Android.Triada.6490

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.618.origin

Network activity:

Connects to:

UDP(???) familyc####.insta####.com:443
UDP(???) z####.g####.insta####.com:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) mqtt-####.face####.com:443
TCP(TLS/1.0) familyc####.insta####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) a####.insta####.com:443
TCP(TLS/1.2) familyc####.insta####.com:443

DNS requests:

a####.insta####.com
aist####.insta####.com
app####.insta####.com
b.i.insta####.com
familyc####.insta####.com
h####.insta####.com
i####.me
i.insta####.com
ins####.am
insta####.com
m.face####.com
mqtt-####.face####.com
www.face####.com
www.insta####.com
z####.g####.insta####.com

File system changes:

Creates the following files:

/app_analytics/micro_batch/####/batch-425345-dba448a8-0859-44fc...3.json
/app_analytics/micro_batch/####/batch-425644-e1f29062-a262-43d7...5.json
/app_analytics/micro_batch/####/batch-434927-777f417a-c9ac-40b8...6.json
/app_analytics/micro_batch/####/batch-442666-7c6d82bb-eb29-4db4...7.json
/app_errorreporting/sess__000000001-1778765313385-447d40ff-206a...ap.txt
/app_errorreporting/sess__000000001-1778765313385-447d40ff-206a...op.txt
/app_errorreporting/sess__000000001-1778765313385-447d40ff-206a...orage0
/app_errorreporting/sess__000000001-1778765313385-447d40ff-206a...st.bin
/app_errorreporting/sess__000000001-1778765313385-447d40ff-206a...te.txt
/app_errorreporting/sess_mqtt_000000001-1778765326119-ef1a464f-...ap.txt
/app_errorreporting/sess_mqtt_000000001-1778765326119-ef1a464f-...op.txt
/app_errorreporting/sess_mqtt_000000001-1778765326119-ef1a464f-...st.bin
/app_errorreporting/sess_mqtt_000000001-1778765326119-ef1a464f-...te.txt
/cache/http_responses/journal
/crash_log
/data/data/####/.unpacked
/data/data/####/0256886d-d794-495d-8908-2a1e34cbc173_prop.txt
/data/data/####/0b303420-05b3-40fd-9d86-5124c23e12b2_prop.txt
/data/data/####/1778765325818.dex
/data/data/####/2aefa28c-c023-48ef-9251-7b2899cdefdf_prop.txt
/data/data/####/2af2a16e-ee17-4419-9568-235c3ab8fa1c_prop.txt
/data/data/####/3107
/data/data/####/3307
/data/data/####/383006032
/data/data/####/3b72499f-b6a3-4928-a78e-a5edb374e8cb_prop.txt
/data/data/####/521f7276-85ca-4af3-8bfa-668418dec190_prop.txt
/data/data/####/672298f7-fe35-4311-ab04-fb0842431158_prop.txt
/data/data/####/70cd5f63-011e-4c1c-badb-2d9585152a78_prop.txt
/data/data/####/802b8c53-dffb-420f-ac13-d8ef675b6890_prop.txt
/data/data/####/81423b61-f31e-44de-bec1-7dde7de5b287_prop.txt
/data/data/####/90c7f328-3f7c-4e8a-9f14-95ad7bf7afc6_prop.txt
/data/data/####/AppModules;;PrevDownload.5179918162329564301.tmp
/data/data/####/AuthHeaderPrefs.xml
/data/data/####/DefaultFrscUnpacker.lock
/data/data/####/INSTALLATION
/data/data/####/NOTIFICATION_CHANNELS.xml
/data/data/####/RoutingHeaderPrefs.xml
/data/data/####/a7f7a193-2733-44ee-bfd8-6d44c514c2ed_prop.txt
/data/data/####/a8ec738b-49c1-4f39-9e29-f29c3a42d2f0_prop.txt
/data/data/####/acb52ffa-2029-4854-b371-030e3edbacb2_prop.txt
/data/data/####/acra_criticaldata_store.xml
/data/data/####/analyticsprefs.xml
/data/data/####/apiv3
/data/data/####/armzfjpw
/data/data/####/armzfjpw.cur.prof
/data/data/####/batch-424116-7c6d82bb-eb29-4db4-9a34-e2dc10fc8b66-0.json
/data/data/####/batch-424165-e1f29062-a262-43d7-96c5-84c8d0a44f10-1.json
/data/data/####/batch-425184-dba448a8-0859-44fc-be0c-8a1322877550-2.json
/data/data/####/batch-425624-7c6d82bb-eb29-4db4-9a34-e2dc10fc8b66-4.json
/data/data/####/c98351aa-2ab1-4c5d-b086-370a0ca9d5ad_prop.txt
/data/data/####/config_logging.Api2.sessionless.ratelimiter
/data/data/####/config_logging.Api2Advanced.sessionless.ratelimiter
/data/data/####/config_logging.Api3.sessionless.ratelimiter
/data/data/####/config_logging.DefaultUpdaterSession.sessionles...imiter
/data/data/####/crash_lock
/data/data/####/crash_log
/data/data/####/critical_suppl_background_prop.txt
/data/data/####/critical_suppl_background_prop.txt_tmp
/data/data/####/critical_suppl_foreground_transition_prop.txt_tmp
/data/data/####/critical_suppl_late_startup_prop.txt
/data/data/####/critical_suppl_late_startup_prop.txt_tmp
/data/data/####/d10e6513-0555-4969-9942-d14c623b7bfb_prop.txt
/data/data/####/devprefs.xml
/data/data/####/dns
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_state
/data/data/####/e4329fcd-b467-410b-b2da-526724ec7a2d_prop.txt
/data/data/####/e44a2ca4-4924-4965-ad0f-e5769075c4e9_prop.txt
/data/data/####/f251b9f9-6e60-4fc0-bbf0-5f559941176d_prop.txt
/data/data/####/f67e8235-c44e-468f-b8df-38634c27b1eb_prop.txt
/data/data/####/f7830f6c-0543-4385-8dea-4f080fba27a0_prop.txt
/data/data/####/fe7da8c1-ca8a-4254-825a-756421232059_prop.txt
/data/data/####/first_intent.txt
/data/data/####/ig_device_theme.xml
/data/data/####/ig_memory_manager_dump_prefs.xml
/data/data/####/ig_zero_rating.preferences_pb.tmp
/data/data/####/imagev3
/data/data/####/insta_crash_log
/data/data/####/io.maild.senderxe.xml
/data/data/####/io.maild.senderxe_preferences.xml
/data/data/####/journal
/data/data/####/lacrima.xml
/data/data/####/large_suppl_background_prop.txt
/data/data/####/large_suppl_background_prop.txt_tmp
/data/data/####/large_suppl_late_startup_prop.txt_tmp
/data/data/####/layouts.bin
/data/data/####/layouts.bin.sha256
/data/data/####/libamlftmerged.so
/data/data/####/libarcore_sdk_c.so
/data/data/####/libardmerged.so
/data/data/####/libarfxmerged.so
/data/data/####/libarlink.so
/data/data/####/libbsdiff.so
/data/data/####/libcommonpatchjni.so
/data/data/####/libcompphotomerged.so
/data/data/####/libcoremerged.so
/data/data/####/libctmerged.so
/data/data/####/libdevtools-crashnownative.so
/data/data/####/libdextricks-jit.so
/data/data/####/libearlystartup.so
/data/data/####/libeffectsmerged.so
/data/data/####/libfb_mboost-lite.so
/data/data/####/libfb_mboost.so
/data/data/####/libfbhttpprioritycontext.so
/data/data/####/libglobalrefmonitor.so
/data/data/####/libhardwarebuffer_converter.so
/data/data/####/libheramerged.so
/data/data/####/libhtmltrimmer_jni.so
/data/data/####/libiglu-filter-debug.so
/data/data/####/libkaleidoscope.so
/data/data/####/libmagimerged.so
/data/data/####/libmediamerged.so
/data/data/####/libmediapipeline-iglufilter-detection.so
/data/data/####/libmediapipeline-iglufilter-gpuimageloader.so
/data/data/####/libmediapipeline-iglufilter-textureloader.so
/data/data/####/libmozjpegturbo.so
/data/data/####/liboacr_utils_jni.so
/data/data/####/libonecamera-autoenhance-native-android.so
/data/data/####/libonecamera-iglufilter-graph.so
/data/data/####/libonecamera-lib-libanim.so
/data/data/####/libpapayamerged.so
/data/data/####/libpytorchjnimerged.so
/data/data/####/libpytorchlitejnimerged.so
/data/data/####/librsatimelock.so
/data/data/####/librtc.so
/data/data/####/libscrollmerged.so
/data/data/####/libshaderfetcher.so
/data/data/####/libstartup.so
/data/data/####/libstreamingmerged.so
/data/data/####/libtorchmerged.so
/data/data/####/libunified_image_transcoder_jni.so
/data/data/####/libvoicemerged.so
/data/data/####/libxplat_compphoto_sdk_common_perfStatsComputerAndroid.so
/data/data/####/libxplat_media_image_transcoding_src_jarvis_jar...oid.so
/data/data/####/libxplat_media_image_transcoding_src_quality_me...oid.so
/data/data/####/libxplat_videoinfra_signals_brisque_BrisqueAndroid.so
/data/data/####/libxplat_videoinfra_signals_image_mos_ImageMOSM...oid.so
/data/data/####/mobile_config_device_scoped_test_cache.xml
/data/data/####/ncnvamft_-400328469.apk
/data/data/####/ncnvamft_263125075.apk
/data/data/####/ncnvamft_263125075.apk.cur.prof
/data/data/####/ncnvamft_263125075.vdex
/data/data/####/pre_init_qe.xml
/data/data/####/prev_build_id.txt
/data/data/####/profileInstalled
/data/data/####/rti.mqtt.address.xml
/data/data/####/rti.mqtt.address.xml.bak
/data/data/####/rti.mqtt.analytics.xml
/data/data/####/rti.mqtt.fbns_state.xml
/data/data/####/rti.mqtt.mqtt_radio_active_time.xml
/data/data/####/rti.mqtt.registrations.xml
/data/data/####/state.txt_entity
/data/data/####/uncompressed_default.frsc.checksum
/data/data/####/uncompressed_default.frsc.xz
/data/data/####/unpackLayoutBundle.lock
/data/data/####/uxdata2
/data/data/####/waterfall_log_in.xml
/data/misc/####/primary.prof
/data/user_de/####/com.facebook.secure.switchoff.xml
/files/ncnvamft_-400328469.apk
/insta_crash_log

Miscellaneous:

Appears corrupted in a way typical for malicious files.

Attempts to detect sandbox environment.

Contains hidden alternative main activities.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial