Android.RemoteCode.6606

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin
Android.RemoteCode.207.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) gs.g####.com:80
TCP(HTTP/1.1) f.gm.m####.com:80
TCP(HTTP/1.1) b####.g####.com:80
TCP(HTTP/1.1) u.f####.com:80
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) gs.g####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) playato####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) voledev####.google####.com:443
TCP(TLS/1.0) 1####.217.17.138:443
TCP(TLS/1.2) 1####.217.17.106:443
TCP(TLS/1.2) 1####.217.17.74:443
TCP(TLS/1.2) 1####.217.20.78:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) 1####.217.168.234:443
TCP(TLS/1.2) 1####.217.17.138:443
TCP(TLS/1.2) playato####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.217.17.78:443
TCP(TLS/1.2) 1####.217.20.98:443

DNS requests:

111.172.242.####.arpa
and####.b####.qq.com
android####.go####.com
api.s####.mob.com
b####.g####.com
c####.g####.com
c####.g####.com
clien####.f####.com
cryptau####.google####.com
f####.f####.com
f.gm.m####.com
gs.g####.com
instant####.google####.com
m####.go####.com
p####.google####.com
playato####.google####.com
u.f####.com
voledev####.google####.com
www.google####.com

HTTP GET requests:

f.gm.m####.com/privacy/policy/ms/version?appkey=####&apppkg=####&appver=...
f.gm.m####.com/privacy/policy/rejection/strategy?appkey=####&apppkg=####...
u.f####.com/favicon.ico
u.f####.com/html/h5/yinsishengming.htm
u.f####.com/pvdata.aspx?faloo_ch_id=####&faloo_ref=####

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
api.s####.mob.com/conf5
api.s####.mob.com/conn
api.s####.mob.com/snsconf
b####.g####.com/api.php?format=####&t=####
c####.g####.com/api.php?format=####&t=####
gs.g####.com/geshu/sdk/getBaseConfs
gs.g####.com/geshu/sdkStatistics/bd
gs.g####.com/geshu/sdkStatistics/ubi

File system changes:

Creates the following files:

/data/data/####/.awkl
/data/data/####/.dex2oatlock
/data/data/####/.globalLock
/data/data/####/.mrecord
/data/data/####/.mrlock
/data/data/####/.sl
/data/data/####/.slw
/data/data/####/.statistics
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/1002
/data/data/####/1004
/data/data/####/56e650779b97cb9f_0
/data/data/####/Cookies-journal
/data/data/####/MOB_SERVICE_1
/data/data/####/PUSH_SDK_RECEIVED_MSG_1
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/abf10274e2d70259_0
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_yaq-journal
/data/data/####/com.faloo.BookReader4Android.BETA_VALUES.xml
/data/data/####/com.faloo.BookReader4Android_preferences.xml
/data/data/####/config.xml
/data/data/####/crashrecord.xml
/data/data/####/efc97f53eb250b27b2af66bf039d27dc910c70dfac9bced....0.tmp
/data/data/####/f69e5345ddda247b_0
/data/data/####/faloo_db.db-journal
/data/data/####/gtc.db-journal
/data/data/####/ias.db-journal
/data/data/####/ias_sp.xml
/data/data/####/index
/data/data/####/journal
/data/data/####/libshellx-super.2019.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/map_record.txt
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/okgo.db-journal
/data/data/####/proc_auxv
/data/data/####/reg_record.txt
/data/data/####/rqd_record.eup
/data/data/####/security_info
/data/data/####/share_sdk_1
/data/data/####/sharesdk.db-journal
/data/data/####/the-real-index
/data/data/####/tomb_1581709090363.txt
/data/data/####/tomb_1581709098947.txt
/data/data/####/tomb_1581709106109.txt
/data/data/####/tosversion
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_0.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_0.dex --compiler-filter=interpret-only
/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_1.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_1.dex --compiler-filter=interpret-only
/system/bin/sh -c getprop
cat /sys/class/net/wlan0/address
getprop
getprop ro.product.cpu.abi
logcat *:e *:i | grep (3362)
logcat -d -v threadtime -s dalvikvm art zygote zygote64 OpenGLRenderer Bugly-libunwind:S
logcat -t 1000 -v threadtime Bugly-libunwind:S
ls /data/local
ping -c 1 -w 100 client4ip.faloo.com

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial