Android.RemoteCode.8160

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) connect####.gst####.com:80
TCP(TLS/1.0) kvinit-####.api.koc####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) mobile-####.c####.nr-####.net:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) chec####.cc:443
TCP(TLS/1.0) log-re####.com:443
TCP(TLS/1.2) 74.1####.131.102:443
TCP(TLS/1.2) www.go####.com:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP lib.alex####.com:10020
TCP lib.alex####.com:10013
UDP and####.google####.com:443
TCP ap2-pro####.discove####.in:443
TCP lib.alex####.com:10009
TCP lib.alex####.com:10019
TCP lib.alex####.com:10002
TCP lib.alex####.com:10011

DNS requests:

360####.org
and####.a####.go####.com
and####.google####.com
ap2-pro####.discove####.in
chec####.cc
connect####.gst####.com
firebas####.crashly####.com
firebas####.google####.com
firebas####.google####.com
g####.face####.com
kvinit-####.api.koc####.com
lib.alex####.com
log-re####.com
m####.go####.com
mobile-####.newr####.com
p####.google####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
st####.tin####.com
www.go####.com

HTTP GET requests:

chec####.cc:443/feature/config?api_version=####&app_id=####&app_version=...
chec####.cc:443/jd?a=####&av=####&cv=####&d=####&p=####&v=####&vc=####
g####.face####.com:443/v11.0/183495032756163/mobile_sdk_gk?fields=####&f...
g####.face####.com:443/v11.0/183495032756163?fields=####&format=####&adv...
g####.face####.com:443/v11.0/183495032756163?fields=####&format=####&sdk...

HTTP POST requests:

and####.google####.com:443/v1/projects/368652264107/namespaces/fireperf:...
and####.google####.com:443/v1/projects/discovery-plus-app/installations/...
kvinit-####.api.koc####.com:443/track/kvinit
log-re####.com:443/report
mobile-####.c####.nr-####.net:443/mobile/v4/connect

File system changes:

Creates the following files:

/data/data/####/.bundledAppData
/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.set_app_data.zip
/data/data/####/000003.log
/data/data/####/05ff90bd-f00b-4555-99c3-ba6049b38ffb.data
/data/data/####/0bb841a1-aebb-46d3-9594-ca3f295c73b4.data
/data/data/####/0d5f8ad6-d4d3-4063-bef2-52296873b6ab.data
/data/data/####/11055ca1-398c-4c3e-9f1c-fc1d775b3300.data
/data/data/####/164ebbe3-87cc-46ac-a8ad-b3f16309f66d.data
/data/data/####/192c05c2-c76e-48dc-9c11-d8867499f8e0.data
/data/data/####/2faa5099-17a7-42bd-b25f-cbf4ff459eb2.data
/data/data/####/301d35644f88852647e2158cb1bfaca94de9396ac1fcfd1...8c.apk
/data/data/####/301d35644f88852647e2158cb1bfaca94de9396ac1fcfd1...8c.dex
/data/data/####/301d35644f88852647e2158cb1bfaca94de9396ac1fcfd1...leted)
/data/data/####/35edb3d1-d69e-4e91-ab1e-5bdd3b9820d5.data
/data/data/####/39be6394-1895-4719-aba2-d654f8b5e418.data
/data/data/####/3d8cc43f-c2c3-4b85-b715-a037533dcbea.data
/data/data/####/4000beaa-3dc9-46c0-afda-ff01cbd96d74.data
/data/data/####/4477d521-c8ac-42ba-9ceb-8d8f087aee2a.data
/data/data/####/4d9267c1-4311-43e4-8f74-879d5b0d96bf.data
/data/data/####/5e1e1366-a2a8-48c9-994f-0b7988910057.data
/data/data/####/5ff2541c-5dd6-4938-8402-5628895374c4.data
/data/data/####/683e4dbb-a1a9-40e8-b708-c7f10d6e568e.data
/data/data/####/6aecb1af-30b6-4081-9976-ddf1cac0152f.data
/data/data/####/6c0771e5-d473-4365-b016-bf09f3f91279.data
/data/data/####/70c3d1a7-4a54-461a-89d7-783aca8fa619.data
/data/data/####/78eb80ca-d0c1-4039-a4a2-4f62f2bf18e2.data
/data/data/####/7ba24b96-9688-47e1-999c-e75574bfd032.data
/data/data/####/7bb9db79-f2dd-4d09-81b9-6cb6bec534b9.data
/data/data/####/9602e56e-fc2d-4e37-8ff8-51b9b55e6912.data
/data/data/####/9dd8526b-e259-4365-94bf-347b4d684c02.data
/data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
/data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
/data/data/####/ADBMobileDataCache.sqlite
/data/data/####/ADBMobileDataCache.sqlite-journal
/data/data/####/ADBMobileMedia.sqlite-journal
/data/data/####/ADBMobileSignalDataCache.sqlite-journal
/data/data/####/APPTENTIVE.xml
/data/data/####/AdobeMobile_ConfigState.xml
/data/data/####/AdobeMobile_Lifecycle.xml
/data/data/####/AnalyticsDataStorage.xml
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/AwOriginVisitLoggerPrefs.xml
/data/data/####/BNC_Server_Request_Queue.xml
/data/data/####/BrowserMetrics-spare.pma
/data/data/####/CBGr2.xml
/data/data/####/CURRENT
/data/data/####/DPlus.xml
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/FirebasePerfSharedPrefs.xml
/data/data/####/Font+Awesome+5+Free-Solid-900.otf
/data/data/####/LOCK
/data/data/####/LOG
/data/data/####/MANIFEST-000001
/data/data/####/MUX_DEVICE_ID.xml
/data/data/####/NRAnalyticsAttributeStore.xml
/data/data/####/NRCrashStore.xml
/data/data/####/NRPayloadStore.xml
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTozNjg2NTIy...l.json
/data/data/####/PersistedInstallation1386007043tmp
/data/data/####/PersistedInstallation1475516457tmp
/data/data/####/PersistedInstallation682923661tmp
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a0ef0f60-1987-40d0-a74f-46ce95ecf7ea.data
/data/data/####/admob.xml
/data/data/####/apptentive
/data/data/####/apptentive-2023-09-28_01-43-17.log
/data/data/####/apptentive-journal
/data/data/####/b42fbe98-1199-4744-9645-6493ca02ab40.data
/data/data/####/blueshift_db.sqlite3
/data/data/####/blueshift_db.sqlite3-journal
/data/data/####/branch_referral_shared_pref.xml
/data/data/####/branch_referral_shared_pref.xml.bak
/data/data/####/bsft_app_preferences.xml
/data/data/####/bsft_inappmessage_db
/data/data/####/bsft_inappmessage_db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/cloneSettings.json
/data/data/####/com.applisto.appcloner.classes.xml
/data/data/####/com.apptentive.sdk.security.xml
/data/data/####/com.blueshift.sdk_preferences.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.discoverypIus.mobiIe.android.client_cast_an...ta.xml
/data/data/####/com.discoverypIus.mobiIe.android.user_info_file.xml
/data/data/####/com.discoverypIus.mobiIe.android_preferences.xml
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.datatransport.events
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.firebase.crashlytics.prefs.xml
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/com.newrelic.android.agent.v1_com.discoverypIus...id.xml
/data/data/####/com.newrelic.android.agent.v1_com.discoverypIus...ml.bak
/data/data/####/conversation-211f902d-6c48-4eba-9090-0167c76de3...rypted
/data/data/####/conversation-bfaf424f-74b0-4eec-a1c4-de470b96fc...rypted
/data/data/####/conversation-v2.meta
/data/data/####/crash_marker
/data/data/####/crashlytics-userlog-6515359A02970001532E5B04ABB69075.temp
/data/data/####/crashlytics-userlog-6515359F025F0002532E5B04ABB69075.temp
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/f42c023f-c6ee-4180-8aae-c4dd76520d9e.data
/data/data/####/f4e15a2f-bdd0-4396-bf14-0bb1e6ab474c.data
/data/data/####/fbff5069-4bbb-4731-8cd3-2f4163cc373d.data
/data/data/####/frc_1;368652264107;android;930aba9b2741fc95298d...e.json
/data/data/####/frc_1;368652264107;android;930aba9b2741fc95298d...gs.xml
/data/data/####/frc_1;368652264107;android;930aba9b2741fc95298d...h.json
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/initialization_marker
/data/data/####/jgobfppppp (deleted)
/data/data/####/kodb
/data/data/####/kodb-journal
/data/data/####/kosp.xml
/data/data/####/kosp.xml.bak
/data/data/####/libRSSupport.so
/data/data/####/libimagepipeline.so
/data/data/####/libjiagu.so
/data/data/####/libnative-filters.so
/data/data/####/libnative-imagetranscoder.so
/data/data/####/librsjni.so
/data/data/####/librsjni_androidx.so
/data/data/####/lunaAndroid.xml
/data/data/####/messages-645252fe-bf4c-4af5-9365-f0a3fcc7551f.encrypted
/data/data/####/messages-f64083db-93c2-48e0-9d6f-7c27687732ba.encrypted
/data/data/####/natives_sec_blob1022686538.dex
/data/data/####/natives_sec_blob1947959720.dex
/data/data/####/natives_sec_blob1947959720.dex.flock (deleted)
/data/data/####/natives_sec_blob1973831792.dex
/data/data/####/natives_sec_blob1973831792.dex.flock (deleted)
/data/data/####/natives_sec_blob712253522.dex
/data/data/####/natives_sec_blob712253522.dex.flock (deleted)
/data/data/####/nr_installation
/data/data/####/paid_storage_sp.xml
/data/data/####/pcam.jar
/data/data/####/pcam.jar.cur.prof
/data/data/####/pcbc
/data/data/####/pcvmspf.xml
/data/data/####/pref_store
/data/data/####/report
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/data/####/visitorIDServiceDataStore.xml
/data/data/####/webview_data.lock
/data/media/####/crash.txt
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod -R 777 <Package Folder>
chmod 600

Loads the following dynamic libraries:

libjiagu

Uses the following algorithms to encrypt data:

DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial