Android.Triada.1050

Technical information

Malicious functions:

Sends SMS messages:

106901332942: rg|587|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T387DoVnMaln7lYSiso3w9V8QXuuii7z0ZH1Nm5pmnXlCT6vlipPobMYiQwHRMo6BHto!

Executes code of the following detected threats:

Android.Triada.236.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sdk.qipa####.cn:8088
TCP(HTTP/1.1) csk.mc####.com:9003
TCP(HTTP/1.1) 1####.55.161.68:29092
TCP(HTTP/1.1) tinyq####.b0.a####.com:80
TCP(HTTP/1.1) dev.pu####.com:80

DNS requests:

csk.mc####.com
dev.pu####.com
rac####.funu####.com
sdk.qipa####.cn

HTTP GET requests:

tinyq####.b0.a####.com/
tinyq####.b0.a####.com/?key=####&fields=####
tinyq####.b0.a####.com/audio/beep.mp3
tinyq####.b0.a####.com/audio/bg_music.mp3
tinyq####.b0.a####.com/audio/buyBike.mp3
tinyq####.b0.a####.com/audio/buyUpgrade.mp3
tinyq####.b0.a####.com/audio/click.mp3
tinyq####.b0.a####.com/audio/closePass0.mp3
tinyq####.b0.a####.com/audio/closePass1.mp3
tinyq####.b0.a####.com/audio/closePass2.mp3
tinyq####.b0.a####.com/audio/coin0.mp3
tinyq####.b0.a####.com/audio/coin1.mp3
tinyq####.b0.a####.com/audio/crash0.mp3
tinyq####.b0.a####.com/audio/crash1.mp3
tinyq####.b0.a####.com/audio/engine0.mp3
tinyq####.b0.a####.com/audio/engine1.mp3
tinyq####.b0.a####.com/audio/engine2.mp3
tinyq####.b0.a####.com/audio/horn0.mp3
tinyq####.b0.a####.com/audio/horn1.mp3
tinyq####.b0.a####.com/audio/inDraft.mp3
tinyq####.b0.a####.com/audio/levelFail.mp3
tinyq####.b0.a####.com/audio/mapBut.mp3
tinyq####.b0.a####.com/audio/overtake0.mp3
tinyq####.b0.a####.com/audio/overtake1.mp3
tinyq####.b0.a####.com/audio/overtake2.mp3
tinyq####.b0.a####.com/audio/raceFail.mp3
tinyq####.b0.a####.com/audio/raceStart.mp3
tinyq####.b0.a####.com/audio/rev0.mp3
tinyq####.b0.a####.com/audio/rev1.mp3
tinyq####.b0.a####.com/audio/scoreTotal0.mp3
tinyq####.b0.a####.com/audio/scoreTotal1.mp3
tinyq####.b0.a####.com/audio/silence.mp3
tinyq####.b0.a####.com/audio/stageSuccess.mp3
tinyq####.b0.a####.com/gameapi/3df41947-b71e-4659-b3ae-c1afe0508e57?_loc...
tinyq####.b0.a####.com/gameapi/assets/0.2-6743d993/css/play.css
tinyq####.b0.a####.com/gameapi/assets/0.2-6743d993/js/gameapi.js
tinyq####.b0.a####.com/gameapi/v1.js?e=####
tinyq####.b0.a####.com/images/bike0.png
tinyq####.b0.a####.com/images/bike1.png
tinyq####.b0.a####.com/images/bike2.png
tinyq####.b0.a####.com/images/bike3.png
tinyq####.b0.a####.com/images/bike4.png
tinyq####.b0.a####.com/images/bike5.png
tinyq####.b0.a####.com/images/bike6.png
tinyq####.b0.a####.com/images/bike7.png
tinyq####.b0.a####.com/images/bike8.png
tinyq####.b0.a####.com/images/calendarNumbers_13x19.png
tinyq####.b0.a####.com/images/car0_383x165.png
tinyq####.b0.a####.com/images/car1_383x165.png
tinyq####.b0.a####.com/images/car2_392x130.png
tinyq####.b0.a####.com/images/car3_392x130.png
tinyq####.b0.a####.com/images/coin2_88x125.png
tinyq####.b0.a####.com/images/coin_89x126.png
tinyq####.b0.a####.com/images/crash.png
tinyq####.b0.a####.com/images/flare.png
tinyq####.b0.a####.com/images/garageBg.jpg
tinyq####.b0.a####.com/images/hudElements.png
tinyq####.b0.a####.com/images/loadSpinner.png
tinyq####.b0.a####.com/images/loader.png
tinyq####.b0.a####.com/images/map.jpg
tinyq####.b0.a####.com/images/numbers_41x47.png
tinyq####.b0.a####.com/images/road0.jpg
tinyq####.b0.a####.com/images/road1.jpg
tinyq####.b0.a####.com/images/road2.jpg
tinyq####.b0.a####.com/images/road3.jpg
tinyq####.b0.a####.com/images/road4.jpg
tinyq####.b0.a####.com/images/scenery.png
tinyq####.b0.a####.com/images/sky0.png
tinyq####.b0.a####.com/images/sky1.png
tinyq####.b0.a####.com/images/sky2.png
tinyq####.b0.a####.com/images/sky3.png
tinyq####.b0.a####.com/images/sky4.png
tinyq####.b0.a####.com/images/sun.png
tinyq####.b0.a####.com/images/titleBg.jpg
tinyq####.b0.a####.com/images/truck0_472x168.png
tinyq####.b0.a####.com/images/truck1_551x219.png
tinyq####.b0.a####.com/images/uiButs.png
tinyq####.b0.a####.com/images/uiElements.png
tinyq####.b0.a####.com/images/whoosh.png
tinyq####.b0.a####.com/js/CC2Gm/music.js
tinyq####.b0.a####.com/js/CC2Gm/resource.js
tinyq####.b0.a####.com/js/CC2Gm/sound.js
tinyq####.b0.a####.com/js/CCPlugin/AudioUtil.js
tinyq####.b0.a####.com/js/CCPlugin/CCAudio.js
tinyq####.b0.a####.com/js/CCPlugin/CCBoot.js
tinyq####.b0.a####.com/js/CCPlugin/CCClass.js
tinyq####.b0.a####.com/js/CCPlugin/miniFramework.js
tinyq####.b0.a####.com/js/HowlerVirtual2Gm/howlerVm.js
tinyq####.b0.a####.com/js/all.js

HTTP POST requests:

csk.mc####.com:9003/csk/c_s/g_f.json
csk.mc####.com:9003/csk/st_c/cn_i_sec.json
csk.mc####.com:9003/csk/st_c/cn_sk_Order.json
csk.mc####.com:9003/csk/st_c/cn_sk_login.json
csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
csk.mc####.com:9003/csk/st_c/getst_tegy.json
dev.pu####.com/mvc/network/get_info.do
sdk.qipa####.cn:8088/a.do

Modified file system:

Creates the following files:

/data/data/####/ApplicationCache.db-journal
/data/data/####/aa
/data/data/####/abc.xml
/data/data/####/app_test.apk
/data/data/####/app_test.dex
/data/data/####/brushs.xml
/data/data/####/cds.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/fmoonStore.db
/data/data/####/fmoonStore.db-journal
/data/data/####/index
/data/data/####/md.tmp
/data/data/####/qipa.apk
/data/data/####/snpwlqop.jar
/data/data/####/vzrenwoj
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Executes next shell scripts:

getprop
service list

Loads the following dynamic libraries:

zpenguin

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
DES

Uses the following algorithms to decrypt data:

AES
DES
DES-CBC-PKCS5Padding
DESede

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Gains access to information about sent/received SMS messages.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial