Android.Triada.1037

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.691.origin
Android.Triada.236.origin
Android.Triada.248.origin
Android.Triada.373.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) shl####.top:9999
TCP(HTTP/1.1) t####.9####.com:9000

DNS requests:

gbk.9####.com
shl####.top
t####.9####.com

HTTP GET requests:

t####.9####.com:9000/init/error?ua=####&cpu=####&sourceid=####

HTTP POST requests:

shl####.top:9999/d19aa2/752
shl####.top:9999/d3d/c8636
shl####.top:9999/d3d2414/4ed024
shl####.top:9999/d54f/a8e6ce
shl####.top:9999/d5b04e3/82d2
shl####.top:9999/d5ed6/24c85
shl####.top:9999/dd52e8/8aa5b
shl####.top:9999/df948/d47d1ec

Modified file system:

Creates the following files:

/data/data/####/.jar
/data/data/####/3.png
/data/data/####/8Q-TTy8S3SbS_jBywtxkJ6RarTU=.new
/data/data/####/8riNxZmJL5UeTPfm
/data/data/####/CIaVcK5RXA2sPyU32vkMDw==.new
/data/data/####/CLvnOVKHc0WntAsQ_rBqZA==.new
/data/data/####/CYCLE_PAY_PREF_NAME.xml
/data/data/####/FB0Sj18dEmOKJe2dpfaxURsc19r5G2dL.new
/data/data/####/JPC3wfbogMCW78PFIXnAYA==
/data/data/####/MainScene_1.csb
/data/data/####/Marker Felt.ttf
/data/data/####/MgGmhvR038zjzbUDGVEDhza2kkw=.new
/data/data/####/TextAtlas.png
/data/data/####/XBN9eSUc0TKt0uRY-BH2EjZJ1dI=
/data/data/####/YCwWuOze3ey4w2hEhzDq_lwDybnnRf0EkNn4wg==_HhtTwI...ournal
/data/data/####/YCwWuOze3ey4w2hEhzDq_lwDybnnRf0EkNn4wg==_PgX70c...gLTg==
/data/data/####/YCwWuOze3ey4w2hEhzDq_lwDybnnRf0EkNn4wg==_PgX70c...ournal
/data/data/####/arial.ttf
/data/data/####/back.png
/data/data/####/button.mp3
/data/data/####/button_back.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cyclesdk.apk
/data/data/####/die.mp3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/game.csb
/data/data/####/gq.ExportJson
/data/data/####/gq0.plist
/data/data/####/gq0.png
/data/data/####/hero.ExportJson
/data/data/####/hero.csb
/data/data/####/hero.png
/data/data/####/hero0.plist
/data/data/####/hero0.png
/data/data/####/high.mp3
/data/data/####/high_score.png
/data/data/####/jI1V3aZFPmn3K5Haqa9kMg==.new
/data/data/####/jx.png
/data/data/####/jx_1.png
/data/data/####/jx_10.png
/data/data/####/jx_2.png
/data/data/####/jx_3.png
/data/data/####/jx_4.png
/data/data/####/jx_5.png
/data/data/####/jx_6.png
/data/data/####/jx_7.png
/data/data/####/jx_8.png
/data/data/####/jx_9.png
/data/data/####/key
/data/data/####/koufei_0.png
/data/data/####/lang_encrypt_dex.dex
/data/data/####/libao.csb
/data/data/####/libhuizhou.so
/data/data/####/logo.png
/data/data/####/luodi.mp3
/data/data/####/mg.png
/data/data/####/mg_1.png
/data/data/####/mg_2.png
/data/data/####/n0nOgNDAryXhHi32yvQReQ==
/data/data/####/name_1.png
/data/data/####/name_10.png
/data/data/####/name_2.png
/data/data/####/name_3.png
/data/data/####/name_4.png
/data/data/####/name_5.png
/data/data/####/name_6.png
/data/data/####/name_7.png
/data/data/####/name_8.png
/data/data/####/name_9.png
/data/data/####/num-lv.png
/data/data/####/num01.png
/data/data/####/num02.png
/data/data/####/p01.png
/data/data/####/p02.png
/data/data/####/p03.png
/data/data/####/p04.png
/data/data/####/p05.png
/data/data/####/p07.png
/data/data/####/p08.png
/data/data/####/p10.png
/data/data/####/p12.png
/data/data/####/pUmyKFdFZ20oeQAtd3_FucbtFgMps1QT.new
/data/data/####/paihang.csb
/data/data/####/paihang_1.png
/data/data/####/paihang_botton.png
/data/data/####/ph-num.png
/data/data/####/rdata_comeiunxerhnq.new
/data/data/####/renwu.mp3
/data/data/####/restart.png
/data/data/####/restart_0.csb
/data/data/####/restart_1.csb
/data/data/####/restarte.png
/data/data/####/runner_info.prop.new
/data/data/####/score.png
/data/data/####/score_bg.png
/data/data/####/score_bg_1.png
/data/data/####/seypaq_f.dex
/data/data/####/seypaq_f.zip
/data/data/####/slot_paper01.png
/data/data/####/start.csb
/data/data/####/start.png
/data/data/####/tiaotiaodonghua.ExportJson
/data/data/####/tiaotiaodonghua0.plist
/data/data/####/tiaotiaodonghua0.png
/data/data/####/tiaotiaodonghua1.plist
/data/data/####/tiaotiaodonghua1.png
/data/data/####/tiaotiaodonghua2.plist
/data/data/####/tiaotiaodonghua2.png
/data/data/####/tiaotiaolizi1.plist
/data/data/####/tiaotiaolizi2.plist
/data/data/####/tiaotiaotietu1.png
/data/data/####/tiaoyitiao01.plist
/data/data/####/tj-2.png
/data/data/####/tj-5.png
/data/data/####/tj-num.png
/data/data/####/tnsea
/data/data/####/tnseaen
/data/data/####/touxiang01.png
/data/data/####/tx_1.png
/data/data/####/tx_10.png
/data/data/####/tx_2.png
/data/data/####/tx_3.png
/data/data/####/tx_4.png
/data/data/####/tx_5.png
/data/data/####/tx_6.png
/data/data/####/tx_7.png
/data/data/####/tx_8.png
/data/data/####/tx_9.png
/data/data/####/ty0rTmNVIWE3USIOH6lhdQ4YEqg=.new
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/wuti_1.png
/data/data/####/wuti_2.png
/data/data/####/yz.png
/data/data/####/yz_1.png
/data/data/####/yz_2.png
/data/data/####/yz_3.png
/data/data/####/yz_4.png
/data/data/####/zX9vctfxL-5KfEKP.zip
/data/media/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
/data/media/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk

Miscellaneous:

Executes next shell scripts:

cat /proc/cpuinfo

Loads the following dynamic libraries:

game
libhuizhou

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
DES
DES-CBC-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial