Android.RemoteCode.8132

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.251.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) ds-####.oss-acc####.aliy####.####.com:80
TCP(HTTP/1.1) nwap####.cdn.bc####.####.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) 47.1####.152.28:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(TLS/1.0) 1####.194.73.95:443
TCP(TLS/1.0) 1####.194.73.113:443
TCP(TLS/1.0) nwap####.cdn.bc####.####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) thi####.q####.cn:443
TCP(TLS/1.0) 1####.251.1.94:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 1####.251.1.94:443

DNS requests:

a####.u####.com
and####.a####.go####.com
and####.google####.com
api####.oss-acc####.aliy####.com
n####.cdn.bc####.com
nwap####.cdn.bc####.com
oc.u####.com
rr9---s####.g####.com
sho####.netwa####.com
thi####.q####.cn

HTTP GET requests:

ds-####.oss-acc####.aliy####.####.com/api.txt?-119220####
ds-####.oss-acc####.aliy####.####.com/api.txt?-55927####
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g10_w...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g1_wx...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g2_wx...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g3_wx...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g5_wx...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g6_wx...
nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g9_wx...
nwap####.cdn.bc####.####.com:443/guajiplugin_1074
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_001_cover.png?x-bc...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_001_img.png?x-bce-...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_002_cover.png?x-bc...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_002_img.png?x-bce-...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_003_cover.png?x-bc...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_003_img.png?x-bce-...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_004_cover2.png?x-b...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_004_img.png?x-bce-...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_005_cover.png?x-bc...
nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_005_img.png?x-bce-...
thi####.q####.cn/mmopen/vi_32/Kic8NlGHLlad0oobicnUpiaz8RH9fussMiaqmeMDQ1...
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTJGTHQh425z9IZcJkwOU8CibwvNsXiaX1...
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTKr9P59XlR3BCMia13Tx8wwCI33sLEezK...
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTKuNBHrK9rdztNqTkWfxN0Uu40fX75q2k...
thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTLTVDib2xrpBMxDMLM6xRXGPyYyWZOhUc...
thi####.q####.cn/mmopen/vi_32/iabrUF3ELZexNA9CSo1ziaFkzPkaH8qtxVHq4aicM9...
thi####.q####.cn/mmopen/vi_32/x360TSqialicw0sLzVa9gic9sJjIGPry9vbxSAWKWK...
thi####.q####.cn:443/mmopen/vi_32/8SdpYbicwXVXt0fIN7L0f2WdvTAbrkY91AloCy...
thi####.q####.cn:443/mmopen/vi_32/QAZ5gLTK2At42xibUW5LDFIvmejFDp8rkmFkEl...
thi####.q####.cn:443/mmopen/vi_32/gK9BjPHZicmLJicRvVsvNrY2RGxib6ia57Tgvg...
thi####.q####.cn:443/mmopen/vi_32/pt4dOV9p5KBdLX14I8ruVNIHVMiavWLxVGWWRh...
thi####.q####.cn:443/mmopen/vi_32/zIqugsZ8vTcibQNxfBrWhPe5c7Gjr0rjvuq8ae...

HTTP POST requests:

a####.u####.com/app_logs
oc.u####.com/check_config_update

File system changes:

Creates the following files:

/data/data/####/-1241843868-1899521153
/data/data/####/-1932087694568414378
/data/data/####/-434068928-1303372751
/data/data/####/-5799921812144330216
/data/data/####/.base.dex
/data/data/####/.base.dex.flock (deleted)
/data/data/####/.base.jar
/data/data/####/.imprint
/data/data/####/13sjukz9n28ydcrwnd1kba2fi
/data/data/####/13sjukz9n28ydcrwnd1kba2fi (deleted)
/data/data/####/15yhsjpa8oejnck3pdyovpj31
/data/data/####/15yhsjpa8oejnck3pdyovpj31.tmp
/data/data/####/1835014708845509062
/data/data/####/1kshi7km80rk4vgwa8uo2uyb7
/data/data/####/1kshi7km80rk4vgwa8uo2uyb7.tmp
/data/data/####/1rjrfw7u85jhz41me5427aigi
/data/data/####/1rjrfw7u85jhz41me5427aigi.tmp
/data/data/####/1vzm7dhmb3hdo592n20v11ra3
/data/data/####/1vzm7dhmb3hdo592n20v11ra3.tmp
/data/data/####/1wxq8euq2z153qr2r07nufw7b
/data/data/####/1wxq8euq2z153qr2r07nufw7b.tmp
/data/data/####/1xlgke4l3wmcl44goge8fe3wd
/data/data/####/1xlgke4l3wmcl44goge8fe3wd.tmp
/data/data/####/24i049w6mo4vef7gwz5a0k9zy
/data/data/####/24i049w6mo4vef7gwz5a0k9zy.tmp
/data/data/####/27dy1osqn2vohzokjsbwxfucr
/data/data/####/27dy1osqn2vohzokjsbwxfucr (deleted)
/data/data/####/373jboiev1rlmex92xjlo5ols
/data/data/####/373jboiev1rlmex92xjlo5ols.tmp
/data/data/####/3b5q6112eylqdqz1l2fwmtmjv
/data/data/####/3b5q6112eylqdqz1l2fwmtmjv.tmp
/data/data/####/3dy1w94xbz33d49q90t9n7d4s
/data/data/####/3dy1w94xbz33d49q90t9n7d4s.tmp
/data/data/####/3m4vay9qy4dz757ya2842u68g
/data/data/####/3m4vay9qy4dz757ya2842u68g.tmp
/data/data/####/3ohep8dqpni38egjohj8m5w2p
/data/data/####/3ohep8dqpni38egjohj8m5w2p.tmp
/data/data/####/3u1agpdrbi8e0n15d0yhdjodi
/data/data/####/3u1agpdrbi8e0n15d0yhdjodi (deleted)
/data/data/####/3zotfkhrjnf3mz81hy4ftfode
/data/data/####/3zotfkhrjnf3mz81hy4ftfode.tmp
/data/data/####/404vncpiwhlmd9mb1c3a35kzq
/data/data/####/404vncpiwhlmd9mb1c3a35kzq.tmp
/data/data/####/40hldaim3yf99ywfvxrcy6mfg
/data/data/####/40hldaim3yf99ywfvxrcy6mfg.tmp
/data/data/####/4tja4zs7r21iuld721rdeyy8j
/data/data/####/4tja4zs7r21iuld721rdeyy8j.tmp
/data/data/####/50ku15twbcu49hlrrulthj5kl
/data/data/####/50ku15twbcu49hlrrulthj5kl (deleted)
/data/data/####/5637uh535u483a8qsg22zr88w
/data/data/####/5637uh535u483a8qsg22zr88w.tmp
/data/data/####/5761398321117666360
/data/data/####/5jslhf6sccv62ml9mabnsgbr1
/data/data/####/5nt8cxgsrwr7ri250xd68gkn
/data/data/####/5nt8cxgsrwr7ri250xd68gkn.tmp
/data/data/####/5pakx9jpc4xu5fii35dwtocgo
/data/data/####/5pakx9jpc4xu5fii35dwtocgo.tmp
/data/data/####/5u4tnlcjcu283kopes9yand9v
/data/data/####/5u4tnlcjcu283kopes9yand9v.tmp
/data/data/####/5zx7yg9q6gs63uzau54oeo2gr
/data/data/####/5zx7yg9q6gs63uzau54oeo2gr.tmp
/data/data/####/63cshp4oz7k4u8twxdgmo5i6f
/data/data/####/63cshp4oz7k4u8twxdgmo5i6f.tmp
/data/data/####/6n8pw984cv3s6u9zx2indptyz
/data/data/####/6n8pw984cv3s6u9zx2indptyz.tmp
/data/data/####/75zzakbrlsp4g3p6tz4f9wb59
/data/data/####/75zzakbrlsp4g3p6tz4f9wb59.tmp
/data/data/####/78ui13kkimm1kq22ktqo97amo
/data/data/####/78ui13kkimm1kq22ktqo97amo (deleted)
/data/data/####/79dnwr02kbr7bk7udforp2cik
/data/data/####/79dnwr02kbr7bk7udforp2cik.tmp
/data/data/####/com.uto6o7jarle0n.h2qqvabmrj.xml
/data/data/####/com.uto6o7jarle0n.h2qqvabmrj.xml.bak
/data/data/####/hiqyujqhoun2xi3syplcoi5g
/data/data/####/hiqyujqhoun2xi3syplcoi5g (deleted)
/data/data/####/ie3r6u06as061pp7ouwwcs9h
/data/data/####/ie3r6u06as061pp7ouwwcs9h.tmp
/data/data/####/lsymxbcq5qxngbodzhsc9px0
/data/data/####/lsymxbcq5qxngbodzhsc9px0 (deleted)
/data/data/####/mobclick_agent_online_setting_com.uto6o7jarle0n...rj.xml
/data/data/####/mytask.db
/data/data/####/mytask.db-journal
/data/data/####/nz62r19vl3ef5929hz0ewjct
/data/data/####/nz62r19vl3ef5929hz0ewjct.tmp
/data/data/####/proc_auxv
/data/data/####/reyaeww33y76pqzsvsyg8lc9
/data/data/####/reyaeww33y76pqzsvsyg8lc9.tmp
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/win.apk
/data/data/####/win.dex
/data/data/####/win.dex.flock (deleted)
/data/media/####/.nomedia
/data/media/####/guajiplugin_1074
/data/media/####/journal
/data/media/####/user.data
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop ro.product.cpu.abi

Loads the following dynamic libraries:

libuxsm

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial