Android.Triada.5038

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.566.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) lo####.suibyu####.com:80
TCP(HTTP/1.1) cc####.sdkclic####.com:80
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) trac####.yoh####.com:443
TCP(TLS/1.0) m####.app.link:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) wcf.seven####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) x8files####.f####.myqc####.com:443
TCP(TLS/1.0) api.x####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) t.9####.me:443
TCP(TLS/1.0) cdn.br####.io:443
TCP(TLS/1.0) fo####.site:443
TCP(TLS/1.2) 2####.58.211.110:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 1####.250.179.163:443
UDP www.google####.com:443

DNS requests:

a####.u####.com
al####.u####.com
api.applove####.com
api.x####.com
cc####.sdkclic####.com
cdn.br####.io
f####.google####.com
f####.gst####.com
firebas####.google####.com
fo####.site
g####.face####.com
lo####.applove####.com
lo####.suibyu####.com
m####.app.link
m####.go####.com
md####.google####.com
pv.s####.com
t.9####.me
trac####.yoh####.com
wcf.seven####.com
www.b####.com
www.google####.com
x8files####.f####.myqc####.com

HTTP GET requests:

api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
cc####.sdkclic####.com/click/?adgroup_id=####&user_id=####&timeflag=####...
lo####.suibyu####.com/android/v1/impression?slot=####&doimp=####&pkg=###...

HTTP POST requests:

lo####.suibyu####.com/android/v2/click_redirect

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/1.acc.apk
/data/data/####/1.acc.dex
/data/data/####/1.acc.dex.flock (deleted)
/data/data/####/60E161710120-0001-0E97-646088F444B0BeginSession.cls_temp
/data/data/####/60E161710120-0001-0E97-646088F444B0SessionApp.cls_temp
/data/data/####/60E161710120-0001-0E97-646088F444B0SessionDevice.cls_temp
/data/data/####/60E161710120-0001-0E97-646088F444B0SessionOS.cls_temp
/data/data/####/60E161710120-0001-0E97-646088F444B0SessionUser.cls_temp
/data/data/####/60E1617A00C2-0001-0F29-646088F444B0BeginSession.cls_temp
/data/data/####/60E1617A00C2-0001-0F29-646088F444B0SessionApp.cls_temp
/data/data/####/60E1617A00C2-0001-0F29-646088F444B0SessionDevice.cls_temp
/data/data/####/60E1617A00C2-0001-0F29-646088F444B0SessionOS.cls_temp
/data/data/####/60E1617A00C2-0001-0F29-646088F444B0SessionUser.cls_temp
/data/data/####/60E161810159-0001-0FD4-646088F444B0BeginSession.cls_temp
/data/data/####/60E161810159-0001-0FD4-646088F444B0SessionApp.cls_temp
/data/data/####/60E161810159-0001-0FD4-646088F444B0SessionDevice.cls_temp
/data/data/####/60E161810159-0001-0FD4-646088F444B0SessionOS.cls_temp
/data/data/####/60E161810159-0001-0FD4-646088F444B0SessionUser.cls_temp
/data/data/####/60E16189011A-0001-107C-646088F444B0BeginSession.cls_temp
/data/data/####/60E16189011A-0001-107C-646088F444B0SessionApp.cls_temp
/data/data/####/60E16189011A-0001-107C-646088F444B0SessionDevice.cls_temp
/data/data/####/60E16189011A-0001-107C-646088F444B0SessionOS.cls_temp
/data/data/####/60E16189011A-0001-107C-646088F444B0SessionUser.cls_temp
/data/data/####/60E1619101FC-0001-111F-646088F444B0BeginSession.cls
/data/data/####/60E1619101FC-0001-111F-646088F444B0SessionApp.cls_temp
/data/data/####/60E1619101FC-0001-111F-646088F444B0SessionDevice.cls_temp
/data/data/####/60E1619101FC-0001-111F-646088F444B0SessionOS.cls_temp
/data/data/####/60E1619101FC-0001-111F-646088F444B0SessionUser.cls_temp
/data/data/####/60E1619C01A3-0001-124E-646088F444B0BeginSession.cls_temp
/data/data/####/60E1619C01A3-0001-124E-646088F444B0SessionApp.cls_temp
/data/data/####/60E1619C01A3-0001-124E-646088F444B0SessionDevice.cls_temp
/data/data/####/60E1619C01A3-0001-124E-646088F444B0SessionOS.cls_temp
/data/data/####/6f4670b6d34feb34_0
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/Cookies-journal
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo2ODY5ODEz...3.json
/data/data/####/PersistedInstallation45826076tmp
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a==9.3.8+000&&2.16.0_1625383294981_dW5pZnlfbG9ncw==;.log
/data/data/####/ad_config.xml
/data/data/####/ad_config.xml.bak
/data/data/####/androidx.work.workdb
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/androidx.work.workdb-shm
/data/data/####/androidx.work.workdb-wal
/data/data/####/app.json
/data/data/####/audience_network.dex
/data/data/####/b84d0c9873afb30f_0
/data/data/####/c34a4c3h54e6_TYUYRTTYT
/data/data/####/cb25b503a66f7eff_0
/data/data/####/classes.dex
/data/data/####/classes.dex.flock (deleted)
/data/data/####/classes2.dex
/data/data/####/classes2.dex.flock (deleted)
/data/data/####/classes3.dex
/data/data/####/classes3.dex.flock (deleted)
/data/data/####/classes4.dex
/data/data/####/classes4.dex.flock (deleted)
/data/data/####/cloud_config.xml
/data/data/####/cloud_config.xml.bak
/data/data/####/com.cc.fea.fewe.try.の.s3u4b34f3f4_YUIYTRYUT
/data/data/####/com.facebook.internal.SKU_DETAILS.xml
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.datatransport.events
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/com.miniclip.agar.io_ct_default.xml
/data/data/####/com.miniclip.agar.io_preferences.xml
/data/data/####/commaincgvvvv.
/data/data/####/commaincgvvvv.dex
/data/data/####/commaincgvvvv.dex.flock
/data/data/####/commaincgvvvv.dex.flock (deleted)
/data/data/####/device.json
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fc67113d2c904791_0
/data/data/####/generatefid.lock
/data/data/####/i==9.3.8+000&&2.16.0_1625383300859_dW5pZnlfbG9ncw==;.log
/data/data/####/i==9.3.8+000&&2.16.0_1625383307030_dW5pZnlfbG9ncw==;.log
/data/data/####/i==9.3.8+000&&2.16.0_1625383317790_dW5pZnlfbG9ncw==;.log
/data/data/####/i==9.3.8+000&&2.16.0_1625383325994_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/libacc.so
/data/data/####/libsubstrate.so
/data/data/####/libumeng-spy.so
/data/data/####/metrics_guid
/data/data/####/os.json
/data/data/####/proc_auxv
/data/data/####/report
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s3p43_OIUTIUYT.xml
/data/data/####/s3p43_OIUTIUYT.xml.bak
/data/data/####/sb-2021-06-30-10-34-31.apk
/data/data/####/session.json
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/uuid.xml
/data/data/####/webview_data.lock
/data/data/####/x8_misc.xml
/data/data/####/x8_misc.xml.bak
/data/data/####/z==1.2.0&&2.16.0_1625383291327_emNmZw==;.log

Miscellaneous:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
desede-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial