Android.RemoteCode.8289

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.8274

Downloads the following detected threats from the Internet:

Android.RemoteCode.8274

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.201.29.110:8052
TCP(HTTP/1.1) cdn.nexta####.com:80
TCP(HTTP/1.1) 1####.57.155.33:80
TCP(HTTP/1.1) l####.miguv####.com:80
TCP(HTTP/1.1) yd.gwt.nexta####.com:80
TCP(HTTP/1.1) sn.nexta####.com:8000
TCP(HTTP/1.1) 1####.201.31.199:8052
TCP(HTTP/1.1) 4####.94.13.7:80
TCP(HTTP/1.1) 39.1####.213.47:7001
TCP(HTTP/1.1) 39.1####.156.205:80
TCP(HTTP/1.1) 39.1####.213.47:80
TCP(HTTP/1.1) hls.nexta####.com:80
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) ccs.u####.com.####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) a####.u####.com.####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) 2####.85.233.94:443
TCP(TLS/1.0) worldti####.org:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 2####.85.233.94:443
TCP(TLS/1.2) pla####.google####.com:443
UDP 49.69.1####.57:12110
UDP 1####.98.84.212:45046
UDP 1####.247.48.216:31749
UDP 1####.126.41.49:17460
UDP 4####.87.4.81:50478
UDP 1####.39.100.242:37391
UDP www.gst####.com:443
UDP 39.1####.201.62:18953
UDP www.google####.com:443
UDP 1####.55.12.44:15381
UDP 1####.8.36.189:2250
UDP 1####.85.239.155:5833
UDP 1####.145.33.154:48483
UDP 1####.0.10.254:36343
UDP 1####.8.116.184:1967
UDP 1####.201.29.110:8050
UDP 36.1####.31.23:44523
TCP ms####.m.u####.com:443
UDP 1####.201.50.6:3479
UDP 1####.0.10.254:53043
UDP 4####.94.7.87:3478
UDP 2####.89.47.153:16616
UDP 2####.102.47.181:4121
UDP 1####.201.31.199:8050
UDP 36.1####.111.102:12366
UDP 1####.13.10.195:18791
UDP 61.1####.204.74:14022
UDP 1####.112.135.115:40409
UDP 61.1####.177.12:16095
UDP 1####.229.60.3:36043

DNS requests:

a####.u####.com
amdc####.m.u####.com
and####.a####.go####.com
and####.b####.qq.com
and####.google####.com
api.cdn.nexta####.com
ccs.u####.com
cdn.nexta####.com
h.t####.qq.com
hls.nexta####.com
l####.miguv####.com
m####.go####.com
msg.umengc####.com
of####.u####.com
pla####.google####.com
rr2---s####.g####.com
rr9---s####.g####.com
sn.nexta####.com
ssssss####.sssssss####.net
u####.u####.com
umen####.m.ta####.com
ut####.u####.com
worldti####.org
www.b####.com
www.google####.com
www.gst####.com
yd.gwt.nexta####.com

HTTP GET requests:

cdn.nexta####.com/app/apk/adJson.txt
cdn.nexta####.com/app/config/live/y4c.json
cdn.nexta####.com/app/config/playback/config_support_ts.json
cdn.nexta####.com/app/uploads/2024-01-26/11647ffb-abb3-4a74-a0f5-841a406...
cdn.nexta####.com/app/uploads/2024-02-22/abe79b60-0c1e-4304-be96-a727329...
cdn.nexta####.com/app/uploads/2024-03-07/ae33e686-7ddc-469b-b794-8f71691...
cdn.nexta####.com/app/uploads/2024-03-10/8babc038-c35f-4f58-8738-6a7bd63...
hls.nexta####.com/api/live/v1/pindaos?s_t=####&s_m=####
hls.nexta####.com/nxt/live/d63oglrmclj4.m3u8?es=####&ts=####&fm=####&pee...
l####.miguv####.com/live/v2/tv-programs-data/608807420/20240312
sn.nexta####.com:8000/
worldti####.org:443/api/ip
www.a.sh####.com:443/
yd.gwt.nexta####.com/d6f3f64id7nkmaterial/transcode/d6el9jhx39xc_4/0_000...
yd.gwt.nexta####.com/user/d6f3f64id7nk/material/transcode/d9upa3m6m9z4/0...

HTTP POST requests:

a####.u####.com.####.com:443/v3/a/audid/req
and####.b####.qq.com:443/rqd/async?aid=####
ccs.u####.com.####.com:443/aa
def####.duals####.cn.####.com:443/log/switch
h.t####.qq.com:443/kv
msg.umengc####.com:443/v3/tag/add
new-####.u####.com:443/anti/postZdata
new-####.u####.com:443/anti/updateZdata
u####.u####.com:443/umpx_push_launch
u####.u####.com:443/umpx_push_register
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.font3761-3761-0
/data/data/####/.font3761-3761-0 (deleted)
/data/data/####/.font4039-4039-0
/data/data/####/.font4039-4039-0 (deleted)
/data/data/####/.font4517-4517-0
/data/data/####/.font4517-4517-0 (deleted)
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/4ac73ad9562b5e66a5980e74bb6bc833.0.tmp
/data/data/####/4ac73ad9562b5e66a5980e74bb6bc833.1
/data/data/####/4ac73ad9562b5e66a5980e74bb6bc833.1.tmp
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Agoo_AppStore.xml.bak
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/CONFIG.xml
/data/data/####/CP_cache.xml
/data/data/####/HISTORY.xml
/data/data/####/LIVE_CONFIG.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PERMANENT_DATA.xml
/data/data/####/PLAY.xml
/data/data/####/Splayer_config.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a==9.5.2&&1.0.105_1710204257992_dW5pZnlfbG9ncw==;.log
/data/data/####/a==9.5.2&&1.0.105_1710204305849_dW5pZnlfbG9ncw==;.log
/data/data/####/accs.db-journal
/data/data/####/api.prefs.xml
/data/data/####/b0bc8977abd6c01973cb5c6d712e199b.0.tmp
/data/data/####/b0bc8977abd6c01973cb5c6d712e199b.1.tmp
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0.tmp
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/cctv01.0
/data/data/####/channel---60d41692fc124df7376ad5905881e52b-1.block
/data/data/####/channel---60d41692fc124df7376ad5905881e52b-2.block
/data/data/####/channel---60d41692fc124df7376ad5905881e52b-3.block
/data/data/####/conf.dat
/data/data/####/crashrecord.xml
/data/data/####/cuuid.xml
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0.tmp
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1.tmp
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/epg-cctv01_v2-20240312-pb.json
/data/data/####/epg.dex
/data/data/####/epg.dex.flock (deleted)
/data/data/####/epg.jar
/data/data/####/epg.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/hdl_v2.jar
/data/data/####/i==1.2.0&&1.0.105_1710204260709_dW5pZnlfbG9ncw==;.log
/data/data/####/i==1.2.0&&1.0.105_1710204274619_dW5pZnlfbG9ncw==;.log
/data/data/####/i==1.2.0&&1.0.105_1710204309333_dW5pZnlfbG9ncw==;.log
/data/data/####/journal
/data/data/####/kk.xml
/data/data/####/kk.xml.bak
/data/data/####/libtvcore.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/p==6.6.2&&1.0.105_1710204256004_dW1weF9wdXNoX3J...y;.log
/data/data/####/p==6.6.2&&1.0.105_1710204266012_dW1weF9wdXNoX2x...=;.log
/data/data/####/player.tmp
/data/data/####/plugin.dex
/data/data/####/plugin.dex.flock (deleted)
/data/data/####/plugin.jar
/data/data/####/plugin.tmp
/data/data/####/pp.jar
/data/data/####/proc_auxv
/data/data/####/risk_user_info.xml
/data/data/####/settings.prefs.xml
/data/data/####/spider_prefs.xml
/data/data/####/t==9.5.2&&1.0.105_1710204256411_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_push_ut.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak (deleted)
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_push.xml
/data/data/####/umeng_push.xml.bak
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/z==1.2.0&&1.0.105_1710204249040_emNmZw==;.log
/data/data/####/zijian-yijiantanghonglanguang.0
/data/media/####/uuid.data

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
getprop
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
logcat -d -v threadtime
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libBugly_Native
libijkffmpeg
libijkplayer
libijksdl
libplayer
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial