Android.Triada.5150

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.1007.origin
Android.RemoteCode.231.origin
Android.Triada.4567
Android.Triada.510.origin
Android.Triada.573.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) o####.cz####.com:10051
TCP(HTTP/1.1) nu####.js####.com:12029
TCP(HTTP/1.1) q####.m####.com:13002
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) ua####.f6####.com:80
TCP(HTTP/1.1) q####.m####.com:16002
TCP(HTTP/1.1) gc4####.9####.com:80
TCP(HTTP/1.1) hw9####.new####.com:80
TCP(HTTP/1.1) fung####.ly####.com:80
TCP(HTTP/1.1) dwq.fs####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) d####.dd7####.com:80
TCP(TLS/1.0) 1####.177.14.95:443
TCP(TLS/1.0) newas####.hcap####.com:443
TCP(TLS/1.0) def####.cn.zb.####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) 74.1####.131.95:443
TCP(TLS/1.0) wcf.seven####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) fo####.site:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.177.14.95:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 64.2####.161.95:443
UDP 64.2####.161.95:443
UDP 1####.177.14.95:443

DNS requests:

36####.ob####.com
a####.r####.com
a####.u####.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.applove####.com
d####.dd7####.com
dwq.fs####.com
f####.gst####.com
fo####.site
fung####.ly####.com
gc4####.9####.com
hcap####.com
hw9####.new####.com
jz####.mc####.com
m####.go####.com
newas####.hcap####.com
nu####.js####.com
o####.cz####.com
pv.s####.com
q####.m####.com
u####.u####.com
ua####.f6####.com
wcf.seven####.com
z5.c####.com
z9.c####.com

HTTP GET requests:

api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
d####.dd7####.com/upload/hw/batdex20191010.jar
d####.dd7####.com/upload/hw/c1005dex20190527.jar
d####.dd7####.com/upload/hw/h5rq20191022.jar
d####.dd7####.com/upload/hw/kklz02dex20200414.jar
d####.dd7####.com/upload/hw/lsdk20200506.jar
d####.dd7####.com/upload/hw/mf20200508.jar
d####.dd7####.com/upload/hw/qcdex20200316.jar
d####.dd7####.com/upload/plog/cy1105.jar
d####.dd7####.com/upload/plog/hwsdk1111.jar
d####.dd7####.com/upload/plog/hx0409.jar
d####.dd7####.com/upload/plog/jar20190515.jar
d####.dd7####.com/upload/plog/jrw20210630.jar
d####.dd7####.com/upload/plog/kk20201106.jar
d####.dd7####.com/upload/plog/ps20210219.jar
d####.dd7####.com/upload/plog/sdk0625.jar
d####.dd7####.com/upload/plog/sh290_20210810.jar
d####.dd7####.com/upload/plog/skk20210416.jar
d####.dd7####.com/upload/plog/xianmm0512.jar
d####.dd7####.com/upload/plog/zcoup1118.jar
dwq.fs####.com/FB/nsa_100008_20211110.zip
dwq.fs####.com/dtbx/liangzong/hwlz06.zip
dwq.fs####.com/dtbx/liangzong/lz04.zip
dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
dwq.fs####.com/dtbx/yunshi/awli-release.zip
dwq.fs####.com/plugins/applh0723.zip
dwq.fs####.com/plugins/dp2.zip
dwq.fs####.com/plugins/yz058Uc30i0913.zip
fo####.site:443/ewewew/s20211101220628.1
fung####.ly####.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v...
fung####.ly####.com/cdn-cgi/images/browser-bar.png?137675####
fung####.ly####.com/cdn-cgi/images/cf-no-screenshot-warn.png
fung####.ly####.com/cdn-cgi/images/trace/captcha/nojs/h/transparent.gif?...
fung####.ly####.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=...
fung####.ly####.com/cdn-cgi/styles/cf.errors.css
fung####.ly####.com/lym07ly07/game/synthetic-number-13/
gc4####.9####.com/zsyunsxda
gc4####.9####.com/zsyunsxda/
gd.a.s####.com:443/cityjson
ua####.f6####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
ua####.f6####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
ua####.f6####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
ua####.f6####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
z.c####.com/stat.htm?id=####&cnzz_eid=####

HTTP POST requests:

al####.u####.com:443/unify_logs
al####.u####.com:443/zcfg
def####.cn.zb.####.com:443/api/postZdata
fung####.ly####.com/cdn-cgi/challenge-platform/h/b/flow/ov1/0.2252241520...
hw9####.new####.com/api/activite
hw9####.new####.com/api/offer
hw9####.new####.com/api/tbdynamic
hw9####.new####.com/apidata/showeb
nu####.js####.com:12029/hfdlls/
nu####.js####.com:12029/i3v8nb/
nu####.js####.com:12029/lfkdnr/
o####.cz####.com:10051/getjar/
o####.cz####.com:10051/getsol/
o####.cz####.com:10051/repsol/
q####.m####.com:13002/84gcjmo/
q####.m####.com:13002/ck0k66o/
q####.m####.com:13002/v1jyved/
q####.m####.com:16002/h7bj93/
wcf.seven####.com:443/BBService.svc/wewrdcazxpkl

File system changes:

Creates the following files:

/data/data/####/.dl
/data/data/####/.imprint
/data/data/####/.udusid
/data/data/####/0437750A541C5BE283568783752E76EF.xml
/data/data/####/0d14514d21dc78fe8462b2bfef0d6fef.temp
/data/data/####/20b690529a2eb88515f2edce6b4017f8.temp
/data/data/####/2118BF62061AA81849864E1FA899D952
/data/data/####/2118BF62061AA81849864E1FA899D952.dex
/data/data/####/2118BF62061AA81849864E1FA899D952.dex.flock (deleted)
/data/data/####/2118BF62061AA81849864E1FA899D952.temp
/data/data/####/2118BF62061AA81849864E1FA899D952.zip
/data/data/####/3e2wssr.xml
/data/data/####/3uy5r.xml
/data/data/####/47AB7209AD7ACF4EB1EA636A3039D803
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.dex
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.dex.flock (deleted)
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.temp
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.zip
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.dex
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.dex.flock (deleted)
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.jar
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.temp
/data/data/####/5af4a0c507f58979be02d3e085923db9.dex
/data/data/####/5af4a0c507f58979be02d3e085923db9.dex.flock (deleted)
/data/data/####/5af4a0c507f58979be02d3e085923db9.jar
/data/data/####/61e492
/data/data/####/61e492.tmp
/data/data/####/7d8d6b
/data/data/####/8083FF58735015297E7624C9CFAC3D8C.xml
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.dex
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.dex.flock (deleted)
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.temp
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.zip
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.dex
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.dex.flock (deleted)
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.jar
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.temp
/data/data/####/92803EBB7D87B2E67FB0CEF6704D2D24
/data/data/####/934bbf
/data/data/####/934bbf.tmp
/data/data/####/9dbe505aa81ac42179c879a331f908d5.temp
/data/data/####/C3B2481BF31F7E7DF213B1679D8AFC65
/data/data/####/CsKaitno.d
/data/data/####/D177CA2FC204D1D92FCFD2A8E1DB9061.xml
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.dex
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.dex.flock (deleted)
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.temp
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.zip
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.dex
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.dex.flock (deleted)
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.temp
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.zip
/data/data/####/F73811C2013B84778D431A6EE070420A.dex
/data/data/####/F73811C2013B84778D431A6EE070420A.dex.flock (deleted)
/data/data/####/F73811C2013B84778D431A6EE070420A.jar
/data/data/####/F73811C2013B84778D431A6EE070420A.temp
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/androidxcorefreec7z.
/data/data/####/androidxcorefreec7z.dex
/data/data/####/androidxcorefreec7z.dex.flock (deleted)
/data/data/####/c851260083e895b72efca803fd33dd4a.temp
/data/data/####/ccddefde.dex
/data/data/####/ccddefde.dex.flock (deleted)
/data/data/####/ccddefde.jar
/data/data/####/cd23423423423
/data/data/####/chzn
/data/data/####/com.android.google.cdcore.db
/data/data/####/com.noteanan.simplenotebased_ct_default.xml
/data/data/####/com.noteanan.simplenotebased_preferences.xml
/data/data/####/df4essr.xml
/data/data/####/df4essr.xml.bak (deleted)
/data/data/####/e3f4r3ed.data
/data/data/####/e3f4r3ed.data-journal
/data/data/####/e3h75rd.data
/data/data/####/e3h75rd.data-journal
/data/data/####/e3wg5rd.data
/data/data/####/e3wg5rd.data-journal
/data/data/####/ep.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gczt.png
/data/data/####/i==1.2.0&&2.0_1637729062868_dW5pZnlfbG9ncw==;.log
/data/data/####/info.xml
/data/data/####/jbo
/data/data/####/knj
/data/data/####/ld_config_cc.xml
/data/data/####/libkezc.so
/data/data/####/libkezc.so-32
/data/data/####/libkezc.so-64
/data/data/####/libsszf.so
/data/data/####/libsszf.so-32
/data/data/####/libsszf.so-64
/data/data/####/libunrt.so
/data/data/####/metrics_guid
/data/data/####/notes.db
/data/data/####/notes.db-journal
/data/data/####/ofew.png
/data/data/####/ooooooooooooooooooooooooooooooooooooooooooooooo...oooooo
/data/data/####/proc_auxv
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s3p43_W12312312.xml
/data/data/####/s3p43_W12312312.xml.bak
/data/data/####/sp_dojz.xml
/data/data/####/sp_flny.xml
/data/data/####/t==9.4.0&&2.0_1637729063064_dW5pZnlfbG9ncw==;.log
/data/data/####/tmp
/data/data/####/tmp.zip
/data/data/####/ttttttttttttttttttttttttttttttttttttttttttttttt...tttttt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/voooooooooooooooooooooooooooooooooooooooooooooo...oooooo
/data/data/####/webview_data.lock
/data/data/####/xmiqcwxg.dex
/data/data/####/xmiqcwxg.dex.flock (deleted)
/data/data/####/xmiqcwxg.jar
/data/data/####/z==1.2.0&&2.0_1637729057577_emNmZw==;.log
/data/data/####/zetj.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/data/user/0/<Package>/.libs/1_1001/.soldx/61e492 dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/data/user/0/<Package>/.libs/1_1001/.soldx/jbo -Z u:r:shell:s0 -c /data/user/0/<Package>/.libs/1_1001/.soldx//CsKaitno.d
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/lib/arm/houdini /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/system/lib64/arm64/houdini64 /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/system/lib64/arm64/houdini64 /data/user/0/<Package>/.libs/1_1001/.soldx/jbo /data/user/0/<Package>/.libs/1_1001/.soldx/jbo HF8Cyjmi1cDd3JCn152ah3T6LO9GefXCk2eqWVyu2Yjmu3Md+QyWSS6rFUOxZbPk7OdhiTbItuWlDo3z3Kt+xaA7RnTU7+oUrodHgLTJIqiz+n6JyKSJkYGYRSs1ZsZi/FGpvTNIgHWlvTkK8Gggoh1u+L4HFCp3MhTxiVRaW1tl+mE7rUNEJlR5PlGvr9W0Q6SkwiyAM88KTRpXw92i8nuwV5Y1e4s8BrWMO1iYy9HAf9dEfm29mGexfKMYYJCn5/bFeA7lSU825KWr3hXocI9eDi1T6icaxpoVTpKQTprnHLqzEPnPcu4fM9G/0TTAAqgwNCiCbu3Q
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/61e492
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/CsKaitno.d
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/com.android.google.cdcore.db
getprop
getprop ro.board.platform
getprop ro.product.cpu.abi
getprop ro.yunos.build.version
ls /
ls /sys/class/thermal
mkdir <Package Folder>/files/1637729125/j0
mkdir <Package Folder>/files/1637729125/j1
mkdir <Package Folder>/files/1637729125/j2
mkdir <Package Folder>/files/1637729125/j3
mkdir <Package Folder>/files/1637729125/j5
mkdir <Package Folder>/files/1637729125/j6
rm -rf /data/user/0/<Package>/.libs/1_1001/.soldx/
rm -rf <Package Folder>/files/1637729125/*
sh
sh -c rm -rf /data/user/0/<Package>/.libs/1_1001/.soldx/ 2>/dev/null
sh -c rm -rf <Package Folder>/files/1637729125/*

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding
desede-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Requests the system alert window permission.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней