Android.RemoteCode.8225

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) 1####.29.29.29:53
UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) devs-####.du####.com:80
TCP(HTTP/1.1) a####.du####.com:80
TCP(HTTP/1.1) 43.1####.104.49:4433
TCP(HTTP/1.1) m.mpl.du####.com:80
TCP(HTTP/1.1) ap####.du####.com:80
TCP(HTTP/1.1) 64.2####.161.94:80
TCP(HTTP/1.1) sd####.sms.mob.com:80
TCP(TLS/1.0) lic####.v####.myqc####.####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) 64.2####.161.94:443
TCP(TLS/1.0) g####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) rr11---####.g####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) gat####.xd####.com:443
TCP(TLS/1.0) 1####.250.150.139:443
TCP(TLS/1.0) c####.cloudf####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) cdn.boo####.com.####.cn:443
TCP(TLS/1.0) rr3---s####.g####.com:443
TCP(TLS/1.0) 74.1####.205.139:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.250.150.139:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) www.go####.com:443
TCP(TLS/1.2) 64.2####.161.94:443
TCP h.m.mpl.####.com:5101
TCP h.m.mpl.####.com:5125
UDP p####.google####.com:443
TCP h.m.mpl.####.com:5099
TCP h.m.mpl.####.com:5097
TCP h.m.mpl.####.com:5098
TCP n####.v####.qq.####.net:443
TCP h.m.mpl.####.com:4155
TCP arm.z####.cn:10017
TCP h.m.mpl.####.com:5100
TCP h.m.mpl.####.com:5117
TCP arm.z####.cn:10015
UDP 2####.255.255.250:1900
TCP h.m.mpl.####.com:5116
TCP ant####.net:443
TCP h.m.mpl.####.com:5092
TCP h.m.mpl.####.com:4157

DNS requests:

a####.du####.com
ant####.net
ap####.du####.com
arm.z####.cn
c####.cloudf####.com
cdn.boo####.com
connect####.gst####.com
devs-####.du####.com
digital####.google####.com
f####.gst####.com
g####.com
gat####.xd####.com
h.m.mpl.####.com
i####.sms.mob.com
lic####.v####.myqc####.com
m####.go####.com
m.mpl.du####.com
md####.google####.com
n####.v####.qq.com
p####.google####.com
rr11---####.g####.com
rr18---####.g####.com
rr2---s####.g####.com
rr2---s####.g####.com
rr3---s####.g####.com
rr9---s####.g####.com
sd####.sms.mob.com
www.go####.com

HTTP GET requests:

a####.du####.com/privacy/policy/authorization/status?networktype=####&is...
lic####.v####.myqc####.####.com:443/license/v2/1316269946_1/v_cube.license

HTTP POST requests:

ap####.du####.com/v6/bpu
devs-####.du####.com/getDuidBlacklist
m.mpl.du####.com/tcp/config/init
m.mpl.du####.com/tcp/push/pbsd
sd####.sms.mob.com/v3/sdk/init
sd####.sms.mob.com/v3/token/get

File system changes:

Creates the following files:

/data/data/####/.duid
/data/data/####/.fsgkea
/data/data/####/.gcf_lock
/data/data/####/.globalLock
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.lock
/data/data/####/.mclg-1_1_0
/data/data/####/.mrecord
/data/data/####/.mrlock
/data/data/####/0b50a103fdba6809_0
/data/data/####/18807682fea19f16_0
/data/data/####/18807682fea19f16_1
/data/data/####/39a9a8c97c648f5b_0
/data/data/####/43f8cd2356aa5027_0
/data/data/####/6585df68f028e7d9_0
/data/data/####/6e80d75a600a97a5_0
/data/data/####/6fde6eebef2fe921_0
/data/data/####/ClassicsHeader.xml
/data/data/####/Cookies-journal
/data/data/####/GYaZUyJGyAwv (deleted)
/data/data/####/GzrbtFqFLusG (deleted)
/data/data/####/LhTCBzKDnRRY (deleted)
/data/data/####/SMSSDK_2
/data/data/####/SMSSDK_VCODE_1
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.oat
/data/data/####/com.kai.video_preferences.xml
/data/data/####/com.liteav.storage.global.xml
/data/data/####/config.xml
/data/data/####/d99da1a1982d3911_0
/data/data/####/d99da1a1982d3911_1
/data/data/####/elp_msg.db
/data/data/####/elp_msg.db-journal
/data/data/####/gu_0
/data/data/####/index
/data/data/####/leieMwlcqlfB (deleted)
/data/data/####/libjiagu.so
/data/data/####/loggerdb-journal
/data/data/####/mcl_0
/data/data/####/metrics_guid
/data/data/####/mob_commons_1
/data/data/####/proc_auxv
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/update_lc
/data/media/####/40fb69aac6cb1141afcd9379b2713c34.0.tmp
/data/media/####/40fb69aac6cb1141afcd9379b2713c34.1.tmp
/data/media/####/62d21d4429e2ddec82f77b97db8436c7.0.tmp
/data/media/####/62d21d4429e2ddec82f77b97db8436c7.1
/data/media/####/62d21d4429e2ddec82f77b97db8436c7.1.tmp
/data/media/####/698e5e74bee1ef27269721aeb5f840e4.0.tmp
/data/media/####/698e5e74bee1ef27269721aeb5f840e4.1.tmp
/data/media/####/6cd02888aa099fdc2f79d3e9fb406c85.0.tmp
/data/media/####/6cd02888aa099fdc2f79d3e9fb406c85.1
/data/media/####/6cd02888aa099fdc2f79d3e9fb406c85.1.tmp
/data/media/####/7537e0b196758997d709e36ea9ba2bd5.0.tmp
/data/media/####/7537e0b196758997d709e36ea9ba2bd5.1
/data/media/####/7537e0b196758997d709e36ea9ba2bd5.1.tmp
/data/media/####/LiteAV_C_20231228-0.clog
/data/media/####/bbf4ae1ac16c82afda4cd5c052311b61.0.tmp
/data/media/####/bbf4ae1ac16c82afda4cd5c052311b61.1.tmp
/data/media/####/errorLog.txt
/data/media/####/journal
/data/misc/####/primary.prof

Miscellaneous:

Loads the following dynamic libraries:

libarm
libjiagu
libliteavsdk
libpl_droidsonroids_gif
libtxffmpeg
libtxsoundtouch

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial