Android.RemoteCode.4635

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.907

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.159.152.136:8090
TCP(HTTP/1.1) 1####.159.103.205:8090
TCP(HTTP/1.1) g.al####.com:80
TCP(HTTP/1.1) 47.1####.78.161:9004
TCP(HTTP/1.1) 1####.78.31.198:8030
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) f####.qiushib####.com:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) nstc####.qiazhiw####.cn:20000
TCP(HTTP/1.1) lp.lapia####.com:6099
TCP(HTTP/1.1) fy.bigb####.com:6099
TCP(HTTP/1.1) api.qiazhiw####.cn:8888
TCP(HTTP/1.1) ji####.jieme####.com:8152
TCP(HTTP/1.1) www.palmfun####.cn:80
TCP(HTTP/1.1) em.b####.com:80
TCP(HTTP/1.1) oth.up####.mdt.####.com:8080
TCP(HTTP/1.1) a####.on####.club:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) ma####.m.ta####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) t####.c####.q####.####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) gw.al####.com:443
TCP(TLS/1.0) qb####.b0.a####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) f####.qiushib####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) ma####.wang:443
TCP(TLS/1.0) wwc.al####.com:443
TCP(TLS/1.0) i####.sogo####.com.####.com:443
TCP(TLS/1.0) pco####.ta####.com:443
TCP(TLS/1.0) em.b####.com:443
TCP(TLS/1.0) guide-w####.m.ta####.com:443
TCP(TLS/1.0) g.al####.com:443
TCP(TLS/1.0) log.mm####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) s.t####.cn:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) zb-cent####.m.ta####.com:443
TCP(TLS/1.0) hk.wagbr####.non####.####.com:443
TCP(TLS/1.0) key####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) h5.m.ta####.com:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) us-aebr####.ali####.com:443
TCP(TLS/1.0) u####.v.qin####.com:443
TCP(TLS/1.0) www.qiushib####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) t####.sogo####.com.####.com:443
TCP(TLS/1.0) ser####.e####.s####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP oth.eve.mdt.####.com:8081
TCP oth.str.mdt.####.com:8081
TCP nstc####.qiazhiw####.cn:6688

DNS requests:

254.106.168.####.arpa
a####.on####.club
acs.m.ta####.com
api.qiazhiw####.cn
c####.b####.com
c####.baidust####.com
c####.mm####.com
c.c####.com
cf.al####.com
dd.bigb####.com
dup.baidust####.com
ec####.b####.com
em.b####.com
f####.qiushib####.com
f####.qiushib####.com
f10.b####.com
f11.b####.com
f12.b####.com
fou####.ali####.com
fy.bigb####.com
g.al####.com
gw.al####.com
h####.m.ta####.com
h5.m.ta####.com
hm.b####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
img.al####.com
ji####.dl####.com
ji####.jieme####.com
key####.com
l####.bigb####.com
l####.m.ta####.com
log.mm####.com
lp.lapia####.com
ma####.m.ta####.com
ma####.wang
nstc####.qiazhiw####.cn
oth.eve.mdt.####.com
oth.str.mdt.####.com
oth.up####.mdt.####.com
pco####.ta####.com
pic.qiushib####.com
plb####.u####.com
pos.b####.com
qb####.qiushib####.com
qiubai####.qiushib####.com
qiubai-####.qiushib####.com
s.t####.cn
s23.c####.com
ser####.e####.s####.com
st####.qiushib####.com
t####.sogo####.com
t10.b####.com
t11.b####.com
t12.b####.com
u####.u####.com
wgo.mm####.com
wu####.e####.s####.com
wwc.al####.com
www.b####.com
www.google-####.com
www.palmfun####.cn
www.qiushib####.com
y####.al####.com
y####.al####.org
z5.c####.com

HTTP GET requests:

a####.on####.club/fileupload/0bc05ad19ed8cf95.jar
em.b####.com/pixel?media_sign=####&media_site=####
f####.qiushib####.com/m.html?mediaid=####&cookie_version=####&timestamp=...
f####.qiushib####.com/xpwuyo/g?c=####
g.al####.com/mtb/??lib-promise/3.0.1/polyfillB.js,lib-mtop/2.4.0/mtop.js...
q####.a####.com/jieplginf/djmdeta29
si####.jom####.com/it/u=2645196208,4204431519&fm=76
si####.jom####.com/it/u=4054697262,2481069558&fm=76
si####.jom####.com/it/u=711056811,3533297447&fm=76

HTTP POST requests:

api.qiazhiw####.cn:8888/v2/api/report?app_id=####&imei=####&imsi=####&ha...
fy.bigb####.com:6099/aps/
ji####.jieme####.com:8152/ryf_webserver/payment/checkupdate.html
lp.lapia####.com:6099/aps/
nstc####.qiazhiw####.cn:20000/v1/sdk/pkg/update?app_id=####&t=####
nstc####.qiazhiw####.cn:20000/v1/srv/err/report?app_id=####&t=####
nstc####.qiazhiw####.cn:20000/v1/srv/info/get?app_id=####&t=####
oth.up####.mdt.####.com:8080/beacon/vercheck
www.palmfun####.cn/fee/active
www.palmfun####.cn/fee/code
www.palmfun####.cn/fee/searchpc
www.palmfun####.cn/fee/searchpcNew

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1.jar
/data/data/####/10.jar
/data/data/####/11.jar
/data/data/####/21.jar
/data/data/####/6.jar
/data/data/####/9.jar
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DENGTA_META.xml
/data/data/####/JiePay.xml
/data/data/####/NorPay_SP.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/XinZF.xml
/data/data/####/XinZF_conf.xml
/data/data/####/XinZFsmspay.db
/data/data/####/XinZFsmspay.db-journal
/data/data/####/beacon_cover.xml
/data/data/####/beacon_cover_check.lock
/data/data/####/beacon_cover_load.lock
/data/data/####/beacon_db-journal
/data/data/####/beacon_sig_1.lock
/data/data/####/c8ef51bca7c6ca597d96a5924f5daec5.xml
/data/data/####/config50496.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU3MjkwMjg4MDYw;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/i==1.2.0&&1.1_1557290288193_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/jiepay_config.xml
/data/data/####/jiepayplugin.apk
/data/data/####/jiepayplugin.apkdata
/data/data/####/jiepaysmspay.db
/data/data/####/jiepaysmspay.db-journal
/data/data/####/lhpkyp.imfhnp.uurenil.com.one.support.c.aNorPay...ournal
/data/data/####/lhpkyp.imfhnp.uurenil.xml
/data/data/####/lhpkyp.imfhnp.uurenil_preferences.xml
/data/data/####/lpeg.jar
/data/data/####/new_md.jar
/data/data/####/one.dex
/data/data/####/one.dex (deleted)
/data/data/####/onePayV3.xml
/data/data/####/t==8.0.0&&1.1_1557290288815_envelope.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/uid.f
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/ydutl.cf
/data/data/####/yunUid.f
/data/data/####/zdfc.jar
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.umm.dat
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/log
/data/media/####/meta.dat
/data/media/####/msg
/data/media/####/order
/data/media/####/status

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.build.fingerprint
getprop ro.build.fingerprint
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

n00abe

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
DES
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Accesses camera interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Displays its own windows over windows of other apps.

Parses information from SMS.

Gets information about sent/received SMS.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial