Android.Triada.2173

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.691.origin
Android.Triada.236.origin

Prompts to install third-party applications.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) gbk.9####.com:9000
TCP(HTTP/1.1) shl####.top:9999
TCP(HTTP/1.1) top.p####.net.####.com:80
TCP(HTTP/1.1) mon.sn####.com:80
TCP(HTTP/1.1) fron####.sn####.com:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(TLS/1.0) mon.sn####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) huo####.com.edg####.net:443
TCP(TLS/1.0) i.sn####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) ib.sn####.com:443

DNS requests:

a####.u####.com
api####.a####.com
api.huo####.com
dm.tou####.com
e.crashly####.com
fron####.sn####.com
gbk.9####.com
hot####.sn####.com
i.sn####.com
ib.sn####.com
is.sn####.com
log.sn####.com
mon.sn####.com
pay.9####.com
sett####.crashly####.com
shl####.top
top.p####.net
x####.sn####.com

HTTP GET requests:

fron####.sn####.com/ws/v1?iid=####&device_id=####&ac=####&channel=####&a...
mon.sn####.com/ies/network/hotsoon/?ac=####&channel=####&aid=####&app_na...
mon.sn####.com/monitor/appmonitor/v2/settings?sdk_version=####&openudid=...
top.p####.net.####.com/ng/201702/143/c/iconzR2qB.jpg
top.p####.net.####.com/ng/201702/143/c/pic0J0n8h.jpg
top.p####.net.####.com/ng/201706/321/c/icon.png
top.p####.net.####.com/ng/201706/321/c/pic0.jpg
top.p####.net.####.com/ng/201706/321/qqdd7v1s_306966.apk
top.p####.net.####.com/ng/201801/645/c/icon_qT7k.png
top.p####.net.####.com/ng/201801/645/c/pic0xTD3s.jpg
top.p####.net.####.com/ng/201801/645/fddzKKo9.apk
top.p####.net.####.com/ng/201810/835/c/icon0X12U.png
top.p####.net.####.com/ng/201810/835/c/pic0yEr7z.png
top.p####.net.####.com/ng/201810/835/hsssyyeuW_402194.apk

HTTP POST requests:

a####.u####.com/app_logs
gbk.9####.com:9000/sdk_pools_pay_version
mon.sn####.com/service/2/app_log_config/?ac=####&channel=####&aid=####&a...
mon.sn####.com/service/2/app_log_config/?iid=####&device_id=####&ac=####...
res####.a####.com/v3/log/init
shl####.top:9999/c872/397
shl####.top:9999/d12ac/0720d
shl####.top:9999/o19cf23a/cb4
shl####.top:9999/s4ceeb/7c02
shl####.top:9999/se93f4dd/093d2a2

Modified file system:

Creates the following files:

/data/data/####/.bak
/data/data/####/.imprint
/data/data/####/.jar
/data/data/####/3.png
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790BeginSession.cls_temp
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790SessionApp.cls_temp
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790SessionDevice.cls_temp
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790SessionOS.cls_temp
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790SessionUser.cls_temp
/data/data/####/5BC3C1A102E6-0001-0A16-99C788666790keys.meta
/data/data/####/5BC3C1A201F0-0001-09D0-99C788666790BeginSession.cls_temp
/data/data/####/5BC3C1A201F0-0001-09D0-99C788666790SessionApp.cls_temp
/data/data/####/5BC3C1A201F0-0001-09D0-99C788666790SessionDevice.cls_temp
/data/data/####/5BC3C1A201F0-0001-09D0-99C788666790SessionOS.cls_temp
/data/data/####/5BC3C1A201F0-0001-09D0-99C788666790keys.meta
/data/data/####/Alvin2.xml
/data/data/####/CYCLE_PAY_PREF_NAME.xml
/data/data/####/CYCLE_UNIQUE_ID.xml
/data/data/####/ContextData.xml
/data/data/####/KEY_NEED_UPLOAD_LAUNCHLOG.xml
/data/data/####/MainScene_1.csb
/data/data/####/Marker Felt.ttf
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/TextAtlas.png
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/app_setting.xml
/data/data/####/app_track.xml
/data/data/####/applog_stats.xml
/data/data/####/arial.ttf
/data/data/####/back.png
/data/data/####/button.mp3
/data/data/####/button_back.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/client_ab.xml
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.ss.android.ugc.live-1.apk.classes-1604235244.zip
/data/data/####/com.ss.spipe_setting.xml
/data/data/####/custom_channels.xml
/data/data/####/cyclesdk.apk
/data/data/####/die.mp3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/feedback.db-journal
/data/data/####/game.csb
/data/data/####/gecko_local_info.db
/data/data/####/gecko_local_info.db-journal
/data/data/####/gecko_local_sp.xml
/data/data/####/gq.ExportJson
/data/data/####/gq0.plist
/data/data/####/gq0.png
/data/data/####/hero.ExportJson
/data/data/####/hero.csb
/data/data/####/hero.png
/data/data/####/hero0.plist
/data/data/####/hero0.png
/data/data/####/high.mp3
/data/data/####/high_score.png
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.l.xml
/data/data/####/jx.png
/data/data/####/jx_1.png
/data/data/####/jx_10.png
/data/data/####/jx_2.png
/data/data/####/jx_3.png
/data/data/####/jx_4.png
/data/data/####/jx_5.png
/data/data/####/jx_6.png
/data/data/####/jx_7.png
/data/data/####/jx_8.png
/data/data/####/jx_9.png
/data/data/####/key
/data/data/####/koufei_0.png
/data/data/####/lang_encrypt_dex.dex
/data/data/####/last_know_location.xml
/data/data/####/lib_log_queue.db-journal
/data/data/####/libao.csb
/data/data/####/libbangbu.so
/data/data/####/live-app-core.xml
/data/data/####/live_app_default.xml
/data/data/####/live_notification_cache.xml
/data/data/####/logo.png
/data/data/####/luodi.mp3
/data/data/####/mg.png
/data/data/####/mg_1.png
/data/data/####/mg_2.png
/data/data/####/monitor_config.xml
/data/data/####/multi_process_config.xml
/data/data/####/multidex.version.xml
/data/data/####/name_1.png
/data/data/####/name_10.png
/data/data/####/name_2.png
/data/data/####/name_3.png
/data/data/####/name_4.png
/data/data/####/name_5.png
/data/data/####/name_6.png
/data/data/####/name_7.png
/data/data/####/name_8.png
/data/data/####/name_9.png
/data/data/####/nulluser.meta
/data/data/####/num-lv.png
/data/data/####/num01.png
/data/data/####/num02.png
/data/data/####/p01.png
/data/data/####/p02.png
/data/data/####/p03.png
/data/data/####/p04.png
/data/data/####/p05.png
/data/data/####/p07.png
/data/data/####/p08.png
/data/data/####/p10.png
/data/data/####/p12.png
/data/data/####/paihang.csb
/data/data/####/paihang_1.png
/data/data/####/paihang_botton.png
/data/data/####/ph-num.png
/data/data/####/push_multi_process_config.xml
/data/data/####/renwu.mp3
/data/data/####/restart.png
/data/data/####/restart_0.csb
/data/data/####/restart_1.csb
/data/data/####/restarte.png
/data/data/####/sa_d00b75f2-419d-49fa-8d1d-bd40c89375dd_1539555746728.tap
/data/data/####/sa_dbb844d9-a65e-4145-b050-9d506b4b1b25_1539555747953.tap
/data/data/####/score.png
/data/data/####/score_bg.png
/data/data/####/score_bg_1.png
/data/data/####/sdk_config.xml
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/slot_paper01.png
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_live_setting.xml
/data/data/####/splashsdk.db-journal
/data/data/####/ss_app_log.db-journal
/data/data/####/ss_app_monitor.db-journal
/data/data/####/ss_downloads.db-journal
/data/data/####/ss_push_log.db
/data/data/####/ss_push_log.db-journal
/data/data/####/start.csb
/data/data/####/start.png
/data/data/####/tiaotiaodonghua.ExportJson
/data/data/####/tiaotiaodonghua0.plist
/data/data/####/tiaotiaodonghua0.png
/data/data/####/tiaotiaodonghua1.plist
/data/data/####/tiaotiaodonghua1.png
/data/data/####/tiaotiaodonghua2.plist
/data/data/####/tiaotiaodonghua2.png
/data/data/####/tiaotiaolizi1.plist
/data/data/####/tiaotiaolizi2.plist
/data/data/####/tiaotiaotietu1.png
/data/data/####/tiaoyitiao01.plist
/data/data/####/tj-2.png
/data/data/####/tj-5.png
/data/data/####/tj-num.png
/data/data/####/tnsea
/data/data/####/tnseaen
/data/data/####/touxiang01.png
/data/data/####/traffic_monitor_info.xml
/data/data/####/twsdk.db
/data/data/####/twsdk.db-journal
/data/data/####/tx_1.png
/data/data/####/tx_10.png
/data/data/####/tx_2.png
/data/data/####/tx_3.png
/data/data/####/tx_4.png
/data/data/####/tx_5.png
/data/data/####/tx_6.png
/data/data/####/tx_7.png
/data/data/####/tx_8.png
/data/data/####/tx_9.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/userData.xml
/data/data/####/userDatas.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wuti_1.png
/data/data/####/wuti_2.png
/data/data/####/yz.png
/data/data/####/yz_1.png
/data/data/####/yz_2.png
/data/data/####/yz_3.png
/data/data/####/yz_4.png
/data/media/####/0aab1c22c2926d409170f35f1481c35b.cach
/data/media/####/38c7d4e2fdaff8caa8ffbd109284d67c.cach
/data/media/####/60a4042250347fc4aadc6528908b8e5e.cach
/data/media/####/6c32040fe461ea54cbf92c71da239ffe.sds
/data/media/####/78e5c7e1e8ea8758405aa24d81b110f3.sds
/data/media/####/9173653c4b2e8b18faf238bf1742b6bc.cach
/data/media/####/93bb34d396344763a3e1b173365c7b97.cach
/data/media/####/Alvin2.xml
/data/media/####/AppShareIcon.jpg
/data/media/####/ContextData.xml
/data/media/####/clientudid.dat
/data/media/####/d546ba3419abfdb4ea64a5653892618b.cach
/data/media/####/daf962db54380bd23c994a5eba35c506.sds
/data/media/####/e1040dbfdac58d67b0dd32f1ab92cec7.cach
/data/media/####/e2e5c822f8961275f4f5ae694a138a8e.cach
/data/media/####/journal
/data/media/####/journal.tmp

Miscellaneous:

Executes next shell scripts:

/data/data/com.ss.android.ugc.live/lib/libsupervisor.so com.ss.android.ugc.live com.ss.android.message.NotifyService com.ss.android.ugc.live:push /data/data/com.ss.android.ugc.live 0
cat /proc/cpuinfo
chmod 777 /storage/emulated/0/tmp/<Package>/78e5c7e1e8ea8758405aa24d81b110f3.sds
chmod 777 /storage/emulated/0/tmp/<Package>/daf962db54380bd23c994a5eba35c506.sds
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
sh /data/data/com.ss.android.ugc.live/lib/libsupervisor.so com.ss.android.ugc.live com.ss.android.message.NotifyService com.ss.android.ugc.live:push /data/data/com.ss.android.ugc.live 0

Loads the following dynamic libraries:

game
libbangbu

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial