Android.RemoteCode.8050

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) f####.site:8888
TCP(HTTP/1.1) f####.site:80
TCP(TLS/1.0) 64.2####.161.94:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) app.c.nf.####.cn:443
TCP(TLS/1.0) 1####.194.221.95:443
TCP(TLS/1.0) rr13---####.g####.com:443
TCP(TLS/1.0) d.musi####.m####.####.com:443
TCP(TLS/1.0) 1####.194.73.95:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.2) 64.2####.161.94:443
TCP(TLS/1.2) 1####.194.222.113:443
TCP(TLS/1.2) 64.2####.161.95:443
TCP(TLS/1.2) 1####.194.73.95:443

DNS requests:

a####.u####.com
app.c.nf.####.cn
arm.z####.cn
d.musi####.m####.cn
er####.u####.com
f####.site
f####.vin
m.m####.m####.cn
rr13---####.g####.com
u####.u####.com

HTTP GET requests:

app.c.nf.####.cn:443/MIGUM2.0/v1.0/content/querycontentbyId.do?needAll=#...
app.c.nf.####.cn:443/MIGUM3.0/bmw/singer-index/list/v1.0?templateVersion...
app.c.nf.####.cn:443/MIGUM3.0/v1.0/template/rank-list/release
d.musi####.m####.####.com:443/data/oss/column/00/1v/i8/ih.webp
d.musi####.m####.####.com:443/data/oss/column/00/1v/i9/53.webp
d.musi####.m####.####.com:443/data/oss/column/00/1v/i9/qv.webp
d.musi####.m####.####.com:443/data/oss/column/00/1v/kv/ly.webp
d.musi####.m####.####.com:443/data/oss/column/00/1v/kv/xy.webp
d.musi####.m####.####.com:443/data/oss/column/00/1v/kw/pg.webp
d.musi####.m####.####.com:443/data/oss/resource/00/1z/rm/1w.webp
d.musi####.m####.####.com:443/data/oss/resource/00/26/di/t0.webp
d.musi####.m####.####.com:443/data/oss/resource/00/26/vy/av
d.musi####.m####.####.com:443/data/oss/resource/00/26/vy/bf
d.musi####.m####.####.com:443/data/oss/resource/00/27/gr/vr.webp
d.musi####.m####.####.com:443/data/oss/resource/00/27/gv/41
d.musi####.m####.####.com:443/data/oss/resource/00/28/v8/1w.webp
d.musi####.m####.####.com:443/data/resource-service/file-down/00/33/ff/uy
d.musi####.m####.####.com:443/data/resource-service/file-down/00/3q/z0/or
d.musi####.m####.####.com:443/data/resource-service/file-down/00/4g/dy/ob
f####.site/Morin/Android/AD/FumiAd.json
f####.site/Morin/Android/AD/MorinAd.json
f####.site/Morin/Android/Login/MoKey.mo
f####.site/Morin/Android/Login/MorinNews.mo
f####.site/Morin/Android/update.json?appKey=####&versionCode=####
f####.site:8888/down/UMdj4ng2XYCT.png

HTTP POST requests:

er####.u####.com.####.com:443/apm_cc
new-####.u####.com:443/api/postZdata
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.font3573-3573-0
/data/data/####/.font3573-3573-0 (deleted)
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/160680330286.30475
/data/data/####/160680330286.30475 (deleted)
/data/data/####/160680330330.70782
/data/data/####/160680330330.70782 (deleted)
/data/data/####/160680330386.7264
/data/data/####/160680330386.7264 (deleted)
/data/data/####/160680330425.55844
/data/data/####/160680330425.55844 (deleted)
/data/data/####/160680330510.29642
/data/data/####/160680330510.29642 (deleted)
/data/data/####/160680330581.831
/data/data/####/160680330581.831 (deleted)
/data/data/####/160680330842.45343
/data/data/####/160680330842.45343 (deleted)
/data/data/####/160680330907.95917
/data/data/####/160680330907.95917 (deleted)
/data/data/####/160680330913.77533
/data/data/####/160680330913.77533 (deleted)
/data/data/####/160680331226.81454
/data/data/####/160680331226.81454 (deleted)
/data/data/####/160680331373.59113
/data/data/####/160680331373.59113 (deleted)
/data/data/####/160680331403.9048
/data/data/####/160680331403.9048 (deleted)
/data/data/####/160680331529.13632
/data/data/####/160680331529.13632 (deleted)
/data/data/####/160680331534.76874
/data/data/####/160680331534.76874 (deleted)
/data/data/####/160680331637.80624
/data/data/####/160680331637.80624 (deleted)
/data/data/####/160680331863.24954
/data/data/####/160680331863.24954 (deleted)
/data/data/####/160680333159.57697
/data/data/####/160680333159.57697 (deleted)
/data/data/####/261205970280.68842
/data/data/####/261205970280.68842 (deleted)
/data/data/####/261205970293.1041
/data/data/####/261205970293.1041 (deleted)
/data/data/####/261205970464.19714
/data/data/####/261205970464.19714 (deleted)
/data/data/####/261205970484.75583 (deleted)
/data/data/####/261205970494.33582
/data/data/####/261205970494.33582 (deleted)
/data/data/####/261205970529.94904
/data/data/####/261205970529.94904 (deleted)
/data/data/####/261205970550.9281
/data/data/####/261205970550.9281 (deleted)
/data/data/####/261205970561.81262
/data/data/####/261205970561.81262 (deleted)
/data/data/####/261205970561.8405
/data/data/####/261205970561.8405 (deleted)
/data/data/####/261205970579.2399
/data/data/####/261205970579.2399 (deleted)
/data/data/####/261205970589.7058
/data/data/####/261205970589.7058 (deleted)
/data/data/####/261205970591.59442
/data/data/####/261205970591.59442 (deleted)
/data/data/####/261205970782.49326
/data/data/####/261205970782.49326 (deleted)
/data/data/####/261205970995.99045
/data/data/####/261205970995.99045 (deleted)
/data/data/####/261205971270.98627
/data/data/####/261205971270.98627 (deleted)
/data/data/####/261205971457.84732
/data/data/####/261205971457.84732 (deleted)
/data/data/####/261205971593.4369
/data/data/####/261205971593.4369 (deleted)
/data/data/####/541394250861.8178
/data/data/####/541394250861.8178 (deleted)
/data/data/####/541394251011.429
/data/data/####/541394251011.429 (deleted)
/data/data/####/541394251200.17737
/data/data/####/541394251200.17737 (deleted)
/data/data/####/541394251331.0175
/data/data/####/541394251331.0175 (deleted)
/data/data/####/541394251616.5326
/data/data/####/541394251616.5326 (deleted)
/data/data/####/541394251857.56024
/data/data/####/541394251857.56024 (deleted)
/data/data/####/541394252735.69824
/data/data/####/541394252735.69824 (deleted)
/data/data/####/541394252956.4122
/data/data/####/541394252956.4122 (deleted)
/data/data/####/541394252976.0092
/data/data/####/541394252976.0092 (deleted)
/data/data/####/541394254030.7595
/data/data/####/541394254030.7595 (deleted)
/data/data/####/541394254525.3067
/data/data/####/541394254525.3067 (deleted)
/data/data/####/541394254627.44507
/data/data/####/541394254627.44507 (deleted)
/data/data/####/541394255049.39886
/data/data/####/541394255049.39886 (deleted)
/data/data/####/541394255068.3765
/data/data/####/541394255068.3765 (deleted)
/data/data/####/541394255415.5498
/data/data/####/541394255415.5498 (deleted)
/data/data/####/541394256175.15546
/data/data/####/541394256175.15546 (deleted)
/data/data/####/541394260542.98456
/data/data/####/541394260542.98456 (deleted)
/data/data/####/60802575640.5602
/data/data/####/60802575640.5602 (deleted)
/data/data/####/60802575657.36264
/data/data/####/60802575657.36264 (deleted)
/data/data/####/60802575678.56046
/data/data/####/60802575678.56046 (deleted)
/data/data/####/60802575693.25477
/data/data/####/60802575693.25477 (deleted)
/data/data/####/60802575725.320244
/data/data/####/60802575725.320244 (deleted)
/data/data/####/60802575752.38943
/data/data/####/60802575752.38943 (deleted)
/data/data/####/60802575851.01081
/data/data/####/60802575851.01081 (deleted)
/data/data/####/60802575875.798645
/data/data/####/60802575875.798645 (deleted)
/data/data/####/60802575877.99951
/data/data/####/60802575877.99951 (deleted)
/data/data/####/60802575996.45577
/data/data/####/60802575996.45577 (deleted)
/data/data/####/60802576051.99708
/data/data/####/60802576051.99708 (deleted)
/data/data/####/60802576063.46798
/data/data/####/60802576063.46798 (deleted)
/data/data/####/60802576110.85647
/data/data/####/60802576110.85647 (deleted)
/data/data/####/60802576112.98782
/data/data/####/60802576112.98782 (deleted)
/data/data/####/60802576151.97796
/data/data/####/60802576151.97796 (deleted)
/data/data/####/60802576237.28728
/data/data/####/60802576237.28728 (deleted)
/data/data/####/60802576727.82677
/data/data/####/60802576727.82677 (deleted)
/data/data/####/690277691935.832
/data/data/####/690277691935.832 (deleted)
/data/data/####/690277691968.6426
/data/data/####/690277691968.6426 (deleted)
/data/data/####/690277692420.7827
/data/data/####/690277692420.7827 (deleted)
/data/data/####/690277692475.1123
/data/data/####/690277692475.1123 (deleted)
/data/data/####/690277692500.4288
/data/data/####/690277692500.4288 (deleted)
/data/data/####/690277692594.5424
/data/data/####/690277692594.5424 (deleted)
/data/data/####/690277692649.9829
/data/data/####/690277692649.9829 (deleted)
/data/data/####/690277692678.7468
/data/data/####/690277692678.7468 (deleted)
/data/data/####/690277692678.8207
/data/data/####/690277692678.8207 (deleted)
/data/data/####/690277692724.8011
/data/data/####/690277692724.8011 (deleted)
/data/data/####/690277692752.4589
/data/data/####/690277692752.4589 (deleted)
/data/data/####/690277692757.45
/data/data/####/690277692757.45 (deleted)
/data/data/####/690277693261.9302
/data/data/####/690277693261.9302 (deleted)
/data/data/####/690277693826.1298
/data/data/####/690277693826.1298 (deleted)
/data/data/####/690277694552.8494
/data/data/####/690277694552.8494 (deleted)
/data/data/####/690277695046.659
/data/data/####/690277695046.659 (deleted)
/data/data/####/690277695404.9757
/data/data/####/690277695404.9757 (deleted)
/data/data/####/MssofdUcTTel (deleted)
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Y29uZmlnXzVlMGY0MDg4NGNhMzU3OWY3NjAwMDEzYQ.sp
/data/data/####/Y29uZmlnXzVlMGY0MDg4NGNhMzU3OWY3NjAwMDEzYQ.sp.bak
/data/data/####/Za2793d9216c749f1J.dex.flock (deleted)
/data/data/####/Za2793d9216c749f1J.jar
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid3491
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&3.2.1_1686114480761_dW5pZnlfbG9ncw==;.log
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/libjiagu_64.so
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/sendlock
/data/data/####/setup.xml
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.4.4&&3.2.1_1686114482863_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/ver
/data/data/####/wgLeQfBlvDts (deleted)
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cache.db-journal (deleted)
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/data/####/xUtils_http_cookie.db-journal (deleted)
/data/data/####/z==1.2.0&&3.2.1_1686114463415_emNmZw==;.log
/data/media/####/01e50f3a4dc2ca07b5dcf8d566dc724e
/data/media/####/08e0cad5ae8ddcdc01a8afbcacf468d2
/data/media/####/091f17aa04cc3506dbaff82864d79822
/data/media/####/0cb511cc49e69bb347e432f2288401ef
/data/media/####/0ff63ee268b441a3bb7d5f0cc9074926
/data/media/####/1d259fa9f34f11fe9a216482733ad88b
/data/media/####/2b140f69501f1b1fa5467bbaa25da2a6
/data/media/####/2b523d15de3d2a487f131734635b9019
/data/media/####/2ba2cc2a7fb2dca8fd0e11e4bd5e5bd2
/data/media/####/4057ee7d6f488d777fb0bc215fbbbd67
/data/media/####/4d891da43191c7d54ccce297f43afd9e
/data/media/####/5b30bb428140e2ddc6ba82cb69f82df4
/data/media/####/65b527544f54cd9764ba2b0798959bf3
/data/media/####/660f83ba11f8dbe7553b07359bea05d9
/data/media/####/7b3c2cda59ff439d0fb80d408e05efb7
/data/media/####/7d3e422173aecd6e9111921f0264a672
/data/media/####/823b670c29a1a79b62e906d1eac6a5f7
/data/media/####/92f777aa6ecaf814ccece3dc3e234f90
/data/media/####/948df97db8272ab13045d46ac89b776e
/data/media/####/94c87c21dafa8d7719a7478e95095e2a
/data/media/####/97e089e63ee59e4b408b65e44185b9ec
/data/media/####/FavoriteData.db-journal
/data/media/####/MusicStory.json
/data/media/####/a3e90e12d434e1c313b7fb2ccaf10d09
/data/media/####/a96784a1f1a5232880784fd3649de88d
/data/media/####/aedf42a9cfa6d84619bde795497b93c8
/data/media/####/b23763b70bf47f741395a89ccd0cf142
/data/media/####/c17b6c74c189b5562d8bfd68a0f6f413
/data/media/####/cfba0dfef266d67fd1b1d1bd7b2947fd
/data/media/####/d57702218b5b4db478033efab4ce6ca7
/data/media/####/daeb94e7ae7a247b22bb4149a77aa61a
/data/media/####/e6618c989343f9ec49ddc124f318960c
/data/media/####/eabe0159d6a10356e8ed7ee4acd08b40
/data/media/####/f28b73b228ce3a769cad1d6a5190c940
/data/media/####/f353109c8116194e8a006bce9117baf3
/data/media/####/f4a07dd0a978c8e07e84430b09ced44b
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh -c type su

Loads the following dynamic libraries:

libcrashsdk
libjiagu_64
librsjni_androidx
libumeng-spy
libzmmkv

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial