Android.Triada.4602

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.893.origin
Android.Triada.477.origin
Android.Triada.491.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) bsws####.su####.com.####.net:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) tv####.chenmi####.top.####.com:80
TCP(HTTP/1.1) ppgat####.c####.ott.####.net:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) api.dianshi####.com:80
TCP(HTTP/1.1) esw.ty####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) e####.ty####.com:80
TCP(HTTP/1.1) es####.dan####.net:80
TCP(HTTP/1.1) 1####.55.43.43:7001
TCP(HTTP/1.1) edan####.b0.a####.com:80
TCP(HTTP/1.1) open####.b####.com:80
TCP(HTTP/1.1) ask.log.k####.com:80
TCP(HTTP/1.1) cdn.dianshi####.com:80
TCP(HTTP/1.1) down####.cloud####.com:80
TCP(HTTP/1.1) reso####.ad.k####.####.cn:80
TCP(HTTP/1.1) hdn.ad####.com.####.com:80
TCP(HTTP/1.1) is####.isha####.com:80
TCP(HTTP/1.1) 1####.43.187.176:8080
TCP(HTTP/1.1) sverup####.opensp####.cn:80
TCP(HTTP/1.1) ip.3####.cn:80
TCP(HTTP/1.1) 1####.97.200.14:80
TCP(HTTP/1.1) www.che####.org:80
TCP(HTTP/1.1) e####.z####.net:80
TCP(TLS/1.0) t####.k####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) s####.we####.com:443
TCP(TLS/1.0) tvhome-####.k####.com:443
TCP(TLS/1.0) idc####.k####.com:443
TCP(TLS/1.0) ap####.k####.com:443
TCP(TLS/1.0) g####.com:443
TCP(TLS/1.0) e####.ty####.com:443
TCP 47.96.1####.82:9988

DNS requests:

ap####.k####.com
api.dianshi####.com
api.gaoqing####.com
ask.log.k####.com
c####.su####.cn
cdn.dianshi####.com
d####.vod.itc.cn
down####.cloud####.com
e####.ty####.com
e####.ty####.com
e####.z####.net
es####.dan####.net
esw.ty####.com
g####.com
hdn.ad####.com
i####.dan####.net
idc####.k####.com
ip.3####.cn
is####.isha####.com
oc.u####.com
open####.b####.com
pi####.qq.com
plb####.u####.com
ppgat####.c####.ott.####.net
pv.s####.com
reso####.ad.k####.com
s####.su####.com
s####.we####.com
sverup####.opensp####.cn
t####.k####.com
tv####.chenmi####.top
tvhome-####.k####.com
u####.u####.com
www.che####.org

HTTP GET requests:

api.dianshi####.com/api/v1/jar/config?jarVerCode=####&encryption=####
api.dianshi####.com/ipInfo
ask.log.k####.com/check.do?model=####&copyright_id=####&userid=####&mac=...
bsws####.su####.com.####.net/sa/conf/appSDKConfig.gif?i=####
cdn.dianshi####.com/static/600911fccf4c9a3bcfd669fb8fb69658
down####.cloud####.com/work/app/is/plugin/2020020700/plugin.jar
edan####.b0.a####.com/appIcon/761472ef30f30d6c01c0d03e61d426a6.png
edan####.b0.a####.com/image/20200206/c9de1b4ee2215fc038427305aca86482.jpg
esw.ty####.com/dbGold/v1/sdkSwitch.do?appkey=####&channel=####&device_na...
gd.a.s####.com/?rb=####&key=####&prod=####&pt=####&new=####
gd.a.s####.com/cityjson
hdn.ad####.com.####.com/zgl/release/bigscr08/task_97.jar
ip.3####.cn/IPShare/info
is####.isha####.com/v1/pluginDex.json
open####.b####.com/api.php?query=####&resource_id=####&oe=####
ppgat####.c####.ott.####.net/ott-web/sdk/authenticate.do?source=####&cha...
ppgat####.c####.ott.####.net/ott-web/sdk/channels.do?source=####&channel...
reso####.ad.k####.####.cn/ad/jar/20191227/1577444366759.apk
tv####.chenmi####.top.####.com/tvlist/soft4.txt
www.che####.org/a/mg.m3u8?id=####
www.che####.org/a0/mg.m3u8?id=####
www.che####.org/a1/mg.m3u8?id=####
www.che####.org/a2/mg.m3u8?id=####
www.che####.org/a3/mg.m3u8?id=####
www.che####.org/a4/mg.m3u8?id=####
www.che####.org/a5/mg.m3u8?id=####
www.che####.org/b/mg.m3u8?id=####
www.che####.org/b0/mg.m3u8?id=####
www.che####.org/b1/mg.m3u8?id=####
www.che####.org/b2/mg.m3u8?id=####
www.che####.org/b3/mg.m3u8?id=####
www.che####.org/b4/mg.m3u8?id=####
www.che####.org/b5/mg.m3u8?id=####
www.che####.org/proxy/mg.m3u8?id=####
www.che####.org/proxy0/mg.m3u8?id=####
www.che####.org/proxy1/mg.m3u8?id=####
www.che####.org/proxy2/mg.m3u8?id=####
www.che####.org/proxy3/mg.m3u8?id=####
www.che####.org/proxy4/mg.m3u8?id=####
www.che####.org/proxy5/mg.m3u8?id=####
www.che####.org/soft/key.php

HTTP POST requests:

bsws####.su####.com.####.net/psdk.gif?t=####
e####.ty####.com/dbGold/v1/deviceRegister.do
e####.ty####.com/dbGold/v1/liveReveal.do
e####.z####.net/dbGold/v1/liveReveal.do
es####.dan####.net/dbzs/m1/appActiveInfo.do
es####.dan####.net/dbzs/m1/appInfo.do
esw.ty####.com/dbGold/v1/diskAuth.do
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
pi####.qq.com/mstat/report/?index=####
sverup####.opensp####.cn/opendvlp/get_version.php?version=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/02574D5D52.jar
/data/data/####/03544C5E53.jar.4ea5e9dfb837befb422de55a1281dc6b
/data/data/####/0a50e0dce415e49fd400a6c1379684ea
/data/data/####/358734d2b0014b2d674a586bb63e89fc
/data/data/####/3acdcf6e2746272cedc579da55823e8d
/data/data/####/3cf355c0e7b9e09f200b7ff2de301d09
/data/data/####/7f33541f781d6072f7cf46862a0a93a1
/data/data/####/7f33541f781d6072f7cf46862a0a93a1 (deleted)
/data/data/####/84a20122c5e113cc029a06190444d209
/data/data/####/84a20122c5e113cc029a06190444d209 (deleted)
/data/data/####/AndroidManifest.xml
/data/data/####/MANIFEST.MF
/data/data/####/MultiDex.lock
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/activity_launcher_summary.xml
/data/data/####/ad_templates.xml
/data/data/####/ad_u.xml
/data/data/####/byl.png
/data/data/####/ccdx
/data/data/####/com.aesq.cztv.mid.world.ro.xml
/data/data/####/com.aesq.cztv_preferences.xml
/data/data/####/com.suning.ottstatistics.StatisticsTools.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgxNDc5OTg3Nzgx;
/data/data/####/dbfile.xml
/data/data/####/device_identification_info.xml
/data/data/####/device_preference.xml
/data/data/####/dflist.txt
/data/data/####/dialog_content.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fav.db
/data/data/####/fav.db-journal
/data/data/####/fsg.png
/data/data/####/fywdl2
/data/data/####/gt.txt
/data/data/####/history.db
/data/data/####/history.db-journal
/data/data/####/hqg.png
/data/data/####/hxg.png
/data/data/####/i==1.2.0&&5.0.06_1581479987871_envelope.log
/data/data/####/info.xml
/data/data/####/jjg.png
/data/data/####/jyg.png
/data/data/####/klg.png
/data/data/####/kuyun.apk.tmp
/data/data/####/kuyun_sdk.xml
/data/data/####/kycfg.xml
/data/data/####/libjiagu232071944.so
/data/data/####/log_manager.xml
/data/data/####/mZB.xml
/data/data/####/mZB.xml.bak
/data/data/####/multidex.version.xml
/data/data/####/no_notice.mp3
/data/data/####/onlineconfig_agent_online_setting_com.aesq.cztv.xml
/data/data/####/otto-v60.so
/data/data/####/parser.jar
/data/data/####/plugin.jar
/data/data/####/plugin_break_point_info.xml
/data/data/####/pptv.txt
/data/data/####/pri_tencent_analysis.db_com.aesq.cztv-journal
/data/data/####/resources.arsc
/data/data/####/selector_dialog_btn.xml
/data/data/####/selector_item.xml
/data/data/####/shape_desktop_bg.xml
/data/data/####/shape_mask_bg.xml
/data/data/####/shape_pro_ring.xml
/data/data/####/shape_tag_bg.xml
/data/data/####/share_date.xml
/data/data/####/ssg.png
/data/data/####/t==8.1.3&&5.0.06_1581479989169_envelope.log
/data/data/####/tencent_analysis.db_com.aesq.cztv-journal
/data/data/####/tv_name_id_map.xml
/data/data/####/tvlist.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/ugw.png
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/urlcfg.txt
/data/data/####/user.xml
/data/data/####/vip.txt
/data/data/####/webview.db-journal
/data/data/####/xml.jar
/data/media/####/.D1C593128F43E2D009A968D7C663F774
/data/media/####/.D1C593128F43E2D009A968D7C663F774-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/.temp/fywdl2 <Package Folder>/files/.temp/hello2 am startservice --user 0 -a com.google.ACTION.service -n <Package>/cn.turkeyo.sxiy.ZhojFbtog
cat /proc/meminfo
cat /proc/net/arp
chmod 777 /storage/emulated/0/Android/data/<Package>/cache/afinalCache
chmod 777 <Package Folder>/files/.temp/otto-v60.so
ls /
ls /sys/class/thermal
sh
sh <Package Folder>/files/.temp/fywdl2 <Package Folder>/files/.temp/hello2 am startservice --user 0 -a com.google.ACTION.service -n <Package>/cn.turkeyo.sxiy.ZhojFbtog
which su

Loads the following dynamic libraries:

MtaNativeCrash_v2
euthenia-lib
libjiagu232071944
otto-v60

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial