Android.Triada.993

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.248.origin
Android.Triada.309
Android.Triada.373.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) l.ace####.com:80
TCP(HTTP/1.1) yun.tuis####.com:80
TCP(HTTP/1.1) acti####.guav####.cn:80
TCP(HTTP/1.1) img.ace####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) fp-st####.b0.a####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) res.ipi####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 2####.86.5.167:14840
TCP(HTTP/1.1) yun.guav####.cn.####.com:80
TCP(HTTP/1.1) yun.d####.com:80
TCP(TLS/1.0) fp.ton####.net:443
TCP(TLS/1.0) en####.lveha####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) adser####.go####.com:443

Запросы DNS:

a####.u####.com
acti####.guav####.cn
adser####.go####.com
adser####.go####.nl
and####.b####.qq.com
c####.mm####.com
c.c####.com
en####.lveha####.com
fp.fraudme####.cn
fp.ton####.net
img.ace####.com
int.d####.s####.####.cn
l.ace####.com
loc.map.b####.com
pag####.googles####.com
res.ipi####.com
s4.c####.com
st####.fraudme####.cn
yun.d####.com
yun.guav####.cn
yun.tuis####.com
z11.c####.com

Запросы HTTP GET:

acti####.guav####.cn/activity/getAllSkin?timestamp=####&couponSkinId=###...
acti####.guav####.cn/activity/getReturnPage?slotId=####&id=####&login=##...
acti####.guav####.cn/activity/index?id=####&slotId=####&login=####&appKe...
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####&web_id=####
fp-st####.b0.a####.com/fm.js?ver=####&t=####
gm.mm####.com/9.gif?abc=####&rnd=####
img.ace####.com/ando-res/ads/20/28/accd2f94-5942-45f2-b3e6-dc96314e5d3e/...
img.ace####.com/ando-res/ads/3/6/3aa978c3-e6f5-48f3-8b67-9094d5ddf573/57...
img.ace####.com/ando-res/m/5Rlwv1la6TsrR2g3NB13ZwiHPBL12Klc86S1ING23KedR...
l.ace####.com/ando/im/mn?k=####&d=####&m=####
l.ace####.com/ando/im/mn?k=####&d=####&t=####&m=####
pag####.googles####.com/pagead/js/adsbygoogle.js
res.ipi####.com/adsw/rd/mm1095.html
yun.d####.com/h5-mami/activity/turnCircle/image/butt.png?x-oss-process=#...
yun.d####.com/h5-mami/activity/turnCircle/image/butt1.png?x-oss-process=...
yun.d####.com/h5-mami/activity/turnCircle/image/butt2.png?x-oss-process=...
yun.guav####.cn.####.com/h5-mami/activity/turnCircle/5.0/index_201804021...
yun.guav####.cn.####.com/h5-mami/activity/turnCircle/5.0/index_201804091...
yun.guav####.cn.####.com/h5-mami/activity/turnCircle/image/point.png?x-o...
yun.guav####.cn.####.com/h5-mami/activity/turnCircle/image/prize.png?x-o...
yun.guav####.cn.####.com/h5-mami/activity/turnCircle/image/rule.png?x-os...
yun.guav####.cn.####.com/h5-mami/common/actBase_201802231028.css
yun.guav####.cn.####.com/h5-mami/common/actBase_201804261114.js
yun.guav####.cn.####.com/h5-mami/common/common_201802011416.css
yun.guav####.cn.####.com/h5-mami/common/common_201804251346.js
yun.guav####.cn.####.com/h5-mami/h5-discern-simulator-1.0.17.min.js
yun.guav####.cn.####.com/h5-mami/pluginBase/common_201804091110.js
yun.guav####.cn.####.com/mami-media/img/4vag2tnhps.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/88nhwz2abp.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/cdjnfiybf1.jpg?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/fm4ynesopy.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/j5dp0x5udz.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/nhguq24e70.jpg?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/odaesenwog.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/sogiv8zsom.png?x-oss-process=####
yun.guav####.cn.####.com/mami-media/img/swdwvm06ds.png?x-oss-process=####
yun.guav####.cn.####.com/tuia/h5-mami/7604ca54a680e46ce50d.vendors.js
yun.tuis####.com/h5-mami/QBModal/index_201801031421.css
yun.tuis####.com/h5-mami/QBModal/index_201801171227.js
yun.tuis####.com/h5-mami/activity/common/bg-rule2.png
yun.tuis####.com/h5-mami/activity/hand.png
yun.tuis####.com/h5-mami/alipayModal/index_201801031414.css
yun.tuis####.com/h5-mami/alipayModal/index_201803061440.js
yun.tuis####.com/h5-mami/biiModal/index_201801242113.css
yun.tuis####.com/h5-mami/biiModal/index_201801242113.js
yun.tuis####.com/h5-mami/couponPrize/1.22/index_201804031040.css
yun.tuis####.com/h5-mami/couponPrize/1.22/index_201804161856.js
yun.tuis####.com/h5-mami/couponPrize/credit.0/bg-light.png
yun.tuis####.com/h5-mami/couponPrize/credit.0/index_201804261138.css
yun.tuis####.com/h5-mami/couponPrize/credit.0/index_201805081422.js
yun.tuis####.com/h5-mami/couponPrize/edu.0/bg-light.png
yun.tuis####.com/h5-mami/couponPrize/edu.0/edu-bg.png
yun.tuis####.com/h5-mami/couponPrize/edu.0/edu-btn.png
yun.tuis####.com/h5-mami/couponPrize/edu.0/edu-img.png
yun.tuis####.com/h5-mami/couponPrize/edu.0/index_201804251157.js
yun.tuis####.com/h5-mami/couponPrize/edu.0/index_201804261136.css
yun.tuis####.com/h5-mami/couponPrize/insurance.0/index_201804251158.js
yun.tuis####.com/h5-mami/couponPrize/insurance.0/index_201804261139.css
yun.tuis####.com/h5-mami/couponPrize/insurance.0/insurance-bg.png
yun.tuis####.com/h5-mami/couponPrize/insurance.0/insurance-btn-active.png
yun.tuis####.com/h5-mami/couponPrize/insurance.0/insurance-btn.png
yun.tuis####.com/h5-mami/couponPrize/insurance.0/insurance-cd.png
yun.tuis####.com/h5-mami/googleModal/red/index_201803121122.css
yun.tuis####.com/h5-mami/googleModal/red/index_201803121122.js
yun.tuis####.com/h5-mami/objectModal/index_201801031418.css
yun.tuis####.com/h5-mami/objectModal/index_201801092025.js
yun.tuis####.com/h5-mami/recommend/index_201801111255.css
yun.tuis####.com/h5-mami/recommend/index_201801111255.js
yun.tuis####.com/h5-mami/thanksPrize/index_201801031425.css
yun.tuis####.com/h5-mami/thanksPrize/index_201803121444.js
yun.tuis####.com/h5-mami/virtualModal/index_201803221420.css
yun.tuis####.com/h5-mami/virtualModal/index_201803221420.js
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

Запросы HTTP POST:

a####.u####.com/app_logs
acti####.guav####.cn/activity/ajaxOptions
acti####.guav####.cn/activity/doJoin
acti####.guav####.cn/activity/result
acti####.guav####.cn/pluginTools/responsiveIndex
acti####.guav####.cn/pluginTools/timingIndex
acti####.guav####.cn/statistics/activityPagePerf?type=####&skinName=####...
acti####.guav####.cn/token/getToken
and####.b####.qq.com/rqd/async
int.d####.s####.####.cn/iplookup/iplookup.php
l.ace####.com/ando/v2/ap?app_id=####&r=####
l.ace####.com/ando/v2/lv?app_id=####&r=####
l.ace####.com/ando/v2/qa?app_id=####&r=####
loc.map.b####.com/sdk.php

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-fxAx7Utk5uTtsHb
/data/data/####/.imprint
/data/data/####/0SoB3VnT6S6UaK9c5HDN915VG4_e_9br-6CwUg==.new
/data/data/####/1ZIrTJwNMmP8EbzElIRvdQ==
/data/data/####/203a4ec1-ec1c-4c7f-be9d-952c82851abc.pic.temp
/data/data/####/3rTjIH353kW55H8Lg8xDDNEoQ6W9HoZs.new
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_RBFlTTmHr-E=-journal
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_YAWstwnGl_ShbG...ournal
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_YAWstwnGl_ShbG...ukzTE=
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF__g_X8LCC_33ozWMg
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF__g_X8LCC_33ozWMg-journal
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_eVbqh6kw3aNnrS...ournal
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_eVbqh6kw3aNnrSbMrqsROA==
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_uXlTnH6sZoGDNv...ournal
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_uXlTnH6sZoGDNvqICe6cfQ==
/data/data/####/3vSnGC3IMH1iqqcad6Lvno7qYqb-zUUF_webview.db-journal
/data/data/####/3y2kDLOc-n4ktwlnUaxmYYweSCSF8EwY.new
/data/data/####/4a0d15f0-1e5d-4f8a-b919-d5f457a28d62.pic.temp
/data/data/####/5B-xdWSmvNUSdcTR_B-jODTLcZ4=.new
/data/data/####/5NUeLzAyNLpyBH1KPM_iMdJyq8ssm0WQp89v3w==.new
/data/data/####/7b_uwdXtJp_hM9hoy_fgRo171-lYw3CF.new
/data/data/####/92LU81T35EnzOgH2kRjoOxo3g93UUkyO.new
/data/data/####/Alvin2.xml
/data/data/####/ByVD2mKkSqWRsAJs0GjR3IZb0cfxuXrSYjDoqnwd8DU=.new
/data/data/####/CitiGame.ini.xml
/data/data/####/ContextData.xml
/data/data/####/G8S87hzWBMnV2Ip-IWHFI78ArVaRFxPQ.new
/data/data/####/IcYtH5FxciEnN1HgbDm5aifmdUc=
/data/data/####/MBhhkYMWCuyBHssh53QC1yN8i0A=.temp
/data/data/####/O5qIda2C8zqFGeJoIDpGsA==
/data/data/####/VTaz1CyXpvRqv5GeR8OO9UB2f_VJZNvW.new
/data/data/####/VmoFsAiC1WW-oa3KnbQIGz5Azn4oQMCuhdFM-Eg5TIo=.new
/data/data/####/W1GZBHrZ_pOy_yz1xLwQmvecWwk2cOUe.new
/data/data/####/WPnVRtLD7O-CeQ29CVsCumJrWJo=.new
/data/data/####/ZSENZre6ay8Cbz3Q.zip
/data/data/####/bVpzr9olN0p387IRZjajJApR6yY=.new
/data/data/####/bb44B8mYRP_iTnjLBFZN50dDnedrSyEJTRCFD1zCT5s=.new
/data/data/####/bugly_db_legu-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e5MLBeQZgOH01BQLoEa7tg==.new
/data/data/####/eUSHkU-LBT6iuud4L_7MMMBKqgY2rB41jYaJJjWF-pE=.new
/data/data/####/eugK0a_DFsxB92nV0SGS8fFr4-GBxBftIRakCQ==.new
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fCup0sndObYXqFs1zZlM6zGMqIU=.new
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/gVkRpVyUKTnBpDi6nydqdWJ6h2c=.new
/data/data/####/gamedata.xml
/data/data/####/ihY2c-3AwJ-AnWX5bsP6XWyMzGbWsvDs.new
/data/data/####/index
/data/data/####/jz0dMC26-050MPlvZGPMpA==.new
/data/data/####/l5x5cbWRR3N8kJIy3KLveQ==.new
/data/data/####/lW0ofYAw2O6T-SeRQUk8hMzKsfw=.temp
/data/data/####/libshella-2.8.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/qAwrNW7GQ5fb9wFgMC4krujxD68=.new
/data/data/####/qyARErDFc6ZOiypEeNZdt5ha5CsAH5zA.new
/data/data/####/rdata_comzsfzbxzzl.new
/data/data/####/runner_info.prop.new
/data/data/####/security_info
/data/data/####/su33oxfdpQ48N3jf
/data/data/####/tefubq_f.zip
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yu52flTumhj_DYJu.new
/data/media/####/.uunique.new
/data/media/####/46d41845-7368-4464-9647-8a04e8e5de4e.res
/data/media/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=
/data/media/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
/data/media/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
/data/media/####/MP8MtaBuguN9jnuSwtN1kQ==
/data/media/####/c24316c5-2ae5-425e-acd3-6c010716a86a.res
/data/media/####/e49b4663-df62-4435-98cf-a3f3fc8c2896.res
/data/media/####/r_pkDgN4OhnkSa0D
/data/media/####/sysid.dat

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/code-3599923/-fxAx7Utk5uTtsHb -p <Package> -c com.zsfz.bxzzl.vrlba.pv.pv.qf.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh <Package Folder>/code-3599923/-fxAx7Utk5uTtsHb -p <Package> -c com.zsfz.bxzzl.vrlba.pv.pv.qf.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung

Загружает динамические библиотеки:

Bugly
cocos2dcpp
libnfix
libshella-2.8
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней