Android.RemoteCode.8313

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.345.origin
Android.RemoteCode.8274

Downloads the following detected threats from the Internet:

Android.RemoteCode.8274

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdn.sn####.cn:80
TCP(HTTP/1.1) s2.starsch####.com:80
TCP(HTTP/1.1) c####.cn.edg####.net:80
TCP(HTTP/1.1) mobilem####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 1####.210.222.28:2013
TCP(HTTP/1.1) 1####.210.216.211:5012
TCP(HTTP/1.1) hudo####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 61.1####.65.114:12371
TCP(HTTP/1.1) videopi####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) c####.dc.100u####.####.net:80
TCP(HTTP/1.1) lr1.a####.miguv####.####.com:80
TCP(HTTP/1.1) singl####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) bt####.yangsh####.cn:443
TCP(TLS/1.0) sf3-fe####.pglstat####.com.####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) dd.zxi####.cn:443
TCP(TLS/1.0) errne####.u####.com.####.com:443
TCP(TLS/1.0) m####.vo####.com.####.com:443
TCP(TLS/1.0) c####.dc.100u####.####.net:443
TCP(TLS/1.0) player####.yangsh####.cn:443
TCP sf3-fe####.pglstat####.com.####.com:443
TCP lf3-ad-####.pglstat####.com:443
TCP m####.vo####.com.####.com:443
UDP 2####.255.255.250:1900
UDP tm2.binst####.live:13
UDP as1.binst####.live:3923
UDP as3.binst####.live:3924
TCP api-ac####.pangoli####.com.####.com:443
TCP 61.1####.65.116:12363
UDP tm2.binst####.live:3923
UDP as3.binst####.live:3923
UDP as1.binst####.live:3924
UDP as3.binst####.live:13
UDP as4.binst####.live:3923
UDP tm2.binst####.live:3924

DNS requests:

api-ac####.pangoli####.com
api-ac####.pangoli####.com
api.c####.cn
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
bt####.yangsh####.cn
c####.dc.100u####.com
cdn.sn####.cn
d####.100u####.com
dd.zxi####.cn
errne####.u####.com
g3.l####.com
hudo####.oss-cn-####.aliy####.com
l####.a####.miguv####.com
lf3-ad-####.pglstat####.com
li####.c####.cn
lr1.a####.miguv####.com
m####.vo####.com
mobilem####.oss-cn-####.aliy####.com
piccpn####.v.myal####.com
player####.yangsh####.cn
s2.starsch####.com
sf3-fe####.pglstat####.com
singl####.oss-cn-####.aliy####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
to####.ctobsn####.com
u####.u####.com
ucc.u####.com
ut####.u####.com
videopi####.oss-cn-####.aliy####.com

HTTP GET requests:

c####.cn.edg####.net/epg/epginfo?serviceId=####&c=####&d=####
c####.dc.100u####.####.net/sdkfile/111c402cfe4d616062d99ab6fbc3d922.jar?...
c####.dc.100u####.####.net/sdkfile/a2a6bcc6f94998ec7b75880e02d8f5b3.apk?...
cdn.sn####.cn/boot/boot.json?token=####
cdn.sn####.cn/channel/202404031505441712127944480.zip
cdn.sn####.cn/plugin/202404022045351712061935333.jar
dd.zxi####.cn:443/api/?ty=####&id=####&channel=####&callback=####
g3.l####.com/r?format=####
hudo####.oss-cn-####.aliy####.com/rec/ad_config.json?ts=####
lr1.a####.miguv####.####.com/wd_r2/cctv/cctv1hd/2500/01.m3u8?msisdn=####...
lr1.a####.miguv####.####.com/wd_r2/cctv/cctv1hd/2500/20231202000628-01-1...
lr1.a####.miguv####.####.com/wd_r2/cctv/cctv1hd/2500/index.m3u8?msisdn=#...
m####.vo####.com.####.com:443/service/2/app_alert_check/?aid=####&tt_inf...
mobilem####.oss-cn-####.aliy####.com/config/config.json
mobilem####.oss-cn-####.aliy####.com/config/update_mobile.json
s2.starsch####.com/thumb/123/thumb@240_180.jpg
s2.starsch####.com/thumb/48/thumb@240_180.jpg
sf3-fe####.pglstat####.com.####.com:443/pic/dongfang_2.png
sf3-fe####.pglstat####.com.####.com:443/pic/guangdong_2.png
sf3-fe####.pglstat####.com.####.com:443/pic/shenzhen_2.png
singl####.oss-cn-####.aliy####.com/config/mbconfig.json?token=####
videopi####.oss-cn-####.aliy####.com/liveing_1231.png
videopi####.oss-cn-####.aliy####.com/liveing_1232.png
videopi####.oss-cn-####.aliy####.com/liveing_1876.png
videopi####.oss-cn-####.aliy####.com/liveing_2497.png

HTTP POST requests:

bt####.yangsh####.cn:443/kvcollect
c####.dc.100u####.####.net:443/pluginsync
c####.dc.100u####.####.net:443/reportcomp
c####.dc.100u####.####.net:443/reportcompbin
c####.dc.100u####.####.net:443/sdk
c####.dc.100u####.####.net:443/sdkbin
errne####.u####.com.####.com:443/apm_cc
m####.vo####.com.####.com:443/mscc/common_setting_otob?lc_id=####&platfo...
m####.vo####.com.####.com:443/ri/report_otob?lc_id=####&platform=####&de...
m####.vo####.com.####.com:443/service/2/app_log/?device_platform=####&ve...
m####.vo####.com.####.com:443/service/2/device_register_only/?aid=####&t...
m####.vo####.com.####.com:443/service/2/log_settings/?device_platform=####
na61-####.wagbr####.ali####.####.com:443/v2/inn/fetch
new-####.u####.com:443/anti/postZdata
player####.yangsh####.cn:443/v1/player/get_live_info
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/data/####/.bak
/data/data/####/.dmpvedpogjhejs.cfg
/data/data/####/.fsgkea
/data/data/####/.hptc_kache_tv.mobile.hdkan
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.msf3_31d659304230575c05a3c5ebd11c8d076e58118c
/data/data/####/.msf3_4101dff45425a5380675454177d6e6b4e29a5ebb
/data/data/####/.msf3_6f05be3a01810a12a0dce73b48e953e9237e0a2b
/data/data/####/.msf3_904f2636614f90c4f53ea2df4c3b31d5d606a64b
/data/data/####/.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
/data/data/####/.msp_589c22335a381f122d129225f5c0ba3056ed5811
/data/data/####/.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
/data/data/####/1712476511274
/data/data/####/1920928991.apk
/data/data/####/1920928991.apk.temp
/data/data/####/1920928991.dex
/data/data/####/1920928991.dex.flock (deleted)
/data/data/####/3380a2a325c0df0fecf67234fabc4038
/data/data/####/529398700.dex
/data/data/####/529398700.dex.flock (deleted)
/data/data/####/529398700.jar
/data/data/####/529398700.jar.temp
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/LauncherConfig.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp.bak
/data/data/####/a16c617105659bc929e2ee827d83fa52-d06e87bb919a07...9.conf
/data/data/####/a16c617105659bc929e2ee827d83fa52-d06e87bb919a07...leted)
/data/data/####/base-1.apk
/data/data/####/ccg_sp_config_file.xml
/data/data/####/cd75e7340733ca48a203532932c1ed29
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.byted.pangle.m.apk
/data/data/####/com.supertv.mobile.hdkan_preferences.xml
/data/data/####/datacdn_channel.0
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/download_history.xml
/data/data/####/download_sdk_config.sgv
/data/data/####/downloader.db-journal
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid2722
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/i==1.2.0&&9.0.3_1712476502902_dW5pZnlfbG9ncw==;.log
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/jgobfppppp (deleted)
/data/data/####/journal
/data/data/####/jsonzip.json
/data/data/####/kk_sp_main_v2.xml
/data/data/####/kk_sp_main_v6.xml
/data/data/####/libPglbizssdk_ml.so
/data/data/####/libavmdl_lite.so
/data/data/####/libjiagu.so
/data/data/####/libkeva.so
/data/data/####/libmaparmor.so
/data/data/####/libpanglearmor.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libtobEmbedEncryptForM.so
/data/data/####/libttmplayer_lite.so
/data/data/####/metrics_guid
/data/data/####/miui.apk
/data/data/####/miui.dex
/data/data/####/miui.dex.flock (deleted)
/data/data/####/mkt_version_v6.xml
/data/data/####/mkt_version_v7.xml
/data/data/####/mkt_version_v8.xml
/data/data/####/mkt_version_v9.xml
/data/data/####/mobile_db-journal
/data/data/####/mobile_tv_version.xml
/data/data/####/mobile_tv_version.xml.bak
/data/data/####/mobile_tv_version.xml.bak (deleted)
/data/data/####/na.czl
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/pangle_com.byted.pangle.m_applog_net_cache.dat.xml
/data/data/####/pangle_com.byted.pangle.m_bd_embed_tea_agent.db-journal
/data/data/####/pangle_com.byted.pangle.m_d8b674543fc0b023b69f6...04.xml
/data/data/####/pangle_com.byted.pangle.m_embed_applog_stats.xml
/data/data/####/pangle_com.byted.pangle.m_embed_header_custom.xml
/data/data/####/pangle_com.byted.pangle.m_embed_last_sp_session.xml
/data/data/####/pangle_com.byted.pangle.m_npth.xml
/data/data/####/pangle_com.byted.pangle.m_npth_log.db-journal
/data/data/####/pangle_com.byted.pangle.m_snssdk_openudid.xml
/data/data/####/pangle_com.byted.pangle.m_softdec.xml
/data/data/####/pangle_com.byted.pangle.m_softdec.xml.bak
/data/data/####/pangle_com.byted.pangle.m_sp_bidding_opt_libra.xml
/data/data/####/pangle_com.byted.pangle.m_sp_bidding_opt_libra.xml.bak
/data/data/####/pangle_com.byted.pangle.m_sp_exec_getad_config.xml
/data/data/####/pangle_com.byted.pangle.m_sp_exec_getad_config.xml.bak
/data/data/####/pangle_com.byted.pangle.m_tt_sdk_settings_other.xml
/data/data/####/pangle_com.byted.pangle.m_ttopensdk.db-journal
/data/data/####/pangle_meta_data_sp.xml
/data/data/####/plugin_oat_info.xml
/data/data/####/proc_auxv
/data/data/####/scheme_list_data.sgv
/data/data/####/sendlock
/data/data/####/share_edit_config.xml
/data/data/####/sid_1.0
/data/data/####/sid_1.0 (deleted)
/data/data/####/sid_2497.0
/data/data/####/sid_2497.0 (deleted)
/data/data/####/sid_3.0
/data/data/####/sid_3.0 (deleted)
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.6.1&&9.0.3_1712476498605_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_v_11.xml
/data/data/####/tt_nd
/data/data/####/tt_sdk_settings_other.blk
/data/data/####/tt_sdk_settings_slot.blk
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/update.lock
/data/data/####/ver
/data/data/####/x_google_ad_s_id_123
/data/data/####/yh-cctv1-20240407.json
/data/data/####/yh-cctv2-20240407.json
/data/data/####/yh-cctv3-20240407.json
/data/data/####/yh-dongfang-20240407.json
/data/data/####/yh-guangdong-20240407.json
/data/data/####/yh-hunan-20240407.json
/data/data/####/yh-jiangsu-20240407.json
/data/data/####/yh-shenzhen-20240407.json
/data/data/####/yh-zhejiang-20240407.json
/data/data/####/z==1.2.0&&9.0.3_1712476494975_emNmZw==;.log
/data/media/####/625354b6ca5be471b368d6c0d396ae57
/data/media/####/7ac13aab8b7b9c2532d71c9f4791ce73
/data/media/####/clientudid.dat
/data/media/####/d8980a9df0be2f58c83a299b6b71a0a1
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/data/user/0/<Package>/files/pangle_com.byted.pangle.m/tt_nd
app_process /system/bin com.android.commands.am.Am get-config
app_process /system/bin com.android.commands.pm.Pm list features
app_process /system/bin com.android.commands.pm.Pm list libraries
app_process /system/bin com.android.commands.pm.Pm list packages -f
app_process /system/bin com.android.commands.pm.Pm path <Package>
app_process /system/bin com.android.commands.pm.Pm path com.ss.android.ugc.aweme
app_process /system/bin com.android.commands.pm.Pm path com.tencent.mm
app_process /system/bin com.android.commands.wm.Wm density
app_process /system/bin com.android.commands.wm.Wm size
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/1920928991.apk
chmod 777 /data/user/0/<Package>/files/.honor/529398700.jar
chmod 777 /data/user/0/<Package>/files/pangle_com.byted.pangle.m/tt_nd
getprop debug.ttcsj.debugmode
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
getprop ro.vivo.os.build.display.id
ip route
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Loads the following dynamic libraries:

libPglbizssdk_ml
libavmdl_lite
libcrashsdk
libijkffmpeg
libijkplayer
libijksdl
libjiagu
libkeva
libmaparmor
libmmkv
libpanglearmor
libtobEmbedEncrypt
libttmplayer_lite
libtvcore
libumeng-spy

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DESede-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial