Android.Triada.2667

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.236.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) gbk.9####.com:9000
TCP(HTTP/1.1) prt.m####.net.####.com:80
TCP(HTTP/1.1) xi####.9####.com:8090
TCP(HTTP/1.1) 1####.199.53.8:9001
TCP(HTTP/1.1) xi####.9####.com:8089
TCP(HTTP/1.1) pay.9####.com:9000

DNS requests:

a####.u####.com
gbk.9####.com
pay.9####.com
prt.m####.net
t####.9####.com
xi####.9####.com

HTTP GET requests:

prt.m####.net.####.com/videocover/08c2dabd5e72f94962fa7ca918b4b144.jpg
prt.m####.net.####.com/videocover/0cb65a5ee3794dd7aa1037e8e32c256b.jpg
prt.m####.net.####.com/videocover/0f1ec58533b750c0b6753dd1d9684ae1.jpg
prt.m####.net.####.com/videocover/0f7a91e4e7ad9440ec2c4a4af69952de.jpg
prt.m####.net.####.com/videocover/141e5c32f3293180f53c87278c7f4a4d.jpg
prt.m####.net.####.com/videocover/152c9ae5a8603dafded321eb26e423f5.jpg
prt.m####.net.####.com/videocover/1c469a56d0a64d57f5a466b91cad8a91.jpg
prt.m####.net.####.com/videocover/1ce2e0ff78c1924e91f2b1179db7a142.jpg
prt.m####.net.####.com/videocover/1cf3879399b9f2b1ce4dd5d0e32520b1.jpg
prt.m####.net.####.com/videocover/28a4dbd8efc3c04510ae1f54a0ccad03.jpg
prt.m####.net.####.com/videocover/2c498f9a7fc2683f1eb86122e90bee7f.jpg
prt.m####.net.####.com/videocover/2c8bdd034ddd4b5f48f0671aae303b82.jpg
prt.m####.net.####.com/videocover/36f444999d5ff9970e4b326f588aec51.jpg
prt.m####.net.####.com/videocover/3ea277e471b408f513c80d541a946146.jpg
prt.m####.net.####.com/videocover/435c27029a307086e598ccf0105195f7.jpg
prt.m####.net.####.com/videocover/43aac46d569c03f298d467ff84e9778b.jpg
prt.m####.net.####.com/videocover/4b005d0e71d16fbedd85a383075832a5.jpg
prt.m####.net.####.com/videocover/56ee92cbf038fdf323610501ea4b3ca6.jpg
prt.m####.net.####.com/videocover/62e7af71c48dad60f4b306b4ef196d2d.jpg
prt.m####.net.####.com/videocover/67d83865ff69835bc061776e67b45a85.jpg
prt.m####.net.####.com/videocover/6908ea4f0b9f9f7b88d72ff958b7f5af.jpg
prt.m####.net.####.com/videocover/72ca8b48623ef851089510d5a89813ca.jpg
prt.m####.net.####.com/videocover/75fbf56a5007d2650ee255ef5b16d3dc.jpg
prt.m####.net.####.com/videocover/76189e752bcfdc34c2950e65c4658a22.jpg
prt.m####.net.####.com/videocover/7cce5af65f94d9a4fc0c141cc2c88f39.jpg
prt.m####.net.####.com/videocover/82d8b4742930e1fc370b07da470db206.jpg
prt.m####.net.####.com/videocover/84252915a13d3f358135b4bad921a9ab.jpg
prt.m####.net.####.com/videocover/844c8ce85812552644543ecb53f67554.jpg
prt.m####.net.####.com/videocover/87810be014bec8f9cc0ea6a9a3bec04f.jpg
prt.m####.net.####.com/videocover/88f3833a5553eb65f454d7fb988ddb21.jpg
prt.m####.net.####.com/videocover/8add67f8816e8961c56c0dfef237e03f.jpg
prt.m####.net.####.com/videocover/93257f5cca77cdffca8b4d0f77238bf0.jpg
prt.m####.net.####.com/videocover/9635193be6569cf8f2b231ce1267b419.jpg
prt.m####.net.####.com/videocover/9dfe02034b4b6280e029242bcb5a0460.jpg
prt.m####.net.####.com/videocover/9eee170539da1008b653d39f9cda77c8.jpg
prt.m####.net.####.com/videocover/b12976f84ce2591718932354a102be56.jpg
prt.m####.net.####.com/videocover/c4aac37d6a7b4186615c11009b563a06.jpg
prt.m####.net.####.com/videocover/c5922019ea7c52bc01d1f7163aa3ea5a.jpg
prt.m####.net.####.com/videocover/cdf05771d3a920b134991c1d8869fd47.jpg
prt.m####.net.####.com/videocover/d1ec55cd00e6a1a394bf0cebea882f39.jpg
prt.m####.net.####.com/videocover/d2602a4ea4cf8af0600cd19ca3c48c03.jpg
prt.m####.net.####.com/videocover/d43eeebd8d9489f80da8653781bacde9.jpg
prt.m####.net.####.com/videocover/e8df4f3a9f20fd5fb92ff95570a6573b.jpg
prt.m####.net.####.com/videocover/f6a2660ef3986f2dae6fdb3df90358a0.jpg
prt.m####.net.####.com/videocover/f79a5678ccad7f2c1f4499f9a1872c0e.jpg
prt.m####.net.####.com/videocover/f8eaafee84f3b37abb374a942153b8a6.jpg
xi####.9####.com:8089/attached//2018/07/09/193446701481.jpg
xi####.9####.com:8089/attached//2018/07/09/193521586214.png
xi####.9####.com:8089/attached//2018/07/09/193553547219.jpg
xi####.9####.com:8089/attached//2018/07/09/193606202980.jpg
xi####.9####.com:8089/attached//2018/07/09/193617152733.jpg
xi####.9####.com:8089/attached//2018/07/09/193628977945.jpg
xi####.9####.com:8089/attached//2018/07/09/193641680204.jpg
xi####.9####.com:8089/attached//2018/07/09/193652851557.jpg

HTTP POST requests:

a####.u####.com/app_logs
gbk.9####.com:9000/sdk_pools_pay_version
pay.9####.com:9000/inner_sdk_upgrade_check
pay.9####.com:9000/record_user_active
xi####.9####.com:8090/count
xi####.9####.com:8090/index
xi####.9####.com:8090/list
xi####.9####.com:8090/more
xi####.9####.com:8090/pingdao
xi####.9####.com:8090/vcheck

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/CYCLE_PAY_PREF_NAME.xml
/data/data/####/CYCLE_UNIQUE_ID.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cyclesdk.apk
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/lang_encrypt_dex.dex
/data/data/####/libcyberplayer.so
/data/data/####/libzaozhuang.so
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ylmob.db-journal
/data/media/####/-1044062454.tmp
/data/media/####/-1054699580.tmp
/data/media/####/-1095479186.tmp
/data/media/####/-1225229399.tmp
/data/media/####/-137810126.tmp
/data/media/####/-1415399119.tmp
/data/media/####/-1449782600.tmp
/data/media/####/-1485882339.tmp
/data/media/####/-1492626860.tmp
/data/media/####/-1498365262.tmp
/data/media/####/-1636403755.tmp
/data/media/####/-16973136.tmp
/data/media/####/-1751382363.tmp
/data/media/####/-1941671996.tmp
/data/media/####/-233178789.tmp
/data/media/####/-260823863.tmp
/data/media/####/-288421439.tmp
/data/media/####/-395327558.tmp
/data/media/####/-395629837.tmp
/data/media/####/-43326355.tmp
/data/media/####/-439606807.tmp
/data/media/####/-471812604.tmp
/data/media/####/-609032595.tmp
/data/media/####/-848905591.tmp
/data/media/####/-866557561.tmp
/data/media/####/-900139431.tmp
/data/media/####/-965067265.tmp
/data/media/####/1046222599.tmp
/data/media/####/1072174763.tmp
/data/media/####/1099387498.tmp
/data/media/####/1107820228.tmp
/data/media/####/1216873351.tmp
/data/media/####/1228603769.tmp
/data/media/####/12663409.tmp
/data/media/####/1313518138.tmp
/data/media/####/1468931560.tmp
/data/media/####/1624421368.tmp
/data/media/####/1692547666.tmp
/data/media/####/1809445927.tmp
/data/media/####/1932580916.tmp
/data/media/####/1946840437.tmp
/data/media/####/2091491931.tmp
/data/media/####/2091792133.tmp
/data/media/####/21285077.tmp
/data/media/####/218782628.tmp
/data/media/####/272230382.tmp
/data/media/####/368804970.tmp
/data/media/####/380139045.tmp
/data/media/####/394945606.tmp
/data/media/####/446631743.tmp
/data/media/####/612947926.tmp
/data/media/####/999622388.tmp
/data/media/####/libcyberplayer-core.so.gz
/data/media/####/libcyberplayer.so

Miscellaneous:

Loads the following dynamic libraries:

libzaozhuang

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Parses information from SMS.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial