Android.RemoteCode.8015

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Proxy.44.origin
Android.Proxy.45.origin
Android.RemoteCode.345.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) d####.100u####.com.####.net:80
TCP(HTTP/1.1) p####.fengmiz####.com:80
TCP(HTTP/1.1) l####.fengmiz####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) 1####.28.228.62:14305
TCP(HTTP/1.1) cpu.f####.skywort####.####.com:80
TCP(HTTP/1.1) jar.fengmiz####.com.####.cn:80
TCP(HTTP/1.1) 1####.9.145.224:3918
TCP(HTTP/1.1) u####.fengmiz####.cn:80
TCP(HTTP/1.1) ad.m####.cn:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) ad####.fengman####.com:80
TCP(HTTP/1.1) cig.x.adan####.com:80
TCP(HTTP/1.1) 7.1####.xd.####.com:80
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) 1####.194.179.152:443
TCP(TLS/1.0) pos.zblqo####.com:8657
TCP(TLS/1.0) 64.2####.162.95:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.0) d####.beev####.tv:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) 64.2####.163.95:443
TCP(TLS/1.0) 1####.194.222.95:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.2) 64.2####.162.95:443
TCP(TLS/1.2) 64.2####.165.94:443
TCP(TLS/1.2) 1####.194.221.139:443
UDP as2.binst####.live:3924
UDP 1.2####.122.9:24432
UDP 1####.57.141.178:9483
UDP 1####.250.226.121:9350
UDP 1####.39.73.38:8115
TCP 1.1####.194.54:34863
UDP 1####.199.188.244:23864
UDP 2####.68.49.40:1028
UDP as2.binst####.live:3925
UDP 42.2####.107.176:13547
TCP 1####.175.112.199:38683
TCP 1####.181.235.177:39877
UDP 1####.198.239.100:13969
UDP 2####.101.33.248:9762
UDP as4.binst####.live:13
UDP 1####.230.224.127:3380
UDP 1####.197.31.199:1425
UDP 36.1####.173.179:18136
UDP 1####.19.57.203:4313
UDP 2####.101.140.218:7702
UDP 1####.235.105.185:8586
UDP 1####.14.128.140:20357
UDP 1####.63.183.94:4032
UDP 1####.148.112.54:2586
UDP 1.1####.207.138:2047
TCP 60.0.2####.204:38466
UDP 1####.0.9.254:36192
UDP 1####.179.183.165:6702
UDP as1.binst####.live:13
UDP 1####.44.182.90:7809
UDP 4####.48.94.171:19395
UDP 1####.0.9.1:137
UDP 2####.255.255.250:1900
TCP 4####.86.97.171:38203
UDP 1.2####.1.78:23600
UDP 1####.12.245.234:17760
UDP 1####.202.220.28:34726
UDP 1####.19.61.117:28558
UDP 59.35.1####.128:11833
UDP 2####.101.6.237:9915
UDP 1.82.1####.234:5858
UDP 2####.90.3.3:11129
UDP 1####.154.145.27:15165
UDP 1####.29.171.6:9954
UDP 1####.124.234.31:27909
UDP 1####.8.50.238:12335
UDP 1####.55.62.2:5466
UDP 1####.14.229.201:2828
UDP 1####.226.139.198:9641
UDP 2####.163.73.115:28767
UDP 42.2####.185.142:9863
UDP 1####.62.209.196:3489
UDP 1####.9.205.149:8976
UDP tm3.binst####.live:3925
UDP hs9.hangzho####.com:16000
UDP tm3.binst####.live:3923
UDP 1####.89.114.22:12112
UDP 2####.74.202.54:23963

DNS requests:

7.1####.xd.####.com
a####.u####.com
ad####.fengman####.com
ad.m####.cn
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
c####.dc.100u####.com
cig.x.adan####.com
cpu.f####.skywort####.####.com
d####.100u####.com
d####.beev####.tv
er####.u####.com
g3.l####.com
hs9.hangzho####.com
img.m####.cn
jar.fengmiz####.com
l####.fengmiz####.com
log.x.adan####.com
p####.fengmiz####.com
p2####.fengmiz####.com
pos.zblqo####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
u####.fengmiz####.cn
u####.u####.com
w####.pcon####.com.cn
www.b####.com

HTTP GET requests:

ad.m####.cn/schedule/api/getIpInfo?t=####&snNo=####&deviceId=####&checks...
ad.m####.cn/schedule/api/listNewAdSpace?channelId=####&modelId=####&mac=...
ad.m####.cn/schedule/api/v4/listAllMaterial?regionId=####&cityId=####&ch...
ad.m####.cn/switch/api/listSwitch?channelId=####&projectName=####&modelI...
cpu.f####.skywort####.####.com/skyworthdigital-mipt/000/0NuNUOAbCf/Skywo...
d####.100u####.com.####.net/sdkfile/239214dc0e620b9c7d77f01eab58e3ec.apk...
d####.100u####.com.####.net/sdkfile/63d2a0466b49cd3cf3306703a8368f27.apk...
d####.100u####.com.####.net/sdkfile/78479b79d677a1b2af6ebc3d75b50105.jar...
d####.100u####.com.####.net/sdkfile/963215350b45dcec76b719f3188ed64f.apk...
g3.l####.com/r?format=####
jar.fengmiz####.com.####.cn/adsys/pic/04d/52818b792fe64d28a3e87e1f8c3fd8...
jar.fengmiz####.com.####.cn/adsys/pic/108/19236834889e4552867b76ad1520b2...
jar.fengmiz####.com.####.cn/adsys/pic/110/e7b1be22f2f84e37ab89f0e96ef1fc...
jar.fengmiz####.com.####.cn/adsys/pic/252/306fda4bfd3449178108842fc87974...
jar.fengmiz####.com.####.cn/adsys/pic/29c/86e13100a134441ba27d31fee5cec5...
jar.fengmiz####.com.####.cn/adsys/pic/2d3/6f81731b108f48c9addccb622d42ee...
jar.fengmiz####.com.####.cn/adsys/pic/368/9f9fdcd52904454bb3d00549fa1f3f...
jar.fengmiz####.com.####.cn/adsys/pic/3b7/e2abfebf29384c3fa79f9a51ad6114...
jar.fengmiz####.com.####.cn/adsys/pic/462/ee7d3f80a19c489ab96dc6c870c0b5...
jar.fengmiz####.com.####.cn/adsys/pic/4b1/2f858170fa4d469c88dad1031b9193...
jar.fengmiz####.com.####.cn/adsys/pic/510/0e622c2b03394a56ad4bbf0dd4a09c...
jar.fengmiz####.com.####.cn/adsys/pic/514/4312344b31cc4726a3cca47ef01b63...
jar.fengmiz####.com.####.cn/adsys/pic/563/050ee91a8589413ab87ef75843d7ce...
jar.fengmiz####.com.####.cn/adsys/pic/563/b2fbc3aadb2f44a2b6af7400a550fe...
jar.fengmiz####.com.####.cn/adsys/pic/67d/15da1e4a6171437f9b1fd9d79c7278...
jar.fengmiz####.com.####.cn/adsys/pic/7d4/a9c9669f49b24a3fa7cf2d5ae3ed0c...
jar.fengmiz####.com.####.cn/adsys/pic/829/5ccb9c59807a4414a0d8f7be789048...
jar.fengmiz####.com.####.cn/adsys/pic/9b1/de9f429cdea84155a6aa84b9f5ee23...
jar.fengmiz####.com.####.cn/adsys/pic/9d0/f0151a9e4d694113bf354b56b08ca3...
jar.fengmiz####.com.####.cn/adsys/pic/b30/dddd8726530f4bce8eecff411ca411...
jar.fengmiz####.com.####.cn/adsys/pic/b5d/1f5625ad85a24e32a25fd5b6cb0096...
jar.fengmiz####.com.####.cn/adsys/pic/dd1/e7d1449a436f40aa8b1dcc6245dceb...
jar.fengmiz####.com.####.cn/adsys/pic/ea1/3c46af9c99b14dfcb418356d733a8d...
jar.fengmiz####.com.####.cn/adsys/pic/f4b/df7afb5d4c6042eaa9a3a570f6fddd...
jar.fengmiz####.com.####.cn/live/201901/1bf46cf22015470bb32999a026ba06a1...
jar.fengmiz####.com.####.cn/live/202106/e1ad88b5e02a4fd0a1d448c119466652...
jar.fengmiz####.com.####.cn/live/202111/5d3d3fb2c27a4c7185e294ea86ad173a...
jar.fengmiz####.com.####.cn/p2pstat/202106/e0a5581dd514409bab98c55ed0b51...
l####.fengmiz####.com/api/service/soInfo.action?type=####
l####.fengmiz####.com/beeLiveRec/api/listPauseBanner.action
l####.fengmiz####.com/liveApi/api/v2/channelDetail.action?channelId=####...
l####.fengmiz####.com/liveApi/api/v2/hotList
l####.fengmiz####.com/liveApi/api/v2/jarsoInfo.action?type=####
l####.fengmiz####.com/liveApi/api/v2/listClassAndChannelv2.action?hideCa...
l####.fengmiz####.com/liveApi/api/v2/listScheduleByClass.action?batchCha...
l####.fengmiz####.com/liveApi/api/v2/liveConfig.action
l####.fengmiz####.com/liveApi/api/v2/liveTester.action
l####.fengmiz####.com/liveApi/api/v2/player?androidVersion=####&software...
l####.fengmiz####.com/liveApi/api/v2/uploadPlayStatus.action?channelName...
l####.fengmiz####.com/liveApi/service/soInfo.action?type=####
l####.fengmiz####.com/oms/download/clientVersion.action?sdkLevel=####&pk...
l####.fengmiz####.com/switch/api/listSwitch?channelId=####&projectName=#...
p####.fengmiz####.com/p2pstat/api/getJarInfo
u####.fengmiz####.cn/liveUser/client/cleanShareLiveUrl
w####.pcon####.com.cn/ipJson.jsp?json=####
www.a.sh####.com:443/

HTTP HEAD requests:

l####.fengmiz####.com/api/tvlive2.0/tvliveTest.action

HTTP POST requests:

7.1####.xd.####.com/x/10075/a05
ad####.fengman####.com/v1/c
ad####.fengman####.com/v1/t
cig.x.adan####.com/x/r/cig?k=####
cig.x.adan####.com/x/r/log/lpfAd
d####.100u####.com.####.net/sdk
d####.100u####.com.####.net:443/pluginsync
d####.100u####.com.####.net:443/reportcomp
d####.100u####.com.####.net:443/sdk
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
l####.fengmiz####.com/liveApi/api/v2/uploadChannelStatus
l####.fengmiz####.com/liveApi/api/v2/uploadplayer?channel=####
new-####.u####.com:443/api/postZdata
pos.zblqo####.com:8657/config?&st=####
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg
w####.pcon####.com.cn/ipJson.jsp?json=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/014982f2d1a9bdd3881d32eaa5187691.0.tmp
/data/data/####/014982f2d1a9bdd3881d32eaa5187691.1
/data/data/####/0b20037d88c975735e7c00453c5868d0.0.tmp
/data/data/####/0b20037d88c975735e7c00453c5868d0.1
/data/data/####/0b20037d88c975735e7c00453c5868d0.1.tmp
/data/data/####/0c894b24024e5f9ef1171b7bc315d3b8
/data/data/####/12b665002ffbc156fba8805361999de1.0.tmp
/data/data/####/12b665002ffbc156fba8805361999de1.1
/data/data/####/149ab74dc1480c934fbfd8deddef2dfc
/data/data/####/1682708935825
/data/data/####/1682708935861
/data/data/####/1682708935909
/data/data/####/1753926458.dex
/data/data/####/1753926458.dex.flock (deleted)
/data/data/####/1753926458.jar
/data/data/####/1753926458.jar.temp
/data/data/####/18a0f8a14648ac12b65428a19d454241.0.tmp
/data/data/####/18a0f8a14648ac12b65428a19d454241.1
/data/data/####/18a0f8a14648ac12b65428a19d454241.1.tmp
/data/data/####/3438967395.apk
/data/data/####/3438967395.apk.temp
/data/data/####/3438967395.dex
/data/data/####/3438967395.dex.flock (deleted)
/data/data/####/3454458149.apk
/data/data/####/3454458149.apk.temp
/data/data/####/3454458149.dex
/data/data/####/3454458149.dex.flock (deleted)
/data/data/####/3981590050.apk
/data/data/####/3981590050.apk.temp
/data/data/####/3981590050.dex
/data/data/####/3981590050.dex.flock (deleted)
/data/data/####/4ba629aa1570b403a2886e792379cac1.0
/data/data/####/4ba629aa1570b403a2886e792379cac1.0.tmp
/data/data/####/4ba629aa1570b403a2886e792379cac1.1
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/74cea724b5ad278d58dea525406fa487.0.tmp
/data/data/####/74cea724b5ad278d58dea525406fa487.1
/data/data/####/74cea724b5ad278d58dea525406fa487.1.tmp
/data/data/####/7c3102b67c11bf0f13eac042aca571a7.0.tmp
/data/data/####/7c3102b67c11bf0f13eac042aca571a7.1
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.0.tmp
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.1
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.1.tmp
/data/data/####/884c5171afa80056cfd10e25f5a2c362.0.tmp
/data/data/####/884c5171afa80056cfd10e25f5a2c362.1
/data/data/####/884c5171afa80056cfd10e25f5a2c362.1.tmp
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.0.tmp
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.1
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.1.tmp
/data/data/####/9dfaa2b2f4f436bf351bbed75591dc0e.0.tmp
/data/data/####/9dfaa2b2f4f436bf351bbed75591dc0e.1
/data/data/####/BeeUrlManager.xml
/data/data/####/EVIL0OBIHZIMGNEF0MOC.ss
/data/data/####/EVIL0OBIHZIMGNEF0MOC.st
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Y29uZmlnXzU5MDk3NzY2ZjQzZTQ4N2NlMTAwMTIxYw.sp
/data/data/####/Y29uZmlnXzU5MDk3NzY2ZjQzZTQ4N2NlMTAwMTIxYw.sp.bak
/data/data/####/a==9.4.0&&2.17.03_1682708931539_dW5pZnlfbG9ncw==;.log
/data/data/####/abc.dex
/data/data/####/abc.dex.flock (deleted)
/data/data/####/abc.jar
/data/data/####/ad.db
/data/data/####/ad.db-journal
/data/data/####/b36091013a71e54b8d5846e220843612.0.tmp
/data/data/####/b36091013a71e54b8d5846e220843612.1
/data/data/####/b36091013a71e54b8d5846e220843612.1.tmp
/data/data/####/ca1f8ed15d79cb45a02530f3afbffd60.0.tmp
/data/data/####/ca1f8ed15d79cb45a02530f3afbffd60.1
/data/data/####/cdt.wa
/data/data/####/com.fengmizhibo.live_preferences.xml
/data/data/####/com.fengmizhibo.live_preferences.xml.bak
/data/data/####/com.fengmizhibo.liveax.xml
/data/data/####/com.fengmizhibo.liveax.xml.bak
/data/data/####/cr.wa
/data/data/####/device_mac_address_config.xml
/data/data/####/deviceid
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/dt.wa
/data/data/####/edaa106356fb37395a355e4d3b5cf339.0.tmp
/data/data/####/edaa106356fb37395a355e4d3b5cf339.1
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid3547
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/i==1.2.0&&2.17.03_1682708931612_dW5pZnlfbG9ncw==;.log
/data/data/####/info.xml
/data/data/####/jikeConfig.xml
/data/data/####/journal
/data/data/####/libbv.so
/data/data/####/libbv.so.zip (deleted)
/data/data/####/libfmcore.so
/data/data/####/libfmcore.so.zip (deleted)
/data/data/####/libztvb321.2.2.2.so
/data/data/####/mifeng_live.db-journal
/data/data/####/p2pnat.jar
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/pid.txt
/data/data/####/proc_auxv
/data/data/####/sendlock
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.4.0&&2.17.03_1682708931297_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/unknown.xml
/data/data/####/urlloader.dex
/data/data/####/urlloader.dex.flock (deleted)
/data/data/####/urlloader.jar
/data/data/####/ver
/data/data/####/wa_gzip_1_1_3712_3946_1682708995303
/data/data/####/wa_gzip_1_1_3712_6790_1682708944360
/data/data/####/wa_none_1_1_3712_5206_1682708935296 (deleted)
/data/data/####/z==1.2.0&&2.17.03_1682708929798_emNmZw==;.log
/data/media/####/050ee91a8589413ab87ef75843d7ceeb.png
/data/media/####/0e622c2b03394a56ad4bbf0dd4a09c77.jpg
/data/media/####/15da1e4a6171437f9b1fd9d79c727835.png
/data/media/####/19236834889e4552867b76ad1520b2b3.png
/data/media/####/1f5625ad85a24e32a25fd5b6cb0096df.png
/data/media/####/2f858170fa4d469c88dad1031b9193cd.png
/data/media/####/306fda4bfd3449178108842fc87974f3.png
/data/media/####/3c46af9c99b14dfcb418356d733a8dc0.png
/data/media/####/4312344b31cc4726a3cca47ef01b63f5.png
/data/media/####/52818b792fe64d28a3e87e1f8c3fd803.png
/data/media/####/5ccb9c59807a4414a0d8f7be789048cb.png
/data/media/####/6f81731b108f48c9addccb622d42ee10.png
/data/media/####/86e13100a134441ba27d31fee5cec5ed.webp
/data/media/####/9f9fdcd52904454bb3d00549fa1f3f29.png
/data/media/####/a9c9669f49b24a3fa7cf2d5ae3ed0c9d.webp
/data/media/####/b2fbc3aadb2f44a2b6af7400a550fe28.png
/data/media/####/dddd8726530f4bce8eecff411ca411e3.png
/data/media/####/de9f429cdea84155a6aa84b9f5ee236b.png
/data/media/####/df7afb5d4c6042eaa9a3a570f6fddd67.png
/data/media/####/dvc
/data/media/####/e2abfebf29384c3fa79f9a51ad6114de.webp
/data/media/####/e7b1be22f2f84e37ab89f0e96ef1fcfa.webp
/data/media/####/e7d1449a436f40aa8b1dcc6245dceb44.png
/data/media/####/ee7d3f80a19c489ab96dc6c870c0b50a.webp
/data/media/####/f0151a9e4d694113bf354b56b08ca3c4.png
/data/media/####/file.test (deleted)
/data/media/####/sysid.dat
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
arp -a
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/1753926458.jar
chmod 777 /data/user/0/<Package>/files/.honor/3438967395.apk
chmod 777 /data/user/0/<Package>/files/.honor/3454458149.apk
chmod 777 /data/user/0/<Package>/files/.honor/3981590050.apk
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Loads the following dynamic libraries:

libcrashsdk
libimagepipeline
libpixel
libtvcore
libumeng-spy
libztvb321.2.2.2

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial