Android.Triada.698

Техническая информация

Вредоносные функции:

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) tcms-a####.wan####.ta####.com:443
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) c.d####.mob.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) s.haowa####.com:8900
TCP(HTTP/1.1) haowa####.oss.aliy####.com:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) tcms-op####.wan####.ta####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) notecon####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) w####.ta####.com:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(SSL/3.0) a####.a####.m.####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) s.haowa####.com:8008
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP ope####.m.ta####.com:443
TCP umengj####.m.ta####.com:80
TCP 2####.204.101.107:80
TCP zhizhi####.com:5222

Запросы DNS:

_ja####._####.zhizhi####.com
_xmpp-c####._####.zhizhi####.com
a####.exc.mob.com
a####.m.ta####.com
a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
c.d####.mob.com
haowa####.oss.aliy####.com
haowa####.qin####.com
hotp####.wan####.ta####.com
m.d####.mob.com
msg.umengc####.com
notecon####.oss-cn-####.aliy####.com
s.haowa####.com
tcms-a####.wan####.ta####.com
tcms-op####.wan####.ta####.com
umen####.m.ta####.com
umengj####.m.ta####.com
w####.ta####.com
zhizhi####.com

Запросы HTTP GET:

a####.m.ta####.com/rest/abtest?logid=####&ak=####&av=####&c=####&v=####&...
haowa####.oss.aliy####.com/04232230f8ed4c034a9ac6ea5a25ea50
haowa####.oss.aliy####.com/082696ebee960df30b666fb0a79a89ce
haowa####.oss.aliy####.com/0aab7c6b1731ff508f75460ceb05df00
haowa####.oss.aliy####.com/229b637e96adfa3680fcbdcd229aef1b
haowa####.oss.aliy####.com/3362facf802b2625ed20793c0a33d36b
haowa####.oss.aliy####.com/66cfc7feef7db50622d306f7c058650c
haowa####.oss.aliy####.com/a795a88c45d030ae767b30b6b80d65fd
haowa####.oss.aliy####.com/a8bb96869098240bd841035c3c95ad55
haowa####.oss.aliy####.com/c9093a402b097a39e120d0b18df2c3e4
haowa####.oss.aliy####.com/dc4817a304d0a7f15a086f17f01c9d69
haowa####.oss.aliy####.com/de64f88100309a89a52d804003224e23
haowa####.oss.aliy####.com/f695eb277805a164d2500e29c521814f
haowa####.oss.aliy####.com/f7075dee65fec6e2dc9b7693521721d7
haowa####.oss.aliy####.com/fd506bfa5cdebd7489fc22a08f822fc1
m.d####.mob.com/v3/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
notecon####.oss-cn-####.aliy####.com/7842337
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreClassInfo?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetAppreciation?jid=####&acti...
s.haowa####.com:8900/RegisterDemo1/servlet/GetComList?noteid=####&visid=...
s.haowa####.com:8900/RegisterDemo1/servlet/GetInvcode?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/GetNewsList?jid=####&newsid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetNoteContent?noteid=####&ji...
s.haowa####.com:8900/RegisterDemo1/servlet/GetNoteInfo?noteid=####&jid=#...
s.haowa####.com:8900/RegisterDemo1/servlet/GetRecomUser?page=####&subtyp...
s.haowa####.com:8900/RegisterDemo1/servlet/GetUserInfo?jid=####&vsjid=####
s.haowa####.com:8900/RegisterDemo1/servlet/SyncSp?jid=####
s.haowa####.com:8900/RegisterDemo1/servlet/UpLoadUmToken?jid=####&passwd...
tcms-a####.wan####.ta####.com:443/imlogingw/tcp60login?devid=####&ver=####
tcms-op####.wan####.ta####.com/getapprule?appkey=####&appId=####
w####.q####.dn.####.com/093af112cad9f831a67032f2869d5217
w####.q####.dn.####.com/0d8d8991b04950b07ddde6dc32aa3bad
w####.q####.dn.####.com/2018-02-09-07-34-01e3z22g7s-0.png
w####.q####.dn.####.com/2018-02-26-20-53-05aa3w3k2k-0.png
w####.q####.dn.####.com/3227eef48f0a1236b52dff35355b48f6
w####.q####.dn.####.com/3b4833f887c38d85e5a48e4d6911ee3b
w####.q####.dn.####.com/4071a2725b1bbcc66ec2c55652bbb605
w####.q####.dn.####.com/4918b5208c6a92492b3f589a2ce78b78
w####.q####.dn.####.com/553c9c04f17b476b23c37395a7415be0
w####.q####.dn.####.com/58089e31c090a413928eeab1e8efd6b0
w####.q####.dn.####.com/5cea5b2c877dadebbb30738368c4bfe0
w####.q####.dn.####.com/658f8a0f6eea552f884729892f466c81
w####.q####.dn.####.com/8f67f1a2385a283032cb7abef745162f
w####.q####.dn.####.com/933bb404ab661083c4546ebafcfb6a06
w####.q####.dn.####.com/99b9d0c773077e26b05ddc4248d97723
w####.q####.dn.####.com/baba4473b228a2821dba80a40270af62
w####.q####.dn.####.com/ea788c20e40911400243ec518b1252fd
w####.q####.dn.####.com/ff5918c6624d948188d64af942283a09

Запросы HTTP POST:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=#...
a####.exc.mob.com/errconf
a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
c.d####.mob.com/v2/cdata
msg.umengc####.com/register
w####.ta####.com/api/user/getUser.json

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_KeyStore/KeyStore.bks
<Package Folder>/cache/####/18554ec90b32e80dfb8dbe523ce13f25.0.tmp
<Package Folder>/cache/####/18554ec90b32e80dfb8dbe523ce13f25.1.tmp
<Package Folder>/cache/####/19b5f3d69c643c76b4613844a96c4941.0.tmp
<Package Folder>/cache/####/19b5f3d69c643c76b4613844a96c4941.1.tmp
<Package Folder>/cache/####/1CERnL0fGyWKgL-ggKDbI7m1XZg.1810305733.tmp
<Package Folder>/cache/####/1a9034fbd0dbc651771998bc11ae2303.0.tmp
<Package Folder>/cache/####/1a9034fbd0dbc651771998bc11ae2303.1.tmp
<Package Folder>/cache/####/1c46a7a1d32f5ef5c7aadee6347d19b6.0.tmp
<Package Folder>/cache/####/1c46a7a1d32f5ef5c7aadee6347d19b6.1.tmp
<Package Folder>/cache/####/24f6c5c4e349523e2e83f4f9558b464b.0.tmp
<Package Folder>/cache/####/24f6c5c4e349523e2e83f4f9558b464b.1.tmp
<Package Folder>/cache/####/28a91d7e33fafc65f43451ef6f12927b.0.tmp
<Package Folder>/cache/####/28a91d7e33fafc65f43451ef6f12927b.1.tmp
<Package Folder>/cache/####/2vcZ_5AKoiQ3Vpys8kA_nvy8wDM.531384020.tmp
<Package Folder>/cache/####/34e6b99b2fa91e2e47083bd399f32ec4.0.tmp
<Package Folder>/cache/####/34e6b99b2fa91e2e47083bd399f32ec4.1.tmp
<Package Folder>/cache/####/35cc4063874cc8c107c5699349d33d08.0.tmp
<Package Folder>/cache/####/35cc4063874cc8c107c5699349d33d08.1.tmp
<Package Folder>/cache/####/49dba216aef36e245aa2ef9514db9778.0.tmp
<Package Folder>/cache/####/49dba216aef36e245aa2ef9514db9778.1.tmp
<Package Folder>/cache/####/5fdd86e09afbb6720d0a2d0dd0f24b33.0.tmp
<Package Folder>/cache/####/5fdd86e09afbb6720d0a2d0dd0f24b33.1.tmp
<Package Folder>/cache/####/5niJ75acYi71ihP-nH6KmLzKVsI.1119474675.tmp
<Package Folder>/cache/####/60HVERDbJyy3j8qEd7IaiItvgts.-500711733.tmp
<Package Folder>/cache/####/68e386bb822684444935f654564524b1.0.tmp
<Package Folder>/cache/####/68e386bb822684444935f654564524b1.1.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.0.tmp
<Package Folder>/cache/####/75faacc6d47ddb0a6f16f0a452637368.1.tmp
<Package Folder>/cache/####/8bd53a4259b0adfbfcab7dbc50f173a8.0.tmp
<Package Folder>/cache/####/8bd53a4259b0adfbfcab7dbc50f173a8.1.tmp
<Package Folder>/cache/####/8e7973766e69ae8d0489abe693e59bed.0.tmp
<Package Folder>/cache/####/8e7973766e69ae8d0489abe693e59bed.1.tmp
<Package Folder>/cache/####/8mFIIzLXij-i8-ovDYbsM4shQLM.-206392116.tmp
<Package Folder>/cache/####/<Package>_2081
<Package Folder>/cache/####/<Package>_TcmsService_2133
<Package Folder>/cache/####/BaB4ST7Q762WsCejODVerfIuw7Q.-1301297638.tmp
<Package Folder>/cache/####/BfUZiN_QGn4F_UOp8amR6ouhVU4.883762425.tmp
<Package Folder>/cache/####/EKI04E3ihgxwW0pHLGalzdjCG4U.-334798391.tmp
<Package Folder>/cache/####/G0tAUQ_CqWusi3hCPIkbDr8tzSg.-754459472.tmp
<Package Folder>/cache/####/Gyu2aBhJMellPOShcb91mn3TBBA.-1527203049.tmp
<Package Folder>/cache/####/HOgLxVkyKG2PUpHG9im2_kwUZxg.914347202.tmp
<Package Folder>/cache/####/IS9E7JNrv8bM8uhNOmzqy-tF70A.-966300559.tmp
<Package Folder>/cache/####/JkGu571gwrxce6kLrAM_RIf7T5M.-1471535417.tmp
<Package Folder>/cache/####/KObQ3mRqLmujNrqfAJt6XgIrxBI.930037636.tmp
<Package Folder>/cache/####/MSEmBNsLpUEjCiQHxcsaaDwpTao.67593810.tmp
<Package Folder>/cache/####/R2xBLHsFnocH465L9OwF7lAi-hU.1531973559.tmp
<Package Folder>/cache/####/RSeWusn2pQrhhGxjKCGUoXIJO58.1297130161.tmp
<Package Folder>/cache/####/Tz469I6SihhKMykqrrD2bqSRUXs.-207804788.tmp
<Package Folder>/cache/####/Vof0Mel6Yz_Sg8F3imhvbwuZiAk.172852627.tmp
<Package Folder>/cache/####/_EEcIXt6fIUgfbqNC9rPu_-E0u8.1488211132.tmp
<Package Folder>/cache/####/_RtnIRPhYqGbx8MT2zYxNU-J_HE.1274998447.tmp
<Package Folder>/cache/####/a346d4a8ab350aa12c4d05ba051dc431.0.tmp
<Package Folder>/cache/####/a346d4a8ab350aa12c4d05ba051dc431.1.tmp
<Package Folder>/cache/####/a4d49ec6ff147538a364f8df1847baea.0.tmp
<Package Folder>/cache/####/a4d49ec6ff147538a364f8df1847baea.1.tmp
<Package Folder>/cache/####/add6d91436d59c72f736af750946c5d5.0.tmp
<Package Folder>/cache/####/add6d91436d59c72f736af750946c5d5.1.tmp
<Package Folder>/cache/####/b754c3a61b7a094d38b2f4f0355b1b2f.0.tmp
<Package Folder>/cache/####/b754c3a61b7a094d38b2f4f0355b1b2f.1.tmp
<Package Folder>/cache/####/b8952fc5e69cccf3d035a7c200d74bb6.0.tmp
<Package Folder>/cache/####/b8952fc5e69cccf3d035a7c200d74bb6.1.tmp
<Package Folder>/cache/####/bdb221aa4cc24fa0de81850e807a0f82.0.tmp
<Package Folder>/cache/####/bdb221aa4cc24fa0de81850e807a0f82.1.tmp
<Package Folder>/cache/####/bdf7a82d5b550854a8af4f14845e5839.0.tmp
<Package Folder>/cache/####/bdf7a82d5b550854a8af4f14845e5839.1.tmp
<Package Folder>/cache/####/c2173396032c121ff38769d50f6c7cbd.0.tmp
<Package Folder>/cache/####/c2173396032c121ff38769d50f6c7cbd.1.tmp
<Package Folder>/cache/####/cab55af510c8e9fdae7e60210b2860db.0.tmp
<Package Folder>/cache/####/cab55af510c8e9fdae7e60210b2860db.1.tmp
<Package Folder>/cache/####/cnX2vPBHF5oyB8QYVQpqskQ1KE8.1982757040.tmp
<Package Folder>/cache/####/d5fd96096a28e138478863d4e90d4352.0.tmp
<Package Folder>/cache/####/d5fd96096a28e138478863d4e90d4352.1.tmp
<Package Folder>/cache/####/dfdc8b3b9323580c78827189cc3eb1b4.0.tmp
<Package Folder>/cache/####/dfdc8b3b9323580c78827189cc3eb1b4.1.tmp
<Package Folder>/cache/####/doRBKN5j-m_HMu0nb_vNaefHSRQ.-940421678.tmp
<Package Folder>/cache/####/eae1e00871ba0a2d753f7973c242ff82.0.tmp
<Package Folder>/cache/####/eae1e00871ba0a2d753f7973c242ff82.1.tmp
<Package Folder>/cache/####/f10cd0851237dad1e5ee95774117775f.0.tmp
<Package Folder>/cache/####/f10cd0851237dad1e5ee95774117775f.1.tmp
<Package Folder>/cache/####/f2a13659b22e8a1bfb21d8f0185a81f7.0.tmp
<Package Folder>/cache/####/f2a13659b22e8a1bfb21d8f0185a81f7.1.tmp
<Package Folder>/cache/####/f7955841a58c4822631684a95df785e2.0.tmp
<Package Folder>/cache/####/f7955841a58c4822631684a95df785e2.1.tmp
<Package Folder>/cache/####/gX7fvFHUGe2jnugn8Llj1fgAa98.-1645796451.tmp
<Package Folder>/cache/####/gfvXnvdTBTpn46tJziDKN5mM0K4.1338234767.tmp
<Package Folder>/cache/####/iZ1BRVQqzvyrzFnvWDdiq8A0Qew.957128155.tmp
<Package Folder>/cache/####/ixCj1Np-6xceL95BdVTI0O4dp3U.-451186311.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/####/meRjMCGs6hHOZTtMVOoHEWff2Lw.-384769256.tmp
<Package Folder>/cache/####/pb20sdWjuq-NFE6lIrQkK4gLSC8.-462347867.tmp
<Package Folder>/cache/####/v49NZz1NDdCN-y72xxNSPVabGfE.-458632253.tmp
<Package Folder>/cache/####/vg1k3weUxjbFxg0TfDyZQUVIzps.1295286933.tmp
<Package Folder>/cache/####/xX6R7j4ZBRR1wwGPCjdv84y0VLc.-329458551.tmp
<Package Folder>/databases/6bb166f1bcca9075a67ce9c82866bef6-journal
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/ThrowalbeLog.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/hmdb
<Package Folder>/databases/hmdb-journal
<Package Folder>/databases/logdb.db
<Package Folder>/databases/logdb.db-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/paintgame.db
<Package Folder>/databases/paintgame.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/eudemon
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/1d2b904cbeadfb72ed9546111a231c85.0
<Package Folder>/files/####/24c110e1f76093b35c3c2df1927aab79.0
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/.imprint
<Package Folder>/files/.lock
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/exid.dat
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ACCS_BINDumeng;52a0242156240b5b4a0104f9.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf-818791854.xml
<Package Folder>/shared_prefs/UTMCLog-818791854.xml
<Package Folder>/shared_prefs/channel_pre.xml
<Package Folder>/shared_prefs/cn_feng_skin_pref.xml
<Package Folder>/shared_prefs/mob_commons_1.xml
<Package Folder>/shared_prefs/mob_sdk_exception_1.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/tcms_setting_sp.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/ywAccount.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.bar
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/.serveruuid
<SD-Card>/<Package>/####/2_20171116_r
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/b23e918ad1f949d4a0d3da2a32a48527
<SD-Card>/Android/####/deviceToken
<SD-Card>/Mob/####/.al
<SD-Card>/Mob/####/.dh-journal
<SD-Card>/Mob/####/.dhlock
<SD-Card>/Mob/####/.dic_lock
<SD-Card>/Mob/####/.duid
<SD-Card>/Mob/####/.globalLock
<SD-Card>/Mob/####/.nulal
<SD-Card>/Mob/####/.nulplt
<SD-Card>/Mob/####/.pkg_lock
<SD-Card>/Mob/####/.plst
<SD-Card>/Mob/####/.rcTag
<SD-Card>/Mob/####/.rc_lock
<SD-Card>/amap/####/1510835681797.db
<SD-Card>/amap/####/1510835683682.db
<SD-Card>/amap/####/1510835692315.db
<SD-Card>/amap/####/1510835707729.db
<SD-Card>/amap/####/alsn20170807.db
<SD-Card>/amap/####/alsn20170807.db-journal
<SD-Card>/huaba/####/7842337.du
<SD-Card>/huaba/####/8f67f1a2385a283032cb7abef745162f

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:52a0242156240b5b4a0104f9","utdid":"Wg2F36Jjyv4DAGdzx1HukVBg","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
app_process /system/bin com.android.commands.pm.Pm list packages
cat /proc/cpuinfo | grep Serial
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop
getprop ro.product.cpu.abi
grep -E -v root|shell|system
ls -l /system/xbin/su
pm list packages
sh
top -d 0 -n 1

Загружает динамические библиотеки:

fb_jpegturbo
imagepipeline
inet.2.0
libjiagu
neh
securitysdk-3.1
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
RSA-ECB-PKCS1Padding
RSA-NONE-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней