Android.Triada.5559

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.272.origin
Android.Triada.110
Android.Triada.477.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) connect####.gst####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(TLS/1.0) rr17---####.g####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) rr11---####.g####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) 74.1####.131.101:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) 74.1####.131.101:443
TCP(TLS/1.2) 64.2####.164.105:443
TCP(TLS/1.2) md####.google####.com:443
UDP rr18---####.g####.com:443
UDP md####.google####.com:443
UDP 1####.194.163.20:443

DNS requests:

a####.u####.com
and####.a####.go####.com
and####.cli####.go####.com
bcd.lk####.com
connect####.gst####.com
digital####.google####.com
f####.gst####.com
md####.google####.com
pla####.googleu####.com
rr11---####.g####.com
rr17---####.g####.com
rr18---####.g####.com
rr18---####.g####.com
rr9---s####.g####.com
www.go####.com

HTTP POST requests:

a####.u####.com/app_logs

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/0.xml
/data/data/####/1020795564.dex
/data/data/####/1020795564.dex.flock (deleted)
/data/data/####/1020795564.jar
/data/data/####/1079280896.dex
/data/data/####/1079280896.dex.flock (deleted)
/data/data/####/1079280896.jar
/data/data/####/1101184282.dex
/data/data/####/1101184282.dex.flock (deleted)
/data/data/####/1101184282.jar
/data/data/####/1175106714.dex
/data/data/####/1175106714.dex.flock (deleted)
/data/data/####/1175106714.jar
/data/data/####/125574205.dex
/data/data/####/125574205.dex.flock (deleted)
/data/data/####/125574205.jar
/data/data/####/1338360647.dex
/data/data/####/1338360647.dex.flock (deleted)
/data/data/####/1338360647.jar
/data/data/####/1410271341.dex
/data/data/####/1410271341.dex.flock (deleted)
/data/data/####/1410271341.jar
/data/data/####/1461067005.dex
/data/data/####/1461067005.dex.flock (deleted)
/data/data/####/1461067005.jar
/data/data/####/1492671797.dex
/data/data/####/1492671797.dex.flock (deleted)
/data/data/####/1492671797.jar
/data/data/####/1529506562.dex
/data/data/####/1529506562.dex.flock (deleted)
/data/data/####/1529506562.jar
/data/data/####/1531987778420
/data/data/####/156673276.dex
/data/data/####/156673276.dex.flock (deleted)
/data/data/####/156673276.jar
/data/data/####/15d48aa8e026b69e75163ba27f860af7.apk
/data/data/####/15d48aa8e026b69e75163ba27f860af7.dex
/data/data/####/15d48aa8e026b69e75163ba27f860af7.dex.flock (deleted)
/data/data/####/1907074140.dex
/data/data/####/1907074140.dex.flock (deleted)
/data/data/####/1907074140.jar
/data/data/####/1911292671.dex
/data/data/####/1911292671.dex.flock (deleted)
/data/data/####/1911292671.jar
/data/data/####/1e7cfe1426b96ae012b4185fe2c5827a.apk
/data/data/####/1e7cfe1426b96ae012b4185fe2c5827a.dex
/data/data/####/1e7cfe1426b96ae012b4185fe2c5827a.dex.flock (deleted)
/data/data/####/2001888516.dex
/data/data/####/2001888516.dex.flock (deleted)
/data/data/####/2001888516.jar
/data/data/####/2070328073.dex
/data/data/####/2070328073.dex.flock (deleted)
/data/data/####/2070328073.jar
/data/data/####/225112833.dex
/data/data/####/225112833.dex.flock (deleted)
/data/data/####/225112833.jar
/data/data/####/288828138.dex
/data/data/####/288828138.dex.flock (deleted)
/data/data/####/288828138.jar
/data/data/####/2e39bd0b49850bf31463d70249adcc71.apk
/data/data/####/2e39bd0b49850bf31463d70249adcc71.dex
/data/data/####/2e39bd0b49850bf31463d70249adcc71.dex.flock (deleted)
/data/data/####/343195916.dex
/data/data/####/343195916.dex.flock (deleted)
/data/data/####/343195916.jar
/data/data/####/39ecf53cd4c27baaf32b53ceacb02f41.apk
/data/data/####/39ecf53cd4c27baaf32b53ceacb02f41.dex
/data/data/####/39ecf53cd4c27baaf32b53ceacb02f41.dex.flock (deleted)
/data/data/####/3f1b6e4465dabfcd27c82fa33d4cb574.apk
/data/data/####/3f1b6e4465dabfcd27c82fa33d4cb574.dex
/data/data/####/3f1b6e4465dabfcd27c82fa33d4cb574.dex.flock (deleted)
/data/data/####/40524c5e29711a2a05fc036b81e7bc97.apk
/data/data/####/40524c5e29711a2a05fc036b81e7bc97.dex
/data/data/####/40524c5e29711a2a05fc036b81e7bc97.dex.flock (deleted)
/data/data/####/443139288.dex
/data/data/####/443139288.dex.flock (deleted)
/data/data/####/443139288.jar
/data/data/####/524b1f72fdda4b5ded78e85c06f1c81d.apk
/data/data/####/524b1f72fdda4b5ded78e85c06f1c81d.dex
/data/data/####/524b1f72fdda4b5ded78e85c06f1c81d.dex.flock (deleted)
/data/data/####/5610b427ff7bb759eeef46786baaccf1.apk
/data/data/####/5610b427ff7bb759eeef46786baaccf1.dex
/data/data/####/5610b427ff7bb759eeef46786baaccf1.dex.flock (deleted)
/data/data/####/606393221.dex
/data/data/####/606393221.dex.flock (deleted)
/data/data/####/606393221.jar
/data/data/####/606898942.dex
/data/data/####/606898942.dex.flock (deleted)
/data/data/####/606898942.jar
/data/data/####/619d47910f9bc05960f62759d295362a.apk
/data/data/####/619d47910f9bc05960f62759d295362a.dex
/data/data/####/619d47910f9bc05960f62759d295362a.dex.flock (deleted)
/data/data/####/697494787.dex
/data/data/####/697494787.dex.flock (deleted)
/data/data/####/697494787.jar
/data/data/####/7058ad59647e764cc6890000daaf88ba.apk
/data/data/####/7058ad59647e764cc6890000daaf88ba.dex
/data/data/####/7058ad59647e764cc6890000daaf88ba.dex.flock (deleted)
/data/data/####/76b6bb7f5d187699c650e080f76eef27.apk
/data/data/####/76b6bb7f5d187699c650e080f76eef27.dex
/data/data/####/76b6bb7f5d187699c650e080f76eef27.dex.flock (deleted)
/data/data/####/77275079.dex
/data/data/####/77275079.dex.flock (deleted)
/data/data/####/77275079.jar
/data/data/####/823d9939564bb58b5a2791d4eab1bf19.apk
/data/data/####/823d9939564bb58b5a2791d4eab1bf19.dex
/data/data/####/823d9939564bb58b5a2791d4eab1bf19.dex.flock (deleted)
/data/data/####/838496996.dex
/data/data/####/838496996.dex.flock (deleted)
/data/data/####/838496996.jar
/data/data/####/88a0bddcc088af9e2235a89153248aa0.apk
/data/data/####/88a0bddcc088af9e2235a89153248aa0.dex
/data/data/####/88a0bddcc088af9e2235a89153248aa0.dex.flock (deleted)
/data/data/####/988685051.dex
/data/data/####/988685051.dex.flock (deleted)
/data/data/####/988685051.jar
/data/data/####/9be20c463adadfd848d17e6a10bc81c6.apk
/data/data/####/9be20c463adadfd848d17e6a10bc81c6.dex
/data/data/####/9be20c463adadfd848d17e6a10bc81c6.dex.flock (deleted)
/data/data/####/DataEvent_651482997.xml
/data/data/####/SqlDataContainer
/data/data/####/SqlDataContainer-journal
/data/data/####/a2e029b128d626ec0acf347d622e27fd.apk
/data/data/####/a2e029b128d626ec0acf347d622e27fd.dex
/data/data/####/a2e029b128d626ec0acf347d622e27fd.dex.flock (deleted)
/data/data/####/b2f11b18fbf55abcf92438d67c6521f5.apk
/data/data/####/b2f11b18fbf55abcf92438d67c6521f5.dex
/data/data/####/b2f11b18fbf55abcf92438d67c6521f5.dex.flock (deleted)
/data/data/####/b3cb98cd1e4e9dfef2e1847c1009e579.apk
/data/data/####/b3cb98cd1e4e9dfef2e1847c1009e579.dex
/data/data/####/b3cb98cd1e4e9dfef2e1847c1009e579.dex.flock (deleted)
/data/data/####/base.so
/data/data/####/blackboard
/data/data/####/c1af59fb7b73f08e9a2c17d8665249af.apk
/data/data/####/c1af59fb7b73f08e9a2c17d8665249af.dex
/data/data/####/c1af59fb7b73f08e9a2c17d8665249af.dex.flock (deleted)
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/e030338d2f5beffb2987f0793d25e9a2.apk
/data/data/####/e030338d2f5beffb2987f0793d25e9a2.dex
/data/data/####/e030338d2f5beffb2987f0793d25e9a2.dex.flock (deleted)
/data/data/####/e4cb9bf8b3cbf77197a407a05ca49e06.apk
/data/data/####/e4cb9bf8b3cbf77197a407a05ca49e06.dex
/data/data/####/e4cb9bf8b3cbf77197a407a05ca49e06.dex.flock (deleted)
/data/data/####/e559080468db0c41b753f9ea51ed4638.apk
/data/data/####/e559080468db0c41b753f9ea51ed4638.dex
/data/data/####/e559080468db0c41b753f9ea51ed4638.dex.flock (deleted)
/data/data/####/e716ed31322b8f7710ca4c2fcf8973ba.apk
/data/data/####/e716ed31322b8f7710ca4c2fcf8973ba.dex
/data/data/####/e716ed31322b8f7710ca4c2fcf8973ba.dex.flock (deleted)
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f16e9d17b4a68c98388d001434f1e3d9.apk
/data/data/####/f16e9d17b4a68c98388d001434f1e3d9.dex
/data/data/####/f16e9d17b4a68c98388d001434f1e3d9.dex.flock (deleted)
/data/data/####/f6b3613d6b8abe4a0cb5c8e569894a15.apk
/data/data/####/f6b3613d6b8abe4a0cb5c8e569894a15.dex
/data/data/####/f6b3613d6b8abe4a0cb5c8e569894a15.dex.flock (deleted)
/data/data/####/ff8d9cbb8a61d6a98c936fd3ac8f48a5.apk
/data/data/####/ff8d9cbb8a61d6a98c936fd3ac8f48a5.dex
/data/data/####/ff8d9cbb8a61d6a98c936fd3ac8f48a5.dex.flock (deleted)
/data/data/####/global.xml
/data/data/####/hotpatch.data
/data/data/####/libzuma.so
/data/data/####/libzuma2.so
/data/data/####/libzuma2.so.0.so
/data/data/####/libzumadata.so
/data/data/####/logRecord
/data/data/####/logRecord (deleted)
/data/data/####/proc_auxv
/data/data/####/test.dex
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml (deleted)
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/userlist.xml
/data/media/####/01f33eac09845dbdfe8995ca38b2ac66.xml
/data/media/####/01f33eac09845dbdfe8995ca38b2ac66.xml.bak
/data/media/####/0bc99e7b3fe1a9f7380dbaab8bd1b56c.xml
/data/media/####/0bc99e7b3fe1a9f7380dbaab8bd1b56c.xml.bak
/data/media/####/0de3a32da750c41362fa9835f9ef386e.xml
/data/media/####/0de3a32da750c41362fa9835f9ef386e.xml.bak
/data/media/####/1488600c0ced6372568398b4e847e492.xml
/data/media/####/1488600c0ced6372568398b4e847e492.xml.bak
/data/media/####/37471e517c1bc138663053769f8c0b30.xml
/data/media/####/37471e517c1bc138663053769f8c0b30.xml.bak
/data/media/####/41ad8193b90091c5cdb5ee8b06848c96.xml
/data/media/####/41ad8193b90091c5cdb5ee8b06848c96.xml (deleted)
/data/media/####/41ad8193b90091c5cdb5ee8b06848c96.xml.bak
/data/media/####/4313394bf44e5492cca7210947cf51a6.xml
/data/media/####/4313394bf44e5492cca7210947cf51a6.xml.bak
/data/media/####/5868d35c0eae55c5652b83cbba7dd1cd.xml
/data/media/####/5868d35c0eae55c5652b83cbba7dd1cd.xml.bak
/data/media/####/6d6a0c0b04278c930d31b09360a2b224.xml
/data/media/####/6d6a0c0b04278c930d31b09360a2b224.xml.bak
/data/media/####/7628ebc6431b4afbd1a3dc0026a1b52c.xml
/data/media/####/7628ebc6431b4afbd1a3dc0026a1b52c.xml.bak
/data/media/####/855a233d4671f71ab84d3216bd7a4e51.xml
/data/media/####/855a233d4671f71ab84d3216bd7a4e51.xml.bak
/data/media/####/8983b5487077a7e57710ac8f4a3d5fab.xml
/data/media/####/8983b5487077a7e57710ac8f4a3d5fab.xml.bak
/data/media/####/8ecef82f822b9c48bed4e8f326454443.xml
/data/media/####/8ecef82f822b9c48bed4e8f326454443.xml.bak
/data/media/####/a1568f078af70a0fc661d8c715a425bc.xml
/data/media/####/a1568f078af70a0fc661d8c715a425bc.xml (deleted)
/data/media/####/a1568f078af70a0fc661d8c715a425bc.xml.bak
/data/media/####/a477335d5cbeef1a6960e6116b020d48.xml
/data/media/####/a477335d5cbeef1a6960e6116b020d48.xml.bak
/data/media/####/aee3cc4208573cf0b0028f25b2554040.xml
/data/media/####/aee3cc4208573cf0b0028f25b2554040.xml.bak
/data/media/####/b6845a4eafd9d7b80f4eab6f2cdcba90.xml
/data/media/####/b6845a4eafd9d7b80f4eab6f2cdcba90.xml.bak
/data/media/####/b6a2fc22d53cc193bd32eecda94233a5.xml
/data/media/####/c04d29fc9ed9ebceda1e4da8d4ba7c5d.xml
/data/media/####/c04d29fc9ed9ebceda1e4da8d4ba7c5d.xml.bak
/data/media/####/c0f98e20ee461ee72c61d8fa309e6a41.xml
/data/media/####/c0f98e20ee461ee72c61d8fa309e6a41.xml.bak
/data/media/####/cc085878d19708ac154814f902370b9a.xml
/data/media/####/cc085878d19708ac154814f902370b9a.xml.bak
/data/media/####/f3175e5e691407c52861026204c134e3.xml
/data/media/####/f3175e5e691407c52861026204c134e3.xml.bak
/data/media/####/f3a7294dbcefa7a9fbaa9bd83cebb41c.xml
/data/media/####/f3a7294dbcefa7a9fbaa9bd83cebb41c.xml.bak
/data/media/####/f746f3563c7b7d132cf7e59104b7f8c8.xml
/data/media/####/f746f3563c7b7d132cf7e59104b7f8c8.xml.bak
/data/media/####/fa7fa58137300974db2f1199bd576a44.xml
/data/media/####/fa7fa58137300974db2f1199bd576a44.xml.bak
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo

Loads the following dynamic libraries:

base
libzuma
libzuma2.so.0

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
Des-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
DES-ECB-NoPadding
Des-ECB-NoPadding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Intercepts notifications.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial