Android.Triada.1901

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.691.origin
Android.Triada.1248

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) shl####.top:9999
TCP(HTTP/1.1) top.p####.net.####.com:80
TCP(HTTP/1.1) gbk.9####.com:9000
TCP(HTTP/1.1) pay.9####.com:9000

DNS requests:

a####.u####.com
gbk.9####.com
mt####.go####.com
pay.9####.com
shl####.top
top.p####.net

HTTP GET requests:

top.p####.net.####.com/ng/201612/111/c/icon.jpg
top.p####.net.####.com/ng/201612/111/c/pic0.jpg
top.p####.net.####.com/ng/201703/170/c/icon.png
top.p####.net.####.com/ng/201703/170/c/pic0.jpg
top.p####.net.####.com/ng/201803/702/c/icon.png
top.p####.net.####.com/ng/201803/702/c/pic0.png
top.p####.net.####.com/ng/201805/787/c/icon.png
top.p####.net.####.com/ng/201805/787/c/pic0.jpg

HTTP POST requests:

a####.u####.com/app_logs
gbk.9####.com:9000/sdk_pools_pay_version
shl####.top:9999/c6a2/c119
shl####.top:9999/d949a/3e1985
shl####.top:9999/o726e6e/0c101
shl####.top:9999/s1c4b75/5ed8b37
shl####.top:9999/s3247/c19
shl####.top:9999/s48c40f/c5ec5
shl####.top:9999/s8e418/92392
shl####.top:9999/sf92adfe/5f5

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jar
/data/data/####/3.png
/data/data/####/CYCLE_PAY_PREF_NAME.xml
/data/data/####/CYCLE_UNIQUE_ID.xml
/data/data/####/MainScene_1.csb
/data/data/####/Marker Felt.ttf
/data/data/####/TextAtlas.png
/data/data/####/arial.ttf
/data/data/####/back.png
/data/data/####/button.mp3
/data/data/####/button_back.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cyclesdk.apk
/data/data/####/die.mp3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/game.csb
/data/data/####/gq.ExportJson
/data/data/####/gq0.plist
/data/data/####/gq0.png
/data/data/####/hero.ExportJson
/data/data/####/hero.csb
/data/data/####/hero.png
/data/data/####/hero0.plist
/data/data/####/hero0.png
/data/data/####/high.mp3
/data/data/####/high_score.png
/data/data/####/jx.png
/data/data/####/jx_1.png
/data/data/####/jx_10.png
/data/data/####/jx_2.png
/data/data/####/jx_3.png
/data/data/####/jx_4.png
/data/data/####/jx_5.png
/data/data/####/jx_6.png
/data/data/####/jx_7.png
/data/data/####/jx_8.png
/data/data/####/jx_9.png
/data/data/####/key
/data/data/####/koufei_0.png
/data/data/####/lang_encrypt_dex.dex
/data/data/####/libao.csb
/data/data/####/libzunyi.so
/data/data/####/logo.png
/data/data/####/luodi.mp3
/data/data/####/mg.png
/data/data/####/mg_1.png
/data/data/####/mg_2.png
/data/data/####/name_1.png
/data/data/####/name_10.png
/data/data/####/name_2.png
/data/data/####/name_3.png
/data/data/####/name_4.png
/data/data/####/name_5.png
/data/data/####/name_6.png
/data/data/####/name_7.png
/data/data/####/name_8.png
/data/data/####/name_9.png
/data/data/####/num-lv.png
/data/data/####/num01.png
/data/data/####/num02.png
/data/data/####/p01.png
/data/data/####/p02.png
/data/data/####/p03.png
/data/data/####/p04.png
/data/data/####/p05.png
/data/data/####/p07.png
/data/data/####/p08.png
/data/data/####/p10.png
/data/data/####/p12.png
/data/data/####/paihang.csb
/data/data/####/paihang_1.png
/data/data/####/paihang_botton.png
/data/data/####/ph-num.png
/data/data/####/renwu.mp3
/data/data/####/restart.png
/data/data/####/restart_0.csb
/data/data/####/restart_1.csb
/data/data/####/restarte.png
/data/data/####/score.png
/data/data/####/score_bg.png
/data/data/####/score_bg_1.png
/data/data/####/slot_paper01.png
/data/data/####/start.csb
/data/data/####/start.png
/data/data/####/tiaotiaodonghua.ExportJson
/data/data/####/tiaotiaodonghua0.plist
/data/data/####/tiaotiaodonghua0.png
/data/data/####/tiaotiaodonghua1.plist
/data/data/####/tiaotiaodonghua1.png
/data/data/####/tiaotiaodonghua2.plist
/data/data/####/tiaotiaodonghua2.png
/data/data/####/tiaotiaolizi1.plist
/data/data/####/tiaotiaolizi2.plist
/data/data/####/tiaotiaotietu1.png
/data/data/####/tiaoyitiao01.plist
/data/data/####/tj-2.png
/data/data/####/tj-5.png
/data/data/####/tj-num.png
/data/data/####/tnsea
/data/data/####/tnseaen
/data/data/####/touxiang01.png
/data/data/####/twsdk.db-journal
/data/data/####/tx_1.png
/data/data/####/tx_10.png
/data/data/####/tx_2.png
/data/data/####/tx_3.png
/data/data/####/tx_4.png
/data/data/####/tx_5.png
/data/data/####/tx_6.png
/data/data/####/tx_7.png
/data/data/####/tx_8.png
/data/data/####/tx_9.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/userData.xml
/data/data/####/userDatas.xml
/data/data/####/webview.db-journal
/data/data/####/wuti_1.png
/data/data/####/wuti_2.png
/data/data/####/yz.png
/data/data/####/yz_1.png
/data/data/####/yz_2.png
/data/data/####/yz_3.png
/data/data/####/yz_4.png
/data/media/####/0693d7ebc6f61a0d8754999fff1e0019.cach
/data/media/####/0ad4eaf8240fa99496887e2e890efd08.cach
/data/media/####/350b40e03cfb67a68396b46ecd1d9cf2.cach
/data/media/####/43e8092717b480ff840cf7fc7470501f.cach
/data/media/####/59f668eee7d7902766eb8596a1a1b1d1.cach
/data/media/####/953650ae19be00049fdc8726d17151d9.cach
/data/media/####/c87a3194690faa66bbca5dd741dc2d81.cach

Miscellaneous:

Executes next shell scripts:

cat /proc/cpuinfo

Loads the following dynamic libraries:

game
libzunyi

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial