Android.RemoteCode.8297

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.8274

Downloads the following detected threats from the Internet:

Android.RemoteCode.8274

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.api.nexta####.com:80
TCP(HTTP/1.1) 39.1####.213.47:7001
TCP(HTTP/1.1) cdn.nexta####.com:80
TCP(HTTP/1.1) 4####.94.13.7:80
TCP(HTTP/1.1) 1####.57.155.33:80
TCP(HTTP/1.1) api.cdn.nexta####.com:80
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) worldti####.org:443
TCP(TLS/1.0) 64.2####.164.95:443
TCP(TLS/1.0) ccs.u####.com.####.com:443
TCP(TLS/1.0) 1####.250.150.113:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) 1####.194.220.95:443
TCP(TLS/1.0) 1####.177.14.94:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) h.t####.qq.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) a####.u####.com.####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) rr6---s####.g####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.2) 1####.177.14.94:443
TCP(TLS/1.2) 1####.194.73.139:443
TCP(TLS/1.2) 1####.250.150.113:443
TCP(TLS/1.2) 1####.194.221.95:443
TCP(TLS/1.2) 1####.194.220.95:443
UDP 1####.194.220.95:443
TCP ms####.m.u####.com:443
UDP rr2---s####.g####.com:443
UDP 1####.201.50.6:3479
UDP 1####.100.243.133:12557
UDP 64.2####.164.95:443
UDP 4####.94.7.87:3478

DNS requests:

a####.u####.com
amdc####.m.u####.com
and####.b####.qq.com
api.cdn.nexta####.com
ccs.u####.com
cdn.nexta####.com
h.t####.qq.com
m####.go####.com
msg.umengc####.com
of####.u####.com
rr2---s####.g####.com
rr6---s####.g####.com
rr9---s####.g####.com
t####.api.nexta####.com
u####.u####.com
umen####.m.ta####.com
ut####.u####.com
worldti####.org
www.b####.com

HTTP GET requests:

api.cdn.nexta####.com/api/live/v1/pindaos?s_t=####&s_m=####
cdn.nexta####.com/app/apk/adJson.txt
cdn.nexta####.com/app/config/live/splayer_d_c.txt
cdn.nexta####.com/app/config/live/y4c.json
cdn.nexta####.com/app/config/playback/config_support_ts.json
cdn.nexta####.com/app/uploads/2024-01-26/11647ffb-abb3-4a74-a0f5-841a406...
cdn.nexta####.com/app/uploads/2024-03-07/ae33e686-7ddc-469b-b794-8f71691...
cdn.nexta####.com/app/uploads/2024-03-11/718989c3-d3e2-434a-a3ab-b238a73...
cdn.nexta####.com/app/uploads/2024-03-13/c1fa547d-494b-42e4-b61b-e4ed5d5...
t####.api.nexta####.com/kdflwelidsnlaisanasdnlew3rmsf
worldti####.org:443/api/ip
www.a.sh####.com:443/

HTTP POST requests:

a####.u####.com.####.com:443/v3/a/audid/req
and####.b####.qq.com:443/rqd/async?aid=####
ccs.u####.com.####.com:443/aa
def####.duals####.cn.####.com:443/log/switch
h.t####.qq.com:443/kv
msg.umengc####.com:443/v3/tag/add
new-####.u####.com:443/anti/postZdata
new-####.u####.com:443/anti/updateZdata
u####.u####.com:443/umpx_push_launch
u####.u####.com:443/umpx_push_register
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.font3844-3844-0
/data/data/####/.font3844-3844-0 (deleted)
/data/data/####/.font4114-4114-0
/data/data/####/.imprint
/data/data/####/1004
/data/data/####/1a410fd803196e367754b5bd390005c8.0.tmp
/data/data/####/1a410fd803196e367754b5bd390005c8.1.tmp
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK.xml.bak
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Agoo_AppStore.xml.bak
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/CP_cache.xml
/data/data/####/LIVE_CONFIG.xml
/data/data/####/LIVE_CONFIG.xml.bak
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PERMANENT_DATA.xml
/data/data/####/PLAY.xml
/data/data/####/Splayer_config.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/accs.db-journal
/data/data/####/api.prefs.xml
/data/data/####/api.prefs.xml.bak
/data/data/####/b128703cd3a465203f3b09db2a628f3b.0.tmp
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1
/data/data/####/b128703cd3a465203f3b09db2a628f3b.1.tmp
/data/data/####/beb9b73ecbfeaf6e1d7561f4c378570f.0.tmp
/data/data/####/beb9b73ecbfeaf6e1d7561f4c378570f.1
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/conf.dat
/data/data/####/crashrecord.xml
/data/data/####/cuuid.xml
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.0.tmp
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1
/data/data/####/db4cc779f4f82a5625bfbeed79d74d2e.1.tmp
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/epg.dex
/data/data/####/epg.dex.flock (deleted)
/data/data/####/epg.jar
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/hdl_v2.jar
/data/data/####/i==1.2.0&&1.0.104_1710740502438_dW5pZnlfbG9ncw==;.log
/data/data/####/i==1.2.0&&1.0.104_1710740553643_dW5pZnlfbG9ncw==;.log
/data/data/####/journal
/data/data/####/kk.xml
/data/data/####/libtvcore.so
/data/data/####/local_crash_lock
/data/data/####/manual_bugly_trace_1710740516409.txt
/data/data/####/manual_bugly_trace_1710740520935.txt
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/p==6.6.2&&1.0.104_1710740501495_dW1weF9wdXNoX3J...y;.log
/data/data/####/p==6.6.2&&1.0.104_1710740512155_dW1weF9wdXNoX2x...=;.log
/data/data/####/player.tmp
/data/data/####/plugin.dex
/data/data/####/plugin.dex.flock (deleted)
/data/data/####/plugin.jar
/data/data/####/plugin.tmp
/data/data/####/pp.jar
/data/data/####/proc_auxv
/data/data/####/risk_user_info.xml
/data/data/####/risk_user_info.xml.bak (deleted)
/data/data/####/settings.prefs.xml
/data/data/####/spider_prefs.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_push_ut.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_push.xml
/data/data/####/umeng_push.xml.bak
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/z==1.2.0&&1.0.104_1710740492385_emNmZw==;.log
/data/media/####/uuid.data
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop
getprop
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
logcat -d -v threadtime
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libBugly_Native
libplayer
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Gets information about installed apps.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial