Android.Triada.3324

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.751.origin
Android.Mobifun.15.origin
Android.RemoteCode.178.origin
Android.Triada.417.origin
Android.Triada.440.origin
Android.Xiny.4018
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 13.2####.16.115:8081
TCP(HTTP/1.1) log.koapk####.com:80
TCP(HTTP/1.1) 1####.104.219.210:80
TCP(HTTP/1.1) bg1.haiqi####.top:8080
TCP(HTTP/1.1) n####.6e####.com:12089
TCP(HTTP/1.1) im####.google####.com:80
TCP(HTTP/1.1) www.91car####.com:80
TCP(HTTP/1.1) n####.6e####.com:12090
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) p####.9b####.com:12089
TCP(HTTP/1.1) y####.k8####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) n####.6e####.com:12086
TCP(HTTP/1.1) 4####.79.5.12:80
TCP(HTTP/1.1) ggg.koapk####.com:80
TCP(HTTP/1.1) pic.a####.com:80
TCP(HTTP/1.1) idv####.qini####.com:80
TCP(TLS/1.0) api.s####.1####.com:443
TCP(TLS/1.0) s0.2####.net:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) a####.cloudf####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) amp.cloudf####.com:443

Запросы DNS:

a####.cloudf####.com
adser####.go####.com
adser####.go####.nl
amp.cloudf####.com
api.unm####.u17888####.com
bg.haiqi####.top
bg1.haiqi####.top
ggg.koapk####.com
googl####.g.doublec####.net
h####.b####.com
im####.google####.com
l.a####.com
log.koapk####.com
n####.6e####.com
p####.9b####.com
p7b3l####.s####.gdi####.com
pag####.googles####.com
pi899####.s####.gdi####.com
pic.a####.com
s####.haiqi####.top
s0.2####.net
www.91car####.com
www.google-####.com
www.googlet####.com
www.googlet####.com
www.koapk####.com
y####.k8####.com
zj####.4v####.com

Запросы HTTP GET:

bg1.haiqi####.top:8080/ads/getAd/zhanqq
bg1.haiqi####.top:8080/ads/getJarVersion/zhanqq/24/cn
bg1.haiqi####.top:8080/ads/getJarVersion/zhanqq/43/cn
idv####.qini####.com/ad01.png
idv####.qini####.com/path_hw_qc_update16.dat
im####.google####.com/js/core/bridge3.286.0_en.html
im####.google####.com/js/sdkloader/ima3.js
pag####.googles####.com/pagead/gen_204?error=####&vis=####&lid=####&sdkv...
pag####.googles####.com/pagead/gen_204?request_type=####&admob=####&lid=...
pag####.googles####.com/pagead/gen_204?rt=####&ec=####&lid=####&sdkv=###...
pag####.googles####.com/pagead/gen_204?rt=####&lid=####&sdkv=####&e=####...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20190313/r20190131/show_ads_impl.js
pic.a####.com/img/icon_87171.png
www.91car####.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decod...
www.91car####.com/css/games.css
www.91car####.com/favicon.ico
www.91car####.com/games/motoRider/600x253.png
www.91car####.com/games/motoRider/?key=####&fields=####
www.91car####.com/games/motoRider/firebase.js
www.91car####.com/games/motoRider/gameapi/3df41947-b71e-4659-b3ae-c1afe0...
www.91car####.com/games/motoRider/gameapi/assets/0.2-6743d993/css/play.css
www.91car####.com/games/motoRider/gameapi/assets/0.2-6743d993/js/gameapi...
www.91car####.com/games/motoRider/gameapi/v1.js?e=####
www.91car####.com/games/motoRider/images/bike0.png
www.91car####.com/games/motoRider/images/bike1.png
www.91car####.com/games/motoRider/images/bike2.png
www.91car####.com/games/motoRider/images/bike3.png
www.91car####.com/games/motoRider/images/bike4.png
www.91car####.com/games/motoRider/images/bike5.png
www.91car####.com/games/motoRider/images/bike6.png
www.91car####.com/games/motoRider/images/bike7.png
www.91car####.com/games/motoRider/images/bike8.png
www.91car####.com/games/motoRider/images/calendarNumbers_13x19.png
www.91car####.com/games/motoRider/images/car0_383x165.png
www.91car####.com/games/motoRider/images/car1_383x165.png
www.91car####.com/games/motoRider/images/car2_392x130.png
www.91car####.com/games/motoRider/images/car3_392x130.png
www.91car####.com/games/motoRider/images/coin2_88x125.png
www.91car####.com/games/motoRider/images/coin_89x126.png
www.91car####.com/games/motoRider/images/crash.png
www.91car####.com/games/motoRider/images/flare.png
www.91car####.com/games/motoRider/images/garageBg.jpg
www.91car####.com/games/motoRider/images/hudElements.png
www.91car####.com/games/motoRider/images/loadSpinner.png
www.91car####.com/games/motoRider/images/loader.png
www.91car####.com/games/motoRider/images/map.jpg
www.91car####.com/games/motoRider/images/numbers_41x47.png
www.91car####.com/games/motoRider/images/road0.jpg
www.91car####.com/games/motoRider/images/road1.jpg
www.91car####.com/games/motoRider/images/road2.jpg
www.91car####.com/games/motoRider/images/road3.jpg
www.91car####.com/games/motoRider/images/road4.jpg
www.91car####.com/games/motoRider/images/scenery.png
www.91car####.com/games/motoRider/images/sky0.png
www.91car####.com/games/motoRider/images/sky1.png
www.91car####.com/games/motoRider/images/sky2.png
www.91car####.com/games/motoRider/images/sky3.png
www.91car####.com/games/motoRider/images/sky4.png
www.91car####.com/games/motoRider/images/splashLogo.png
www.91car####.com/games/motoRider/images/sun.png
www.91car####.com/games/motoRider/images/titleBg.jpg
www.91car####.com/games/motoRider/images/truck0_472x168.png
www.91car####.com/games/motoRider/images/truck1_551x219.png
www.91car####.com/games/motoRider/images/uiButs.png
www.91car####.com/games/motoRider/images/uiElements.png
www.91car####.com/games/motoRider/images/whoosh.png
www.91car####.com/games/motoRider/index.html
www.91car####.com/games/motoRider/js/all.js
www.91car####.com/images/100balls.jpg
www.91car####.com/images/CandyCrushBlockSaga.jpg
www.91car####.com/images/CandyRain.jpg
www.91car####.com/images/GunFightCrimeCity.jpg
www.91car####.com/images/GunShoot.jpg
www.91car####.com/images/TempleRunBunny.jpg
www.91car####.com/images/angrybearrun.jpg
www.91car####.com/images/armyshoot.jpg
www.91car####.com/images/awefont/home-64.png
www.91car####.com/images/baseBall3D.jpg
www.91car####.com/images/bubblepop.jpg
www.91car####.com/images/cityracing.jpg
www.91car####.com/images/fruitcut.jpg
www.91car####.com/images/ht5game.png
www.91car####.com/images/kisshotgirl.jpg
www.91car####.com/images/motoRider.jpg
www.91car####.com/images/rollball.jpg
www.91car####.com/images/shootball.jpg
www.91car####.com/js/gamen_function_v2.js
www.91car####.com/js/jquery.1.8.2.min.js
www.91car####.com/js/jquery.min.js
www.91car####.com/js/owl.carousel.js
www.91car####.com/js/style.js
www.91car####.com/musicgame18/frame/gframe.html?gId=####&cId=####
www.91car####.com/musicgame18/frame/loading.gif
www.91car####.com/musicgame18/frame/loading.js
www.91car####.com/musicgame18/frame/spaceGad.js
www.91car####.com/musicgame18/icon-144.png
www.91car####.com/musicgame18/index.html
y####.k8####.com/Adown/zjdtikgd.zip
y####.k8####.com/hw/avkjpvbvx.zip
y####.k8####.com/hw/awvmfnjtysx.zip

Запросы HTTP POST:

13.2####.16.115:8081/sm/sr/sdl/in
ggg.koapk####.com/pgm/sr/gm/gy
l.a####.com/l.php
l.a####.com/sal.php
log.koapk####.com/pgm/sr/gm/gy
n####.6e####.com:12086/ts/
n####.6e####.com:12090/drq/
p####.9b####.com:12089/ds/
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sdl/in

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.atmp9.dex
/data/data/####/.atmp9.jar
/data/data/####/.atmp_8.log
/data/data/####/.do.dex
/data/data/####/.do.jar
/data/data/####/1180807000016154921ea243cbeba174dcd5bbdcd10190a...sp.xml
/data/data/####/13ac5cb0008ae82bd77e17a78673152d.jp
/data/data/####/13ac5cb0008ae82bd77e17a78673152d.jp.temp
/data/data/####/13ac5cb0008ae82bd77e17a78673152d.jp.temp (deleted)
/data/data/####/20160121.xml
/data/data/####/201812272050.apk
/data/data/####/201812272050.dex
/data/data/####/3323003.dex
/data/data/####/3323003.jar
/data/data/####/3323003.ttf
/data/data/####/43920745.apk
/data/data/####/9bec2b08ec75d39255a25c8d400779c4.jp.temp
/data/data/####/F2A6715737C9504B2F82BDDEA960CD1B.xml
/data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
/data/data/####/VirtualAPK_Settings.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1552688673420
/data/data/####/__send_data_1552688714700
/data/data/####/adv_51044.jpg
/data/data/####/ag.xml
/data/data/####/b233b735258242b7a299b4f4bfb46f9f
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/base.apk
/data/data/####/base.dex (deleted)
/data/data/####/bdownloaders.db
/data/data/####/bdownloaders.db-journal
/data/data/####/c201812272050.apk
/data/data/####/d2327ba32c0bbe68147a8587eb02d5ad.xml
/data/data/####/d2327ba32c0bbe68147a8587eb02d5ad.xml.bak (deleted)
/data/data/####/external.apk
/data/data/####/external.dex
/data/data/####/external.so
/data/data/####/external_dex.apk
/data/data/####/external_dex.dex
/data/data/####/external_dex.so
/data/data/####/f7cfca1aa6ce9a9d444190c11b45be24
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/ja201903110950.data
/data/data/####/jgkkmijq.dex (deleted)
/data/data/####/jgkkmijq.jar
/data/data/####/kryrv
/data/data/####/kyypex
/data/data/####/libcom.turtle.wall.pro.so
/data/data/####/libcuid.so
/data/data/####/libdntz.so
/data/data/####/libdntz.so-32
/data/data/####/libdntz.so-64
/data/data/####/ljtq.xml
/data/data/####/loa.xml
/data/data/####/lob.xml
/data/data/####/m2019010709.apk
/data/data/####/m2019010709.dex
/data/data/####/mid.dex
/data/data/####/moduleinfos
/data/data/####/path_hw_qc_update16.temp (deleted)
/data/data/####/pndwjpcl.dex (deleted)
/data/data/####/pndwjpcl.jar
/data/data/####/rtr.db
/data/data/####/rtr.db-journal
/data/data/####/rxnqdjun.dex (deleted)
/data/data/####/rxnqdjun.jar
/data/data/####/s2019010709.apk
/data/data/####/s2019010709.dex
/data/data/####/settingsLog.xml
/data/data/####/smovmwns.dex (deleted)
/data/data/####/smovmwns.jar
/data/data/####/swith1014.db
/data/data/####/swith1014.db-journal
/data/data/####/temp.zip (deleted)
/data/data/####/trhkndox.dex (deleted)
/data/data/####/trhkndox.jar
/data/data/####/u3kmid.db
/data/data/####/u3kmid.db-journal
/data/data/####/v71.xml
/data/data/####/ver.ini.xml
/data/data/####/yd_config_c.xml
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.roboid
/data/media/####/.timestamp
/data/media/####/sub_imei.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.pm.Pm path <Package>
awk {print $9}
cat /sys/class/net/wlan0/address
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.version
grep 2273
grep 3290
grep 4396
grep 5233
grep 6250
logcat -d -v time
md5 /data/app/<Package>-1.apk
ps
sh

Загружает динамические библиотеки:

com.turtle.wall
kryrv
libdntz

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней