Android.RemoteCode.4444

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.907
Android.Triada.248.origin
Android.Triada.464.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ji####.jieme####.com:8152
TCP(HTTP/1.1) v####.api.eeric####.com:80
TCP(HTTP/1.1) 1####.78.31.198:8030
TCP(HTTP/1.1) 1####.55.93.104:9004
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10002
TCP(HTTP/1.1) dn.tc####.com:80
TCP(HTTP/1.1) l####.bigb####.com:6099
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10201
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10001
TCP(HTTP/1.1) i####.api.qiazhiw####.cn:10003
TCP(HTTP/1.1) wn.qiazhiw####.cn.####.net:80
TCP(HTTP/1.1) ny.liz####.com:666
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) apc.wjm####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) fy.bigb####.com:6099
TCP(HTTP/1.1) a####.u####.com:80
TCP(TLS/1.0) if.jw####.cn:443

DNS requests:

a####.u####.com
apc.wjm####.com
api.ila####.com
bf####.8p####.com
dn.tc####.com
fy.bigb####.com
hx.wjm####.com
i####.api.qiazhiw####.cn
i####.api.qiazhiw####.cn
if.jw####.cn
ji####.dl####.com
ji####.jieme####.com
l####.bigb####.com
l.ace####.com
nc####.6tf####.com
ny.liz####.com
oc.u####.com
pv.s####.com
re####.api.qiazhiw####.cn
sdk.api.qiazhiw####.cn
v####.api.eeric####.com
wn.qiazhiw####.cn
z####.heyc####.net

HTTP GET requests:

dn.tc####.com/dnfile/wmp/WG3N20181029LD31020.jar
gdv.a.s####.com/cityjson?ie=####
q####.a####.com/jieplginf/djmdeta29
wn.qiazhiw####.cn.####.net/update/up03169499

HTTP POST requests:

a####.u####.com/app_logs
apc.wjm####.com/core/user/initPay
apc.wjm####.com/fetchMobileService/fetchMobile
apc.wjm####.com/inte/upResult
apc.wjm####.com/inte/upSdkCrashLog
apc.wjm####.com/inte/upSmsCollection
fy.bigb####.com:6099/aps/
i####.api.qiazhiw####.cn:10003/v2/chis2
ji####.jieme####.com:8152/ryf_webserver/payment/checkupdate.html
l####.bigb####.com:6099/aps/
ny.liz####.com:666/slsdk/getdata.aspx
ny.liz####.com:666/slsdk/settings.aspx
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
sdk.api.qiazhiw####.cn:10001/v2/bag/monitor?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/sdk/init2?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/update/check?app_id=####&t=####
sdk.api.qiazhiw####.cn:10002/v2/callback/message?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/report2?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/report?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v3/sdk/report?appId=####&t=####
v####.api.eeric####.com/api/payment/mobileInit.html
v####.api.eeric####.com/api/payment/payDynamic.html
z####.heyc####.net/getlist
z####.heyc####.net/xlogin

File system changes:

Creates the following files:

/data/data/####/-MzN5Y6mvUmEoMfk.zip
/data/data/####/.imprint
/data/data/####/01PttYevdaLeruXsFya2Jg==.new
/data/data/####/1555346072467
/data/data/####/1555346077866
/data/data/####/1555346087122
/data/data/####/1555346099329
/data/data/####/1555346114274
/data/data/####/1555346126326
/data/data/####/38DD8B96194AE9A9E42BDA0DE378C3BC.xml
/data/data/####/BB329387E35EC64A285EDFFB32DC6E12.xml
/data/data/####/BE64377A23A0130F6C5A82350310E31E.xml
/data/data/####/BnXgYIErYkjFs1EDyeieGEqhwDg=.new
/data/data/####/F29B5FE74986CD64B2DDAEDD2A58B7AA.xml
/data/data/####/IC4828jGBsdy3wGO5p3n9DCP208ETgJx
/data/data/####/IC4828jGBsdy3wGO5p3n9DCP208ETgJx.new
/data/data/####/JV44i-3t92lSjY6WvhMTyynZDME=.new
/data/data/####/JiePay.xml
/data/data/####/NLRkvVFkcvcCxKBVojWRng==
/data/data/####/PBlZt1DPy3WADTLjSok0xz-VPh8=.new
/data/data/####/VPwEUouG0L2qpb86hSuVK3_EzoI=
/data/data/####/VPwEUouG0L2qpb86hSuVK3_EzoI=.new
/data/data/####/WGPAUDD2NyqXAzBIKOg50Q==.new
/data/data/####/XinZF.xml
/data/data/####/XinZF_conf.xml
/data/data/####/XinZFsmspay.db
/data/data/####/XinZFsmspay.db-journal
/data/data/####/action.db-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.pzjump.ctuhfjhik.com.one.sdk.c.amsg.db-journal
/data/data/####/com.pzjump.ctuhfjhik.com.sdk.a.a_mseg.db
/data/data/####/com.pzjump.ctuhfjhik.com.sdk.a.a_mseg.db-journal
/data/data/####/com.pzjump.ctuhfjhik.xml
/data/data/####/com.pzjump.ctuhfjhik_preferences.xml
/data/data/####/config50083.xml
/data/data/####/config50083.xml.bak (deleted)
/data/data/####/dRRrlXwSPfA-5gtG
/data/data/####/dpi
/data/data/####/engc.jar
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fG71K8g3E3yi0mg_6MMr_A7RuKVycO0O_Rm4jBCjGoWArA8nY-journal
/data/data/####/gxuobg_f.zip
/data/data/####/hid.db
/data/data/####/jiepay_config.xml
/data/data/####/jiepayplugin.apk
/data/data/####/jiepayplugin.apkdata
/data/data/####/jiepaysmspay.db
/data/data/####/jiepaysmspay.db-journal
/data/data/####/lCq161Z6jTWFKe3ExDqVjQ==.new
/data/data/####/loccalCache.xml
/data/data/####/new_md.jar
/data/data/####/onePay.xml
/data/data/####/onlineconfig_agent_online_setting_com.pzjump.ctuhfjhik.xml
/data/data/####/p4VULmqD9lyw_ePX2Jw-5w==
/data/data/####/prdopt.xml
/data/data/####/q647dChDwkjCKt-eNoQkZBLvAac=.new
/data/data/####/qOnaQZyCzfNB4z0eW57ACA68YD4=.new
/data/data/####/rdata_comuflwhzd.new
/data/data/####/runner_info.prop.new
/data/data/####/shunpay_config
/data/data/####/t41Jpy8dc-tTScKW.new
/data/data/####/tdargs.xml
/data/data/####/tmpbl.jar
/data/data/####/tools8977.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uid.f
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/up03169499
/data/data/####/up03169499.jar
/data/data/####/webview.db-journal
/data/data/####/zE90-O4Psgtfh5JfMwRsfg==.new
/data/data/####/zdfc.jar
/data/media/####/.nid
/data/media/####/.uunique.new
/data/media/####/log
/data/media/####/msg
/data/media/####/order
/data/media/####/status
/data/media/####/tag2.dat871d28a6-1af3-40ce-b818-7917d233066c.tmp

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh
cat /proc/version
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
cat /sys/class/net/wlan0/address
getprop
getprop ro.board.platform
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.version
getprop ro.yunos.version
ls -l /dev
ls -l /dev/block
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuctl/apps
ls -l /dev/cpuctl/apps/bg_non_interactive
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/log
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ps

Loads the following dynamic libraries:

cocos2dcpp
core
n24b61
shunpay

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Contains functionality for automatic SMS sending.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Parses information from SMS.

Gets information about sent/received SMS.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial