Android.Triada.4356

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.248.origin
Android.Triada.464.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.11.186.32:80
TCP(HTTP/1.1) sh.i####.uc.cn:80
TCP(HTTP/1.1) hy.9####.cn:8080
TCP(HTTP/1.1) na61-####.wagbr####.adverti####.####.com:80
TCP(TLS/1.0) na61-####.wagbr####.adverti####.####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) sh.i####.uc.cn:443

DNS requests:

api.yous####.cn
h####.b####.com
hy.9####.cn
i####.9####.cn
l.ace####.com
payce####.9####.cn
paycent####.9####.cn
s####.9####.cn
sd####.9####.cn
sdkress####.9####.cn
sdky####.9####.cn
sh.i####.uc.cn

HTTP GET requests:

sh.i####.uc.cn/s/y9c/g/myspace_server/system/20170726/150103492719098685...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a143d57f80857ed96176_selected_150...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a143d57f80857ed96176_unselected_1...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a189d57f80857ed9617e_selected_147...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a189d57f80857ed9617e_unselected_1...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a1bbd57f80857ed96182_selected_152...
sh.i####.uc.cn/s/y9h/g/floatWindow/5703a1bbd57f80857ed96182_unselected_1...
sh.i####.uc.cn/s/y9h/g/floatWindow/5b0e206ff57f93681def2929_selected_152...
sh.i####.uc.cn/s/y9h/g/floatWindow/5b0e206ff57f93681def2929_unselected_1...

HTTP POST requests:

hy.9####.cn:8080/v1/d
hy.9####.cn:8080/v2/m?account_id=####
hy.9####.cn:8080/v2/x?account_id=####
na61-####.wagbr####.adverti####.####.com/act/client/client.event.report?...
na61-####.wagbr####.adverti####.####.com/client/floatwindow.column.list?...
na61-####.wagbr####.adverti####.####.com/client/pack.sdkPlugin.get?df=####
na61-####.wagbr####.adverti####.####.com/client/res.msgtempl.get?df=####
na61-####.wagbr####.adverti####.####.com/ng/client/gift.getBookingList?d...
na61-####.wagbr####.adverti####.####.com/ng/client/gift.getKaBoxList?df=...
na61-####.wagbr####.adverti####.####.com/ng/client/gift.getListByGameId?...
na61-####.wagbr####.adverti####.####.com/ng/client/gift.isMemberPreGet?d...
na61-####.wagbr####.adverti####.####.com/ng/client/log.collect.sdklog?os...
na61-####.wagbr####.adverti####.####.com/ng/client/log.collect.sdklog?ve...
na61-####.wagbr####.adverti####.####.com/ng/client/ngaccount.anonymousLo...
na61-####.wagbr####.adverti####.####.com/ng/client/ngaccount.getUserSimp...
na61-####.wagbr####.adverti####.####.com/ng/client/realname.getStrategyA...
na61-####.wagbr####.adverti####.####.com/ng/client/system.brand.check?ve...
na61-####.wagbr####.adverti####.####.com/ng/client/system.getSecurityKey...
na61-####.wagbr####.adverti####.####.com/ng/client/ucid.user.deviceHisto...
na61-####.wagbr####.adverti####.####.com/ng/mcs/mcs.combine?ver=####&df=...
na61-####.wagbr####.adverti####.####.com/v3/sdk.shell.log?id=####&sb=####

File system changes:

Creates the following files:

/data/data/####/-wcFdlY-TZFx_wQavZwn69qEZSErf-Ns.new
/data/data/####/.verify
/data/data/####/1231050160.floatWindow.config.tmp
/data/data/####/134bd8946013d2c28296971d3ebc4b2a
/data/data/####/134bd8946013d2c28296971d3ebc4b2a.dat
/data/data/####/1573EAA95EA16DE294F0C4DE6B36A088.lock
/data/data/####/24B92336F25C951F4F65C1FE54839D61.lock
/data/data/####/3007DA5CB7ED13CD59BFF9F7583C2D89.lock
/data/data/####/48a36c2d105fe4a44695067fef12170a
/data/data/####/48a36c2d105fe4a44695067fef12170a.dat
/data/data/####/4dc849fde5e5448e096e4febae2ee69f
/data/data/####/4dc849fde5e5448e096e4febae2ee69f.dat
/data/data/####/5c27ae1d49c5ddbf3d98cadf029262f5
/data/data/####/5c27ae1d49c5ddbf3d98cadf029262f5.dat
/data/data/####/61257EC6F8D4352F64EC57EB2C44F2F0.lock
/data/data/####/691e518b04b7258576701f118af99056
/data/data/####/691e518b04b7258576701f118af99056.dat
/data/data/####/7uRNj3odQJmUzdvQ.new
/data/data/####/99d7a3d898d87b504b9f77c21401920c
/data/data/####/99d7a3d898d87b504b9f77c21401920c.dat
/data/data/####/9game.png
/data/data/####/AejxZgBC1CCenl0pH3qvqovidcbazRlmCMeZjF-EXog=_Nu...ournal
/data/data/####/Alvin2.xml
/data/data/####/BaseSDK.xml
/data/data/####/ContextData.xml
/data/data/####/FC1E4038728E095CEA281ED4F602B7EE.lock
/data/data/####/FO-F82cXKAyiBwUoOyMokA==.new
/data/data/####/HR1XI5zPxLFDUffNG17O4u_qt0s=.new
/data/data/####/ModuleManifest.json
/data/data/####/P6t0ecixn77aYH41DpxP6A==.new
/data/data/####/SDKORDERDB.db-journal
/data/data/####/VipbsvRQ_do5ZzQV.zip
/data/data/####/YdSx38UTVhOo4Jie
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/_hyDnsServiceIp.txt
/data/data/####/_xtqServiceIp.txt
/data/data/####/account_hMG3zbtbnkmocvtfYQBalRPUP47GaGXN_46ee31...86b8fb
/data/data/####/advConfig.json
/data/data/####/aes.min.js
/data/data/####/ar_l.png
/data/data/####/ar_l_2.png
/data/data/####/at.png
/data/data/####/auto_login.png
/data/data/####/back.png
/data/data/####/backbone.min.js
/data/data/####/base.css
/data/data/####/bbs.html
/data/data/####/bbs.png
/data/data/####/bbsico.png
/data/data/####/bg.gif
/data/data/####/bg_item.png
/data/data/####/bg_password.png
/data/data/####/bg_pop.png
/data/data/####/bg_sprites.png
/data/data/####/bizlog_dao.db-journal
/data/data/####/bridge.android.js
/data/data/####/bt_icon.png
/data/data/####/btn-states.png
/data/data/####/btn_error.png
/data/data/####/btn_succ.png
/data/data/####/c070f1c8d8c610ca6573521daa302f28
/data/data/####/c070f1c8d8c610ca6573521daa302f28.dat
/data/data/####/captcha.png
/data/data/####/captcha_press.png
/data/data/####/cb4a7f4dcdbf6fbf1cce50ece56d5a26
/data/data/####/cb4a7f4dcdbf6fbf1cce50ece56d5a26.dat
/data/data/####/ceab.png
/data/data/####/cecz.png
/data/data/####/ceedit.png
/data/data/####/cenh.png
/data/data/####/ceyj.png
/data/data/####/channellist.xml
/data/data/####/check_sprites.png
/data/data/####/chv.png
/data/data/####/cn.sirius.adpsdk.loader.apk
/data/data/####/cn.sirius.adpsdk.pref.xml
/data/data/####/cn.uc.gamesdk.httpdns.pref.xml
/data/data/####/cn.uc.gamesdk.httpdns.pref.xml.bak
/data/data/####/cn.uc.gamesdk.loader.apk
/data/data/####/cn.uc.gamesdk.pref.svr.xml
/data/data/####/cn.uc.gamesdk.pref.xml
/data/data/####/cn.uc.paysdk.pref.xml
/data/data/####/codecenter.html
/data/data/####/common.js
/data/data/####/coupon.png
/data/data/####/dWw7-cOHCVZiolWfZ-iO5r1HKDw=.new
/data/data/####/dd08e7e6585c65c72c756cb643a587c5
/data/data/####/dd08e7e6585c65c72c756cb643a587c5.dat
/data/data/####/display_mode.config
/data/data/####/dk.png
/data/data/####/dkl.png
/data/data/####/entry.xml
/data/data/####/environment.js
/data/data/####/exp.png
/data/data/####/fdKcZe_nDi7J5daofzxXn1IJA70=.new
/data/data/####/feedback.html
/data/data/####/floatWindow.config.tmp
/data/data/####/float_bg.9.png
/data/data/####/float_btn_orange.9.png
/data/data/####/float_btn_orange_press.9.png
/data/data/####/float_btn_white.9.png
/data/data/####/float_btn_white_press.9.png
/data/data/####/float_head_icon_back.png
/data/data/####/float_head_icon_back_press.png
/data/data/####/float_head_icon_close.png
/data/data/####/float_head_icon_close_press.png
/data/data/####/game.html
/data/data/####/game.js
/data/data/####/gameRoute.js
/data/data/####/gamesdk_stat.db-journal
/data/data/####/general.js
/data/data/####/getparameters.js
/data/data/####/h-8PilR3zdKz-61ymM9iOw==.new
/data/data/####/hMG3zbtbnkmocvtfYQBalRPUP47GaGXN__local_last_session.json
/data/data/####/hMG3zbtbnkmocvtfYQBalRPUP47GaGXN__local_stat_cache.json
/data/data/####/heart.png
/data/data/####/iUmO_LyUrqphpSbFbm3XAi5spDM=.new
/data/data/####/ico.png
/data/data/####/ico_error.png
/data/data/####/ico_mobile.png
/data/data/####/ico_mobile_q.png
/data/data/####/icon.png
/data/data/####/icon_email.png
/data/data/####/icon_email_dis.png
/data/data/####/icon_password.png
/data/data/####/icon_password_dis.png
/data/data/####/icon_phone.png
/data/data/####/icon_phone_dis.png
/data/data/####/imei
/data/data/####/jc_logo.png
/data/data/####/ju8u1kRjCO-G1-ENinthPDCmbew=.new
/data/data/####/lib_ucsdk_softlink.so
/data/data/####/lib_ucsdk_xcrypt.so
/data/data/####/libcn.uc.gamesdk.account.apk
/data/data/####/libcn.uc.gamesdk.core.apk
/data/data/####/libcn.uc.gamesdk.floater.apk
/data/data/####/libcn.uc.gamesdk.init.apk
/data/data/####/libcn.uc.gamesdk.update.apk
/data/data/####/libcuid.so
/data/data/####/libenigma.so
/data/data/####/libpandora.so
/data/data/####/libsoftlink.so
/data/data/####/libugpsdk.so
/data/data/####/list.xml
/data/data/####/loading.gif
/data/data/####/localstore.js
/data/data/####/lock
/data/data/####/logo.png
/data/data/####/md5.min.js
/data/data/####/mo.png
/data/data/####/mui.min.css
/data/data/####/mui.min.js
/data/data/####/mui.ttf
/data/data/####/my_account.png
/data/data/####/news.png
/data/data/####/onico.png
/data/data/####/operatorConfig.json
/data/data/####/pay-angle.png
/data/data/####/pay__.png
/data/data/####/platformProtocol.html
/data/data/####/pop_sprites.png
/data/data/####/popup.html
/data/data/####/property
/data/data/####/ql1kBkm-tctiqoIKXsZqtw==
/data/data/####/rdata_combfzrevenue.new
/data/data/####/reAwakeGamellpoker.xml
/data/data/####/rsa.min.js
/data/data/####/runner_info.prop.new
/data/data/####/safe.png
/data/data/####/scroll.9.png
/data/data/####/sdk.NetworkConfig.xml
/data/data/####/sdkBase.js
/data/data/####/sdkBase.min.js
/data/data/####/secrecy.html
/data/data/####/security.js
/data/data/####/select.png
/data/data/####/serviceMemory.xml
/data/data/####/signature
/data/data/####/srjuug_f.zip
/data/data/####/start.html
/data/data/####/start.js
/data/data/####/state-ico.png
/data/data/####/stgy.png
/data/data/####/style.css
/data/data/####/style_sdk.css
/data/data/####/sui.css
/data/data/####/svip_1.png
/data/data/####/svip_2.png
/data/data/####/system_config_pref.xml
/data/data/####/template.js
/data/data/####/test.js
/data/data/####/trumpet.png
/data/data/####/tx-998.jpg
/data/data/####/tx-999.jpg
/data/data/####/tx-grey-male.jpg
/data/data/####/u_ico.png
/data/data/####/ucRoute.js
/data/data/####/uc_systemConfig.json
/data/data/####/ucf.js
/data/data/####/ucgame_sdk.db-journal
/data/data/####/ucsdk.apk
/data/data/####/ud.png
/data/data/####/ugpsdk-plugin-loader.apk
/data/data/####/underscore.min.js
/data/data/####/user.html
/data/data/####/user.js
/data/data/####/userProtocol.html
/data/data/####/userRoute.js
/data/data/####/user_landscape.html
/data/data/####/userdata.xml
/data/data/####/util.js
/data/data/####/vTWyoTeIhTxw0ld707mHpA==
/data/data/####/version.ini
/data/data/####/vip-default.png
/data/data/####/vip-grade-1.png
/data/data/####/vip-gray.png
/data/data/####/vip-icon.png
/data/data/####/vip.png
/data/data/####/wait.gif
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xIk8JTXXszDelB0Aw4AqiQ==.new
/data/data/####/yX6Nd-a_QsSFOH-46eCBAKj2obY=.new
/data/data/####/yes.png
/data/data/####/zepto.min.js
/data/data/####/zf.png
/data/media/####/-1097781549
/data/media/####/-1196876462
/data/media/####/-1467643064
/data/media/####/-1763661886
/data/media/####/-2090138920
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.uunique.new
/data/media/####/269841921
/data/media/####/326196171
/data/media/####/533035176
/data/media/####/824941927
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/config
/data/media/####/net_20191115_log
/data/media/####/stat_20191115_log
/data/media/####/ucgame_sdk.db-journal

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/xbin/which su
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.vivo.os.version
getprop ro.yunos.version
ps
sh

Loads the following dynamic libraries:

lib_ucsdk_softlink
lib_ucsdk_xcrypt
libsoftlink
libugpsdk
pandora

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Uses elevated priveleges.

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial