Android.Triada.698

Technical information

Malicious functions:

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) tcms-a####.wan####.ta####.com:443
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) c.d####.mob.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) s.haowa####.com:8900
TCP(HTTP/1.1) haowa####.oss.aliy####.com:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) tcms-op####.wan####.ta####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) notecon####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) w####.ta####.com:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(SSL/3.0) a####.a####.m.####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) s.haowa####.com:8008
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP ope####.m.ta####.com:443
TCP umengj####.m.ta####.com:80
TCP 2####.204.101.107:80
TCP zhizhi####.com:5222

DNS requests:

_ja####._####.zhizhi####.com
_xmpp-c####._####.zhizhi####.com
a####.exc.mob.com
a####.m.ta####.com
a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
c.d####.mob.com
haowa####.oss.aliy####.com
haowa####.qin####.com
hotp####.wan####.ta####.com
m.d####.mob.com
msg.umengc####.com
notecon####.oss-cn-####.aliy####.com
s.haowa####.com
tcms-a####.wan####.ta####.com
tcms-op####.wan####.ta####.com
umen####.m.ta####.com
umengj####.m.ta####.com
w####.ta####.com
zhizhi####.com

HTTP GET requests:

a####.m.ta####.com/rest/abtest?logid=####&ak=####&av=####&c=####&v=####&...
haowa####.oss.aliy####.com/04232230f8ed4c034a9ac6ea5a25ea50
haowa####.oss.aliy####.com/082696ebee960df30b666fb0a79a89ce
haowa####.oss.aliy####.com/0aab7c6b1731ff508f75460ceb05df00
haowa####.oss.aliy####.com/229b637e96adfa3680fcbdcd229aef1b
haowa####.oss.aliy####.com/3362facf802b2625ed20793c0a33d36b
haowa####.oss.aliy####.com/66cfc7feef7db50622d306f7c058650c
haowa####.oss.aliy####.com/a795a88c45d030ae767b30b6b80d65fd
haowa####.oss.aliy####.com/a8bb96869098240bd841035c3c95ad55
haowa####.oss.aliy####.com/c9093a402b097a39e120d0b18df2c3e4
haowa####.oss.aliy####.com/dc4817a304d0a7f15a086f17f01c9d69
haowa####.oss.aliy####.com/de64f88100309a89a52d804003224e23
haowa####.oss.aliy####.com/f695eb277805a164d2500e29c521814f
haowa####.oss.aliy####.com/f7075dee65fec6e2dc9b7693521721d7
haowa####.oss.aliy####.com/fd506bfa5cdebd7489fc22a08f822fc1
m.d####.mob.com/v3/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
notecon####.oss-cn-####.aliy####.com/7842337
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreClassInfo?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreciation?jid=####&acti...
s.haowa####.com:8900/RegisterDemo1/servlet/GetComList?noteid=####&visid=...
s.haowa####.com:8900/RegisterDemo1/servlet/GetInvcode?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetNewsList?jid=####&newsid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetNoteContent?noteid=####&ji...
s.haowa####.com:8900/RegisterDemo1/servlet/GetNoteInfo?noteid=####&jid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetRecomUser?page=####&subtyp...
s.haowa####.com:8900/RegisterDemo1/servlet/GetUserInfo?jid=####&vsjid=####
s.haowa####.com:8900/RegisterDemo1/servlet/SyncSp?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/UpLoadUmToken?jid=####&passwd...
tcms-a####.wan####.ta####.com:443/imlogingw/tcp60login?devid=####&ver=####
tcms-op####.wan####.ta####.com/getapprule?appkey=####&appId=####
w####.q####.dn.####.com/093af112cad9f831a67032f2869d5217
w####.q####.dn.####.com/0d8d8991b04950b07ddde6dc32aa3bad
w####.q####.dn.####.com/2018-02-09-07-34-01e3z22g7s-0.png
w####.q####.dn.####.com/2018-02-26-20-53-05aa3w3k2k-0.png
w####.q####.dn.####.com/3227eef48f0a1236b52dff35355b48f6
w####.q####.dn.####.com/3b4833f887c38d85e5a48e4d6911ee3b
w####.q####.dn.####.com/4071a2725b1bbcc66ec2c55652bbb605
w####.q####.dn.####.com/4918b5208c6a92492b3f589a2ce78b78
w####.q####.dn.####.com/553c9c04f17b476b23c37395a7415be0
w####.q####.dn.####.com/58089e31c090a413928eeab1e8efd6b0
w####.q####.dn.####.com/5cea5b2c877dadebbb30738368c4bfe0
w####.q####.dn.####.com/658f8a0f6eea552f884729892f466c81
w####.q####.dn.####.com/8f67f1a2385a283032cb7abef745162f
w####.q####.dn.####.com/933bb404ab661083c4546ebafcfb6a06
w####.q####.dn.####.com/99b9d0c773077e26b05ddc4248d97723
w####.q####.dn.####.com/baba4473b228a2821dba80a40270af62
w####.q####.dn.####.com/ea788c20e40911400243ec518b1252fd
w####.q####.dn.####.com/ff5918c6624d948188d64af942283a09

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=#...
a####.exc.mob.com/errconf
a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
c.d####.mob.com/v2/cdata
msg.umengc####.com/register
w####.ta####.com/api/user/getUser.json

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_KeyStore/KeyStore.bks
<Package Folder>/cache/####/18554ec90b32e80dfb8dbe523ce13f25.0.tmp
<Package Folder>/cache/####/18554ec90b32e80dfb8dbe523ce13f25.1.tmp
<Package Folder>/cache/####/19b5f3d69c643c76b4613844a96c4941.0.tmp
<Package Folder>/cache/####/19b5f3d69c643c76b4613844a96c4941.1.tmp
<Package Folder>/cache/####/1CERnL0fGyWKgL-ggKDbI7m1XZg.1810305733.tmp
<Package Folder>/cache/####/1a9034fbd0dbc651771998bc11ae2303.0.tmp
<Package Folder>/cache/####/1a9034fbd0dbc651771998bc11ae2303.1.tmp
<Package Folder>/cache/####/1c46a7a1d32f5ef5c7aadee6347d19b6.0.tmp
<Package Folder>/cache/####/1c46a7a1d32f5ef5c7aadee6347d19b6.1.tmp
<Package Folder>/cache/####/24f6c5c4e349523e2e83f4f9558b464b.0.tmp
<Package Folder>/cache/####/24f6c5c4e349523e2e83f4f9558b464b.1.tmp
<Package Folder>/cache/####/28a91d7e33fafc65f43451ef6f12927b.0.tmp
<Package Folder>/cache/####/28a91d7e33fafc65f43451ef6f12927b.1.tmp
<Package Folder>/cache/####/2vcZ_5AKoiQ3Vpys8kA_nvy8wDM.531384020.tmp
<Package Folder>/cache/####/34e6b99b2fa91e2e47083bd399f32ec4.0.tmp
<Package Folder>/cache/####/34e6b99b2fa91e2e47083bd399f32ec4.1.tmp
<Package Folder>/cache/####/35cc4063874cc8c107c5699349d33d08.0.tmp
<Package Folder>/cache/####/35cc4063874cc8c107c5699349d33d08.1.tmp
<Package Folder>/cache/####/49dba216aef36e245aa2ef9514db9778.0.tmp
<Package Folder>/cache/####/49dba216aef36e245aa2ef9514db9778.1.tmp
<Package Folder>/cache/####/5fdd86e09afbb6720d0a2d0dd0f24b33.0.tmp
<Package Folder>/cache/####/5fdd86e09afbb6720d0a2d0dd0f24b33.1.tmp
<Package Folder>/cache/####/5niJ75acYi71ihP-nH6KmLzKVsI.1119474675.tmp
<Package Folder>/cache/####/60HVERDbJyy3j8qEd7IaiItvgts.-500711733.tmp
<Package Folder>/cache/####/68e386bb822684444935f654564524b1.0.tmp
<Package Folder>/cache/####/68e386bb822684444935f654564524b1.1.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.0.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.1.tmp
<Package Folder>/cache/####/8bd53a4259b0adfbfcab7dbc50f173a8.0.tmp
<Package Folder>/cache/####/8bd53a4259b0adfbfcab7dbc50f173a8.1.tmp
<Package Folder>/cache/####/8e7973766e69ae8d0489abe693e59bed.0.tmp
<Package Folder>/cache/####/8e7973766e69ae8d0489abe693e59bed.1.tmp
<Package Folder>/cache/####/8mFIIzLXij-i8-ovDYbsM4shQLM.-206392116.tmp
<Package Folder>/cache/####/<Package>_2081
<Package Folder>/cache/####/<Package>_TcmsService_2133
<Package Folder>/cache/####/BaB4ST7Q762WsCejODVerfIuw7Q.-1301297638.tmp
<Package Folder>/cache/####/BfUZiN_QGn4F_UOp8amR6ouhVU4.883762425.tmp
<Package Folder>/cache/####/EKI04E3ihgxwW0pHLGalzdjCG4U.-334798391.tmp
<Package Folder>/cache/####/G0tAUQ_CqWusi3hCPIkbDr8tzSg.-754459472.tmp
<Package Folder>/cache/####/Gyu2aBhJMellPOShcb91mn3TBBA.-1527203049.tmp
<Package Folder>/cache/####/HOgLxVkyKG2PUpHG9im2_kwUZxg.914347202.tmp
<Package Folder>/cache/####/IS9E7JNrv8bM8uhNOmzqy-tF70A.-966300559.tmp
<Package Folder>/cache/####/JkGu571gwrxce6kLrAM_RIf7T5M.-1471535417.tmp
<Package Folder>/cache/####/KObQ3mRqLmujNrqfAJt6XgIrxBI.930037636.tmp
<Package Folder>/cache/####/MSEmBNsLpUEjCiQHxcsaaDwpTao.67593810.tmp
<Package Folder>/cache/####/R2xBLHsFnocH465L9OwF7lAi-hU.1531973559.tmp
<Package Folder>/cache/####/RSeWusn2pQrhhGxjKCGUoXIJO58.1297130161.tmp
<Package Folder>/cache/####/Tz469I6SihhKMykqrrD2bqSRUXs.-207804788.tmp
<Package Folder>/cache/####/Vof0Mel6Yz_Sg8F3imhvbwuZiAk.172852627.tmp
<Package Folder>/cache/####/_EEcIXt6fIUgfbqNC9rPu_-E0u8.1488211132.tmp
<Package Folder>/cache/####/_RtnIRPhYqGbx8MT2zYxNU-J_HE.1274998447.tmp
<Package Folder>/cache/####/a346d4a8ab350aa12c4d05ba051dc431.0.tmp
<Package Folder>/cache/####/a346d4a8ab350aa12c4d05ba051dc431.1.tmp
<Package Folder>/cache/####/a4d49ec6ff147538a364f8df1847baea.0.tmp
<Package Folder>/cache/####/a4d49ec6ff147538a364f8df1847baea.1.tmp
<Package Folder>/cache/####/add6d91436d59c72f736af750946c5d5.0.tmp
<Package Folder>/cache/####/add6d91436d59c72f736af750946c5d5.1.tmp
<Package Folder>/cache/####/b754c3a61b7a094d38b2f4f0355b1b2f.0.tmp
<Package Folder>/cache/####/b754c3a61b7a094d38b2f4f0355b1b2f.1.tmp
<Package Folder>/cache/####/b8952fc5e69cccf3d035a7c200d74bb6.0.tmp
<Package Folder>/cache/####/b8952fc5e69cccf3d035a7c200d74bb6.1.tmp
<Package Folder>/cache/####/bdb221aa4cc24fa0de81850e807a0f82.0.tmp
<Package Folder>/cache/####/bdb221aa4cc24fa0de81850e807a0f82.1.tmp
<Package Folder>/cache/####/bdf7a82d5b550854a8af4f14845e5839.0.tmp
<Package Folder>/cache/####/bdf7a82d5b550854a8af4f14845e5839.1.tmp
<Package Folder>/cache/####/c2173396032c121ff38769d50f6c7cbd.0.tmp
<Package Folder>/cache/####/c2173396032c121ff38769d50f6c7cbd.1.tmp
<Package Folder>/cache/####/cab55af510c8e9fdae7e60210b2860db.0.tmp
<Package Folder>/cache/####/cab55af510c8e9fdae7e60210b2860db.1.tmp
<Package Folder>/cache/####/cnX2vPBHF5oyB8QYVQpqskQ1KE8.1982757040.tmp
<Package Folder>/cache/####/d5fd96096a28e138478863d4e90d4352.0.tmp
<Package Folder>/cache/####/d5fd96096a28e138478863d4e90d4352.1.tmp
<Package Folder>/cache/####/dfdc8b3b9323580c78827189cc3eb1b4.0.tmp
<Package Folder>/cache/####/dfdc8b3b9323580c78827189cc3eb1b4.1.tmp
<Package Folder>/cache/####/doRBKN5j-m_HMu0nb_vNaefHSRQ.-940421678.tmp
<Package Folder>/cache/####/eae1e00871ba0a2d753f7973c242ff82.0.tmp
<Package Folder>/cache/####/eae1e00871ba0a2d753f7973c242ff82.1.tmp
<Package Folder>/cache/####/f10cd0851237dad1e5ee95774117775f.0.tmp
<Package Folder>/cache/####/f10cd0851237dad1e5ee95774117775f.1.tmp
<Package Folder>/cache/####/f2a13659b22e8a1bfb21d8f0185a81f7.0.tmp
<Package Folder>/cache/####/f2a13659b22e8a1bfb21d8f0185a81f7.1.tmp
<Package Folder>/cache/####/f7955841a58c4822631684a95df785e2.0.tmp
<Package Folder>/cache/####/f7955841a58c4822631684a95df785e2.1.tmp
<Package Folder>/cache/####/gX7fvFHUGe2jnugn8Llj1fgAa98.-1645796451.tmp
<Package Folder>/cache/####/gfvXnvdTBTpn46tJziDKN5mM0K4.1338234767.tmp
<Package Folder>/cache/####/iZ1BRVQqzvyrzFnvWDdiq8A0Qew.957128155.tmp
<Package Folder>/cache/####/ixCj1Np-6xceL95BdVTI0O4dp3U.-451186311.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/####/meRjMCGs6hHOZTtMVOoHEWff2Lw.-384769256.tmp
<Package Folder>/cache/####/pb20sdWjuq-NFE6lIrQkK4gLSC8.-462347867.tmp
<Package Folder>/cache/####/v49NZz1NDdCN-y72xxNSPVabGfE.-458632253.tmp
<Package Folder>/cache/####/vg1k3weUxjbFxg0TfDyZQUVIzps.1295286933.tmp
<Package Folder>/cache/####/xX6R7j4ZBRR1wwGPCjdv84y0VLc.-329458551.tmp
<Package Folder>/databases/6bb166f1bcca9075a67ce9c82866bef6-journal
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/ThrowalbeLog.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/hmdb
<Package Folder>/databases/hmdb-journal
<Package Folder>/databases/logdb.db
<Package Folder>/databases/logdb.db-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/paintgame.db
<Package Folder>/databases/paintgame.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/eudemon
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/1d2b904cbeadfb72ed9546111a231c85.0
<Package Folder>/files/####/24c110e1f76093b35c3c2df1927aab79.0
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/.imprint
<Package Folder>/files/.lock
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/exid.dat
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ACCS_BINDumeng;52a0242156240b5b4a0104f9.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf-818791854.xml
<Package Folder>/shared_prefs/UTMCLog-818791854.xml
<Package Folder>/shared_prefs/channel_pre.xml
<Package Folder>/shared_prefs/cn_feng_skin_pref.xml
<Package Folder>/shared_prefs/mob_commons_1.xml
<Package Folder>/shared_prefs/mob_sdk_exception_1.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/tcms_setting_sp.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/ywAccount.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.bar
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/.serveruuid
<SD-Card>/<Package>/####/2_20171116_r
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/b23e918ad1f949d4a0d3da2a32a48527
<SD-Card>/Android/####/deviceToken
<SD-Card>/Mob/####/.al
<SD-Card>/Mob/####/.dh-journal
<SD-Card>/Mob/####/.dhlock
<SD-Card>/Mob/####/.dic_lock
<SD-Card>/Mob/####/.duid
<SD-Card>/Mob/####/.globalLock
<SD-Card>/Mob/####/.nulal
<SD-Card>/Mob/####/.nulplt
<SD-Card>/Mob/####/.pkg_lock
<SD-Card>/Mob/####/.plst
<SD-Card>/Mob/####/.rcTag
<SD-Card>/Mob/####/.rc_lock
<SD-Card>/amap/####/1510835681797.db
<SD-Card>/amap/####/1510835683682.db
<SD-Card>/amap/####/1510835692315.db
<SD-Card>/amap/####/1510835707729.db
<SD-Card>/amap/####/alsn20170807.db
<SD-Card>/amap/####/alsn20170807.db-journal
<SD-Card>/huaba/####/7842337.du
<SD-Card>/huaba/####/8f67f1a2385a283032cb7abef745162f

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:52a0242156240b5b4a0104f9","utdid":"Wg2F36Jjyv4DAGdzx1HukVBg","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
app_process /system/bin com.android.commands.pm.Pm list packages
cat /proc/cpuinfo | grep Serial
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop
getprop ro.product.cpu.abi
grep -E -v root|shell|system
ls -l /system/xbin/su
pm list packages
sh
top -d 0 -n 1

Loads the following dynamic libraries:

fb_jpegturbo
imagepipeline
inet.2.0
libjiagu
neh
securitysdk-3.1
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-NONE-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial