Android.Triada.1218

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.417.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10003
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10002
TCP(HTTP/1.1) preload####.hishen####.com:5500
TCP(HTTP/1.1) e4####.oi####.com:20351
TCP(HTTP/1.1) 1####.159.152.136:8090
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10201
TCP(HTTP/1.1) 6y####.lvdi####.com:10091
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) wn.qiazhiw####.cn.####.net:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600
TCP(HTTP/1.1) rtf####.5do####.com:15215
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10101
TCP(HTTP/1.1) www.ope####.net:80
TCP(HTTP/1.1) prelo####.hishen####.com.####.com:80
TCP(HTTP/1.1) 1####.159.180.48:8090
TCP(HTTP/1.1) m####.jh####.cn:80
TCP(HTTP/1.1) w####.iduot####.com:5500
TCP(HTTP/1.1) 1####.159.131.193:10201
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) 1####.129.132.111:8001
TCP(HTTP/1.1) 1####.159.103.205:8090
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) sdk.api.qiazhiw####.cn:10001
TCP(HTTP/1.1) i####.api.qiazhiw####.cn:10002
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(TLS/1.0) 2####.58.212.142:443

DNS requests:

6y####.lvdi####.com
and####.b####.qq.com
c####.api.qiazhiw####.cn
e4####.oi####.com
i####.api.qiazhiw####.cn
i####.api.qiazhiw####.cn
int.d####.s####.####.cn
m####.jh####.cn
oc.u####.com
prelo####.hishen####.com
preload####.hishen####.com
pt.co####.com
pv.s####.com
r####.qq####.cn
re####.api.qiazhiw####.cn
rtf####.5do####.com
sdk.api.qiazhiw####.cn
w####.iduot####.com
wn.qiazhiw####.cn
www.ope####.net
z####.wann####.com
zxc####.wann####.com

HTTP GET requests:

gdv.a.s####.com/cityjson?ie=####
m####.jh####.cn/f/TFWC16681886
m####.jh####.cn/v/1ZX0614gdfojrf4x.zip
m####.jh####.cn/v/1ZX0614jajd4x.zip
m####.jh####.cn/v/1ZXhabzye4x.zip
m####.jh####.cn/v/1ZXmbavp4x.zip
m####.jh####.cn/v/1ZXyguil4x.zip
prelo####.hishen####.com.####.com/project_preloaded/6592ff3287544e948f3a...
prelo####.hishen####.com.####.com/project_preloaded/c9b8112a330c405eaf61...
prelo####.hishen####.com.####.com/project_preloaded/cd89c48e607342709479...
wn.qiazhiw####.cn.####.net/update/up06057081

HTTP POST requests:

6y####.lvdi####.com:10091/wisdom/marking
and####.b####.qq.com/rqd/async
e4####.oi####.com:20351/ds/
i####.api.qiazhiw####.cn:10002/v2/sdk/init?app_id=####&t=####
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveDevice
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveFile
rtf####.5do####.com:15215/tr/
rtf####.5do####.com:15215/ts/
sdk.api.qiazhiw####.cn:10001/v2/adconfig/get?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/bag/monitor?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/sdk/init?app_id=####&t=####
sdk.api.qiazhiw####.cn:10001/v2/update/check?app_id=####&t=####
sdk.api.qiazhiw####.cn:10002/v2/callback/message?app_id=####&t=####
sdk.api.qiazhiw####.cn:10002/v2/log/add?app_id=####&t=####
sdk.api.qiazhiw####.cn:10003/v2/chis
sdk.api.qiazhiw####.cn:10101/v2/order/get?app_id=####&t=####
sdk.api.qiazhiw####.cn:10101/v2/splog/config?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/order?app_id=####&t=####
sdk.api.qiazhiw####.cn:10201/v2/sdk/report?app_id=####&t=####
w####.iduot####.com:5500/api-log-server/thirdPlugin/save
w####.iduot####.com:5500/api-plugin-jar/thirdPlugin/jars
www.ope####.net/sdkinterface/cooguosdk/initGameId?method=####
www.ope####.net/sdkinterface/cooguosdk?b=####&requestId=####&a=####
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Modified file system:

Creates the following files:

/data/data/####/469d731f81937a3bab92f9c04a3ca370.xml
/data/data/####/5223f5ab0a5adf2de9432014980a7509
/data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log
/data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log.temp
/data/data/####/OutsidePlugin_UR.jar
/data/data/####/a4be9ff4668403efdb304dc0106533f6.log
/data/data/####/a4be9ff4668403efdb304dc0106533f6.log.temp
/data/data/####/bugly_db_legu-journal
/data/data/####/cg.xml
/data/data/####/channel.xml
/data/data/####/config50200.xml
/data/data/####/device_info.xml
/data/data/####/device_info_sdk_update.jar
/data/data/####/e2d119a1c8895232098cd0bba4d5750c.log
/data/data/####/e2d119a1c8895232098cd0bba4d5750c.log.temp
/data/data/####/e64db61cc859d4aa808dc59fa18db2ff.log
/data/data/####/e64db61cc859d4aa808dc59fa18db2ff.log.temp
/data/data/####/ff533ee364e852cd5369a6766a6f448b.log
/data/data/####/ff533ee364e852cd5369a6766a6f448b.log.temp
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/getprop
/data/data/####/init.xml
/data/data/####/libjlyx.so
/data/data/####/libjlyx.so-32
/data/data/####/libjlyx.so-64
/data/data/####/libnfix.so
/data/data/####/libshella-2.8.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/new_md.jar
/data/data/####/onlineconfig_agent_online_setting_com.fdgs.dsg....e3.xml
/data/data/####/proxy.db-journal
/data/data/####/puqisgpo.jar
/data/data/####/qiangang_sdk_update_uml.jar
/data/data/####/qy_db_pay-journal
/data/data/####/security_info
/data/data/####/umeng_general_config.xml
/data/data/####/unknown.xml
/data/data/####/up06057081
/data/data/####/webview.db-journal
/data/data/####/yd_config_c.xml
/data/media/####/.cfg
/data/media/####/.uidoslog
/data/media/####/device
/data/media/####/msg.db
/data/media/####/msg.db-journal
/data/media/####/vauid

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
cat /proc/version
cat /sys/block/mmcblk0/device/cid
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
chmod 700 <Package Folder>/tx_shell/libufix.so
df
getprop
getprop ro.board.platform
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls -l /system/bin/su
ps | grep <Package>

Loads the following dynamic libraries:

Bugly
libjlyx
libnfix
libshella-2.8
libufix
nfix
ufix

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
DES-CBC-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
DES-ECB-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial