Android.RemoteCode.8516

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.358.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(DNS) <Google DNS>
TCP(HTTP/1.1) 39.1####.226.196:8801
TCP(HTTP/1.1) www.xn--sss####.com:80
TCP(HTTP/1.1) cfcn-a-####.chinab####.pp.ua:80
TCP(HTTP/1.1) tt.ys####.cn:80
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) c####.xn--m7r####.tk:80
TCP(HTTP/1.1) v.r####.cn:80
TCP(HTTP/1.1) cdn.k####.com.####.net:80
TCP(HTTP/1.1) w####.x####.cf:80
TCP(HTTP/1.1) wxjr####.cnm####.top:80
TCP(HTTP/1.1) 1####.23.247.140:8888
TCP(HTTP/1.1) 1####.180.198.40:1110
TCP(HTTP/1.1) i####.x####.com:80
TCP(HTTP/1.1) 1.9####.79.193:80
TCP(HTTP/1.1) cfcn-a-####.dns####.pp.ua:80
TCP(HTTP/1.1) 1####.23.247.140:7777
TCP(HTTP/1.1) 2xia####.fun:80
TCP(HTTP/1.1) 39.1####.226.196:8802
TCP(HTTP/1.1) a####.jianpia####.com:80
TCP(HTTP/1.1) 8141####.53####.xyz:80
TCP(HTTP/1.1) v.l####.cn:80
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) www.x####.com:443
TCP(TLS/1.0) i####.doub####.com.####.net:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) img.ffz####.com:443
TCP(TLS/1.0) f####.zohopu####.com.cn:443
TCP(TLS/1.2) 1####.250.74.35:443
TCP(TLS/1.2) 74.1####.163.36:443
TCP(TLS/1.2) 2####.58.207.234:443
TCP i####.doub####.com:443
TCP www.e####.com:443
TCP lbysapi####.68.gy:16789
TCP c####.xn--m7r####.tk:443
TCP www.li####.cc:443
TCP 4####.76.79.23:27899
TCP i1.h####.com:443
TCP seagm-m####.seag####.com:443
UDP 2####.255.255.250:1900
TCP i####.g####.com.####.net:443
TCP i####.doub####.com.####.com:443
TCP img1-do####.b0.a####.com:443
TCP i0.h####.com.####.com:443
TCP d####.cloudf####.18####.xyz:443
TCP www.b####.me:443
TCP feim####.site:443
TCP vip.w####.cn:5200
TCP for####.do####.com:443
TCP a.w.bili####.com:443
TCP www.suba####.com:443
TCP opencdn####.jom####.com:443
TCP www.me####.cn:443
TCP www.mi####.cc:443
TCP img.bfz####.com:443
TCP www.hkybq####.com:443
TCP api.web.36####.com:443
TCP cfcn-a-####.dns####.pp.ua:443
TCP a####.com:443
TCP www.xn--sss####.com:443
TCP 1####.173.106.162:443
TCP www.dm####.com:443
TCP lbysapi####.68.gy:10678
TCP w####.x####.cf:443
TCP 1####.24.249.186:9999
TCP fs-im-k####.qini####.com:443
TCP www.panse####.me:443

DNS requests:

2xia####.fun
5####.fun
a####.com
a####.jianpia####.com
and####.b####.qq.com
api.bili####.com
api.web.36####.com
apiapp####.l####.cc
c####.xn--m7r####.tk
c8k2n5l####.ydy####.cfd
cdn.k####.com
d####.cloudf####.18####.xyz
f####.do####.com
f####.zohopu####.com.cn
feim####.site
fr####.cloudfl####.eu.org
fs-im-####.7moor####.com
g####.b####.com
gh-p####.net
h.t####.qq.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
i####.g####.com
i####.x####.com
i0.h####.com
i1.h####.com
i2.h####.com
img.bfz####.com
img.ffz####.com
img.sh####.me
ip.ta####.com
lab####.com
lbysapi####.68.gy
m####.do####.com
m####.top
mil####.fun
mo.66####.xyz
mo.91####.icu
mo.mu####.fun
p####.google####.com
seagm-m####.seag####.com
so.xn--m7r####.tk
tt.ys####.cn
tv.yy####.top
v.l####.cn
v.r####.cn
vip.w####.cn
w####.nl
w####.x####.cf
wo####.33####.xyz
wog####.88####.xyz
wog####.w####.lol
wog####.x####.cf
www.b####.me
www.dm####.com
www.e####.com
www.google####.com
www.hkybq####.com
www.li####.cc
www.me####.cn
www.mi####.cc
www.panse####.me
www.suba####.com
www.w####.lol
www.w####.one
www.x####.com
www.xn--sss####.com
y####.fun
ydysdyn####.68.gy
z####.cloudf####.18####.xyz

HTTP GET requests:

2xia####.fun/index.php/vod/search.html?wd=####
8141####.53####.xyz/tv
a####.jianpia####.com/api/video/search?page=####&key=####
c####.xn--m7r####.tk/czzysearch.php?wd=####
c####.xn--m7r####.tk/upload/video/2025/04/11/07cdd395349d2370612e9d61d71...
cdn.k####.com.####.net/update/sdk/task_164.jar
cfcn-a-####.chinab####.pp.ua/
cfcn-a-####.dns####.pp.ua/s----------.html?wd=####
f####.zohopu####.com.cn:443/public/workdrive-public/download/i4mj169c989...
i####.x####.com/api.php/v2.vod/androidsearch10086?page=####&wd=####
img.ffz####.com:443/upload/vod/20250202-1/70befa7c27ad47d4fb46bcf6fe1e57...
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
w####.x####.cf/
w####.x####.cf/vodsearch/-------------.html?wd=####
www.xn--sss####.com/tv
wxjr####.cnm####.top/index.php/vod/search.html?wd=####

HTTP POST requests:

and####.b####.qq.com:443/rqd/async?aid=####
h.t####.qq.com:443/kv
tt.ys####.cn/v3/home/search
v.l####.cn/v3/home/search
v.r####.cn/v3/home/search
www.x####.com:443/e/search/index.php

File system changes:

Creates the following files:

/data/data/####/.ftyfnw1zjywnpj70
/data/data/####/.ftyfnw95wjv39q5g
/data/data/####/1004
/data/data/####/122324393d9da3f880cde199a222f190cdfae2c83fb7318...c45e.0
/data/data/####/12755f9bc2d68f6f3be5674ab4b08e7f37c696b924da820...5807.0
/data/data/####/1373037256.dex
/data/data/####/1373037256.dex.flock (deleted)
/data/data/####/1373037256.jar.ab04210df573be1507691bc5b569031f
/data/data/####/147ebb405d05c4094455320179a2e379990e4a211247c31....0.tmp
/data/data/####/1cfc9d5caf98284145807c2a7b6f3c090a5e1617ab100ba....0.tmp
/data/data/####/20071d6e7e64f8f5b5e339a32afdeeb28ec10d48b1dbd55...44dc.0
/data/data/####/2063315211.dex
/data/data/####/2063315211.dex.flock (deleted)
/data/data/####/2063315211.jar
/data/data/####/2063315211.jar.temp
/data/data/####/2948121486a04ae4b74858ef7877e0856050194ea963241....0.tmp
/data/data/####/2948121486a04ae4b74858ef7877e0856050194ea963241...e50f.0
/data/data/####/2c3be788cddeb6ef2d94c54b149978cdd85e0d61bcd8261...55c2.0
/data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
/data/data/####/38762f9350f3a468647ef47c7af567ca9ceef962c6e732d...0e64.0
/data/data/####/3b7371c07eefca10f31786447962b669
/data/data/####/3f9882c73ee9182891c6ee2ca89d76d2d71863e931adc38...4078.0
/data/data/####/476dcaa8897f01f30d881104365bd0fd524adbae086b41a...904a.0
/data/data/####/6961fdf82d63dfe0c01dd69da59eaa61dace64f5f7aa710....0.tmp
/data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
/data/data/####/6b2fe19e66c766ad9215fe06f19484c548987405acae404....0.tmp
/data/data/####/6b2fe19e66c766ad9215fe06f19484c548987405acae404...6fe7.0
/data/data/####/6ce2247dd80f8e099b72be4183c108735967f4bf782ea25....0.tmp
/data/data/####/6ce2247dd80f8e099b72be4183c108735967f4bf782ea25...2bc5.0
/data/data/####/6e95dfb1423f2d7e07ff82eb4b54891b12714cbb7f427b3....0.tmp
/data/data/####/6e95dfb1423f2d7e07ff82eb4b54891b12714cbb7f427b3...d006.0
/data/data/####/7ca108caed86f94846722c56f41ddcd5e3b22750226cff1...52de.0
/data/data/####/7ce2c8e3ae028b86853b8fb6206a681e
/data/data/####/7cf239c5b6c6ab03927a2881e7eaddbdae1844fb47ed6c2...61f5.0
/data/data/####/80609ea1f48bc7f1b682c9ae3c325d2d95eca83d0a483c1...5058.0
/data/data/####/8b71719038b653c912999e35f05875fc9c336004fcf6726....0.tmp
/data/data/####/8b71719038b653c912999e35f05875fc9c336004fcf6726...7bc2.0
/data/data/####/8fbe7cb6276a92748d6bc4ab40266560c83a3486950563c....0.tmp
/data/data/####/8fbe7cb6276a92748d6bc4ab40266560c83a3486950563c...3698.0
/data/data/####/962b8c681f9b07e1de19283299cd96bdb9c00cc140c7085...0da4.0
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/LocalConfigSharePreference.xml
/data/data/####/Utils.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a2fe9e702db75deead688c9bc77cc03e2a56145fa795dc4...b50f.0
/data/data/####/a9b15ebe745fdc2b53c4e1216798ad90f32475e09590adb....0.tmp
/data/data/####/a9b15ebe745fdc2b53c4e1216798ad90f32475e09590adb...5c64.0
/data/data/####/aa350dbec6510496fd12f8a5bb946f283766d9746451331...1ca8.0
/data/data/####/ad01749041509323
/data/data/####/appSx.xml
/data/data/####/b6d94ac2b7e15c5aa6b84d8a6e127a5a9309477a4ed6201....0.tmp
/data/data/####/b6d94ac2b7e15c5aa6b84d8a6e127a5a9309477a4ed6201...ba65.0
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/c397a23d99e5ac978d2616036264f49c7bc7044fd19e1b8...2593.0
/data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
/data/data/####/com.huawei.himovceif268_preferences.xml
/data/data/####/config.db
/data/data/####/config.dex
/data/data/####/config.dex.flock (deleted)
/data/data/####/crashrecord.xml
/data/data/####/crypto.KEY_256.xml
/data/data/####/e916413b094af9b7c470945b552d41b8.dex
/data/data/####/e916413b094af9b7c470945b552d41b8.dex.flock (deleted)
/data/data/####/e916413b094af9b7c470945b552d41b8.jar
/data/data/####/e925372acabdd3b44736b54cc23c147f67b16c9142b108f....0.tmp
/data/data/####/e925372acabdd3b44736b54cc23c147f67b16c9142b108f...573f.0
/data/data/####/ec6806724ccc8d744a51b32662df957f16afeed4ed2d7ae....0.tmp
/data/data/####/ec6806724ccc8d744a51b32662df957f16afeed4ed2d7ae...1b2d.0
/data/data/####/eeb7775c55cd34abcba13ee7dbc2f8c1b6ae60ed9bffb9a...e7d3.0
/data/data/####/f50effb31d6f9d54a72c1af95aa293735e771f23868e8dc...8b14.0
/data/data/####/fe380c05f02bdedf5ab556be1196322450938e237b4479d....0.tmp
/data/data/####/fe380c05f02bdedf5ab556be1196322450938e237b4479d...cf43.0
/data/data/####/ff_sp.xml
/data/data/####/hawk.kva
/data/data/####/hawk.kvb
/data/data/####/journal
/data/data/####/load_time.xml
/data/data/####/local_crash_lock
/data/data/####/log1083860641749041506879
/data/data/####/log1083860641749041534096
/data/data/####/log1bc45def45d0cb14e14ab4f87050b44a
/data/data/####/log3f66076d2f1647f487efc88fa7088fe9
/data/data/####/log719eae1694c574b78018ca30f4070d73
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/okgo.db-journal
/data/data/####/plugin_file.name
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak (deleted)
/data/data/####/spUtils.xml
/data/data/####/woggSite
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/sh -c getprop
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/files/.kad
chmod 777 /data/user/0/<Package>/cache/woggSite
getprop
logcat -d -v threadtime
sh

Loads the following dynamic libraries:

.ftyfnw1zjywnpj70
.ftyfnw95wjv39q5g
libBugly_Native
libconceal
libgit-platinum
libijkffmpeg
libijksdl
libjp
libmitv
libplayer
libquickjs-android-wrapper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Gets information about network.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней