Android.Triada.5495

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Proxy.47.origin
Android.RemoteCode.108.origin
Android.RemoteCode.210.origin
Android.RemoteCode.345.origin
Android.Triada.588.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) pp.showg####.com.####.com:80
TCP(HTTP/1.1) 8.2####.89.234:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) 1####.208.133.106:9999
TCP(HTTP/1.1) dc.g####.com:80
TCP(HTTP/1.1) c####.dc.100u####.####.net:80
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) app-api####.adenjo####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) 1####.217.18.99:443
TCP(TLS/1.0) rr12---####.g####.com:443
TCP(TLS/1.0) o####.azh####.com:9190
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) lp.xl####.com:443
TCP(TLS/1.0) rr16---####.g####.com:443
TCP(TLS/1.2) app-mea####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) pla####.google####.com:443
TCP(TLS/1.2) md####.google####.com:443
TCP(TLS/1.2) 1####.217.18.99:443
TCP sz2####.na.lb.####.co:6065
TCP 47.1####.227.5:9010
TCP 1####.106.188.66:800
UDP digital####.google####.com:443
TCP 43.1####.121.225:800
TCP 1####.208.184.42:12358
TCP L####.na.lb.####.com:6065

DNS requests:

L####.na.lb.####.com
and####.b####.qq.com
and####.cli####.go####.com
app-api####.adenjo####.com
app-mea####.com
c####.dc.100u####.com
d####.100u####.com
dc.g####.com
dct.g####.com
digital####.google####.com
firebas####.google####.com
lp.xl####.com
m####.go####.com
md####.google####.com
o####.azh####.com
p####.google####.com
pla####.google####.com
pla####.googleu####.com
pp.showg####.com
rr12---####.g####.com
rr16---####.g####.com
rr9---s####.g####.com
sz2####.na.lb.####.co
www.google####.com
z.ttp####.com

HTTP GET requests:

c####.dc.100u####.####.net/sdkfile/187305e99a5fb455319169611af8e199.apk?...
c####.dc.100u####.####.net/sdkfile/2e1fd157ddd77f47fcc975b80ebd4a11.jar?...
c####.dc.100u####.####.net/sdkfile/3298c01f2ecc0e4eee785ff72e3bc7d0.apk?...
c####.dc.100u####.####.net/sdkfile/40dd88487df8fe6e41feeb602aed3244.apk?...
c####.dc.100u####.####.net/sdkfile/419e7a3266d8540f9fd199ceceff2b42.apk?...
c####.dc.100u####.####.net/sdkfile/76d6c1f696ce0608917ea7448055cbff.apk?...
dc.g####.com/d/bcc/v2/o/6fc4e840c94587cb89ea441f59bbd325
dc.g####.com/d/t/134/r/5cac2fad32154.t
dc.g####.com/d/t/252/r/607e6860d1b42.t
dc.g####.com/d/t/285/r/61f35fc5688a3.t
dc.g####.com/d/t/290/r/6389918f89405.t
dc.g####.com/loadable/r/6294893ab7797.l
pp.showg####.com.####.com/mm

HTTP POST requests:

and####.b####.qq.com/rqd/async
app-api####.adenjo####.com:443/v1/os/get
app-api####.adenjo####.com:443/v1/ts/get
c####.dc.100u####.####.net/pluginsync
c####.dc.100u####.####.net/reportcomp
c####.dc.100u####.####.net/sdk
lp.xl####.com:443/v1/ls/get
o####.azh####.com:9190/downSdkEncryption

File system changes:

Creates the following files:

/data/data/####/002bdfab0e8debb0c1a1740cc4dca167
/data/data/####/02260edcc5f2392033f793d048f4f7ad6957.dex
/data/data/####/02260edcc5f2392033f793d048f4f7ad6957.dex.flock (deleted)
/data/data/####/02260edcc5f2392033f793d048f4f7ad6957.jar
/data/data/####/03a3a7c1ebc66b438fa70fac52d43510
/data/data/####/0b32636f21ace6e1ded46bb6fdd5961c
/data/data/####/0bab4023cf6e157bf33aa41112cba0e2
/data/data/####/0f7c7820a923443c863da56f44038ae7
/data/data/####/0fc4e9efde1f7266b5296cfa83393258
/data/data/####/1676058271447
/data/data/####/1676058271449
/data/data/####/1676058271457
/data/data/####/1676058271458
/data/data/####/1676058271466
/data/data/####/17b398a4371a4251b0b4ad665508a847.dex
/data/data/####/17b398a4371a4251b0b4ad665508a847.dex.flock (deleted)
/data/data/####/17b398a4371a4251b0b4ad665508a847.jar
/data/data/####/180de10f89c71677ddbfd6ee0801fc7e
/data/data/####/18e2a2ba03524f5eb4427379fc2b245d
/data/data/####/212e082c81a348179ed3e216b47cda31
/data/data/####/2462080088.apk
/data/data/####/2462080088.apk.temp
/data/data/####/2462080088.dex
/data/data/####/2462080088.dex.flock (deleted)
/data/data/####/2648111592.apk
/data/data/####/2648111592.apk.temp
/data/data/####/2648111592.dex
/data/data/####/2648111592.dex.flock (deleted)
/data/data/####/2b7f421ca26b9430ed8b970acb07af9718f184414dd0245...57fd7e
/data/data/####/3017739405.dex
/data/data/####/3017739405.dex.flock (deleted)
/data/data/####/3017739405.jar
/data/data/####/3017739405.jar.temp
/data/data/####/3155ce384df445eb80ad96ed17f6f13a.dex
/data/data/####/3155ce384df445eb80ad96ed17f6f13a.dex.flock (deleted)
/data/data/####/3155ce384df445eb80ad96ed17f6f13a.jar
/data/data/####/3272783205.apk
/data/data/####/3272783205.apk.temp
/data/data/####/3272783205.dex
/data/data/####/3272783205.dex.flock (deleted)
/data/data/####/4133839139.apk
/data/data/####/4133839139.apk.temp
/data/data/####/4133839139.dex
/data/data/####/4133839139.dex.flock (deleted)
/data/data/####/417763fda617744a324747f1cd1d94cf.d
/data/data/####/45586aa387299b6a39e8ea1e21518a14
/data/data/####/481194881.apk
/data/data/####/481194881.apk.temp
/data/data/####/481194881.dex
/data/data/####/481194881.dex.flock (deleted)
/data/data/####/5b1d93b3ff684731a7d8204fe14ac25a
/data/data/####/657a7e832add4b25984fea2e63c10203.dex
/data/data/####/657a7e832add4b25984fea2e63c10203.dex.flock (deleted)
/data/data/####/657a7e832add4b25984fea2e63c10203.jar
/data/data/####/6d2d73d2006275ded37a07865ea1c7d5b1fea7cbc43e0e8...c57f62
/data/data/####/6e1e2aa174f5400782bde0d0eca8618a.dex
/data/data/####/6e1e2aa174f5400782bde0d0eca8618a.dex.flock (deleted)
/data/data/####/6e1e2aa174f5400782bde0d0eca8618a.jar
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/74cbd0aa070921fe25f84f85653b9281
/data/data/####/7e58c9df8f4b8225081d3acf7de66a68
/data/data/####/7ed4bbfa0d0e4e6f371df85570217a63
/data/data/####/7f1a2c5ec7f04f9a9e7db52c2fc741e3
/data/data/####/7ff7bc759b7594b663035fc235bb72d0
/data/data/####/843cab144b1952ce33e2a628b60ff1b118f184414dd0245...57fd7e
/data/data/####/9032f6b606412ab9267eec28c20fc561
/data/data/####/925cbadc567cead7ed600ca7df194bf1.d
/data/data/####/98045f6cbad8fddeb90a6c546aa7c60e
/data/data/####/9e2e715b7553440596772a3dcd99f8e1
/data/data/####/9edc12c92461295d5695d94019d870e0.d
/data/data/####/9fdaaf736402200e12378880a8cb9838
/data/data/####/SWORD-journal
/data/data/####/b327534d49856d93cf529c508e43b8a3
/data/data/####/b773cb538abb36dde9499cd8cc41a2da
/data/data/####/be8f45a437d7488b948200f19fc711aa
/data/data/####/bugly_db_-journal
/data/data/####/d49fda0f0b3278314984140e1371a968
/data/data/####/d62c95aad28c4738b0e70c6788cdaa90
/data/data/####/device_id.xml.xml
/data/data/####/e4106c73f385ec35c0326c1acbdf0718
/data/data/####/ed16ba23ccf3a36e64df6436d5a568ef
/data/data/####/f1bfff8b1a034fca953925b161667c79.dex
/data/data/####/f1bfff8b1a034fca953925b161667c79.dex.flock (deleted)
/data/data/####/f1bfff8b1a034fca953925b161667c79.jar
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/model.xml
/data/data/####/native_record_lock
/data/data/####/no_notice.mp3
/data/data/####/no_notice.mp3.temp
/data/data/####/pref_cfg.xml
/data/data/####/pref_record.xml
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/ul8g14y48j7zxhr3qy03
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/data/####/xUtils_http_cookie.db-journal (deleted)
/data/data/####/x_google_ad_s_id_123
/data/media/####/daa.dat
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c type su
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/2462080088.apk
chmod 777 /data/user/0/<Package>/files/.honor/2648111592.apk
chmod 777 /data/user/0/<Package>/files/.honor/3017739405.jar
chmod 777 /data/user/0/<Package>/files/.honor/3272783205.apk
chmod 777 /data/user/0/<Package>/files/.honor/4133839139.apk
chmod 777 /data/user/0/<Package>/files/.honor/481194881.apk
getprop ro.board.platform
sh

Loads the following dynamic libraries:

libBugly

Uses the following algorithms to encrypt data:

AES
AES-CBC-NoPadding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial