Android.Triada.5321

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.373.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) xi####.edges####.net:80
TCP(HTTP/1.1) d####.g####.xi####.com:80
TCP(HTTP/1.1) apm####.inf.m####.com:80
TCP(HTTP/1.1) st####.g.mi.com:80
TCP(HTTP/1.1) c####.7####.com:80
TCP(TLS/1.0) sdkco####.ad.xi####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) d####.g####.xi####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) gv1.x####.com:443
TCP(TLS/1.0) f.ma####.c.####.com:443
TCP(TLS/1.0) d####.mi####.xi####.com:443
TCP(TLS/1.0) xi####.edges####.net:443
TCP(TLS/1.0) f.ma####.mi####.####.com:443
TCP(TLS/1.2) 1####.251.36.46:443
TCP g####.g.mi.com:8080
TCP g####.g.mi.com:80
TCP g####.g.mi.com:443
TCP g####.g.mi.com:14000

DNS requests:

apm####.inf.m####.com
c####.7####.com
c####.x####.com
commu####.7####.com
d####.g####.xi####.com
d####.mi####.xi####.com
f####.ma####.xi####.com
f3.ma####.xi####.com
f5.ma####.mi####.com
g####.g.mi.com
gv1.x####.com
h####.g####.xi####.com
m####.go####.com
oss.m####.g.####.com
res####.a####.com
sdkco####.ad.xi####.com
st####.g.mi.com
z####.ad.xi####.com

HTTP GET requests:

c####.7####.com/index.php/Sdk/index/GetFunctionListV2?DeviceID=####&Pass...
d####.g####.xi####.com:443/1px.gif?CID=####&appid=####&cpChannel=####&md...
d####.g####.xi####.com:443/1px.gif?CID=####&p1=####&time=####&imei=####&...
d####.g####.xi####.com:443/1px.gif?appid=####&imei=####&channelId=####&c...
d####.g####.xi####.com:443/1px.gif?channelId=####&imei=####&ua=####&appi...
f.ma####.c.####.com:443/download/AdCenter/0e830c372382e473d94ba4667b014d...
f.ma####.mi####.####.com:443/download/AdCenter/0e830c372382e473d94ba4667...
sdkco####.ad.xi####.com:443/api/checkupdate/lastusefulversion2?av=####&c...
st####.g.mi.com/favicon.ico
st####.g.mi.com/pages/realname/css/app.e6980db3.css
st####.g.mi.com/pages/realname/index.html?fuid=####&sid=####&pid=####
st####.g.mi.com/pages/realname/js/app.88f67318.js
st####.g.mi.com/pages/realname/js/chunk-vendors.7096db0f.js
xi####.edges####.net:443/download/AppStore/0b03c468e99cd7327ccf099da4abb...

HTTP POST requests:

c####.7####.com/index.php/sdk/CollectRequest?
c####.x####.com:443/configcloud/rest/sdk/match
d####.g####.xi####.com/ossv2/getbaseinfo
d####.g####.xi####.com:443/client/upgrade/mimo/v1
d####.g####.xi####.com:443/rn/verify
d####.mi####.xi####.com:443/mistats
gv1.x####.com:443/u/g/v1/47cdb3f1
gv1.x####.com:443/u/g/v1/55767b72
gv1.x####.com:443/u/g/v1/88f8016e
res####.a####.com:443/v3/iasdkauth?key=####&ts=####&scode=####

HTTP OPTIONS requests:

apm####.inf.m####.com/intake/v2/rum/events

File system changes:

Creates the following files:

/data/data/####/.hptc.cache_om.zd.bowman.mi
/data/data/####/.huyugamepaytoken_security_v3
/data/data/####/1616433feb587406_0
/data/data/####/1652203331733_3656
/data/data/####/1652203337818_3656
/data/data/####/1652203349492_3792
/data/data/####/1652203350501_3792
/data/data/####/1652203351045_3792
/data/data/####/1652203358602_3792
/data/data/####/1652203358944_3792
/data/data/####/1652203359446_3792
/data/data/####/1652203360223_3792
/data/data/####/1652203361766_3792
/data/data/####/1652203392294_4462
/data/data/####/1652203393600_4462
/data/data/####/1652203394293_4462
/data/data/####/1652203396502_4462
/data/data/####/1652203398796_4462
/data/data/####/16b3c362c42b7a0b981f0d9aa52aa476.0
/data/data/####/2943be759cd7324597737f4b971f81e7;account_file.xml
/data/data/####/455dcf09c217b2421b27ca99bd0706ad.0
/data/data/####/49b5c0cdb059a027_0
/data/data/####/4ca332a0dbc38cfb_0
/data/data/####/5e321068dbbcc862db33a756bc787109.0
/data/data/####/67a8cc7523d14c3c_0
/data/data/####/6lTBNGzvxz4yvnQx3yqHPg==
/data/data/####/8692e180ad051c66_0
/data/data/####/8692e180ad051c66_1
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/Cookies
/data/data/####/Cookies-journal
/data/data/####/GameDataCache
/data/data/####/KvhnMlq7M-5vsZBPIRC-tQ==
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_cloudcontrol3.xml
/data/data/####/TDpref_cloudcontrol3.xml.bak
/data/data/####/TDpref_game.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime3.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime3.xml
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__zad_uuid__
/data/data/####/_db_zad_.xml
/data/data/####/_device_holder_gamesdkplugin.xml
/data/data/####/_m_rec.xml
/data/data/####/_m_rec.xml.bak
/data/data/####/alsn20170807.db
/data/data/####/alsn20170807.db-journal
/data/data/####/analytics.apk.tmp
/data/data/####/analytics_api.xml
/data/data/####/analytics_updater.xml
/data/data/####/apnisps_for_channel_session
/data/data/####/backupservers_for_channel_session
/data/data/####/ca77f25a366c75f0_0
/data/data/####/ccbc121b4cd7d1b1_0
/data/data/####/com.zd.bowman.mi_preferences.xml
/data/data/####/dfba17c4d52138281c2597d63d6b225a.0
/data/data/####/e2e8e58b2e189bd5_0
/data/data/####/e2e8e58b2e189bd5_1
/data/data/####/e8b3d6f98f8c6ee0_0
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/huqpbg_f.dex
/data/data/####/huqpbg_f.dex.flock (deleted)
/data/data/####/huqpbg_f.zip
/data/data/####/i6rnjiFQbtS9ONOUlWcrpA==
/data/data/####/i6rnjiFQbtS9ONOUlWcrpA==.new
/data/data/####/index
/data/data/####/iv
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/metrics_guid
/data/data/####/milink_channel_account.xml
/data/data/####/mimo_asset.apk
/data/data/####/mimo_asset.dex
/data/data/####/mimo_asset.dex.flock (deleted)
/data/data/####/mimo_download.apk.tmp
/data/data/####/mns_settings_data.xml
/data/data/####/options.for.com.zd.bowman.mi.xml
/data/data/####/optservers_for_channel_session
/data/data/####/plugin_updater.xml
/data/data/####/pref_first_channel.xml
/data/data/####/proc_auxv
/data/data/####/recentlyservers_for_channel_session
/data/data/####/report2.db
/data/data/####/report2.db-journal
/data/data/####/runtime-dex.dex
/data/data/####/runtime-dex.dex.flock (deleted)
/data/data/####/runtime-dex.jar
/data/data/####/runtime-dex.jar_temp
/data/data/####/runtime-dex.jar_temp (deleted)
/data/data/####/salt
/data/data/####/sddQPSzUtgUTl1IOxeJ8FQ==.new
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/v7nDb1ToZh_CDvE9
/data/data/####/yKtibl-ytIfAuRVj.zip
/data/data/####/zeus_crash_info.xml
/data/data/####/zeus_pms.xml
/data/data/####/zeus_pms.xml.bak
/data/media/####/1.m.log
/data/media/####/1652203399953.db (deleted)
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

cat /sys/class/net/wlan0/address
getprop
getprop net.dns1
getprop net.dns2
sh -c cat /sys/class/net/wlan0/address

Loads the following dynamic libraries:

libconnectionbase
libegret
libmilinkconnection

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1PADDING
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial