Android.RemoteCode.8242

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.1093.origin
Android.RemoteCode.345.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.210.222.28:2013
TCP(HTTP/1.1) singl####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 64.2####.162.94:80
TCP(HTTP/1.1) mobilem####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) s2.starsch####.com:80
TCP(HTTP/1.1) d####.100u####.com.####.net:80
TCP(HTTP/1.1) c####.cn.edg####.net:80
TCP(HTTP/1.1) p####.api.math####.cn:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) 1####.57.193.52:80
TCP(HTTP/1.1) videopi####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 1####.92.163.136:8088
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) 1####.57.193.95:80
TCP(HTTP/1.1) co####.ssp.math####.cn:80
TCP(HTTP/1.1) cdn.sn####.cn:80
TCP(HTTP/1.1) 74.1####.131.106:80
TCP(HTTP/1.1) api.o####.ads####.cn:80
TCP(HTTP/1.1) detec####.math####.cn:80
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) 74.1####.131.105:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) dd.zxi####.cn:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) appmk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) errne####.u####.com.####.com:443
TCP(TLS/1.0) to####.ctobsn####.com.####.net:443
TCP(TLS/1.0) sf3-fe####.pglstat####.com.####.com:443
TCP(TLS/1.0) 64.2####.162.94:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.0) d####.han####.today:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) m####.vo####.com.####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) p####.google####.com:443
UDP tm4.binst####.live:3923
UDP as2.binst####.live:3924
UDP as3.binst####.live:13
UDP www.gst####.com:443
UDP tm4.binst####.live:3924
UDP 2####.255.255.250:1900
UDP as3.binst####.live:3923
UDP p####.google####.com:443
UDP as2.binst####.live:3923
UDP tm4.binst####.live:13
UDP tm1.binst####.live:13
UDP tm1.binst####.live:3923
TCP api-ac####.pangoli####.com.####.com:443
TCP lf6-ad-####.pglstat####.com.####.com:443
UDP as3.binst####.live:3924
UDP as2.binst####.live:13
TCP sf3-fe####.pglstat####.com.####.com:443

DNS requests:

and####.a####.go####.com
and####.google####.com
api-ac####.pangoli####.com
api-ac####.pangoli####.com
api.c####.cn
api.o####.ads####.cn
appmk####.oss-cn-####.aliy####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
c####.dc.100u####.com
cdn.sn####.cn
co####.ssp.math####.cn
d####.100u####.com
d####.han####.today
dd.zxi####.cn
detec####.math####.cn
errne####.u####.com
g3.l####.com
lf6-ad-####.pglstat####.com
m####.go####.com
m####.vo####.com
mobilem####.oss-cn-####.aliy####.com
newap####.math####.cn
p####.api.math####.cn
p####.google####.com
p####.han####.today
piccpn####.v.myal####.com
pla####.google####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
s2.starsch####.com
sf3-fe####.pglstat####.com
singl####.oss-cn-####.aliy####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
to####.ctobsn####.com
u####.u####.com
ucc.u####.com
ut####.u####.com
videopi####.oss-cn-####.aliy####.com
www.gst####.com

HTTP GET requests:

appmk####.oss-cn-####.aliy####.com:443/recommend/20231115180614170004277...
c####.cn.edg####.net/epg/epginfo?serviceId=####&c=####&d=####
cdn.sn####.cn/channel/202401121524481705044288321.zip
cdn.sn####.cn/plugin/202401161937581705405078467.jar
co####.ssp.math####.cn/api/v2/SDKCommonConfig?channelCode=####&version=#...
co####.ssp.math####.cn/api/v3/sdkTestConfig?send_ts=####
d####.100u####.com.####.net/sdkfile/111c402cfe4d616062d99ab6fbc3d922.jar...
d####.100u####.com.####.net/sdkfile/7d708e5667de342077cfab8cc1a0412a.apk...
d####.100u####.com.####.net/sdkfile/898092e3f1108fc5ab84211e6078203c.apk...
d####.100u####.com.####.net/sdkfile/d88ff57291eb7cb9851b1ae7163ff26c.apk...
dd.zxi####.cn:443/api/?ty=####&id=####&channel=####&callback=####
detec####.math####.cn/favicon.ico
detec####.math####.cn/sdk/checkCookie/httpClient?uniqueId=####&androidVe...
detec####.math####.cn/sdk/checkCookie/webview?uniqueId=####&androidVersi...
detec####.math####.cn/sdk/checkRedirect?uniqueId=####&androidVersion=###...
detec####.math####.cn/sdk/filterHeader/httpClient?uniqueId=####&androidV...
detec####.math####.cn/sdk/filterHeader/webview?uniqueId=####&androidVers...
detec####.math####.cn/sdk/redirectHttpClientSecondPage?uniqueId=####&and...
detec####.math####.cn/sdk/setCookie/httpClient?uniqueId=####&androidVers...
detec####.math####.cn/sdk/setCookie/webview?uniqueId=####&androidVersion...
detec####.math####.cn/sdk/validateCookie/httpClient?uniqueId=####&androi...
detec####.math####.cn/sdk/validateCookie/webview?uniqueId=####&androidVe...
g3.l####.com/r?format=####
mobilem####.oss-cn-####.aliy####.com/config/config.json
mobilem####.oss-cn-####.aliy####.com/config/update.json
p####.api.math####.cn/ip?send_ts=####
s2.starsch####.com/thumb/123/thumb@240_180.jpg
s2.starsch####.com/thumb/48/thumb@240_180.jpg
sf3-fe####.pglstat####.com.####.com:443/pic/cctv6_2.png
singl####.oss-cn-####.aliy####.com/config/mbconfig.json?token=####
to####.ctobsn####.com.####.net:443/service/2/app_alert_check/?aid=####&t...
videopi####.oss-cn-####.aliy####.com/liveing_1930.png
videopi####.oss-cn-####.aliy####.com/liveing_2136.png
videopi####.oss-cn-####.aliy####.com/liveing_2370.png
videopi####.oss-cn-####.aliy####.com/liveing_2372.png
videopi####.oss-cn-####.aliy####.com/liveing_47.png
videopi####.oss-cn-####.aliy####.com/liveing_48.png
videopi####.oss-cn-####.aliy####.com/mz.png
videopi####.oss-cn-####.aliy####.com/xiqu.webp

HTTP POST requests:

api.o####.ads####.cn/thirdparty/encsapi/enChn2
d####.100u####.com.####.net:443/pluginsync
d####.100u####.com.####.net:443/reportcomp
d####.100u####.com.####.net:443/reportcompbin
d####.100u####.com.####.net:443/sdk
d####.100u####.com.####.net:443/sdkbin
d####.han####.today:443/dycn/update
d####.han####.today:443/proxy/get?e=####&r=####
errne####.u####.com.####.com:443/apm_cc
m####.vo####.com.####.com:443/mscc/common_setting_otob?lc_id=####&platfo...
m####.vo####.com.####.com:443/ri/report_otob?lc_id=####&platform=####&de...
na61-####.wagbr####.ali####.####.com:443/v2/inn/fetch
new-####.u####.com:443/anti/postZdata
newap####.math####.cn/titan/monitor/device_info
to####.ctobsn####.com.####.net:443/service/2/app_log/?device_platform=##...
to####.ctobsn####.com.####.net:443/service/2/device_register_only/?aid=#...
to####.ctobsn####.com.####.net:443/service/2/log_settings/?device_platfo...
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.bak
/data/data/####/.dmpvedpogjhejs.cfg
/data/data/####/.fsgkea
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.msf3_31d659304230575c05a3c5ebd11c8d076e58118c
/data/data/####/.msf3_4101dff45425a5380675454177d6e6b4e29a5ebb
/data/data/####/.msf3_6f05be3a01810a12a0dce73b48e953e9237e0a2b
/data/data/####/.msf3_904f2636614f90c4f53ea2df4c3b31d5d606a64b
/data/data/####/.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
/data/data/####/.msp_589c22335a381f122d129225f5c0ba3056ed5811
/data/data/####/.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
/data/data/####/.mss_9b8ed9956d7e60469912dd239a0251f93cd1e80d
/data/data/####/.pylock
/data/data/####/0c8418c0f2386069_0
/data/data/####/1705440331823
/data/data/####/1705440331884
/data/data/####/1705440331937
/data/data/####/17e22849ba98dec2_0
/data/data/####/19d5b75cebbee26c_0
/data/data/####/2634634575.apk
/data/data/####/2634634575.apk.temp
/data/data/####/2634634575.dex
/data/data/####/2634634575.dex.flock (deleted)
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...0-5905
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...05.apk
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...5.conf
/data/data/####/3688728299.apk
/data/data/####/3688728299.apk.temp
/data/data/####/3688728299.dex
/data/data/####/3688728299.dex.flock (deleted)
/data/data/####/4006947416.apk
/data/data/####/4006947416.apk.temp
/data/data/####/4006947416.dex
/data/data/####/4006947416.dex.flock (deleted)
/data/data/####/529398700.dex
/data/data/####/529398700.dex.flock (deleted)
/data/data/####/529398700.jar
/data/data/####/529398700.jar.temp
/data/data/####/6eb68ea955d68f02_0
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/8d4af11beedb9435_0
/data/data/####/CHLfVtqJjCYW (deleted)
/data/data/####/Cookies-journal
/data/data/####/PROXYDATA.xml
/data/data/####/PROXYDATA.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Web Data-journal (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp.bak
/data/data/####/a==9.6.1&&6.2.0_1705440325903_dW5pZnlfbG9ncw==;.log
/data/data/####/adc.xml
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/c6a46ad0f5c550909994dd81f5728cb5
/data/data/####/ccg_sp_config_file.xml
/data/data/####/cd75e7340733ca48a203532932c1ed29
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/com.byted.pangle.apk
/data/data/####/com.supertv.mobile.hdkan_preferences.xml
/data/data/####/compFully.dex
/data/data/####/datacdn_channel.0
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/download_history.xml
/data/data/####/download_sdk_config.sgv
/data/data/####/dy_live.xml
/data/data/####/efs_launch.xml
/data/data/####/efs_launch.xml.bak
/data/data/####/efsid
/data/data/####/efsid3627
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/i==1.2.0&&6.2.0_1705440329765_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jsonzip.json
/data/data/####/kk_sp_main_v2.xml
/data/data/####/kk_sp_main_v6.xml
/data/data/####/libPglbizssdk_ml.so
/data/data/####/libavmdl_lite.so
/data/data/####/libjiagu.so
/data/data/####/libkeva.so
/data/data/####/libmaparmor.so
/data/data/####/libpanglarmor.so
/data/data/####/libpanglearmor.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libttmplayer_lite.so
/data/data/####/metrics_guid
/data/data/####/miui.apk
/data/data/####/miui.dex
/data/data/####/miui.dex.flock (deleted)
/data/data/####/mkt_version_v6.xml
/data/data/####/mkt_version_v6.xml.bak
/data/data/####/mobile_db-journal
/data/data/####/mobile_tv_version.xml
/data/data/####/mobile_tv_version.xml.bak
/data/data/####/na.czl
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/pangle_com.byted.pangle_applog_net_cache.dat.xml
/data/data/####/pangle_com.byted.pangle_bd_embed_tea_agent.db-journal
/data/data/####/pangle_com.byted.pangle_d8b674543fc0b023b69f6a3...04.xml
/data/data/####/pangle_com.byted.pangle_downloader.db-journal
/data/data/####/pangle_com.byted.pangle_embed_applog_stats.xml
/data/data/####/pangle_com.byted.pangle_embed_applog_stats.xml....leted)
/data/data/####/pangle_com.byted.pangle_embed_header_custom.xml
/data/data/####/pangle_com.byted.pangle_embed_last_sp_session.xml
/data/data/####/pangle_com.byted.pangle_npth.xml
/data/data/####/pangle_com.byted.pangle_npth_log.db-journal
/data/data/####/pangle_com.byted.pangle_snssdk_openudid.xml
/data/data/####/pangle_com.byted.pangle_softdec.xml
/data/data/####/pangle_com.byted.pangle_softdec.xml.bak
/data/data/####/pangle_com.byted.pangle_sp_bidding_opt_libra.xml
/data/data/####/pangle_com.byted.pangle_sp_bidding_opt_libra.xml.bak
/data/data/####/pangle_com.byted.pangle_tt_sdk_settings_other.xml
/data/data/####/pangle_com.byted.pangle_tt_sdk_settings_other.xml.bak
/data/data/####/pangle_com.byted.pangle_ttopensdk.db-journal
/data/data/####/pangle_meta_data_sp.xml
/data/data/####/pangle_meta_data_sp.xml.bak
/data/data/####/plugin_oat_info.xml
/data/data/####/proc_auxv
/data/data/####/scheme_list_data.sgv
/data/data/####/sendlock
/data/data/####/share_edit_config.xml
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.6.1&&6.2.0_1705440324978_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_v_11.xml
/data/data/####/the-real-index
/data/data/####/tt_nd
/data/data/####/tt_sdk_settings_other.blk
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak (deleted)
/data/data/####/unique
/data/data/####/update.lock
/data/data/####/ver
/data/data/####/yh-cctv1-20240117.json
/data/data/####/yh-cctv2-20240117.json
/data/data/####/yh-zhejiang-20240117.json
/data/data/####/z==1.2.0&&6.2.0_1705440322025_emNmZw==;.log
/data/media/####/5796f032f776bf88c6d4c9ce9edd0850
/data/media/####/5ed27668d66d4361b5d6611db249f496
/data/media/####/67e2094305d6f146137ec3160b5f043f
/data/media/####/clientudid.dat
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
/system/bin/cat /proc/cpuinfo
app_process /system/bin com.android.commands.pm.Pm list features
app_process /system/bin com.android.commands.pm.Pm list libraries
app_process /system/bin com.android.commands.pm.Pm list packages -f
app_process /system/bin com.android.commands.pm.Pm path <Package>
app_process /system/bin com.android.commands.pm.Pm path com.ss.android.ugc.aweme
app_process /system/bin com.android.commands.pm.Pm path com.tencent.mm
app_process /system/bin com.android.commands.wm.Wm density
app_process /system/bin com.android.commands.wm.Wm size
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/2634634575.apk
chmod 777 /data/user/0/<Package>/files/.honor/3688728299.apk
chmod 777 /data/user/0/<Package>/files/.honor/4006947416.apk
chmod 777 /data/user/0/<Package>/files/.honor/529398700.jar
chmod 777 /data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --compiler-filter=speed --dex-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5403/apk/base-1.apk --oat-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5403/dalvik-cache/compFully.dex
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
getprop ro.vivo.os.build.display.id
ip route
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Loads the following dynamic libraries:

libPglbizssdk_ml
libavmdl_lite
libcrashsdk
libjiagu
libkeva
libmaparmor
libmmkv
libpanglarmor
libtobEmbedEncrypt
libttmplayer_lite
libtvcore
libumeng-spy

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial