Android.Triada.4812

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.6122
Android.Triada.4567
Android.Triada.510.origin
Android.Triada.541.origin
Android.Triada.546.origin
Android.Xiny.287.origin
Android.Xiny.293.origin
Android.Xiny.5261
Android.Xiny.5549

Threat detection based on machine learning.

File system changes:

Creates the following files:

/data/data/####/-1852006340
/data/data/####/.2969407120.apk
/data/data/####/.2969407120.dex
/data/data/####/.3477600307.apk
/data/data/####/.3477600307.dex
/data/data/####/.cqy
/data/data/####/.fy
/data/data/####/.gjuwpnpjlgwszw
/data/data/####/.qhce
/data/data/####/0C28D9BA3AEB4DBB629AF378AED396B2
/data/data/####/0C28D9BA3AEB4DBB629AF378AED396B2.dex
/data/data/####/0C28D9BA3AEB4DBB629AF378AED396B2.temp
/data/data/####/0C28D9BA3AEB4DBB629AF378AED396B2.zip
/data/data/####/13856442.apk
/data/data/####/13856442.dex
/data/data/####/1502509754
/data/data/####/1D302D3E6464EA39840D761291936A8C
/data/data/####/1FB529D5B86CB576CE98288F77DE7CFE
/data/data/####/1FB529D5B86CB576CE98288F77DE7CFE.dex
/data/data/####/1FB529D5B86CB576CE98288F77DE7CFE.temp
/data/data/####/1FB529D5B86CB576CE98288F77DE7CFE.zip
/data/data/####/20160121.xml
/data/data/####/20160121.xml.bak
/data/data/####/201908311950.apk
/data/data/####/201908311950.dex
/data/data/####/3327275
/data/data/####/386566751
/data/data/####/46EDBEC850D374CAD35CA3D274036409.dex
/data/data/####/46EDBEC850D374CAD35CA3D274036409.temp
/data/data/####/46EDBEC850D374CAD35CA3D274036409.zip
/data/data/####/7b2efb3777cca82ed8639540639eab54.xml
/data/data/####/829FC85977A25D40F667DA2163353D1B.dex
/data/data/####/829FC85977A25D40F667DA2163353D1B.temp
/data/data/####/829FC85977A25D40F667DA2163353D1B.zip
/data/data/####/8C8F552939218D4D55F5ACC7505AE2C6.xml
/data/data/####/9145E4178974FEAFB084264767F30932.xml
/data/data/####/98FDECB17B837318717C64311D2C05D8
/data/data/####/98FDECB17B837318717C64311D2C05D8.dex
/data/data/####/98FDECB17B837318717C64311D2C05D8.jar
/data/data/####/98FDECB17B837318717C64311D2C05D8.temp
/data/data/####/E36FAB93CB4E285016833DFC4CB2FC55.dex
/data/data/####/E36FAB93CB4E285016833DFC4CB2FC55.jar
/data/data/####/E36FAB93CB4E285016833DFC4CB2FC55.temp
/data/data/####/E796DC7A583043BFD4849DB0067F31E4.xml
/data/data/####/EA463EE35D35053E84058554191CA8D8
/data/data/####/FCC9153290073B970452C537AAF7420E
/data/data/####/FCC9153290073B970452C537AAF7420E.dex
/data/data/####/FCC9153290073B970452C537AAF7420E.temp
/data/data/####/FCC9153290073B970452C537AAF7420E.zip
/data/data/####/K.dex (deleted)
/data/data/####/K.jar
/data/data/####/MobikokCommonConfig.xml
/data/data/####/MobikokDeviceConfig.xml
/data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
/data/data/####/VirtualAPK_Settings.xml
/data/data/####/ag.xml
/data/data/####/bdownloaders.db
/data/data/####/bdownloaders.db-journal
/data/data/####/c1d051984a6a2bdb48368beb7b7b7190.d
/data/data/####/c201908311950.apk
/data/data/####/dasdasdsadsad
/data/data/####/data.dex
/data/data/####/data.jar
/data/data/####/eb9005176242923167b577981a25e143.d
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/i.i.xml
/data/data/####/ja201908091350.data
/data/data/####/libcom.wireroea.baetey.so
/data/data/####/libjvbc.so
/data/data/####/libjvbc.so-32
/data/data/####/libjvbc.so-64
/data/data/####/libnav-6mdw2z.so
/data/data/####/lob.xml
/data/data/####/m2019083117.apk
/data/data/####/m2019083117.dex
/data/data/####/pref_bl
/data/data/####/psbp
/data/data/####/puqicgpg.dex (deleted)
/data/data/####/puqicgpg.jar
/data/data/####/rt
/data/data/####/s2019083117.apk
/data/data/####/s2019083117.dex
/data/data/####/sp_aaxcx.xml
/data/data/####/sp_aaxcx.xml.bak
/data/data/####/sp_hziwkj.xml
/data/data/####/sp_kjjpy.xml
/data/data/####/sp_qyejw.xml
/data/data/####/sp_qyejw.xml.bak
/data/data/####/sp_xbjrq.xml
/data/data/####/temp.zip (deleted)
/data/data/####/tsf2.xml
/data/data/####/vk.xml
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/wzdb.png
/data/data/####/yd_config_c.xml
/data/data/####/yxrx.xml

Miscellaneous:

Executes the following shell scripts:

app_process /system/bin com.android.commands.pm.Pm path <Package>
awk {print $9}
cat /proc/version
cat /sys/class/net/wlan0/address
getprop
getprop ro.board.platform
getprop ro.product.cpu.abi
getprop ro.yunos.build.version
grep 2148
logcat -d -v time
md5 /data/app/<Package>-1.apk
ps
sh

Loads the following dynamic libraries:

com.wireroea
dasdasdsadsad
libjvbc

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding
DES
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
DES
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial