Android.Triada.5233

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.3382

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) ads.w####.xyz:80
TCP(HTTP/1.1) android####.cc####.com.cn:80
TCP(HTTP/1.1) cdn-cre####.unit####.uni####.####.net:80
TCP(HTTP/1.1) cdn-sto####.unit####.uni####.####.net:80
TCP(HTTP/1.1) i.w.in####.cn:80
TCP(HTTP/1.1) co####.in####.cn:80
TCP(HTTP/1.1) down####.wild####.appl####.####.net:80
TCP(HTTP/1.1) api.w####.xyz:80
TCP(HTTP/1.1) res.w####.xyz:80
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) publish####.unit####.uni####.com:443
TCP(TLS/1.0) s.y####.com.cn:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) sdk-i####.in####.cn:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) au####.unit####.uni####.com:443
TCP(TLS/1.0) onesi####.com:443
TCP(TLS/1.0) ipv6-wi####.appl####.com.####.net:443
TCP(TLS/1.0) www.pu####.com:443
TCP(TLS/1.0) g####.adfur####.jp:443
TCP(TLS/1.0) cou####.y####.com.cn:443
TCP(TLS/1.0) 1####.250.185.170:443
TCP(TLS/1.0) s####.corona####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.2) 1####.250.179.202:443
TCP(TLS/1.2) 1####.250.186.46:443
TCP(TLS/1.2) connect####.gst####.com:443
TCP(TLS/1.2) pla####.google####.com:443

DNS requests:

a.appl####.com
ads.w####.xyz
and####.b####.qq.com
android####.cc####.com.cn
api.w####.xyz
as####.appl####.com
au####.unit####.uni####.com
auc####.unit####.uni####.com
cdn-cre####.unit####.uni####.com
cdn-sto####.unit####.uni####.com
co####.in####.cn
co####.unit####.uni####.com
connect####.gst####.com
cou####.y####.com.cn
d####.fl####.com
d.appl####.com
g####.adfur####.jp
i.w.in####.cn
img.appl####.com
instant####.google####.com
m####.go####.com
monetiz####.corona####.com
onesi####.com
pdn.appl####.com
pla####.google####.com
publish####.unit####.uni####.com
res.w####.xyz
rt.appl####.com
s####.corona####.com
s####.w.in####.cn
s.y####.com.cn
safebro####.google####.com
sdk-i####.in####.cn
web####.unit####.uni####.com
www.pu####.com

HTTP GET requests:

ads.w####.xyz/html/nothing.html
ads.w####.xyz/html/okami/logo_banner_sc.html
ads.w####.xyz/html/okami/logo_rectangle_sc.html
ads.w####.xyz/html/usotsuki/banner_sc.html
ads.w####.xyz/settings.php?project=####&version=####&store=####&language...
api.w####.xyz/cgame/okami_game_cn/review/reviews.json
api.w####.xyz/cgame/store_api/load.php?project=####
cdn-cre####.unit####.uni####.####.net/assets/617b87785970dc5ccbdf4174/VP...
cdn-cre####.unit####.uni####.####.net/assets/617b87795970dc5ccbdf4175/57...
cdn-sto####.unit####.uni####.####.net/store-icons/6808ffe3-3857-408d-bc3...
down####.wild####.appl####.####.net/1381250003_28x28.png
down####.wild####.appl####.####.net/closeOptOut.png
down####.wild####.appl####.####.net/jquery-2.1.1.min.js
down####.wild####.appl####.####.net/spinner4.gif
g####.adfur####.jp:443/adfurikun/api/getinfo/app_id/5af6ddcc21eaefad7c00...
ipv6-wi####.appl####.com.####.net:443/3.0/ad?accept=####&v4=####&api_did...
onesi####.com:443/api/v1/players/250e01a4-8b30-11ec-98ad-4e8fb158e971
publish####.unit####.uni####.com:443/games/1797786/configuration?deviceM...
res.w####.xyz/okami_game/sc_1.01/filelist.json
res.w####.xyz/okami_game/share_sc/filelist.json
res.w####.xyz/okami_game/share_sc/videos/share_sc.mp4
unit####.edges####.net:443/webview/2.1.0/release/config.json?ts=####&sdk...
unit####.edges####.net:443/webview/2.1.0/release/index.html

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
android####.cc####.com.cn/apicenter/v3.clientIcon.getIconTopicList/be28e...
api.w####.xyz/cgame/okami_game_cn/error_reports.php
api.w####.xyz/cgame/okami_game_cn/purchase_data.php
api.w####.xyz/cgame/okami_game_cn/push/init.php
au####.unit####.uni####.com:443/v1/category/experiment
co####.in####.cn/config-server/v1/config/secure.cfg
cou####.y####.com.cn:443/api_client.php
d####.fl####.com:443/aap.do
i.w.in####.cn/showad.asm
ipv6-wi####.appl####.com.####.net:443/device?api_key=####
ipv6-wi####.appl####.com.####.net:443/pix?api_did=####&volume=####&count...
nginx-a####.unit####.uni####.com:443/v6/games/1797786/requests?advertisi...
onesi####.com:443/api/v1/players
s.y####.com.cn:443/api_open.php?a=####&c=####
sdk-i####.in####.cn:443/config-server/v1/config/secure.cfg
www.pu####.com:443/payment/unifiedpay/

HTTP PUT requests:

onesi####.com:443/api/v1/players/250e01a4-8b30-11ec-98ad-4e8fb158e971

File system changes:

Creates the following files:

/data/data/####/.YFlurrySenderIndex.info.AnalyticsData_NHY2V92T...W5_258
/data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/.appInfo
/data/data/####/.com.coronalabs.corona.analyticsData
/data/data/####/.hptc_kache_wasabi.okami.cn
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.yflurrydatasenderblock.68b1989b-bf43-4e82-bc4d...73f2c4
/data/data/####/1004
/data/data/####/Corona.xml
/data/data/####/OneSignal.db
/data/data/####/OneSignal.db-journal
/data/data/####/OneSignal.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ad_setting.json
/data/data/####/adfurikun_adpref.dat.xml
/data/data/####/adfurikun_getinfo.dat
/data/data/####/alert_popup.html
/data/data/####/alert_popup.html.txt
/data/data/####/answer.json
/data/data/####/bugly_db_tgsdk-journal
/data/data/####/cancel.png
/data/data/####/chapter.json
/data/data/####/charas.json
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/com.applovin.sdk.1.xml
/data/data/####/com.applovin.sdk.preferences.WJTgHZKoCKeW9sqDe9...Wo.xml
/data/data/####/com.applovin.sdk.preferences.WJTgHZKoCKeW9sqDe9...ml.bak
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.im.keyValueStore.aes_key_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml
/data/data/####/com.im.keyValueStore.config_store.xml.bak
/data/data/####/com.im.keyValueStore.sdk_version_store.xml
/data/data/####/com.im.keyValueStore.sdk_version_store.xml.bak
/data/data/####/com.im.keyValueStore.uid_store.xml
/data/data/####/com.im.keyValueStore.uid_store.xml.bak
/data/data/####/com.im_7.0.2.db
/data/data/####/com.im_7.0.2.db-journal
/data/data/####/com.soulgame.tgsdk.xml
/data/data/####/com.wasabi.okami.cn_preferences.xml
/data/data/####/convertedGameData.txt
/data/data/####/convertedShop.txt
/data/data/####/convertedStory.txt
/data/data/####/crashrecord.xml
/data/data/####/dictionary.json
/data/data/####/download1747038477.tmp
/data/data/####/download2074567586.tmp
/data/data/####/download331233522.tmp
/data/data/####/download564209039.tmp
/data/data/####/download96198968.tmp
/data/data/####/downloaded_files_init.json
/data/data/####/downloaded_files_share.json
/data/data/####/end_card.json
/data/data/####/finish.png
/data/data/####/floors.json
/data/data/####/gimmick_object_serifs.json
/data/data/####/gimmick_objects.json
/data/data/####/hints.json
/data/data/####/index
/data/data/####/info.json
/data/data/####/installationNum
/data/data/####/items.json
/data/data/####/jisha_banner.html
/data/data/####/judges.json
/data/data/####/last_act.json
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/message_item_choices.json
/data/data/####/metrics_guid
/data/data/####/nothing.html
/data/data/####/objects.json
/data/data/####/okami_game.db-journal
/data/data/####/okami_game.db-journal (deleted)
/data/data/####/op.mp3
/data/data/####/popup.png
/data/data/####/positions.json
/data/data/####/proc_auxv
/data/data/####/products.json
/data/data/####/puzzles.json
/data/data/####/room.json
/data/data/####/security_info
/data/data/####/self_ads.json
/data/data/####/share_sc.mp4
/data/data/####/side_story.json
/data/data/####/start.atlas
/data/data/####/start.json
/data/data/####/start_edm.mp3
/data/data/####/story.json
/data/data/####/tgsdk.db-journal
/data/data/####/tgsdk_counter.db-journal
/data/data/####/thanks_interstitial.html
/data/data/####/thanks_interstitial2.html
/data/data/####/the-real-index
/data/data/####/tutorial_gimmick.json
/data/data/####/userData.json
/data/media/####/.nomedia
/data/media/####/1381250003_28x28.png
/data/media/####/UnityAdsCache-1cb75f17e6275deffe95e6c1eb095ef7...2.html
/data/media/####/UnityAdsCache-449dc6930bd8279d31af12aeeb8466aa...7c.jpg
/data/media/####/UnityAdsCache-e6541cb854dc9ff7518a0546c4ccebec...d.webm
/data/media/####/UnityAdsStorage-private-data.json
/data/media/####/UnityAdsStorage-public-data.json
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsWebApp.html
/data/media/####/closeOptOut.png
/data/media/####/jquery-2.1.1.min.js
/data/media/####/spinner4.gif
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop

Loads the following dynamic libraries:

libalmixer
libcorona
libjiagu
libjnlua5.1
liblua
libmpg123
libopenal

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-CFB8-NoPadding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-ECB-nopadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-CFB8-NoPadding
AES-GCM-NoPadding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial