Android.Triada.2028

Technical information

Malicious functions:

Sends SMS messages:

106901332942: rg|39|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T385RaipJ9sNb6RwyAWRW,rdPE5oDwKoqt4XsPzyx.NLk9O7nj2QWCQI0UYrFV6.Z.cg!

Executes code of the following detected threats:

Android.Spy.373.origin
Android.Triada.2018
Android.Triada.373.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.55.161.68:29092
TCP(HTTP/1.1) csk.cns####.com:9003
TCP(HTTP/1.1) q####.a####.com:80

DNS requests:

csk.cns####.com
csk.mc####.com
rac####.funu####.com

HTTP GET requests:

q####.a####.com/
q####.a####.com/?key=####&fields=####
q####.a####.com/audio/beep.mp3
q####.a####.com/audio/bg_music.mp3
q####.a####.com/audio/buyBike.mp3
q####.a####.com/audio/buyUpgrade.mp3
q####.a####.com/audio/click.mp3
q####.a####.com/audio/closePass0.mp3
q####.a####.com/audio/closePass1.mp3
q####.a####.com/audio/closePass2.mp3
q####.a####.com/audio/coin0.mp3
q####.a####.com/audio/coin1.mp3
q####.a####.com/audio/crash0.mp3
q####.a####.com/audio/crash1.mp3
q####.a####.com/audio/engine0.mp3
q####.a####.com/audio/engine1.mp3
q####.a####.com/audio/engine2.mp3
q####.a####.com/audio/horn0.mp3
q####.a####.com/audio/horn1.mp3
q####.a####.com/audio/inDraft.mp3
q####.a####.com/audio/levelFail.mp3
q####.a####.com/audio/mapBut.mp3
q####.a####.com/audio/overtake0.mp3
q####.a####.com/audio/overtake1.mp3
q####.a####.com/audio/overtake2.mp3
q####.a####.com/audio/raceFail.mp3
q####.a####.com/audio/raceStart.mp3
q####.a####.com/audio/rev0.mp3
q####.a####.com/audio/rev1.mp3
q####.a####.com/audio/scoreTotal0.mp3
q####.a####.com/audio/scoreTotal1.mp3
q####.a####.com/audio/silence.mp3
q####.a####.com/audio/stageSuccess.mp3
q####.a####.com/gameapi/3df41947-b71e-4659-b3ae-c1afe0508e57?_location=#...
q####.a####.com/gameapi/assets/0.2-6743d993/css/play.css
q####.a####.com/gameapi/assets/0.2-6743d993/js/gameapi.js
q####.a####.com/gameapi/v1.js?e=####
q####.a####.com/images/bike0.png
q####.a####.com/images/bike1.png
q####.a####.com/images/bike2.png
q####.a####.com/images/bike3.png
q####.a####.com/images/bike4.png
q####.a####.com/images/bike5.png
q####.a####.com/images/bike6.png
q####.a####.com/images/bike7.png
q####.a####.com/images/bike8.png
q####.a####.com/images/calendarNumbers_13x19.png
q####.a####.com/images/car0_383x165.png
q####.a####.com/images/car1_383x165.png
q####.a####.com/images/car2_392x130.png
q####.a####.com/images/car3_392x130.png
q####.a####.com/images/coin2_88x125.png
q####.a####.com/images/coin_89x126.png
q####.a####.com/images/crash.png
q####.a####.com/images/flare.png
q####.a####.com/images/garageBg.jpg
q####.a####.com/images/hudElements.png
q####.a####.com/images/loadSpinner.png
q####.a####.com/images/loader.png
q####.a####.com/images/map.jpg
q####.a####.com/images/numbers_41x47.png
q####.a####.com/images/road0.jpg
q####.a####.com/images/road1.jpg
q####.a####.com/images/road2.jpg
q####.a####.com/images/road3.jpg
q####.a####.com/images/road4.jpg
q####.a####.com/images/scenery.png
q####.a####.com/images/sky0.png
q####.a####.com/images/sky1.png
q####.a####.com/images/sky2.png
q####.a####.com/images/sky3.png
q####.a####.com/images/sky4.png
q####.a####.com/images/sun.png
q####.a####.com/images/titleBg.jpg
q####.a####.com/images/truck0_472x168.png
q####.a####.com/images/truck1_551x219.png
q####.a####.com/images/uiButs.png
q####.a####.com/images/uiElements.png
q####.a####.com/images/whoosh.png
q####.a####.com/js/CC2Gm/music.js
q####.a####.com/js/CC2Gm/resource.js
q####.a####.com/js/CC2Gm/sound.js
q####.a####.com/js/CCPlugin/AudioUtil.js
q####.a####.com/js/CCPlugin/CCAudio.js
q####.a####.com/js/CCPlugin/CCBoot.js
q####.a####.com/js/CCPlugin/CCClass.js
q####.a####.com/js/CCPlugin/miniFramework.js
q####.a####.com/js/HowlerVirtual2Gm/howlerVm.js
q####.a####.com/js/all.js

HTTP POST requests:

csk.cns####.com:9003/csk/c_s/g_f.json
csk.cns####.com:9003/csk/st_c/cn_i_sec.json
csk.cns####.com:9003/csk/st_c/cn_sk_login.json
csk.cns####.com:9003/csk/st_c/cn_sk_specialVersion.json
csk.cns####.com:9003/csk/st_c/cn_sk_tj.json
csk.cns####.com:9003/csk/st_c/getst_tegy.json

Modified file system:

Creates the following files:

/data/data/####/0O8r6k7fSq6MPHNP
/data/data/####/7C0qQphMmNhJAyXs_JuX7Q==.new
/data/data/####/ApplicationCache.db-journal
/data/data/####/TRb1Q3nxwnw9nq4GsZG6zA==
/data/data/####/U_TlJqRwVKJoMXptqiCu0g==
/data/data/####/W6bSWANgxdFPbuCy.zip
/data/data/####/aa
/data/data/####/app_test.apk
/data/data/####/app_test.dex
/data/data/####/brushs.xml
/data/data/####/cds.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/fmoonStore.db
/data/data/####/fmoonStore.db-journal
/data/data/####/ih9VNK9VsR1mP6AwWUxuzQ==.new
/data/data/####/index
/data/data/####/nxhacsxq.jar
/data/data/####/order_sp.xml
/data/data/####/rdata_comivnjnweuklz.new
/data/data/####/tvva_f.zip
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Loads the following dynamic libraries:

fhyaena

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
DES-CBC-PKCS5Padding
DESede

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Gains access to information about sent/received SMS messages.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial