Android.Triada.356

Technical information

Malicious functions:

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) mo####.ultrapr####.com:80
TCP(HTTP/1.1) sm####.m####.com:80
TCP(HTTP/1.1) r####.android####.info:80
TCP(HTTP/1.1) acc####.thefunn####.com:8100
TCP(HTTP/1.1) hijo####.thefunn####.com:8100
TCP(HTTP/1.1) rt.duodu####.com:8080
TCP(HTTP/1.1) hijo####.thefunn####.com:80
TCP(HTTP/1.1) g####.m####.com:80
TCP(HTTP/1.1) b####.android####.info:80
TCP(HTTP/1.1) loading####.mids####.info:80

DNS requests:

106.17.217.####.arpa
202.19.217.####.arpa
46.17.217.####.arpa
67.20.217.####.arpa
77.20.217.####.arpa
a####.u####.com
acc####.thefunn####.com
acco####.go####.com
b####.android####.info
g####.m####.com
gp####.m####.com
hijo####.thefunn####.com
loading####.mids####.info
mo####.ultrapr####.com
p####.3g.qq.com
p####.google####.com
r####.android####.info
rt.duodu####.com
sm####.m####.com
ssl.gst####.com
www.google####.com

HTTP GET requests:

b####.android####.info/api/timeInterval
hijo####.thefunn####.com/soft/59b1ed77a2edd.zip
hijo####.thefunn####.com/soft/59f9b84c64333.zip
hijo####.thefunn####.com/soft/5a178918b9258.zip
hijo####.thefunn####.com/soft/5a1d192c526b3.zip
hijo####.thefunn####.com/soft/5a21228959317.zip
hijo####.thefunn####.com/soft/5a308ad51cac7.zip
hijo####.thefunn####.com/soft/5a31158ef0425.zip
loading####.mids####.info/api/initOpen?tag=####&version=####&game_id=####
sm####.m####.com/Api/Partners/initOpen?tag=####&version=####

HTTP POST requests:

b####.android####.info/api/dystat
b####.android####.info/api/tempLogInfo
g####.m####.com/Grab/ip
hijo####.thefunn####.com:8100/Update/packageLogByType
hijo####.thefunn####.com:8100/Update/packageUpdateResult
loading####.mids####.info/api/getpagenew
loading####.mids####.info/api/shua
mo####.ultrapr####.com/index.php?c=####&m=####
rt.duodu####.com:8080/SpringWind/testapi/check.do

Modified file system:

Creates the following files:

/data/local/####/accounts.db
/data/local/####/accounts.db-journal
/data/local/####/finsky.xml
/data/local/####/gservices.db
/data/local/####/gservices.db-journal
<Package Folder>/applib/ktools
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/12372278
<Package Folder>/files/####/59b1ed77a2edd.zip
<Package Folder>/files/####/59f9b84c64333.zip
<Package Folder>/files/####/5a178918b9258.zip
<Package Folder>/files/####/5a1d192c526b3.zip
<Package Folder>/files/####/5a21228959317.zip
<Package Folder>/files/####/5a308ad51cac7.zip
<Package Folder>/files/####/5a31158ef0425.zip
<Package Folder>/files/####/8101.jar
<Package Folder>/files/####/__krsdk.res__
<Package Folder>/files/####/a
<Package Folder>/files/####/actsts
<Package Folder>/files/####/b
<Package Folder>/files/####/b.zip
<Package Folder>/files/####/chkmount
<Package Folder>/files/####/classes.dex
<Package Folder>/files/####/ddexe
<Package Folder>/files/####/debuggerd
<Package Folder>/files/####/error
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/install-recovery.sh
<Package Folder>/files/####/kd
<Package Folder>/files/####/kds
<Package Folder>/files/####/kr-stock-conf
<Package Folder>/files/####/krdem
<Package Folder>/files/####/krsdk.cert
<Package Folder>/files/####/krsdk.res
<Package Folder>/files/####/ktools
<Package Folder>/files/####/ku-config
<Package Folder>/files/####/libkrsdk.so
<Package Folder>/files/####/libkrsdk1.2.0.220.so
<Package Folder>/files/####/libnativeUtil.so
<Package Folder>/files/####/libso1.so
<Package Folder>/files/####/libun7z.so
<Package Folder>/files/####/reportroot
<Package Folder>/files/####/runtime
<Package Folder>/files/####/servicesd.apk
<Package Folder>/files/####/source.zip
<Package Folder>/files/####/su
<Package Folder>/files/####/su2
<Package Folder>/files/####/su_check
<Package Folder>/files/####/supolicy
<Package Folder>/files/.pa
<Package Folder>/files/3b6bb137ece2b85535c20bc952871b49
<Package Folder>/files/lib32sbfaAfef23.so
<Package Folder>/files/lib32sdfaAfef23.so
<Package Folder>/files/mobclick_agent_cached_<Package>30179
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Cocos2dxPrefsFile.xml
<Package Folder>/shared_prefs/com.solo.adsdk.preference.user.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/get_ip_file.xml
<Package Folder>/shared_prefs/kingrootsdk.xml
<Package Folder>/shared_prefs/kingrootsdk_defense.xml
<Package Folder>/shared_prefs/log.xml
<Package Folder>/shared_prefs/receive_time_file.xml
<Package Folder>/shared_prefs/toor.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/.androidID
<SD-Card>/.recordinterval
<SD-Card>/.temp/pureSdk
<SD-Card>/kr-stock-conf

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/modules/data/8101/krsdk/kd
cat /sys/class/net/wlan0/address
chmod -R 777 /data/data/com.android.vending
chmod -R 777 /data/data/com.google.android.gms
chmod -R 777 /data/data/com.google.android.gsf
chmod -R 777 /data/local/fakeData/uploadData/GO_TEMP/
chmod -R 777 /data/system/users/0
chmod 0755 <Package Folder>/applib/ktools
chmod 0755 <Package Folder>/files/modules/data/8101/krsdk/ktools
chmod 0771 <Package Folder>/applib
chmod 755 <Package Folder>/files/modules/data/8101/krsdk/xmls/ddexe <Package Folder>/files/modules/data/8101/krsdk/xmls/debuggerd <Package Folder>/files/modules/data/8101/krsdk/xmls/install-recovery.sh <Package Folder>/files/modules/data/8101/krsdk/xmls/krdem <Package Folder>/files/modules/data/8101/krsdk/xmls/servicesd.apk <Package Folder>/files/modules/data/8101/krsdk/xmls/su <Package Folder>/files/modules/data/8101/krsdk/xmls/su2
chmod 777 /data/local/fakeData/uploadData/GO_TEMP/
cp -rf /data/data/com.android.vending/shared_prefs/finsky.xml /data/local/fakeData/uploadData/GO_TEMP/finsky.xml
cp -rf /data/data/com.google.android.gms/shared_prefs/Checkin.xml /data/local/fakeData/uploadData/GO_TEMP/Checkin.xml
cp -rf /data/data/com.google.android.gms/shared_prefs/CheckinLogging.xml /data/local/fakeData/uploadData/GO_TEMP/CheckinLogging.xml
cp -rf /data/data/com.google.android.gms/shared_prefs/CheckinService.xml /data/local/fakeData/uploadData/GO_TEMP/CheckinService.xml
cp -rf /data/data/com.google.android.gms/shared_prefs/adid_settings.xml /data/local/fakeData/uploadData/GO_TEMP/adid_settings.xml
cp -rf /data/data/com.google.android.gms/shared_prefs/com.google.android.gcm.xml /data/local/fakeData/uploadData/GO_TEMP/com.google.android.gcm.xml
cp -rf /data/data/com.google.android.gsf/databases/gservices.db /data/local/fakeData/uploadData/GO_TEMP/gservices.db
cp -rf /data/data/com.google.android.gsf/databases/gservices.db-journal /data/local/fakeData/uploadData/GO_TEMP/gservices.db-journal
cp -rf /data/system/users/0/accounts.db /data/local/fakeData/uploadData/GO_TEMP/accounts.db
cp -rf /data/system/users/0/accounts.db-journal /data/local/fakeData/uploadData/GO_TEMP/accounts.db-journal
getprop ro.board.platform
getprop ro.build.description
getprop ro.build.version.opporom
getprop ro.cm.device
getprop ro.cm.version
getprop ro.hardware
getprop ro.miui.ui.version.code
getprop ro.miui.ui.version.name
getprop ro.mtk.hardware
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
ls -l /dev/kmem
ls -lZ <Package Folder>/files/modules/data/8101/krsdk/
ls /data/local/tmp
mkdir /data/local/fakeData
mkdir /data/local/fakeData/uploadData
mkdir /data/local/fakeData/uploadData/GO_TEMP
mkdir /data/local/fakeData/uploadData/GO_TEMP/
ping -c 3 -w 10 accounts.google.com
ping -c 3 -w 10 android.clients.google.com
ping -c 3 -w 10 play.googleapis.com
ping -c 3 -w 10 ssl.gstatic.com
ping -c 3 -w 10 www.googleapis.com
sh
sh -c chmod 755 <Package Folder>/files/modules/data/8101/krsdk/xmls/*
sh <Package Folder>/files/modules/data/8101/krsdk/kd
su
su -v

Loads the following dynamic libraries:

cocos2dcpp
lib32sbfaAfef23
libkrsdk
libkrsdk1.2.0.220
libnativeUtil
libso1
libun7z
so1

Uses elevated priveleges.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial