Android.Triada.5565

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.573.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) lo####.applove####.com:80
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) img.atomhik####.com:80
TCP(HTTP/1.1) 64.2####.161.94:80
TCP(HTTP/1.1) sdk-####.ro####.io:80
TCP(HTTP/1.1) stset####.ro####.io:80
TCP(TLS/1.0) seven####.com:443
TCP(TLS/1.0) and-re####.tut####.com:443
TCP(TLS/1.0) img.atomhik####.com:443
TCP(TLS/1.0) configv####.unit####.uni####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) pv.s####.com.####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) adash####.man.aliy####.com:443
TCP(TLS/1.0) analy####.atomhik####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) 64.2####.161.94:443
TCP(TLS/1.0) p####.tut####.com:443
TCP(TLS/1.0) cdn####.unit####.uni####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) httpk####.unit####.uni####.com:443
TCP(TLS/1.0) sett####.atomhik####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) and####.tut####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) gce-auc####.unit####.uni####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP(TLS/1.2) 64.2####.161.94:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 74.1####.205.138:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 64.2####.162.104:443
UDP and####.google####.com:443
TCP ms####.m.u####.com:443

DNS requests:

a####.man.aliy####.com
a####.u####.com
amdc####.m.ta####.com
analy####.atomhik####.com
and####.a####.go####.com
and####.google####.com
and####.tut####.com
and-re####.tut####.com
api.applove####.com
auction####.unit####.uni####.com
co####.unit####.uni####.com
conf####.unit####.uni####.com
er####.u####.com
f####.gst####.com
httpk####.unit####.uni####.com
img.atomhik####.com
lo####.applove####.com
log.u####.com
m####.go####.com
p####.google####.com
p####.tut####.com
publish####.unit####.uni####.com
pv.s####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
sdk-####.ro####.io
sdk.adti####.com
sett####.atomhik####.com
seven####.com
stset####.ro####.io
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
www.go####.com

HTTP GET requests:

and-re####.tut####.com:443/ws?udid=####
api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
cdn####.unit####.uni####.com:443/webview/4.0.0/5c1fee8e1c1f3b85b4256f9ea...
configv####.unit####.uni####.com:443/games/3810785/configuration?deviceM...
configv####.unit####.uni####.com:443/webview/4.1.0/release/config.json?t...
def####.duals####.cn.####.com:443/bar/get/541835c1fd98c51ee3010b68/?pcv=...
img.atomhik####.com/static/sdk/AD_mark.png
img.atomhik####.com:443/static/sdk/AD_close.png
img.atomhik####.com:443/static/sdk/AD_mute.png
img.atomhik####.com:443/static/sdk/AD_voice.png
img.atomhik####.com:443/static/sdk/AD_webview_close.png
lo####.applove####.com/agreement/v1/upload?consent_value=####&consent_ty...
p####.tut####.com:443/photo/da/2023/11/15/10/ymvxh7m96u6s.jpg
p####.tut####.com:443/photo/da/2023/11/15/15/ish0sudr9gul.jpg
p####.tut####.com:443/photo/da/2023/11/15/17/rt7h2k6amkax.jpg
p####.tut####.com:443/photo/da/2023/11/22/17/4o88kyskv6ry.jpg
p####.tut####.com:443/photo/da/2023/11/29/15/z44pkq910n7h.jpg
p####.tut####.com:443/photo/da/2023/11/29/15/zn86gqr6uuq9.jpg
p####.tut####.com:443/photo/da/2023/11/29/17/r6qthq9t688v.jpg
p####.tut####.com:443/photo/da/2023/11/29/17/ymvlaenq9xdu.jpg
p####.tut####.com:443/picture/app_android/us/2021/04/20/4ptvn9fqu6kd1tli...
p####.tut####.com:443/picture/app_ios/us/2021/04/27/11/s4ovqouhux0y.jpg
p####.tut####.com:443/picture/app_ios/us/2023/02/14/14/65u81nunb2ep.jpg
p####.tut####.com:443/picture/app_ios/us/2023/02/15/10/t18kkd0nrwrg.jpg
p####.tut####.com:443/picture/app_ios/us/2023/11/15/16/zh2iy88oa7kz.jpg
p####.tut####.com:443/picture/app_ios/us/2023/11/27/11/h5q64lmr450k.jpg
p####.tut####.com:443/picture/app_ios/us/2023/11/28/10/tayv0fnfopkz.jpg
pv.s####.com.####.com:443/cityjson
sdk.adti####.com:443/ck?v=####&sdkv=####&k=####&make=####&brand=####&mod...
stset####.ro####.io/ad/v1?mc=####&mb=####&ifa=####&os_v=####&ma=####&mcc...

HTTP POST requests:

adash####.man.aliy####.com:443/man/api?ak=####&s=####
analy####.atomhik####.com:443/v1/sdk_event
and####.tut####.com:443/apiandroid/api/CheckTutuVersion
and####.tut####.com:443/apiandroid/api/checkTutuAdsCompany
and####.tut####.com:443/apiandroid/apiAndroid/GetHomeSpecialList
and####.tut####.com:443/apiandroid/apiAndroid/adSwitcher
and####.tut####.com:443/apiandroid/apiAndroid/chaos
and####.tut####.com:443/apiandroid/apiAndroid/checkAppVersion
and####.tut####.com:443/apiandroid/apiAndroid/getDomainByIp
and####.tut####.com:443/apiandroid/apiAndroid/getListDataIntl
and####.tut####.com:443/apiandroid/apiAndroid/getMessageTotalNum
and####.tut####.com:443/apiandroid/apiAndroid/getMostPlayList
and####.tut####.com:443/apiandroid/apiAndroid/getNewGameAndAppList
and####.tut####.com:443/apiandroid/apiAndroid/getRecentUpdateList
and####.tut####.com:443/apiandroid/apiAndroid/getSearchBoxKeywordIntl
and####.tut####.com:443/apiandroid/apiAndroid/getServerTime
and####.tut####.com:443/apiandroid/apiAndroid/getSpecialShow
configv####.unit####.uni####.com:443/privacy/3810785/state
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
gce-auc####.unit####.uni####.com:443/v6/games/3810785/requests?idfi=####...
httpk####.unit####.uni####.com:443/v1/events
new-####.u####.com:443/api/postZdata
sdk-####.ro####.io/sdk_analytics
sdk.adti####.com:443/al?did=####&k=####&v=####&sdkv=####
sdk.adti####.com:443/cl?v=####&plat=####&mv=####&sdkv=####
sdk.adti####.com:443/conf?v=####&plat=####&k=####&sv=####
sett####.atomhik####.com:443/gate/auth
sett####.atomhik####.com:443/gate/cfg
seven####.com:443/AAService.svc/j6xsaoiowk57867
u####.u####.com:443/umpx_share
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.fsgkea
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/AmplitudeUtils.xml
/data/data/####/CACHE_PREFS.xml
/data/data/####/CHLfVtqJjCYW (deleted)
/data/data/####/ContextData.xml
/data/data/####/D0PPAUTUT0PIV.st
/data/data/####/Language.db-journal
/data/data/####/REDAOLNWODELIF1D0PPAUTUT0PIV.anr
/data/data/####/REDAOLNWODELIF1D0PPAUTUT0PIV.anrpid
/data/data/####/TutuApp_ID.xml
/data/data/####/TutuMarket.db-journal
/data/data/####/TutuUser.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp.bak
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/accs.db-journal
/data/data/####/al.xml
/data/data/####/androidxcorealc0z.
/data/data/####/androidxcorealc0z.dex (deleted)
/data/data/####/androidxcorealc0z.dex.flock (deleted)
/data/data/####/cd_yurirty
/data/data/####/cdt.wa
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.dex;classes8.dex
/data/data/####/classes.dex;classes9.dex
/data/data/####/com.paypal.pyplcheckout.instrumentation.amplitu...ao.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info_vip.tu...loader
/data/data/####/core.xml
/data/data/####/cr.wa
/data/data/####/crash_log_sp.xml
/data/data/####/dt.wa
/data/data/####/efsid
/data/data/####/efsid3398
/data/data/####/excellent_appic_sdk.xml
/data/data/####/excellent_appic_sdk.xml.bak
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/filedownloader_umeng_common_config.xml
/data/data/####/filedownloader_umeng_common_config.xml.bak
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_enable.xml
/data/data/####/i==1.2.0&&4.2.5_1704215909016_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/libjiagu.so
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/rx_user.xml
/data/data/####/rxsdk.db-journal
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s==7.1.4&&4.2.5_1704215908602_dW1weF9zaGFyZQ==;.log
/data/data/####/sendlock
/data/data/####/share.db-journal
/data/data/####/shell_config
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/sp_ytuetryetr.xml
/data/data/####/t==9.3.8&&4.2.5_1704215909587_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_log_file
/data/data/####/the-real-index
/data/data/####/tutu_crash.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/unique
/data/data/####/unityads-installinfo.xml
/data/data/####/ver
/data/data/####/vip.tutuapp.d.xml
/data/data/####/vip.tutuapp.d_ct_default.xml
/data/data/####/vip.tutuapp.d_ct_default.xml.bak
/data/data/####/vip.tutuapp.d_preferences.xml
/data/data/####/wa_gzip_1_1_3598_4720_1704215915442
/data/data/####/wa_gzip_1_1_3598_8015_1704215966267
/data/data/####/wa_none_1_1_3598_8127_1704215906208
/data/data/####/z==1.2.0&&4.2.5_1704215899881_emNmZw==;.log
/data/media/####/.nomedia
/data/media/####/017D614924ADB89C3C7BA46068549B06
/data/media/####/02491668F0A8727C8237682D53EA89F2
/data/media/####/024E741D3CBF289612401A21D1DBC3A2
/data/media/####/025A542A5B8733CC335AADD6192B6867
/data/media/####/04A9F583B603D068BF68BF7238C371FD
/data/media/####/05DA00BA89A0C9540E4F1EC6EE4E801F
/data/media/####/065BE5ED3B86995B33FE7F5EC3B2D208
/data/media/####/08D43291968908030C84E5902D38A860
/data/media/####/0A8448439C2E29A8123A07B258D94D1D
/data/media/####/0DFEBA1E678BC92B3256E7D185A0B9EE
/data/media/####/157F638E839818C6D9B4EBFB56DBB5CD
/data/media/####/16B21C4C9E3C0F3B2160CD8AFAE6190F
/data/media/####/21325BC6472BE8A903CFE1E34A56E008
/data/media/####/21D02530C0F6C0A6C242A1B5E477AA38
/data/media/####/2429CF59B5A6A4653699B5FB3EEFB4DB
/data/media/####/278DA0DC014D39B052E4B352D6B90763
/data/media/####/2B4B8365953926CE0A5CBD0C9B9B90B0
/data/media/####/2B6782682BC4016ABE23BAA9BC769C21
/data/media/####/2D7E168BD1406081A7A624D5D3D93CBC
/data/media/####/2F309E789EDF45B7208411417CB9EF8E
/data/media/####/34DA66B1226519CAD6272A3C42A12048
/data/media/####/3844C6AE92787AA510BE3093B493AF86
/data/media/####/3EF961ACD537449422B808D517E7A9F6
/data/media/####/462CBC74B99700A449511407ADBBE41C
/data/media/####/466CC7432BDD65FB9A4E6DB29E68B7D7
/data/media/####/49AE355201728671B3ECAB3A85B8A2F7
/data/media/####/4E268401CCB6BAED4851446C2C57F35B
/data/media/####/50F329DA85144624861188FA7B50AEB8
/data/media/####/52C1084E9EF9EA1D963828CE39411636
/data/media/####/53B556790A6C7B5470C1025B9C3E44A7
/data/media/####/560E1CD02D107A9760BE1BC6D3600636
/data/media/####/56E5F2C7CA805A196F945069F2217052
/data/media/####/5A45B7D04A36CB5FECA19453BFBE6C5D
/data/media/####/5C31C75A38EC160C76E3588B91274DD2
/data/media/####/62B45097E57CD531FA20B23DB7403D29
/data/media/####/6BC06E65DB888985742186E4DA320FA4
/data/media/####/6E4DE0D3A5CC3944EED3BA49C8448D01
/data/media/####/74A7067BFB1891623C14AC40E45ED2DB
/data/media/####/77623068E14B09CE972BEAD970D8F215
/data/media/####/7DD1E53023CEF7D4925E8D8FBCF76B37
/data/media/####/7E89D03BEFB0C56ADC0B0B48AAFE0E78
/data/media/####/80C241A3FBF0D77BEB6A7B1AD1BA1A3A
/data/media/####/81067917945403B41B928EED040020FB
/data/media/####/82522DBC9D91E8FD3FCF45AD36CACD46
/data/media/####/843BD8DACDABE7226763824C981BA3CB
/data/media/####/84CB0BFD9725F8C88780871E86359273
/data/media/####/86D2782342FCE44BFA0AA9BF1F26F1DA
/data/media/####/8A9742AD8531D03C23650ABC0CB2B56E
/data/media/####/8A9B0CEB58E516E4DC78EEEE52C0850B
/data/media/####/8F15BB71ABD521563E357B8E63020E74
/data/media/####/8FF11575F6C38AFEAE76F84D9AE383BA
/data/media/####/9088A2827166219A323F7B9A1A54DC9A
/data/media/####/9288E38C16A737D75DDA35CA902F2292
/data/media/####/94AED0049822FDE0850B22FB45A0E296
/data/media/####/970D4214E438245C03690BB59AAE7C54
/data/media/####/984B599B6B201AA31E74EFD484F4E55E
/data/media/####/985A56D11C4ABF96218305D0381476B6
/data/media/####/993CB7238F0724BCD10C2EBEE29D1E7D
/data/media/####/9E6610FC3EA6DF0FC591A0203ABFF487
/data/media/####/A5172A7ACCE39E0719D4B075D0A3343F
/data/media/####/A6D0896EB7F8372AE4D5CF0088B70945
/data/media/####/AF0F898C17C7D9CEC0D5DA20D6E9105B
/data/media/####/Alvin2.xml
/data/media/####/B352A6C307D85E43EADA3308F431CA1D
/data/media/####/BA580F70093BB516954A4D08313A90FB
/data/media/####/C458B340901578D733FB20410E7186A0
/data/media/####/C5B51F11F622CF342792FE919498F445
/data/media/####/C746EBC504973FDD78611D69F673656E
/data/media/####/CDCA4DEF3412208E599D95F2935946FB
/data/media/####/CECD7C1E4947BFD7599552D6F099A578
/data/media/####/ContextData.xml
/data/media/####/D0BBD894AF2BCA7FFF043E73C341ACB3
/data/media/####/D53B3FA5D6172CE675CF0770B42E86BC
/data/media/####/D89D2AA7F3F2F1C9059F7A5075358E31
/data/media/####/DCD916F725AA0EA7ECD83E1039500CDF
/data/media/####/E1CF4644484E67C03706E60873464481
/data/media/####/E292AE0EF7270E01BE674B22AB7FF5D5
/data/media/####/E4FFDEE3CF092EF5AC74E3B82C5A10E5
/data/media/####/E6743317B8C97D586EF48D2804A1EAC8
/data/media/####/E7CBFA49020D656CE79876629F0CB7F4
/data/media/####/E91F6E6588EFB86DE75FF755D2C2C6FB
/data/media/####/E9C0E7C7A40E4FD86FEB8C0D1D37ADF2
/data/media/####/EDB73614AE77213AC15604C4F9E7EE7B
/data/media/####/F59C957CB4148FD01326B2B519542D9B
/data/media/####/F9B8757A27CB468DD433239069073641
/data/media/####/FA24781306B1741EF1EF582A8DCA7CF8
/data/media/####/FC2C82988C28EF3147BDCFA139D403F2
/data/media/####/FC40C8E11FD4C274F5ACCF12B4C952D9
/data/media/####/FD800A7615AE1618570E7A7165A79038
/data/media/####/TutuApp.bin
/data/media/####/UnityAdsTest.txt (deleted)
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/self/cgroup
getprop
getprop ro.debuggable
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list package -3
sh
sh -c type su

Loads the following dynamic libraries:

libcrashsdk
libjiagu
libtnet-3.1.14
libumeng-spy

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS7Padding
DES
desede-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial