Android.DownLoader.5527

Technical information

Malicious functions:

Downloads the following detected threats from the Internet:

Android.RemoteCode.8274

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) hls.nexta####.com:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) l####.miguv####.com:80
TCP(HTTP/1.1) cdn.nexta####.com:80
TCP(HTTP/1.1) 1####.56.226.115:7001
TCP(HTTP/1.1) 39.1####.224.153:80
TCP(HTTP/1.1) api.cdn.nexta####.com:80
TCP(HTTP/1.1) 4####.94.13.7:80
TCP(HTTP/1.1) 1####.57.217.238:80
TCP(TLS/1.0) worldti####.org:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) 59.82.1####.219:443
TCP(TLS/1.0) a####.u####.com.####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) ccs.u####.com.####.com:443
TCP(TLS/1.0) 2####.239.34.223:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.2) digital####.google####.com:443
TCP(TLS/1.2) 2####.239.34.223:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) 1####.177.14.104:443
UDP 2####.239.34.223:443
UDP 4####.94.46.159:8050
UDP 1####.201.50.6:2345
UDP 4####.94.7.87:3478
UDP 1####.201.50.6:3479
UDP 1####.100.243.133:25928
UDP 4####.94.7.87:2345
TCP ms####.m.u####.com:443

DNS requests:

a####.u####.com
amdc####.m.u####.com
and####.a####.go####.com
and####.b####.qq.com
and####.google####.com
api.cdn.nexta####.com
ccs.u####.com
cdn.nexta####.com
connect####.gst####.com
digital####.google####.com
g3.l####.com
gmscomp####.google####.com
h.t####.qq.com
hls.nexta####.com
l####.miguv####.com
msg.umengc####.com
of####.u####.com
pla####.google####.com
prog####.nexta####.com
rr2---s####.g####.com
rr9---s####.g####.com
u####.u####.com
umen####.m.ta####.com
ut####.u####.com
worldti####.org
www.b####.com
www.google####.com
yd.or####.ts.####.com

HTTP GET requests:

api.cdn.nexta####.com/api/live/v1/pindaos?s_t=####&s_m=####
cdn.nexta####.com/app/config/live/app_conf_global.json
cdn.nexta####.com/app/config/live/source_parse_track_conf.json
cdn.nexta####.com/app/config/live/splayer_d_c.txt
cdn.nexta####.com/app/config/playback/config_support_ts.json
cdn.nexta####.com/app/config/third/jar/hdp_0429.jar
cdn.nexta####.com/app/config/upgrade/xingkong/apk_upgrade_config_v2.json...
cdn.nexta####.com/app/uploads/2024-01-25/374340bb-778c-49cc-b6d1-b20a7cb...
cdn.nexta####.com/app/uploads/2024-01-25/c144e15e-cc5f-4490-99d6-6dae868...
cdn.nexta####.com/app/uploads/2024-01-25/dcae444c-e690-4ff8-80f0-bed667f...
cdn.nexta####.com/app/uploads/2024-04-26/7249dc4d-0b74-41b7-bc08-61febe1...
cdn.nexta####.com/app/uploads/2024-06-11/14bd20fb-8caa-47ec-a3db-77c48c7...
cdn.nexta####.com/app/uploads/2024-06-17/f316e378-e082-4fe1-8895-0afa085...
cdn.nexta####.com/app/uploads/2024-06-19/121409e7-e2b6-425d-b8ac-d926b74...
cdn.nexta####.com/app/uploads/2024-06-25/4dfaeb89-1106-4d19-aff8-b5d93c0...
g3.l####.com/r?format=####
hls.nexta####.com/nxt/live/d934y6mh59ts.m3u8?isCks=####&ts=####&fm=####&...
l####.miguv####.com/live/v2/tv-programs-data/608807420/20240626
l####.miguv####.com/live/v2/tv-programs-data/624878271/20240626
l####.miguv####.com/live/v2/tv-programs-data/631780421/20240626
l####.miguv####.com/live/v2/tv-programs-data/631780532/20240626
l####.miguv####.com/live/v2/tv-programs-data/641886683/20240626
worldti####.org:443/api/ip
www.a.sh####.com:443/

HTTP POST requests:

a####.u####.com.####.com:443/v3/a/audid/req
and####.b####.qq.com:443/rqd/async?aid=####
ccs.u####.com.####.com:443/aa
def####.duals####.cn.####.com:443/log/switch
h.t####.qq.com:443/kv
msg.umengc####.com:443/v3/tag/add
new-####.u####.com:443/anti/postZdata
u####.u####.com:443/umpx_push_launch
u####.u####.com:443/umpx_push_register
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/dalvik-cache/####/system@framework@am.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
/data/data/####/.font4108-4108-0
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/15fb26093b269f1e3a1e24e6180fe4b2.0
/data/data/####/15fb26093b269f1e3a1e24e6180fe4b2.1
/data/data/####/3f83e4935ac4481ba4049c754171d93a405f35583b35de8...83b9.0
/data/data/####/93783eb171526b50728e365cdaf66c44879f51bfabd058b....0.tmp
/data/data/####/93783eb171526b50728e365cdaf66c44879f51bfabd058b...baed.0
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AD_REC_PLAY_DATA.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Agoo_AppStore.xml.bak
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/CP_cache.xml
/data/data/####/FAVORITE.xml
/data/data/####/LIVE_CONFIG.xml
/data/data/####/LIVE_CONFIG.xml.bak
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/PERMANENT_DATA.xml
/data/data/####/PLAY.xml
/data/data/####/Sb_Cn.xml
/data/data/####/Splayer_config.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a54c65ef8f9f11a84bbec565263439c8.0.tmp
/data/data/####/a54c65ef8f9f11a84bbec565263439c8.1.tmp
/data/data/####/a==9.5.2&&1.0.105_1719354519117_dW5pZnlfbG9ncw==;.log
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/api.prefs.xml
/data/data/####/api.prefs.xml.bak
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0.tmp
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1.tmp
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/crashrecord.xml
/data/data/####/cuuid.xml
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0.tmp
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1.tmp
/data/data/####/dce875ab9112348070e82dcbdab8d9cd4cdc52da73d10c0....0.tmp
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/epg-cctv01_v2-20240626-pb.json
/data/data/####/epg-cctv02_v2-20240626-pb.json
/data/data/####/epg-cctv03_v2-20240626-pb.json
/data/data/####/epg-cctv04_v2-20240626-pb.json
/data/data/####/epg-cctv05_v2-20240626-pb.json
/data/data/####/epg.dex
/data/data/####/epg.dex.flock (deleted)
/data/data/####/epg.jar
/data/data/####/epg.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/hdl_0429.jar
/data/data/####/i==1.2.0&&1.0.105_1719354522726_dW5pZnlfbG9ncw==;.log
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/kk.xml
/data/data/####/kk.xml.bak
/data/data/####/libtvcore.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/p==6.6.2&&1.0.105_1719354519653_dW1weF9wdXNoX3J...y;.log
/data/data/####/p==6.6.2&&1.0.105_1719354529185_dW1weF9wdXNoX2x...=;.log
/data/data/####/player.tmp
/data/data/####/plugin.dex
/data/data/####/plugin.dex.flock (deleted)
/data/data/####/plugin.jar
/data/data/####/pp.tmp
/data/data/####/proc_auxv
/data/data/####/risk_user_info.xml
/data/data/####/risk_user_info.xml.bak
/data/data/####/risk_user_info.xml.bak (deleted)
/data/data/####/settings.prefs.xml
/data/data/####/spider_prefs.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_push_ut.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak (deleted)
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_push.xml
/data/data/####/umeng_push.xml.bak
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/z==1.2.0&&1.0.105_1719354513520_emNmZw==;.log
/data/data/####/zijian-douniucaijing.0
/data/media/####/conf.dat
/data/media/####/uuid.data
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop
LD_LIBRARY_PATH=/vendor/lib:/system/lib
getprop
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
logcat -d -v threadtime
ls /
ls /sys/class/thermal
sh
su

Loads the following dynamic libraries:

libBugly_Native
libijkffmpeg
libijkplayer
libijksdl
libplayer
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial