Android.RemoteCode.8284

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.337.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 60.2####.242.79:8091
TCP(HTTP/1.1) 1####.37.24.57:10001
TCP(HTTP/1.1) 1.1####.11.240:7862
TCP(HTTP/1.1) 1####.71.99.107:9002
TCP(HTTP/1.1) 1####.37.24.57:9002
TCP(HTTP/1.1) opencdn####.jom####.com:80
TCP(HTTP/1.1) mo####.b####.com:80
TCP(TLS/1.0) p####.ad####.com.####.com:443
TCP(TLS/1.0) mo####.b####.com:443
TCP(TLS/1.0) dc.si####.cn:443
TCP(TLS/1.0) adser####.si####.cn:443
TCP(TLS/1.0) o####.e.kuai####.com:443
TCP(TLS/1.0) c####.baidust####.com.####.com:443
TCP(TLS/1.0) l####.cdn.bc####.####.com:443
TCP(TLS/1.0) 1####.251.1.94:443
TCP(TLS/1.0) n.si####.cn.####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) opencdn####.jom####.com:443
TCP(TLS/1.0) g####.gif####.com:443
TCP(TLS/1.0) regi####.app.maoyunc####.com:443
TCP(TLS/1.0) to####.ctobsn####.com.####.net:443
TCP(TLS/1.0) 64.2####.163.95:443
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) m####.vo####.com.####.com:443
TCP(TLS/1.0) 64.2####.162.102:443
TCP(TLS/1.2) 74.1####.131.113:443
TCP(TLS/1.2) 64.2####.162.102:443
TCP(TLS/1.2) 1####.194.73.95:443
TCP(TLS/1.2) 1####.251.1.94:443
TCP api-ac####.pangoli####.com.####.com:443
UDP 64.2####.163.95:443
TCP sf3-fe####.pglstat####.com.####.com:443
UDP rr2---s####.g####.com:443
UDP 1####.194.73.95:443
TCP log####.pangoli####.com.####.com:443

DNS requests:

adser####.si####.cn
api-ac####.pangoli####.com
api-ac####.pangoli####.com
c####.baidust####.com
cp####.b####.com
dc.si####.cn
digital####.google####.com
g####.gif####.com
gro####.pangoli####.com
l####.cdn.bc####.com
log####.pangoli####.com
m####.vo####.com
mo####.b####.com
n.si####.cn
nadv####.b####.com
nadvi####.b####.com
o####.e.kuai####.com
p####.ad####.com
p####.adu####.com
regi####.app.maoyunc####.com
rr2---s####.g####.com
rr9---s####.g####.com
sf3-fe####.pglstat####.com
to####.ctobsn####.com
ulog####.gif####.com
w1.ks####.com
zt.gif####.com

HTTP GET requests:

adser####.si####.cn:443/extconfig?appId=####&sdkVersion=####
c####.baidust####.com.####.com:443/cpro/logo/sdk/mob-adIcon_2x.png
c####.baidust####.com.####.com:443/cpro/logo/sdk/new-bg-logo.png
l####.cdn.bc####.####.com:443/static/aden_sdk_cache.b647449.css
mo####.b####.com/ads/pa/8/reconfig/__pasys_remote_banner.php?v=####&bdr=...
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770623=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770626=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770627=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770640=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770642=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770649=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770650=####
mo####.b####.com/cpro/ui/mads.php?code2=####&b1709791770651=####
mo####.b####.com:443/ads/preload.php
n.si####.cn.####.com:443/mraid/prod/6661/index.dc42b55a.html
n.si####.cn.####.com:443/mtsvideo/d8253d5b3c3b4745828c82701287eee9/verti...
o####.e.kuai####.com:443/rest/e/system/speed
opencdn####.jom####.com/a3b9484aba06e001c00475f337001596_1080_1920.mp4?p...
opencdn####.jom####.com:443/05016ff06995ae4c241da638a715430c_720_1280_ca...
opencdn####.jom####.com:443/33941815ceda22bbc175bd6a6316be94_720_1280_ca...
opencdn####.jom####.com:443/a94b6701a7c576c140d41698eaa964cc.jpg
opencdn####.jom####.com:443/e21c508b77f331828c7fa5653c6686bd.jpg
opencdn####.jom####.com:443/static/assets/sdk-cache.cache-lottie.94178d4...
p####.ad####.com.####.com:443/kos/nlav11213/hybrid-zip/20220630-143109-a...
p####.ad####.com.####.com:443/udata/pkg/KS-Android-KSAdSDk/offline_compo...
p####.ad####.com.####.com:443/udata/pkg/KS-Android-KSAdSDk/sdk/ksDynamic...
p####.ad####.com.####.com:443/udata/pkg/KS-Android-KSAdSDk/so/exception/...
to####.ctobsn####.com.####.net:443/service/2/app_alert_check/?aid=####&t...

HTTP POST requests:

adser####.si####.cn:443/ad/v4?appId=####&sdkVersion=####
adser####.si####.cn:443/s/config?appId=####&sdkVersion=####
adser####.si####.cn:443/strategy/v6?appId=####&sdkVersion=####
adser####.si####.cn:443/w/config?appId=####&sdkVersion=####
adser####.si####.cn:443/waterfall/v1?appId=####&sdkVersion=####
dc.si####.cn:443/log?appId=####&sdkVersion=####
g####.gif####.com:443/rest/infra/gdfp/a/q?timestamp=####&secretkey=####&...
m####.vo####.com.####.com:443/api/ad/union/mediation/config/
m####.vo####.com.####.com:443/api/ad/union/mediation/stats/
m####.vo####.com.####.com:443/ri/report_otob?lc_id=####&platform=####&de...
o####.e.kuai####.com:443/rest/e/v3/open/config
o####.e.kuai####.com:443/rest/e/v3/open/sdk2
o####.e.kuai####.com:443/rest/e/v3/open/univ
to####.ctobsn####.com.####.net:443/service/2/app_log/?device_platform=##...
to####.ctobsn####.com.####.net:443/service/2/device_register_only/?aid=#...
to####.ctobsn####.com.####.net:443/service/2/log_settings/?device_platfo...

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.bak
/data/data/####/.fsgkea
/data/data/####/.hptc_kache_.viva.time_todo
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.msf3_31d659304230575c05a3c5ebd11c8d076e58118c
/data/data/####/.msf3_4101dff45425a5380675454177d6e6b4e29a5ebb
/data/data/####/.msf3_6f05be3a01810a12a0dce73b48e953e9237e0a2b
/data/data/####/.msf3_904f2636614f90c4f53ea2df4c3b31d5d606a64b
/data/data/####/.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
/data/data/####/.msp_589c22335a381f122d129225f5c0ba3056ed5811
/data/data/####/.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
/data/data/####/.old_file_converted
/data/data/####/20220630-143109-ad-union-stimulate-video-page.zip
/data/data/####/20220630-143109-ad-union-stimulate-video-page.zip.temp
/data/data/####/46c389d1afc1f71b90f460e0ae853b17.tmp
/data/data/####/50b973dd0dbbf7e3abdfdaf5ffcb0677.tmp
/data/data/####/705add3ecd0197f2b88943a82db10f640105cfb2
/data/data/####/AndroidVideoCache.db-journal
/data/data/####/BuriedPointConfig.xml
/data/data/####/FlutterSharedPreferences.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/WindAdSettings.xml
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__x_adsdk_agent_header__.xml.bak
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/__xadsdk__remote__final__running__.dex
/data/data/####/__xadsdk__remote__final__running__.dex.flock (deleted)
/data/data/####/__xadsdk__remote__final__running__.jar
/data/data/####/_manifest_.json
/data/data/####/ad-union-stimulate-video-page-0fc4975290.html
/data/data/####/ad-union-stimulate-video-page.01051b1f7cb5a58e9b9e.js
/data/data/####/base-1.apk
/data/data/####/bd_embed_m_log.db-journal
/data/data/####/bd_sp_file.xml
/data/data/####/bd_sp_file.xml.bak
/data/data/####/bd_sp_logo.xml
/data/data/####/bd_sp_logo.xml.bak
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.oat
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/com.byted.pangle.apk
/data/data/####/com.sigmob.Settings.xml
/data/data/####/com.viva.time_todo_preferences.xml
/data/data/####/com.wind.Settings.xml
/data/data/####/compFully.dex
/data/data/####/config
/data/data/####/downloader.db-journal
/data/data/####/dynamic_monitor_info.kva
/data/data/####/dynamic_monitor_info.kvb
/data/data/####/dynamic_monitor_info.xml
/data/data/####/dynamic_monitor_info.xml.bak
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/evt_upload_info.xml
/data/data/####/freqctl_102365055.xml
/data/data/####/freqctl_102365233.xml
/data/data/####/jgobfppppp (deleted)
/data/data/####/ksad_file_download.db-journal
/data/data/####/ksadcache.db-journal
/data/data/####/ksadrep.db-journal
/data/data/####/ksadsdk_JS_CONFIG.kva
/data/data/####/ksadsdk_JS_CONFIG.kvb
/data/data/####/ksadsdk_api_path.kva
/data/data/####/ksadsdk_api_path.kvb
/data/data/####/ksadsdk_config.xml
/data/data/####/ksadsdk_config_request.kva
/data/data/####/ksadsdk_config_request.kvb
/data/data/####/ksadsdk_config_request.xml
/data/data/####/ksadsdk_data_flow_auto_start.kva
/data/data/####/ksadsdk_data_flow_auto_start.kvb
/data/data/####/ksadsdk_device_sig.kva
/data/data/####/ksadsdk_device_sig.kvb
/data/data/####/ksadsdk_device_sig.xml
/data/data/####/ksadsdk_download_package_length.kva
/data/data/####/ksadsdk_download_package_length.kvb
/data/data/####/ksadsdk_download_package_md5.kva
/data/data/####/ksadsdk_download_package_md5.kvb
/data/data/####/ksadsdk_egid.kva
/data/data/####/ksadsdk_egid.kvb
/data/data/####/ksadsdk_egid.xml
/data/data/####/ksadsdk_egid.xml.bak
/data/data/####/ksadsdk_fullscreen_local_ad_count.kva
/data/data/####/ksadsdk_fullscreen_local_ad_count.kvb
/data/data/####/ksadsdk_gidExpireTimeMs.kva
/data/data/####/ksadsdk_gidExpireTimeMs.kvb
/data/data/####/ksadsdk_gidExpireTimeMs.xml
/data/data/####/ksadsdk_idc.kva
/data/data/####/ksadsdk_idc.kvb
/data/data/####/ksadsdk_idc.xml
/data/data/####/ksadsdk_interstitial_aggregate_daily_show_count.kva
/data/data/####/ksadsdk_interstitial_aggregate_daily_show_count.kvb
/data/data/####/ksadsdk_interstitial_daily_show_count.kva
/data/data/####/ksadsdk_interstitial_daily_show_count.kvb
/data/data/####/ksadsdk_local_ad_force_active.kva
/data/data/####/ksadsdk_local_ad_force_active.kvb
/data/data/####/ksadsdk_local_ad_force_active_data.kva
/data/data/####/ksadsdk_local_ad_force_active_data.kvb
/data/data/####/ksadsdk_local_ad_task_info.kva
/data/data/####/ksadsdk_local_ad_task_info.kvb
/data/data/####/ksadsdk_model.kva
/data/data/####/ksadsdk_model.kvb
/data/data/####/ksadsdk_model.xml
/data/data/####/ksadsdk_mplogseq.kva
/data/data/####/ksadsdk_mplogseq.kvb
/data/data/####/ksadsdk_notification_download_complete.kva
/data/data/####/ksadsdk_notification_download_complete.kvb
/data/data/####/ksadsdk_pref.kva
/data/data/####/ksadsdk_pref.kvb
/data/data/####/ksadsdk_pref.xml
/data/data/####/ksadsdk_pref.xml.bak
/data/data/####/ksadsdk_rep.kva
/data/data/####/ksadsdk_rep.kvb
/data/data/####/ksadsdk_rep.xml
/data/data/####/ksadsdk_reward_auto_call_app_card_show_count.kva
/data/data/####/ksadsdk_reward_auto_call_app_card_show_count.kvb
/data/data/####/ksadsdk_reward_full_ad_jump_direct.kva
/data/data/####/ksadsdk_reward_full_ad_jump_direct.kvb
/data/data/####/ksadsdk_reward_reflow_config.kva
/data/data/####/ksadsdk_reward_reflow_config.kvb
/data/data/####/ksadsdk_sdk_config_data
/data/data/####/ksadsdk_seq.kva
/data/data/####/ksadsdk_seq.kvb
/data/data/####/ksadsdk_seq.xml
/data/data/####/ksadsdk_so_load_times.kva
/data/data/####/ksadsdk_so_load_times.kvb
/data/data/####/ksadsdk_solder.kva
/data/data/####/ksadsdk_solder.kvb
/data/data/####/ksadsdk_splash_daily_show_count.kva
/data/data/####/ksadsdk_splash_daily_show_count.kvb
/data/data/####/ksadsdk_splash_local_rotate_active_count.kva
/data/data/####/ksadsdk_splash_local_rotate_active_count.kvb
/data/data/####/ksadsdk_splash_preload_id_list.kva
/data/data/####/ksadsdk_splash_preload_id_list.kvb
/data/data/####/ksadsdk_splash_preload_id_list.xml
/data/data/####/ksadsdk_wallpaper_path.kva
/data/data/####/ksadsdk_wallpaper_path.kvb
/data/data/####/kscfg_outdfp.xml
/data/data/####/kssdk_api_pref.xml
/data/data/####/libPglbizssdk_ml.so
/data/data/####/libavmdl_lite.so
/data/data/####/libc++_shared.so
/data/data/####/libexception-handler.so
/data/data/####/libjiagu.so
/data/data/####/libkeva.so
/data/data/####/libkscutils.so
/data/data/####/libmaparmor.so
/data/data/####/libpanglarmor.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libttmplayer_lite.so
/data/data/####/metrics_guid
/data/data/####/mobads_aplist_status_new.xml
/data/data/####/mobads_aplist_status_new.xml.bak
/data/data/####/mobads_builds.xml
/data/data/####/mobads_uniqueidentifier_v2.xml
/data/data/####/mobads_uniqueidentifier_v2.xml.bak
/data/data/####/na.czl
/data/data/####/npth.xml
/data/data/####/npth_m_log.db-journal
/data/data/####/pacing_102365055.xml
/data/data/####/pacing_102365233.xml
/data/data/####/packageIndex.json
/data/data/####/pangle_com.byted.pangle_applog_net_cache.dat.xml
/data/data/####/pangle_com.byted.pangle_bd_embed_tea_agent.db-journal
/data/data/####/pangle_com.byted.pangle_d8b674543fc0b023b69f6a3...04.xml
/data/data/####/pangle_com.byted.pangle_downloader.db-journal
/data/data/####/pangle_com.byted.pangle_embed_applog_stats.xml
/data/data/####/pangle_com.byted.pangle_embed_header_custom.xml
/data/data/####/pangle_com.byted.pangle_npth.xml
/data/data/####/pangle_com.byted.pangle_npth_log.db-journal
/data/data/####/pangle_com.byted.pangle_snssdk_openudid.xml
/data/data/####/pangle_com.byted.pangle_tt_mediation_ppe_info.xml
/data/data/####/pangle_com.byted.pangle_ttopensdk.db-journal
/data/data/####/pangle_meta_data_sp.xml
/data/data/####/pangle_meta_data_sp.xml.bak
/data/data/####/plugin_oat_info.xml
/data/data/####/proc_auxv
/data/data/####/sigmob_mta.db-journal
/data/data/####/sigmob_track.db-journal
/data/data/####/snssdk_openudid.xml
/data/data/####/style.3f6846716d816a03d6c8.css
/data/data/####/tb_config
/data/data/####/tt_device_info.xml
/data/data/####/tt_mediation_open_sdk.db-journal
/data/data/####/tt_mediation_ppe_info.xml
/data/data/####/tt_nd
/data/data/####/tt_sdk_settings_5360347.xml
/data/data/####/tt_sdk_settings_5360347.xml.bak
/data/data/####/vendor.92d80afeddd25d5588e2.js
/data/data/####/w.db-journal
/data/data/####/wind.db-journal
/data/data/####/wm_frequency.db
/data/data/####/wm_frequency.db-journal
/data/media/####/.oukdtft
/data/media/####/0ae48a7565d7e9eb2573b335be166312
/data/media/####/0ca82343907c05531cddeb2303cf8cf2
/data/media/####/3b1154abffc88a8fe1607340833874b5
/data/media/####/3dd206ec4f223d4728555b2009debe12
/data/media/####/6021e3ac5f5e74c637b65a7c8bf0ea54
/data/media/####/a486fd22d4dd1e255b8338256821164c.html
/data/media/####/a486fd22d4dd1e255b8338256821164c.html.tmp
/data/media/####/b81ed5b5de8714108dbf3dca435d8051
/data/media/####/clientudid.dat
/data/media/####/cookie
/data/media/####/e11cdda57279eda62da4da605e93889c
/data/media/####/e8e336e734a97c4ed69a4b0bd728981e
/data/media/####/eb7b47dbe35916a503ee62f4128dd0f0
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
app_process /system/bin com.android.commands.am.Am get-config
app_process /system/bin com.android.commands.pm.Pm list features
app_process /system/bin com.android.commands.pm.Pm list libraries
app_process /system/bin com.android.commands.pm.Pm list packages -f
app_process /system/bin com.android.commands.pm.Pm list packages -f <Package>
app_process /system/bin com.android.commands.pm.Pm path <Package>
app_process /system/bin com.android.commands.pm.Pm path com.ss.android.ugc.aweme
app_process /system/bin com.android.commands.pm.Pm path com.tencent.mm
app_process /system/bin com.android.commands.wm.Wm density
app_process /system/bin com.android.commands.wm.Wm size
cat /proc/sys/kernel/random/boot_id
cat /sys/class/net/wlan0/address
cat /sys/devices/soc0/serial_number
chmod 777 /data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --compiler-filter=speed --dex-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5305/apk/base-1.apk --oat-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5305/dalvik-cache/compFully.dex
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ip route
ls -l /system/bin/su
sh

Loads the following dynamic libraries:

libPglbizssdk_ml
libarm
libavmdl_lite
libflutter
libg-native
libjiagu
libkeva
liblua-core
libsecsdk
libsgcore
libtanId
libtobEmbedEncrypt
libtobEmbedEncryptForM
libttmplayer_lite

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial