Android.DownLoader.5516

Technical information

Malicious functions:

Downloads the following detected threats from the Internet:

Android.RemoteCode.360.origin
Android.RemoteCode.8274

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.57.155.33:80
TCP(HTTP/1.1) 39.1####.77.61:8052
TCP(HTTP/1.1) 1####.56.226.115:7001
TCP(HTTP/1.1) cdn.nexta####.com:80
TCP(HTTP/1.1) hls.nexta####.com:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) 39.1####.48.1:80
TCP(HTTP/1.1) 4####.94.13.7:80
TCP(HTTP/1.1) sn.nexta####.com:8000
TCP(HTTP/1.1) 47.94.1####.170:8052
TCP(TLS/1.0) 74.1####.131.138:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) 59.82.1####.219:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 64.2####.165.94:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) a####.u####.com.####.com:443
TCP(TLS/1.0) ccs.u####.com.####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.2) 1####.177.14.104:443
TCP(TLS/1.2) p####.google####.com:443
UDP 1####.96.235.85:41496
UDP p####.google####.com:443
UDP 1####.110.10.0:23982
UDP 4####.94.7.87:3478
UDP 27.1####.120.151:41113
UDP 1####.0.10.254:44848
UDP 1####.114.159.95:1459
UDP 1####.222.121.68:5083
UDP 1####.37.128.108:11776
UDP 1####.114.13.138:9182
UDP 1####.139.108.9:34992
UDP 36.1####.158.96:12418
UDP 39.1####.77.61:8050
UDP 1####.15.69.212:3797
UDP 1####.52.37.233:6045
UDP 1####.7.172.246:35486
UDP 1####.90.237.13:13054
UDP 2####.73.16.103:42842
UDP 1####.130.68.27:4608
UDP 1####.188.161.0:39737
UDP 1####.183.241.224:3022
UDP 1####.165.216.135:45112
UDP 42.48.1####.88:10671
UDP 4####.93.93.61:36161
UDP 36.62.2####.128:25585
UDP 1####.35.158.190:25255
UDP 39.1####.119.168:5914
UDP 1####.216.164.85:35308
UDP 1####.249.217.232:27031
UDP 1####.226.239.127:13312
UDP 60.87.1####.184:36028
UDP 1####.154.90.215:17409
UDP 2####.90.33.157:2460
UDP 1####.139.144.90:43196
UDP 1####.155.5.250:38954
UDP 1####.94.166.254:41591
UDP 1####.64.84.82:29880
UDP 2####.208.232.188:16186
UDP 1####.200.191.137:3802
UDP 49.5.1####.178:3139
UDP 1####.26.161.197:12497
UDP 1####.87.241.125:14447
UDP 1####.225.230.79:2418
UDP 60.2####.106.204:4760
UDP 1####.53.31.188:18031
UDP 1####.113.236.226:42744
UDP 98.37.1####.230:42699
UDP 1####.201.50.6:3479
UDP 1####.190.68.221:10151
UDP 1####.114.82.221:42088
UDP 1####.199.184.235:13693
UDP 1####.63.154.253:38097
UDP 1####.197.85.210:22528
UDP 1####.246.151.54:41149
UDP 2####.101.233.92:8855
UDP 2####.220.103.141:43941
UDP 1####.130.68.23:17794
UDP 42.95.2####.216:43522
TCP ms####.m.u####.com:443
UDP 1####.20.80.68:39206
UDP 1####.179.131.35:1688
UDP 1####.43.247.68:27504
UDP 2####.209.109.139:36604
UDP 1####.106.212.142:32009
UDP 1####.155.82.171:13790
UDP 47.94.1####.170:8050
UDP 2####.21.195.47:36746
UDP 2####.250.42.70:37388
UDP 2####.14.125.118:29761
UDP 1####.199.237.168:1024
UDP 74.1####.131.138:443
UDP 1####.0.10.254:46559
UDP 1####.216.209.42:40900
UDP 1####.99.167.223:41629
UDP 1####.225.112.68:9306
UDP 42.1####.8.175:23524
UDP 1####.225.222.157:9442
UDP 60.23.1####.121:20541
UDP 1####.42.128.18:2710
UDP rr2---s####.g####.com:443
UDP 1####.22.130.8:19136
UDP 36.1####.129.130:3490
UDP 1####.250.204.211:30992
UDP 2####.161.25.79:4364
UDP 2####.250.209.6:33539
UDP 42.98.1####.7:36282
UDP 2####.73.24.197:23969
UDP 1####.9.50.189:44262
UDP 1####.41.178.203:13091
UDP 61.1####.118.105:22220
UDP 1####.230.219.110:19200
UDP 1####.14.73.50:19933
UDP 2####.73.15.232:12569
UDP 1####.8.81.241:31545

DNS requests:

a####.u####.com
amdc####.m.u####.com
and####.b####.qq.com
api.cdn.nexta####.com
ccs.u####.com
cdn.nexta####.com
g3.l####.com
hls.nexta####.com
msg.umengc####.com
p####.google####.com
prog####.ya####.com
rr2---s####.g####.com
sn.nexta####.com
u####.u####.com
umen####.m.ta####.com
ut####.u####.com
www.b####.com
yd.or####.ts.####.com

HTTP GET requests:

cdn.nexta####.com/app/uploads/2024-01-25/ab63ff8a-1ea0-4f1b-8b6d-ff3aa3a...
cdn.nexta####.com/app/uploads/2024-01-25/c144e15e-cc5f-4490-99d6-6dae868...
cdn.nexta####.com/app/uploads/2024-01-25/dcae444c-e690-4ff8-80f0-bed667f...
cdn.nexta####.com/app/uploads/2024-04-26/7249dc4d-0b74-41b7-bc08-61febe1...
cdn.nexta####.com/app/uploads/2024-05-23/a9f4b78e-7324-4303-8e08-c470e95...
cdn.nexta####.com/app/uploads/2024-06-06/17998db0-6df5-4797-be6a-07dae46...
cdn.nexta####.com/app/uploads/2024-06-11/14bd20fb-8caa-47ec-a3db-77c48c7...
cdn.nexta####.com/app/uploads/2024-06-13/71cb4ab3-4973-4a03-b97b-31d5767...
g3.l####.com/r?format=####
hls.nexta####.com/api/live/v1/pindaos?s_t=####&s_m=####
hls.nexta####.com/nxt/live/d63oglrmclj4.m3u8?es=####&ts=####&fm=####&pee...
hls.nexta####.com/nxt/live/d934y6mh59ts.m3u8?isCks=####&es=####&ts=####&...
sn.nexta####.com:8000/
www.a.sh####.com:443/

HTTP POST requests:

a####.u####.com.####.com:443/v3/a/audid/req
ccs.u####.com.####.com:443/aa
msg.umengc####.com:443/v3/tag/add
new-####.u####.com:443/anti/postZdata
u####.u####.com:443/umpx_push_launch
u####.u####.com:443/umpx_push_register
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.hptc_kache_i.starryskylive
/data/data/####/.imprint
/data/data/####/0e9fb6677ec30bf8f35ad03ba7939990.0.tmp
/data/data/####/0e9fb6677ec30bf8f35ad03ba7939990.1.tmp
/data/data/####/1.0.136.apk
/data/data/####/1004
/data/data/####/271c9c0165ec8f416156de1bb8b631b7.0.tmp
/data/data/####/271c9c0165ec8f416156de1bb8b631b7.1
/data/data/####/3f83e4935ac4481ba4049c754171d93a405f35583b35de8....0.tmp
/data/data/####/3f83e4935ac4481ba4049c754171d93a405f35583b35de8...83b9.0
/data/data/####/647813e1a8fab206c4238a31bd51d7ac1394b0d9e2fc563....0.tmp
/data/data/####/647813e1a8fab206c4238a31bd51d7ac1394b0d9e2fc563...cfee.0
/data/data/####/701992c109623c91e92852581bbbbb2e.0.tmp
/data/data/####/701992c109623c91e92852581bbbbb2e.1.tmp
/data/data/####/93783eb171526b50728e365cdaf66c44879f51bfabd058b...baed.0
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Agoo_AppStore.xml.bak
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/CONFIG.xml
/data/data/####/CP_cache.xml
/data/data/####/LIVE_CONFIG.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PLAY.xml
/data/data/####/Splayer_config.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a==9.5.2&&1.0.116_1718376874994_dW5pZnlfbG9ncw==;.log
/data/data/####/accs.db-journal
/data/data/####/accs.db-journal (deleted)
/data/data/####/advertisement.xml
/data/data/####/api.prefs.xml
/data/data/####/api.prefs.xml.bak
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0.tmp
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1.tmp
/data/data/####/b5f46f6c2e011b1e5219259d758a0c9c.0.tmp
/data/data/####/b5f46f6c2e011b1e5219259d758a0c9c.1.tmp
/data/data/####/bd035c39874eb6c38c6452c24a79b265.0.tmp
/data/data/####/bd035c39874eb6c38c6452c24a79b265.1
/data/data/####/bd035c39874eb6c38c6452c24a79b265.1.tmp
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/c87cb1b81d66b8204506dde15ee7b83a.0.tmp
/data/data/####/c87cb1b81d66b8204506dde15ee7b83a.1.tmp
/data/data/####/cctv01.0
/data/data/####/ce1ff1d0937c8098bd52f3029f9e27ba.0.tmp
/data/data/####/ce1ff1d0937c8098bd52f3029f9e27ba.1.tmp
/data/data/####/conf.dat
/data/data/####/crashrecord.xml
/data/data/####/cuuid.xml
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/event_db
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&1.0.116_1718376876912_dW5pZnlfbG9ncw==;.log
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libplayer.so
/data/data/####/libvaci_tvcore.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/native_record_lock
/data/data/####/p==6.6.2&&1.0.116_1718376875962_dW1weF9wdXNoX3J...y;.log
/data/data/####/p==6.6.2&&1.0.116_1718376886043_dW1weF9wdXNoX2x...=;.log
/data/data/####/proc_auxv
/data/data/####/risk_user_info.xml
/data/data/####/settings.prefs.xml
/data/data/####/spider_prefs.xml
/data/data/####/t==9.5.2&&1.0.116_1718376872611_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_push_ut.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_push.xml
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/vaci_epg.dex
/data/data/####/vaci_epg.dex.flock (deleted)
/data/data/####/vaci_epg.jar
/data/data/####/vaci_epg.tmp
/data/data/####/vaci_plugin.dex
/data/data/####/vaci_plugin.dex.flock (deleted)
/data/data/####/vaci_plugin.jar
/data/data/####/vaci_plugin.tmp
/data/data/####/vaci_plugin_config.xml
/data/data/####/vaci_pp.dex
/data/data/####/vaci_pp.dex.flock (deleted)
/data/data/####/vaci_pp.jar
/data/data/####/vaci_pp.tmp
/data/data/####/z==1.2.0&&1.0.116_1718376860733_emNmZw==;.log
/data/data/####/zijian-douniucaijing.0
/data/media/####/uuid.data
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
chmod 777 /data/user/0/<Package>/files/pull/1.0.136.apk
getprop
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libBugly_Native
libmmkv
libplayer
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial