Android.Triada.5199

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.4567

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) c####.sx####.cn.####.com:80
TCP(HTTP/1.1) t####.dspliul####.com:99
TCP(HTTP/1.1) up-ali-####.b0.a####.com:80
TCP(HTTP/1.1) h####.t11.store:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) www.new####.com:80
TCP(HTTP/1.1) 54####.r####.com:16891
TCP(HTTP/1.1) big.admast####.com:808
TCP(HTTP/1.1) i####.wt####.com:80
TCP(HTTP/1.1) big.admast####.com:99
TCP(HTTP/1.1) dsp.a####.com:80
TCP(HTTP/1.1) cdn.pro####.com:80
TCP(HTTP/1.1) c####.jumen####.com:80
TCP(HTTP/1.1) dsp.a####.com:8081
TCP(TLS/1.0) gtm-cn-####.gtm-####.com:443
TCP(TLS/1.0) ad####.a####.com:443
TCP(TLS/1.0) 1####.217.16.10:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) terr####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) img.pcon####.com.cn:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) c####.x####.com.####.com:443
TCP(TLS/1.0) img.pc####.com.cn:443
TCP(TLS/1.0) c####.sx####.cn.####.com:443
TCP(TLS/1.0) new-er####.u####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) on####.pcv####.com.####.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) www.pcon####.com.cn:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.2) 1####.250.203.131:443
TCP(TLS/1.2) 1####.217.16.10:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP 1####.33.12.120:8051
TCP x.ali####.com:8001

DNS requests:

54####.r####.com
a####.new####.com
a####.pcv####.com.cn
a####.u####.com
ad####.a####.com
and####.cli####.go####.com
api.xzrj####.com
big.admast####.com
c####.jumen####.com
c####.mm####.com
c####.sx####.cn
c####.x####.com.cn
c.c####.com
cdn.pro####.com
cdn.rcpu####.cn
dsp.a####.com
er####.u####.com
h####.t11.store
hm.b####.com
i####.wt####.com
i####.x####.com.cn
img.pc####.com.cn
img.pcon####.com.cn
js.3con####.com
js.wt####.com
jwz.3con####.com
k####.pro####.com
li####.r####.com
m####.go####.com
p####.pc####.com.cn
s4.c####.com
s95.c####.com
s96.c####.com
t####.dspliul####.com
terr####.oss-cn-####.aliy####.com
u####.u####.com
ue.3con####.com
v1.c####.com
w####.pc####.com.cn
www.new####.com
www.pc####.com.cn
www.pcon####.com.cn
x.ali####.com
z2.c####.com
z3.c####.com
z6.c####.com

HTTP GET requests:

big.admast####.com:808/ipgg/index.html
big.admast####.com:99/newcar/index.html
big.admast####.com:99/wts/index.html
c####.jumen####.com/flow_control.php
c####.jumen####.com/init.php
c####.sx####.cn.####.com/asapi/jsonp/8
c####.sx####.cn.####.com/pjs/as/apiasv4.js?c=####
c.c####.com/stat.php?id=####
cdn.pro####.com/js/yys/Pfhl132.js
cdn.pro####.com/stat/Pfhl132.html
dsp.a####.com:8081/res/html/cnzz_yyspfhl132.html
h####.t11.store/daiapi.php
i####.wt####.com/auto/202002/css20200810/index_red_noflow.css
i####.wt####.com/js/iwt/iwt1.0.1.js
i####.wt####.com/top/202002/css/index_red_noflow.css
t####.dspliul####.com:99/tpy/index.htm?i####
terr####.oss-cn-####.aliy####.com:443/ABS_SDK_FILE/6cb7fd0b0a38c6baf1bfd...
up-ali-####.b0.a####.com/image/auto/160630/lazyload50.jpg
www.new####.com/index1.html

HTTP POST requests:

54####.r####.com:16891/xsacs/dacting
54####.r####.com:16891/xsacs/reqlk
ad####.a####.com:443/task/getAppUpdate
ad####.a####.com:443/task/taskReport
al####.u####.com:443/unify_logs
al####.u####.com:443/zcfg
dsp.a####.com/task/reqTask
dsp.a####.com/task/taskReport
gtm-cn-####.gtm-####.com:443/api/v2_5/android/ib8gus/init?opof=####&qmvz...
gtm-cn-####.gtm-####.com:443/api/v2_5/android/ib8gus/stats/events?opof=#...
new-er####.u####.com:443/api/crashsdk/logcollect?chk=####&vno=####&uuid=...
new-er####.u####.com:443/apm_cc

File system changes:

Creates the following files:

/data/data/####/.hptc_kache_d0ec.f4a9809a6f
/data/data/####/.imprint
/data/data/####/0263442e92686de4_0
/data/data/####/05acd9c8f8d09125_0
/data/data/####/0862522e11235568_0
/data/data/####/0d397c6b7a322051_0
/data/data/####/0e6b295ad3ebe0c7_0
/data/data/####/120d7e87daa4703e_0
/data/data/####/16d0fafd1fc6a0a4_0
/data/data/####/17075bb3f4a7be9a_0
/data/data/####/17a51c579e06ed5b_0
/data/data/####/1a7bfd5bc8298690_0
/data/data/####/1d27e58629cb1d05_0
/data/data/####/1e9f547ca0f140da_0
/data/data/####/24903279f60327b4_0
/data/data/####/24903279f60327b4_1
/data/data/####/26622744191a615a_0
/data/data/####/2c78502f4a1b362a_0
/data/data/####/2c78502f4a1b362a_1
/data/data/####/2dbc7818a3f2c686_0
/data/data/####/2e16051d8d890d63_0
/data/data/####/2e16051d8d890d63_1
/data/data/####/2fa07621c26a6ca7_0
/data/data/####/2fc33fe21cdd6ca5_0
/data/data/####/31321f4ed5b9b5d2_0
/data/data/####/31a922470e45c7ce_0
/data/data/####/3fb0d52f7384f4aa_0
/data/data/####/424961eba0ff4faf_0
/data/data/####/4541575120ac3f78_0
/data/data/####/471a25592fa48eab_0
/data/data/####/4db277b461166761_0
/data/data/####/50dfbb80bca63d3e_0
/data/data/####/513e4dc2effed36b_0
/data/data/####/51e40dbfa53ba83f_0
/data/data/####/53da9b3e14d4e228_0
/data/data/####/53da9b3e14d4e228_1
/data/data/####/56868dc2248459a6_0
/data/data/####/58ff5d47c23772c4_0
/data/data/####/61062b685109802f_0
/data/data/####/61062b685109802f_1
/data/data/####/6aca59b90f48c428_0
/data/data/####/6aca59b90f48c428_1
/data/data/####/6b178f70f5d5b1aa_0
/data/data/####/6b1b7859e20c2ee1_0
/data/data/####/6bbc5af5ad542fbf_0
/data/data/####/6cc7034eef1ca454_0
/data/data/####/6dc341e1ddf198fb_0
/data/data/####/701f76628bb91193_0
/data/data/####/767b40dd25c6c082_0
/data/data/####/775114fd2ec802a8_0
/data/data/####/7aeb98fa18809f3c_0
/data/data/####/7b7835fc106fe95e_0
/data/data/####/7b962edce75a2ce6_0
/data/data/####/7cf726773deb49c6_0
/data/data/####/7e4d2a4937a371e9_0
/data/data/####/7fac08c2bc4d0893_0
/data/data/####/8180dbfc818c6b93_0
/data/data/####/836704e95130499a_0
/data/data/####/8623c851cb77a9e7_0
/data/data/####/8be546bf03ddce82_0
/data/data/####/8ed497972741700e_0
/data/data/####/9106dd4b0f951514_0
/data/data/####/9403df4b6de85d67_0
/data/data/####/941663fd0ad858af_0
/data/data/####/983f9fde3ca857f9_0
/data/data/####/983f9fde3ca857f9_1
/data/data/####/985958d976619751_0
/data/data/####/985958d976619751_1
/data/data/####/9bbe2d4a476f1591_0
/data/data/####/9ec86282e5dbb0a3_0
/data/data/####/9f278484fca42410_0
/data/data/####/AWAAGAAAQAAIXCEPAGGP777777777737AAAAAAAAAAAABZA...AEBSAA
/data/data/####/AWAQGAAAQAAIXCEPAGGP777777777737AAAAAAAAAAAABZA...AEBSAA
/data/data/####/AWQAGAAAQAAIXCEPAGGP777777777737AAAAAAAAAAAABZA...AEBSAA
/data/data/####/Alvin2.xml
/data/data/####/BUAAQAAAAQAAAAABC3777777777QAAAAAAAAAAAAZAAQAAA...AQAAAA
/data/data/####/BWAAQAAAAQAAAAABC3777777AAOAAAAAAAAAAAAAZAAQAAA...AQAAAA
/data/data/####/BWABSAAAAQAAAAABC3777777AAOAAAAAAAAAAAAAZAAQAAA...AQAAAA
/data/data/####/BWIASAAAAQAAAAABCYIR7777AAOAAAAAAAAAAAAAZAAQAAA...AQAAAA
/data/data/####/C4QAAAAAMAAAAABAYAROFA6CAIAAAABAAAAAAAAAAAAAAOI...ABAMQA
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/E5YQAAAAMAAGGADDACRQAAAAMAACHQDCABRQAI7CAMAAAAA...IAAAAA
/data/data/####/F6A9089A4F0CE0DA5C9DL0MOC.st
/data/data/####/F6IAAAAAAIAAAAABCYBR6AAAAAAAAAAAADEACAAAAAIAAAAAQCIACAAAAA
/data/data/####/FM_config.xml
/data/data/####/FlutterSharedPreferences.xml
/data/data/####/GABQAAAAAELBCHYCDYAAAAAAAEAAAACAIQAABSABAAAAAEAAAAAIBEABAA
/data/data/####/HMMAAAAABCYIR6AYYAAAAAAAAAAAAACABYAAAAEAAAAAAAEEBQAA
/data/data/####/HQJAAAAAAAGAAAAAAIWP577774BSZ7X7777QCAAAAABAAAA...BAMAAA
/data/data/####/HQQAAAAAAAGAAAAAAIWP57ZDH37P7777777QCAAAAAAAAAA...AAAAAA
/data/data/####/HQQACAAAAAGAAAAAAIWP57ZDH37P7777777QCAAAAAAAAAA...AAAAAA
/data/data/####/HQQACAAAAAGAAAAAAIWP57ZDH37P7777777QCAAAAAAAAAA...EBQAAA
/data/data/####/HRIAAAAAAAMAAAAAARMPZ72HPQCFR7H7777QGAAAAAAAAAA...YAAAAA
/data/data/####/STORE_MAIN.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzYwZjgzOTNmMmExYTJhNThlN2UwMzJjZg.sp
/data/data/####/Y29uZmlnXzYwZjgzOTNmMmExYTJhNThlN2UwMzJjZg.sp.bak
/data/data/####/a366c1e7445d2f74_0
/data/data/####/a45e54c9a1f56864_0
/data/data/####/a64d49c326d587a1_0
/data/data/####/aa38d4adaa37a16e_0
/data/data/####/abs.xml
/data/data/####/ad6ffd6294e6d642_0
/data/data/####/af78ff7aed03407c_0
/data/data/####/b3ec4dd349f64b66_0
/data/data/####/b4b087dcbcac375c_0
/data/data/####/b4b087dcbcac375c_1
/data/data/####/b62dfbd72373da23_0
/data/data/####/b8b19eff776fbc29_0
/data/data/####/ba6fcac68058b03b_0
/data/data/####/ba6fcac68058b03b_1
/data/data/####/bafb93aa68f397f2_0
/data/data/####/bc257d4a39d2d5a5_0
/data/data/####/bc257d4a39d2d5a5_1
/data/data/####/be49ea9551e5b397_0
/data/data/####/c293c84d784eb460_0
/data/data/####/c8205e863f480120_0
/data/data/####/c840e3ecd86d7c5a_0
/data/data/####/c97e4be06f9bcc08_0
/data/data/####/cbba8c912d11e35d_0
/data/data/####/cdt.wa
/data/data/####/com.ld9c5ad0ec.f4a9809a6f_preferences.xml
/data/data/####/cr.wa
/data/data/####/d119490a6becf284_0
/data/data/####/d1c4424d5ae58a8d_0
/data/data/####/d359028385ebc4cc_0
/data/data/####/d3aaa887a9a6fe1e_0
/data/data/####/d952ff91f27e44a2_0
/data/data/####/dev_id.xml.xml
/data/data/####/dt.wa
/data/data/####/e1d181694d88d153_0
/data/data/####/e3e65b0de825181b_0
/data/data/####/e6dff136f57971a1_0
/data/data/####/e7289a2f300c4684_0
/data/data/####/eb8a0b69a87af27b_0
/data/data/####/ee497c9f4f3d9af8_0
/data/data/####/ee497c9f4f3d9af8_1
/data/data/####/efsid
/data/data/####/efsid3586
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1824568e944aa33_0
/data/data/####/f1824568e944aa33_1
/data/data/####/f26005bf558319ec_0
/data/data/####/f4b1397d7e432fe2_0
/data/data/####/f715571c75ece99d_0
/data/data/####/f715571c75ece99d_1
/data/data/####/f8025f56886d94aa_0
/data/data/####/f86427f1730b39f3_0
/data/data/####/fe0505942301fda9_0
/data/data/####/fe6a5e33f2b9fc23_0
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/http_118.190.144.37_8081.localstorage-journal
/data/data/####/http_big.admasterto.com_808.localstorage-journal
/data/data/####/http_cdn.propsad.com_0.localstorage-journal
/data/data/####/i==1.2.0&&3.1.2_1642791073266_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/kwak
/data/data/####/kwcfg
/data/data/####/libygay.so
/data/data/####/libygay.so-32
/data/data/####/libygay.so-64
/data/data/####/load
/data/data/####/metrics_guid
/data/data/####/mobclick_agent_user_com.ld9c5ad0ec.f4a9809a6f.xml
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/sdk.dex
/data/data/####/sdk.dex.flock (deleted)
/data/data/####/sdk.jar
/data/data/####/sendlock
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.3.8&&3.1.2_1642791071202_dW5pZnlfbG9ncw==;.log
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/ver
/data/data/####/ver.txt
/data/data/####/wlrc.png
/data/data/####/wphtrror.dex
/data/data/####/wphtrror.dex.flock (deleted)
/data/data/####/wphtrror.jar
/data/data/####/yd_config_c.xml
/data/data/####/z==1.2.0&&3.1.2_1642791062327_emNmZw==;.log
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/version
cat /sys/class/net/wlan0/address
getprop
getprop ro.board.platform
getprop ro.product.cpu.abi
ls /
ls /sys/class/thermal
sh
sh -c type su

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial