Android.Triada.3352

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.440.origin

Downloads the following detected threats from the Internet:

Android.DownLoader.611.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) log.sn####.com.####.net:80
TCP(HTTP/1.1) log.r####.com:80
TCP(HTTP/1.1) dn.tc####.com:80
TCP(HTTP/1.1) ad.fan####.cn:57588
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) api.unipl####.com:80
TCP(HTTP/1.1) v3.bule####.cn:7001
TCP(HTTP/1.1) dn.gogo####.top:80
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) cdn.on####.mobi:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) ads.on####.mobi:443
TCP(TLS/1.0) 2####.58.212.142:443
TCP(TLS/1.0) log.sn####.com.####.net:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) adser####.go####.com:443
TCP 1####.168.108.254:48354
TCP 1####.168.108.254:48384
TCP 1####.168.108.254:41195
TCP 1####.168.108.254:39902
TCP 1####.168.108.254:55369
TCP 1####.168.108.254:48690
TCP 1####.168.108.254:43667
TCP 1####.168.108.254:38482
TCP 1####.168.108.254:40329
TCP 1####.168.108.254:33962
TCP 1####.168.108.254:34204
TCP 1####.168.108.254:39975
TCP 1####.168.108.254:36279
TCP 1####.168.108.254:52506
TCP 1####.168.108.254:45450
TCP 1####.168.108.254:34598
TCP 1####.168.108.254:48130
TCP 1####.168.108.254:41720
TCP 1####.168.108.254:35696
TCP 1####.168.108.254:33018
TCP 1####.168.108.254:40854
TCP 1####.168.108.254:35383
TCP 1####.168.108.254:34433
TCP 1####.168.108.254:35806
TCP 1####.168.108.254:53473
TCP 1####.168.108.254:34073
TCP 1####.168.108.254:43322
TCP 1####.168.108.254:37165
TCP 1####.168.108.254:56610
TCP 1####.168.108.254:53099
TCP 1####.168.108.254:51715
TCP 1####.168.108.254:35899
TCP 1####.168.108.254:48408
TCP 1####.168.108.254:53420
TCP 1####.168.108.254:47936
TCP 1####.168.108.254:56917
TCP 1####.168.108.254:33872
TCP 1####.168.108.254:35403
TCP 1####.168.108.254:34719
TCP 1####.168.108.254:46601
TCP 1####.168.108.254:48105
TCP 1####.168.108.254:48954
TCP 1####.168.108.254:51054
TCP 1####.168.108.254:35817
TCP 1####.168.108.254:34439
TCP 1####.168.108.254:44952
TCP 1####.168.108.254:39664
TCP 1####.168.108.254:50465
TCP 1####.168.108.254:45288
TCP 1####.168.108.254:38468
TCP 1####.168.108.254:33530
TCP 1####.168.108.254:49407
TCP 1####.168.108.254:37132
TCP 1####.168.108.254:57530
TCP 1####.168.108.254:54013
TCP 1####.168.108.254:47597
TCP 1####.168.108.254:38853
TCP 1####.168.108.254:55663
TCP 1####.168.108.254:35958

DNS requests:

ad.fan####.cn
ads.on####.mobi
adser####.go####.com
adser####.go####.nl
api.unipl####.com
bds.sn####.com
cdn.on####.mobi
dn.gogo####.top
dn.tc####.com
googl####.g.doublec####.net
imgc####.qq.com
is.sn####.com
log.r####.com
log.sn####.com
mi.g####.qq.com
p####.ugd####.com
plb####.u####.com
qzones####.g####.cn
s####.e.qq.com
sf1-ttc####.ps####.com
ssl.gst####.com
u####.u####.com
u####.umengc####.com
v####.ix####.com
v3.bule####.cn
w####.pcon####.com.cn
www.go####.com
www.go####.nl
www.gst####.com

HTTP GET requests:

ad.fan####.cn:57588/adc/getSimple?appid=####&version=####&codeid=####&pr...
ad.fan####.cn:57588/init/getSimple?appid=####&projectid=####&version=###...
api.unipl####.com/phone/config.php?c=####&appid=####&pkg=####&ext=####
api.unipl####.com/sdk/signin.php?&vsdk=####&plt=####&net=####&opt=####&p...
dn.gogo####.top/dnfile/shengjibao/Kernel103_NY.jar
dn.tc####.com/dnfile/Video/2018071017075700wr0f.mp4
dn.tc####.com/dnfile/image/nwny/1280-720-1.jpg
dn.tc####.com/dnfile/image/nwny/720-1280-1.jpg
log.r####.com/receive/gettime
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...

HTTP POST requests:

api.unipl####.com/phone/get.php
log.r####.com/receive/tkio/event
log.r####.com/receive/tkio/startup
log.sn####.com.####.net/service/2/app_log_exception/?openudid=####&versi...
s####.e.qq.com/activate
s####.e.qq.com/launch
s####.e.qq.com/msg
v3.bule####.cn:7001/v3/api_request.aspx
v3.bule####.cn:7001/v3/api_settings.aspx
w####.pcon####.com.cn/ip.jsp

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1552874714718
/data/data/####/1552874732979
/data/data/####/1552874760085
/data/data/####/2375.yaqcookie
/data/data/####/2536.yaqcookie
/data/data/####/2676.yaqcookie
/data/data/####/3459.yaqcookie
/data/data/####/3694.yaqcookie
/data/data/####/3939.yaqcookie
/data/data/####/BuglySdkInfos.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/Reyun.db
/data/data/####/Reyun.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Uniplay.xml
/data/data/####/Uniplay.xml.bak
/data/data/####/VideoRes.apk
/data/data/####/_umeng_common_config.xml
/data/data/####/a==8.0.0+G&&1.0.6_1552874731538_envelope.log
/data/data/####/config.xml
/data/data/####/config.xml.bak
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzE3NzE5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzEzMDA4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzI0NDUz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzI5MjQ4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzIwODc5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzM1NzU3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzMxMjc4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzMxOTc1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzQ0MDU3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzQ2ODcw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzQ5MDc1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzQwNTg3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzU0NDUx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzU2NzI0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzY1MDIz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTUyODc0NzY4Mzg3;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/dexMethod.68778890.dat
/data/data/####/dexMethod.91475202.dat
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.dex (deleted)
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/i==1.2.0&&1.0.6_1552874713228_envelope.log
/data/data/####/id574defe5-ced2-46be-9bf4-fb20470712f9.tmp
/data/data/####/index
/data/data/####/info.xml
/data/data/####/libyaqbasic.68778890.so
/data/data/####/libyaqbasic.91475202.so
/data/data/####/libyaqpro.68778890.so
/data/data/####/libyaqpro.91475202.so
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sdk_config.xml
/data/data/####/sp_reward_video_adslot.xml
/data/data/####/t==8.0.0+G&&1.0.6_1552874718306_envelope.log
/data/data/####/tracking_install.xml
/data/data/####/tracking_interval.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/videokernel.apk
/data/data/####/videonewyd_db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yaqsdkcookie
/data/media/####/-2077649869
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.sys
/data/media/####/.umm.dat
/data/media/####/1000013510000adtime
/data/media/####/775401827
/data/media/####/ApplicationCache.db
/data/media/####/ApplicationCache.db-journal
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/OnewaySdkWebApp.html
/data/media/####/Videoshell.log
/data/media/####/sysid.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /sys/class/net/wlan0/address
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

cocos2djs
libyaqbasic.68778890
libyaqbasic.91475202
libyaqpro.68778890
libyaqpro.91475202
nms

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial