Android.RemoteCode.7588

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.1763

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(TLS/1.0) 1####.251.39.106:443
TCP(TLS/1.0) afb953b####.s3-ap-n####.amazo####.com:443
TCP(TLS/1.0) i####.superso####.com:443
TCP(TLS/1.0) out####.superso####.com:443
TCP(TLS/1.2) 2####.58.208.99:443
UDP 2####.255.255.255:67

DNS requests:

afb953b####.s3-ap-n####.amazo####.com
api.m.ta####.com
i####.superso####.com
out####.superso####.com
tt.benzcl####.com
tt.benzcl####.com.####.8

HTTP GET requests:

afb953b####.s3-ap-n####.amazo####.com:443/atc.txt
api.m.ta####.com/rest/api3.do?api=####
i####.superso####.com:443/sdk/v6.7.7?request=####

HTTP POST requests:

out####.superso####.com:443/mediation/

File system changes:

Creates the following files:

/data/data/####/.jgck
/data/data/####/.lock
/data/data/####/25dd5bbe52f8041443872c57895f89b14dff707778cbebe....0.tmp
/data/data/####/292d724d2252990dc2d818fae6b475fefe6795f69a11be6....0.tmp
/data/data/####/333b496fd15665159d3931b447cda26b08ad9fb32c4e537....0.tmp
/data/data/####/37fdb280098a1fb046251ad860f0b86e9fc7a924c992737....0.tmp
/data/data/####/4b0713ac7f19c2e454d3d3099e59ebbca24d5fef1ed55e9....0.tmp
/data/data/####/4ff2e716fbe8b22f14282fc2356f6c1a20787973903aec1....0.tmp
/data/data/####/7d2fdaca2b552aff834e76298bb0c292f1d5e7fc1bc0633...0afb.0
/data/data/####/FBAdPrefs.xml
/data/data/####/Mediation_Shared_Preferences.xml
/data/data/####/SDKIDFA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/caade3848806bcf7f2ed9ed52eb78448839a9498c7d4032....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.oat
/data/data/####/com.find.five.differences.sevengameInitUtils.xml
/data/data/####/com.find.five.differences.sevengame_preferences.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fb633ed5ef5d03033d140094710def64e015a11b5930a7c....0.tmp
/data/data/####/fe2293eca1d36269f3c3e80cd28ef3448a309cbd528e167...4c7e.0
/data/data/####/game.dex
/data/data/####/game.dex (deleted)
/data/data/####/game.dex.flock
/data/data/####/game.dex.flock (deleted)
/data/data/####/game.zip
/data/data/####/godaemon
/data/data/####/journal
/data/data/####/libjiagu.so
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/supersonic_sdk.db
/data/data/####/supersonic_sdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_cache_1640280347281.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/lib/arm/houdini /data/user/0/<Package>/app_daemon/godaemon /data/user/0/<Package>/app_daemon/godaemon -p <Package> -s com.south.clover.jz.PersistentProcessService -t 60 -f /data/user/0/<Package>/app_indicators/indicator_p
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.south.clover.jz.PersistentProcessService --es commerce.processdaemon.start.from commerce.processdaemon --include-stopped-packages
chmod 755 /data/user/0/<Package>/app_daemon/godaemon

Uses the following algorithms to encrypt data: