Android.Triada.4540

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.477.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) d####.lovec####.info:80
TCP(HTTP/1.1) sdm####.doula####.com:9842
TCP(HTTP/1.1) bird-vi####.cn-hang####.log.####.com:80
TCP(HTTP/1.1) m####.zish####.cn.####.com:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) azh####.com:9060
TCP(HTTP/1.1) supload####.doula####.com:9842
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.217.17.106:443
TCP(TLS/1.0) ad1.azh####.com:9190
TCP(TLS/1.0) is.sn####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.217.17.106:443
TCP(TLS/1.2) 1####.217.20.74:443
TCP(TLS/1.2) 2####.58.211.110:443

DNS requests:

a####.u####.com
ad1.azh####.com
ad4.azh####.com
and####.cli####.go####.com
azh####.com
bird-vi####.cn-hang####.log.####.com
cgi.con####.qq.com
d####.lovec####.info
i.sn####.com
instant####.google####.com
is.sn####.com
m####.go####.com
m####.zish####.cn
sdm####.doula####.com
supload####.doula####.com

HTTP GET requests:

azh####.com:9060/v3/1/QdhYoxX37dO5qwC3/zh/en?t=####
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?status_os=####&stat...
d####.lovec####.info/8ff077d87cbe4c6588ec6dd7c92be373.jpg
d####.lovec####.info/a96e4f6b1da449288f613e310f8a749d.jpg
m####.zish####.cn.####.com/0f24bde9b3e14f55b00a34a5c8e8de3c.jpg
m####.zish####.cn.####.com/1148281ea5d34ef9909b814160767246.jpg
m####.zish####.cn.####.com/256324fb72dd4221be5002ca56c7ebe9.jpg
m####.zish####.cn.####.com/400c32d10fac4fda809d28145a727566.jpg
m####.zish####.cn.####.com/40d964d2030c4f138d5c958f66f36998.jpg
m####.zish####.cn.####.com/5ce3fff690f04df496993d14b972e033.jpg
m####.zish####.cn.####.com/7d7fbc84552a46eea4d9946b03afa21d.jpg
m####.zish####.cn.####.com/8aa11f41582648288352eafe221ccf53.jpg
m####.zish####.cn.####.com/93955917edbe43709a4f63112afca748.jpg
m####.zish####.cn.####.com/9a27202a75e04397b2762228fae34994.jpg
m####.zish####.cn.####.com/9f6ab3ea95f54c00ab38a1df663d9dbf.jpg
m####.zish####.cn.####.com/a3a2875dca714613969cba96835b7ca8.jpg
m####.zish####.cn.####.com/a475032804e746b8b918c1e02a3e07c6.jpg
m####.zish####.cn.####.com/a6b265480b67418097b9e96bc861a867.jpg
m####.zish####.cn.####.com/banner_33c45a95dd4f4888bd06507c4b653c9b.jpg
m####.zish####.cn.####.com/banner_3bc102d5de3d454fa7c4842ada5827c3.jpg
m####.zish####.cn.####.com/banner_a04da5e04d8442e3aa5237a544c791df.jpg
m####.zish####.cn.####.com/banner_d025f0d0cb6d43a5bd11ba163ed5ff66.jpg
m####.zish####.cn.####.com/c31d848334154cff96ff2b1e3f5afd80.jpg
m####.zish####.cn.####.com/cd49815f36664cc3b9e1ef945070ad9b.jpg
m####.zish####.cn.####.com/column_002347d0042146a48b91dc5c9eb205b9.jpg
m####.zish####.cn.####.com/column_00ad06cf7acd450eb0e9a206fa27bac1.jpg
m####.zish####.cn.####.com/column_010a79c453a9486f98443effe559de33.jpg
m####.zish####.cn.####.com/column_10e48db2506d4f09bc470e4b1e750e02.jpg
m####.zish####.cn.####.com/column_34069e5b12054a4296794e6631148783.jpg
m####.zish####.cn.####.com/column_4e95bc9a58a74e04b0a40c3806e515a8.jpg
m####.zish####.cn.####.com/column_55123d7b36fb45acb1ab111627a48ace.jpg
m####.zish####.cn.####.com/column_77d7e044c10a480ba8a39fd37ece7667.jpg
m####.zish####.cn.####.com/column_7ba14b1165de4910ae86a8afcad9c8dc.jpg
m####.zish####.cn.####.com/column_81c91cb5a0854843a68d4cb283ee7036.jpg
m####.zish####.cn.####.com/column_898727b6224648f78131c04a9078c918.jpg
m####.zish####.cn.####.com/column_99e860e6964349ce997ad21eebe4ed26.jpg
m####.zish####.cn.####.com/column_a181fbab3b884f1a90d0dfa78c1fdb44.jpg
m####.zish####.cn.####.com/column_a43b41a411d244f29215e69eb25e2bf0.jpg
m####.zish####.cn.####.com/column_b7a5a35fa4ab4e25b0ed9547830abfd7.jpg
m####.zish####.cn.####.com/column_c2a6a7f0173c43bc91c0228f01c754a2.jpg
m####.zish####.cn.####.com/column_c7ff9ee46b4f46d492fcde43f16ed9f0.jpg
m####.zish####.cn.####.com/column_d36630583d6241a7879d587a50827d70.jpg
m####.zish####.cn.####.com/column_eed4cf7e8bac4e77b89f43e5baf4e67f.jpg
m####.zish####.cn.####.com/d34c1b4a07f84d899a6210610dc4050a.jpg
m####.zish####.cn.####.com/de1f023ec0cf4b858ae0a11dbd7d09b9.jpg
m####.zish####.cn.####.com/dfc5bc4a2b08492d9eb0d40a71ddc68e.jpg
m####.zish####.cn.####.com/e14f3bea7b6844709db20c833d60a8e7.jpg
m####.zish####.cn.####.com/e1f84cfe38d643f7afce9035d9c210e1.jpg
m####.zish####.cn.####.com/fa1f459e35da4d8a8c8afe33eb91257f.jpg
m####.zish####.cn.####.com/fb96c404a7134293b3bbd445e94a76b1.jpg
m####.zish####.cn.####.com/fe45c7bbe11c428592ce4e3b764f6f8e.jpg
supload####.doula####.com:9842/upload/mp/getConfig.do?appid=####&appVers...

HTTP POST requests:

a####.u####.com/app_logs
bird-vi####.cn-hang####.log.####.com/logstores/ad_info/shards/lb
sdm####.doula####.com:9842/client/getLastestCartoonList
sdm####.doula####.com:9842/client/getRandomCartoonsByTags
sdm####.doula####.com:9842/client/user/appRegister
supload####.doula####.com:9842/upload/api/getBanner.do

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/068050663f6695bbc929869dd550f2f019e979a7278b68b....0.tmp
/data/data/####/147741bd7f4c156cf9914c08dc9efaf22f712f02e93e8c2....0.tmp
/data/data/####/24e89a1c59ced158a82f1504127397980c0d2b31459146d....0.tmp
/data/data/####/39df71519d848e92e0b05a651cd6b43c6bc3c72e178cbcd....0.tmp
/data/data/####/3db131b1949ddcfb11111cc73ee849ebd4c1077641463e8....0.tmp
/data/data/####/3e2bd780c100e70ecd2c5671d72cbcb831ef5831b5aea29....0.tmp
/data/data/####/3e2e3eea4ca5a606d27cb3c1a441155f2ecacd05738d605....0.tmp
/data/data/####/3eb2899b24fb3dad9683aafebb539e434dddfea27d1098b....0.tmp
/data/data/####/405b05c7718a06067a9fed8e9054044688080ac3856d8d0....0.tmp
/data/data/####/421a5bcf51cfe2efacaa21e129b312759a2c1f6dfc4d290....0.tmp
/data/data/####/48cb6ec25154587e546d133ff27c86b4b747f2bd0a6565c....0.tmp
/data/data/####/49116ac052c28c1088edc5b7c5415ee60d750b84af3895f....0.tmp
/data/data/####/59e3d678c8f55bf2870b344255af44d977c903687789e01....0.tmp
/data/data/####/5a27a0ebbda8106635bd74e49fff89d95c03190ec16571b....0.tmp
/data/data/####/612326291732f9ad8fc1a1eb23dba28fd39d9a0a66e58b5....0.tmp
/data/data/####/646ed02d5139459e40c44694de801904d2ee37b9fdf9c5a....0.tmp
/data/data/####/6528bd19cdf74497f9d567833b20480f3bc5b46a0a81048....0.tmp
/data/data/####/6cae7e3eceaf007fae76bf5dcb152fdede877047706da1f....0.tmp
/data/data/####/6d7e12dac1e826bbdf67e66aef2075a298672a0283a4148....0.tmp
/data/data/####/6db37318db2a996a0c6dbd6b60ecde76ca79572bcfcb4fd....0.tmp
/data/data/####/75cc8863b1f46d9ebc27ce49009629d9ee3a89996f88798....0.tmp
/data/data/####/769c65118eb3dc75b914000baa1b95aa70e30c1ba2712fe....0.tmp
/data/data/####/78267cf18cd10cbe75993510c374551a1b7f01ad96a5b10....0.tmp
/data/data/####/81ed021b6059b6d759e9b95fa873aa4c913f7a23eb593b1....0.tmp
/data/data/####/8250719cd3a7c855a76bdd33fd2dbb6f0f0b52e2201ee9d....0.tmp
/data/data/####/871be76552d57ff20f8a4a9386be00505e136627ab97f92....0.tmp
/data/data/####/89210728bcf56a7643f307e93c231a39bf90ce3d90f2506....0.tmp
/data/data/####/8ea6d959f8a2c71ecd8de64f7bdec2ef2efa7a5858a6439....0.tmp
/data/data/####/9132b6324e47d4fed95f834e5f660ff0f3523444f7e4c1b....0.tmp
/data/data/####/94430794.dex
/data/data/####/94430794.dex.flock (deleted)
/data/data/####/94430794.jar
/data/data/####/94430914.dex
/data/data/####/94430914.dex.flock (deleted)
/data/data/####/94430914.jar
/data/data/####/95667cf9fcec30f5916d9a49c9b6aa5c1ba9bb9c52e7552....0.tmp
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/b10f9fb298fa78d4f92ce23922cdbb70abd301ba2201a95....0.tmp
/data/data/####/b35b8051a6d6b6cc75e2d935657930f73d37842439d6463....0.tmp
/data/data/####/b8eca525af581e355a92a689386de7b92c4eeafe68080a6....0.tmp
/data/data/####/bbcc723035cdd6674abb9b4330afd2a3ff5400461a81a3e....0.tmp
/data/data/####/bd10eaf10868438fd787d53cb2877b6216e8f803fbeb2e8....0.tmp
/data/data/####/c41285f2a7f8b2d0d55c149af6f46c6dd8427f6868bee35....0.tmp
/data/data/####/c9e04c7700f61d2ecea97e32fc6fdcd25fd4a5f4eefd2ee....0.tmp
/data/data/####/cb026bbb56efe02a3ddd5e1d36b41095638d132c2174a59....0.tmp
/data/data/####/cbb3ffeb4081d63554bf52f6f8d5d0112e33eddcc5d1b81....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.hgd.hgdcomic_preferences.xml
/data/data/####/com.hgd.hgdcomic_sdk_opt.xml
/data/data/####/com.tencent.open.config.json.1106775500
/data/data/####/d190d14926d52f64a02c88a34a1dc855e10d05aa33f9e88....0.tmp
/data/data/####/d3ed57c55a24da333290e2388054064910fa21e57505771....0.tmp
/data/data/####/db0149de1f0f9970a55b87d2543b2f2470d17558ed561bd....0.tmp
/data/data/####/dca29857d367719b5b69e6623fe64d8b.xml
/data/data/####/dca29857d367719b5b69e6623fe64d8b.xml.bak
/data/data/####/downloader.db-journal
/data/data/####/eaa0e8051b7052073cd4f80e7a276cc764f88146134321c....0.tmp
/data/data/####/ee0130fedd0c66cd01ef87a8be3b397351abc5603eb350d....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f155aa2ae6725e0613231557abb790b14d8521633e93b48....0.tmp
/data/data/####/f3c386d2ded6936837ec39678493af5b19fb0e1e6b7ae88....0.tmp
/data/data/####/f4becad91faeaaf29fdd25e2183643baef8fcccd83f2630....0.tmp
/data/data/####/f6895f4b46a41055279c0a4b9d55684c4cf9f8b623ac084....0.tmp
/data/data/####/f8ab38af70d1294432adeba827f9cf11b50b3220ca006d2....0.tmp
/data/data/####/journal.tmp
/data/data/####/metrics_guid
/data/data/####/sjmlive.xml
/data/data/####/spdb.xml
/data/data/####/them_day_night.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/998792508/94430794.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/998792508/94430794.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/998794182/94430914.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/998794182/94430914.dex --compiler-filter=speed
getprop ro.build.version.emui

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DESede
Des-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
Des-ECB-NoPadding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial