295d5695d94019d870e0.d
/data/data/####/9fdaaf736402200e12378880a8cb9838
/data/data/####/SWORD-journal
/data/data/####/TbSngs.xml
/data/data/####/TbSngs.xml.bak
/data/data/####/aebc179b0e1941199b473a9bcbc520d5.dex
/data/data/####/aebc179b0e1941199b473a9bcbc520d5.dex.flock (deleted)
/data/data/####/aebc179b0e1941199b473a9bcbc520d5.jar
/data/data/####/af43976639eac6ef98d9dc08f7667e9a
/data/data/####/b327534d49856d93cf529c508e43b8a3
/data/data/####/b773cb538abb36dde9499cd8cc41a2da
/data/data/####/browserxml.xml
/data/data/####/d49fda0f0b3278314984140e1371a968
/data/data/####/device_id.xml.xml
/data/data/####/e4106c73f385ec35c0326c1acbdf0718
/data/data/####/ea48c3bcff934387a1ba18011889996b
/data/data/####/ed16ba23ccf3a36e64df6436d5a568ef
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak (deleted)
/data/data/####/link.db
/data/data/####/link.db-journal
/data/data/####/model.xml
/data/data/####/pakge_caches.xml
/data/data/####/pref_cfg.xml
/data/data/####/pref_record.xml
/data/data/####/readzibaomemo.xml
/data/data/####/settingsLog.xml
/data/data/####/settingsLog.xml.bak
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/ul8g14y48j7zxhr3qy03
/data/data/####/v71.xml
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/data/####/xUtils_http_cookie.db-journal (deleted)
/data/media/####/2023_04_26zibaomemo
/data/media/####/daa.dat
/data/media/####/isreadzibaohu
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/1241290240.apk
chmod 777 /data/user/0/<Package>/files/.honor/141005221.jar
sh

Uses the following algorithms to encrypt data:

AES
AES-CBC-NoPadding
DES

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial