Android.RemoteCode.8389

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(TLS/1.0) s####.we####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) 64.2####.165.94:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) gmscomp####.google####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.2) 1####.177.14.106:443
TCP(TLS/1.2) gmscomp####.google####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 64.2####.164.139:443
TCP edg####.mma####.com:443
TCP firebas####.crashly####.com:443
TCP arm.z####.cn:10016
TCP arm.z####.cn:10004
UDP www.gst####.com:443
TCP arm.z####.cn:10011
UDP 64.2####.165.101:443

DNS requests:

android####.go####.com
arm.z####.cn
edg####.mma####.com
f####.gst####.com
firebas####.crashly####.com
firebas####.google####.com
gmscomp####.google####.com
p####.google####.com
rr2---s####.g####.com
sharec####.qq.com
ssl.google-####.com
www.b####.com
www.google####.com
www.googlet####.com
www.gst####.com

HTTP GET requests:

s####.we####.com:443/d60c120442eaa89933796bb0c4356e5c
www.a.sh####.com:443/
www.googlet####.com:443/r?id=####&v=####
www.googlet####.com:443/r?id=####&v=####&pv=####

HTTP POST requests:

gmscomp####.google####.com:443/v1/projects/tubevpn-feaac/installations

File system changes:

Creates the following files:

/data/data/####/667E6A34037E-0001-134A-F0C979B979E4BeginSession.cls
/data/data/####/667E6A34037E-0001-134A-F0C979B979E4SessionApp.cls
/data/data/####/667E6A34037E-0001-134A-F0C979B979E4SessionApp.cls_temp
/data/data/####/667E6A34037E-0001-134A-F0C979B979E4SessionDevice.cls
/data/data/####/667E6A34037E-0001-134A-F0C979B979E4SessionOS.cls
/data/data/####/667E6A34037E-0001-134A-F0C979B979E4SessionUser.cls
/data/data/####/667E6A380123-0001-13FA-F0C979B979E4BeginSession.cls
/data/data/####/667E6A380123-0001-13FA-F0C979B979E4SessionApp.cls
/data/data/####/667E6A380123-0001-13FA-F0C979B979E4SessionDevice.cls
/data/data/####/667E6A380123-0001-13FA-F0C979B979E4SessionOS.cls
/data/data/####/667E6A380123-0001-13FA-F0C979B979E4SessionUser.cls
/data/data/####/667E6A520162-0001-15A5-F0C979B979E4BeginSession.cls
/data/data/####/667E6A520162-0001-15A5-F0C979B979E4SessionApp.cls
/data/data/####/667E6A520162-0001-15A5-F0C979B979E4SessionDevice.cls
/data/data/####/667E6A520162-0001-15A5-F0C979B979E4SessionOS.cls
/data/data/####/667E6A520162-0001-15A5-F0C979B979E4SessionUser.cls
/data/data/####/667E6A5C01EB-0001-1632-F0C979B979E4BeginSession.cls
/data/data/####/667E6A5C01EB-0001-1632-F0C979B979E4SessionApp.cls
/data/data/####/667E6A5C01EB-0001-1632-F0C979B979E4SessionDevice.cls
/data/data/####/667E6A5C01EB-0001-1632-F0C979B979E4SessionOS.cls
/data/data/####/667E6A5C01EB-0001-1632-F0C979B979E4SessionUser.cls
/data/data/####/667E6A7402FF-0001-16B8-F0C979B979E4BeginSession.cls
/data/data/####/667E6A7402FF-0001-16B8-F0C979B979E4SessionApp.cls
/data/data/####/667E6A7402FF-0001-16B8-F0C979B979E4SessionDevice.cls
/data/data/####/667E6A7402FF-0001-16B8-F0C979B979E4SessionOS.cls
/data/data/####/Config.xml
/data/data/####/Config.xml.bak
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo2Mzk1MTc4...k.json
/data/data/####/PersistedInstallation89564838tmp
/data/data/####/PersistedInstallation976446764tmp
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_gtmContainerRefreshPolicy_GTM-NT8WS8.xml
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/apiUser.xml
/data/data/####/bypass-china.acl
/data/data/####/bypass-lan-china.acl
/data/data/####/bypass-lan.acl
/data/data/####/china-list.acl
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.analytics.prefs.xml
/data/data/####/com.google.android.gms.analytics.prefs.xml.bak
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/com.tube.client_preferences.xml
/data/data/####/crashlytics-userlog-667E6A380123-0001-13FA-F0C9...4.temp
/data/data/####/crashlytics-userlog-667E6A520162-0001-15A5-F0C9...4.temp
/data/data/####/crashlytics-userlog-667E6A5C01EB-0001-1632-F0C9...4.temp
/data/data/####/evernote_jobs.db-journal
/data/data/####/evernote_jobs.xml
/data/data/####/gaClientId
/data/data/####/generatefid.lock
/data/data/####/gfwlist.acl
/data/data/####/google_analytics_v4.db-journal
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/google_tagmanager.db
/data/data/####/google_tagmanager.db-journal
/data/data/####/initialization_marker
/data/data/####/jgobfppppp (deleted)
/data/data/####/lianTime.xml
/data/data/####/libjiagu_64.so
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/profile.db-journal
/data/data/####/report
/data/data/####/resource_GTM-NT8WS8
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/app/<Package>-1/lib/arm64/kcptun
chmod 755 /data/app/<Package>-1/lib/arm64/libpdnsd.so
chmod 755 /data/app/<Package>-1/lib/arm64/libredsocks.so
chmod 755 /data/app/<Package>-1/lib/arm64/libssr-local.so
chmod 755 /data/app/<Package>-1/lib/arm64/libtun2socks.so
chmod 755 /data/app/<Package>-1/lib/arm64/ss-tunnel
echo -BOC-
id
killall libpdnsd.so
killall libredsocks.so
killall libssr-local.so
killall libtun2socks.so
killall proxychains
killall ss-tunnel
rm -f /data/user/0/<Package>/libpdnsd.so-nat.conf /data/user/0/<Package>/libpdnsd.so-vpn.conf
rm -f /data/user/0/<Package>/libredsocks.so-nat.conf /data/user/0/<Package>/libredsocks.so-vpn.conf
rm -f /data/user/0/<Package>/libssr-local.so-nat.conf /data/user/0/<Package>/libssr-local.so-vpn.conf
rm -f /data/user/0/<Package>/libtun2socks.so-nat.conf /data/user/0/<Package>/libtun2socks.so-vpn.conf
rm -f /data/user/0/<Package>/proxychains-nat.conf /data/user/0/<Package>/proxychains-vpn.conf
rm -f /data/user/0/<Package>/ss-tunnel-nat.conf /data/user/0/<Package>/ss-tunnel-vpn.conf
sh

Loads the following dynamic libraries:

libarm
libjiagu_64
libsystem

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial