Android.RemoteCode.3523

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.104.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h5####.yeekoo####.com:80
TCP(HTTP/1.1) cdn.yeekoo####.com:80
TCP(HTTP/1.1) wf.mob####.pt:80
TCP(HTTP/1.1) st####.mob####.pt:80

DNS requests:

ad####.yeekoo####.com
cdn.yeekoo####.com
dcb.mob####.pt
h5####.yeekoo####.com
s####.yeekoo####.com
st####.mob####.pt
wf.mob####.pt

HTTP GET requests:

cdn.yeekoo####.com//images/icon/Ben-10-Omnitrix-Attack.png
cdn.yeekoo####.com//images/icon/Bubble-Penguins.png
cdn.yeekoo####.com//images/icon/Heroes-Of-Myth.png
cdn.yeekoo####.com//images/icon/Tomb-Runner.png
cdn.yeekoo####.com//images/portal/Ben10OmnitrixAttack.jpg
cdn.yeekoo####.com//images/portal/BouncingHell.jpg
cdn.yeekoo####.com//images/portal/DimensionalDomination.jpg
cdn.yeekoo####.com//images/portal/HeroesOfMyth.jpg
cdn.yeekoo####.com//images/portal/KingSoldiers2.jpg
cdn.yeekoo####.com//images/portal/VikingEscape.jpg
cdn.yeekoo####.com/images/dtm_up.png
h5####.yeekoo####.com/
h5####.yeekoo####.com/api/get_ad.htm?page=####&devid=####&network=####
h5####.yeekoo####.com/css/main3-min.css
h5####.yeekoo####.com/css/swiper-min.css?v####
h5####.yeekoo####.com/detail.php?id=####
h5####.yeekoo####.com/images/c_2.png
h5####.yeekoo####.com/images/c_3.png
h5####.yeekoo####.com/images/c_4.png
h5####.yeekoo####.com/images/content/Ben10OmnitrixAttack/1.jpg
h5####.yeekoo####.com/images/content/Ben10OmnitrixAttack/2.jpg
h5####.yeekoo####.com/images/content/Ben10OmnitrixAttack/3.jpg
h5####.yeekoo####.com/images/content/Ben10OmnitrixAttack/4.jpg
h5####.yeekoo####.com/images/content/HeroesOfMyth/1.jpg
h5####.yeekoo####.com/images/content/HeroesOfMyth/2.jpg
h5####.yeekoo####.com/images/content/HeroesOfMyth/3.jpg
h5####.yeekoo####.com/images/content/HeroesOfMyth/4.jpg
h5####.yeekoo####.com/images/content/TombRunner/1.jpg
h5####.yeekoo####.com/images/content/TombRunner/2.jpg
h5####.yeekoo####.com/images/content/TombRunner/3.jpg
h5####.yeekoo####.com/images/content/TombRunner/4.jpg
h5####.yeekoo####.com/images/index_vip_logo.png
h5####.yeekoo####.com/images/more_arrow2.png
h5####.yeekoo####.com/images/more_arrow3.png
h5####.yeekoo####.com/images/star0.png
h5####.yeekoo####.com/images/top.png
h5####.yeekoo####.com/images/topLoGo.png
h5####.yeekoo####.com/images/xiazai-1.png
h5####.yeekoo####.com/js/aes-min.js
h5####.yeekoo####.com/js/analytics.js
h5####.yeekoo####.com/js/common-min.js
h5####.yeekoo####.com/js/ebOneTag.js
h5####.yeekoo####.com/js/foot.js
h5####.yeekoo####.com/js/jquery.js
h5####.yeekoo####.com/js/layer-min.js?v####
h5####.yeekoo####.com/js/md5-min.js
h5####.yeekoo####.com/js/need/layer.css
h5####.yeekoo####.com/js/pad-zeropadding-min.js
h5####.yeekoo####.com/js/pad-zeropadding-min.js?v####
h5####.yeekoo####.com/js/swipe-min.js
h5####.yeekoo####.com/js/swiper.min.js
h5####.yeekoo####.com/js/zepto-min.js
h5####.yeekoo####.com/webflow.php?id=####
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/css/main3-min.css
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/css/swiper-min.css?v#...
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/images/content/Ben10O...
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/images/topLoGo.png
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/aes-min.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/analytics.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/common-min.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/ebOneTag.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/foot.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/jquery.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/layer-min.js?v####
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/md5-min.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/need/layer.css
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/pad-zeropadding-mi...
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/swipe-min.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/swiper.min.js
st####.mob####.pt/dcb/butterfly/ycoolgames/generic/js/zepto-min.js
wf.mob####.pt/api/wbHtmlIdentify?wbrmId=####

HTTP POST requests:

wf.mob####.pt/api/wbHtmlIdentify?wbrmId=####
wf.mob####.pt/api/wbV2WebFlow

File system changes:

Creates the following files:

/data/data/####/SSPPrefe.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/index
/data/data/####/plug.dataBase
/data/data/####/plug.dataBase-journal
/data/data/####/sklead.dataBase
/data/data/####/sklead.dataBase-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/dedygen.jar
/data/media/####/endygen.jar

Miscellaneous:

Uses the following algorithms to decrypt data:

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней