Android.Triada.3055

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.440.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) v3.bule####.cn:7001
TCP(HTTP/1.1) dn.tc####.com:80
TCP(HTTP/1.1) ad.fan####.cn:57588
TCP(HTTP/1.1) log.r####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) is.sn####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) bds.sn####.com:80
TCP(HTTP/1.1) api.unipl####.com:80
TCP(HTTP/1.1) i.sn####.com:80
TCP(HTTP/1.1) to####.sn####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) i.sn####.com:443
TCP(TLS/1.0) ads.on####.mobi:443
TCP(TLS/1.0) to####.sn####.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP 1####.168.104.254:32914
TCP 1####.168.104.254:43928
TCP 1####.168.104.254:42851
TCP 1####.168.104.254:45235
TCP 1####.168.104.254:48780
TCP 1####.168.104.254:40937
TCP 1####.168.104.254:42642
TCP 1####.168.104.254:38847
TCP 1####.168.104.254:32923
TCP 1####.168.104.254:34883
TCP 1####.168.104.254:43757
TCP 1####.168.104.254:42802
TCP 1####.168.104.254:34126
TCP 1####.168.104.254:39685
TCP 1####.168.104.254:36294
TCP 1####.168.104.254:44410
TCP 1####.168.104.254:55069
TCP 1####.168.104.254:42280
TCP 1####.168.104.254:36173
TCP 1####.168.104.254:56308
TCP 1####.168.104.254:44177
TCP 1####.168.104.254:52320
TCP 1####.168.104.254:40070
TCP 1####.168.104.254:35006
TCP 1####.168.104.254:52624
TCP 1####.168.104.254:52251
TCP 1####.168.104.254:51647
TCP 1####.168.104.254:35246
TCP 1####.168.104.254:37079
TCP 1####.168.104.254:56723
TCP 1####.168.104.254:34608
TCP 1####.168.104.254:44664
TCP 1####.168.104.254:41848
TCP 1####.168.104.254:38541
TCP 1####.168.104.254:38154
TCP 1####.168.104.254:44488
TCP 1####.168.104.254:38353
TCP 1####.168.104.254:51274
TCP 1####.168.104.254:57137
TCP 1####.168.104.254:42258
TCP 1####.168.104.254:56298
TCP 1####.168.104.254:52173
TCP 1####.168.104.254:53074
TCP 1####.168.104.254:57396
TCP 1####.168.104.254:37792
TCP 1####.168.104.254:54220
TCP 1####.168.104.254:51824
TCP 1####.168.104.254:49090
TCP 1####.168.104.254:53777
TCP 1####.168.104.254:37866
TCP 1####.168.104.254:47041
TCP 1####.168.104.254:43045
TCP 1####.168.104.254:49370
TCP 1####.168.104.254:46339
TCP 1####.168.104.254:39768

DNS requests:

ad.fan####.cn
ads.on####.mobi
api.unipl####.com
bds.sn####.com
cdn.on####.mobi
dn.tc####.com
i.sn####.com
icha####.sn####.com
imgc####.qq.com
is.sn####.com
log.r####.com
log.sn####.com
mi.g####.qq.com
p####.ugd####.com
plb####.u####.com
s####.e.qq.com
sf1-ttc####.ps####.com
to####.sn####.com
u####.u####.com
v####.ix####.com
v3.bule####.cn
w####.pcon####.com.cn

HTTP GET requests:

ad.fan####.cn:57588/adc/getSimple?appid=####&version=####&codeid=####&pr...
ad.fan####.cn:57588/report/errorReport?appid=####&projectid=####&adver=#...
api.unipl####.com/phone/config.php?c=####&appid=####&pkg=####&ext=####
api.unipl####.com/sdk/signin.php?&vsdk=####&plt=####&net=####&opt=####&p...
bds.sn####.com/service/2/app_alert_check/?build_serial=####&timezone=###...
dn.tc####.com/dnfile/Video/2018071017075700wr0f.mp4
dn.tc####.com/dnfile/image/nwny/1280-720-1.jpg
dn.tc####.com/dnfile/image/nwny/720-1280-1.jpg
dn.tc####.com/dnfile/shengjibao/NewVideoKernalApiTT1127_101.jar
i.sn####.com/service/2/app_alert_check/?build_serial=####&timezone=####&...
log.r####.com/receive/gettime
mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
to####.sn####.com/service/2/app_alert_check/?build_serial=####&timezone=...

HTTP POST requests:

api.unipl####.com/phone/get.php
bds.sn####.com/service/2/ab_test_config/?tt_data=####
bds.sn####.com/service/2/app_log/?tt_data=####
i.sn####.com/service/2/ab_test_config/?tt_data=####
i.sn####.com/service/2/app_log/?tt_data=####
i.sn####.com/service/2/app_log_exception/?openudid=####&version_name=###...
is.sn####.com/service/2/app_log_exception/?openudid=####&version_name=##...
log.r####.com/receive/tkio/event
log.r####.com/receive/tkio/startup
s####.e.qq.com/activate
s####.e.qq.com/launch
to####.sn####.com/service/2/ab_test_config/?tt_data=####
to####.sn####.com/service/2/app_log/?tt_data=####
to####.sn####.com/service/2/device_register/?tt_data=####
to####.sn####.com/service/2/log_settings/?tt_data=####
v3.bule####.cn:7001/v3/api_request.aspx
v3.bule####.cn:7001/v3/api_settings.aspx
v3.bule####.cn:7001/verrlog.aspx
w####.pcon####.com.cn/ip.jsp

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1548904699724
/data/data/####/1548904728018
/data/data/####/2556.yaqcookie
/data/data/####/2817.yaqcookie
/data/data/####/2944.yaqcookie
/data/data/####/Alvin2.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/Reyun.db
/data/data/####/Reyun.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Uniplay.xml
/data/data/####/VideoRes.apk
/data/data/####/_umeng_common_config.xml
/data/data/####/a==8.0.0+G&&1.2.5_1548904702160_envelope.log
/data/data/####/a==8.0.0+G&&1.2.5_1548904729044_envelope.log
/data/data/####/a==8.0.0+G&&1.2.5_1548904736926_envelope.log
/data/data/####/app_log_encrypt_switch_count.xml
/data/data/####/applog_stats.xml
/data/data/####/config.xml
/data/data/####/custom_channels.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0Njg1MjI3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0Njg3NDgy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NjkwNDIz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NjkzMDM0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzA0Njkz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzAxNDE4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzE2MjA4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzEyOTQz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzI4MTA0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzIwOTEw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzM2NDYz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4OTA0NzMxMzY2;
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/dexMethod.68778890.dat
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_stat.db
/data/data/####/gdt_suid
/data/data/####/header_custom.xml
/data/data/####/i==1.2.0&&1.2.5_1548904685300_envelope.log
/data/data/####/i==1.2.0&&1.2.5_1548904701773_envelope.log
/data/data/####/i==1.2.0&&1.2.5_1548904716758_envelope.log
/data/data/####/i==1.2.0&&1.2.5_1548904721316_envelope.log
/data/data/####/i==1.2.0&&1.2.5_1548904732782_envelope.log
/data/data/####/id01756421-12ad-4d0b-bf2e-69f32d8748c2.tmp
/data/data/####/info.xml
/data/data/####/last_sp_session.xml
/data/data/####/libyaqbasic.68778890.so
/data/data/####/libyaqpro.68778890.so
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sdk_config.xml
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_reward_video_adslot.xml
/data/data/####/ss_app_log.db-journal
/data/data/####/t==8.0.0+G&&1.2.5_1548904687816_envelope.log
/data/data/####/t==8.0.0+G&&1.2.5_1548904690687_envelope.log
/data/data/####/tracking_install.xml
/data/data/####/tracking_interval.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak (deleted)
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/videokernel.apk
/data/data/####/videonewyd_db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yaqsdkcookie
/data/media/####/-2077649869
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.sys
/data/media/####/.umm.dat
/data/media/####/775401827
/data/media/####/Alvin2.xml
/data/media/####/ApplicationCache.db
/data/media/####/ApplicationCache.db-journal
/data/media/####/ApplicationCache.db-journal (deleted)
/data/media/####/ContextData.xml
/data/media/####/OnewaySdkStorage-ow-pri.json
/data/media/####/OnewaySdkStorage-ow-pub.json
/data/media/####/OnewaySdkWebApp.html
/data/media/####/Videoshell.log
/data/media/####/clientudid.dat
/data/media/####/kernel.dat
/data/media/####/sysid.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /sys/class/net/wlan0/address
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

cocos2djs
libyaqbasic.68778890
libyaqpro.68778890
nms
ttEncrypt

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial