Android.Triada.4027

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.477.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.umengc####.com:80
TCP(HTTP/1.1) a####.c####.com:80
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) interfa####.c####.com:80
TCP(HTTP/1.1) z####.c####.com:80
TCP(HTTP/1.1) adx.c####.com:80
TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
TCP(HTTP/1.1) j####.lie####.cn:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) api.f2####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) www.d####.com.cn:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) yun.t####.cn:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) fp.ton####.net:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) dc.si####.cn:443
TCP(TLS/1.0) s####.j####.cn:443
TCP(TLS/1.0) adser####.si####.cn:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) fp-st####.b0.a####.com:443
TCP(TLS/1.0) yun.d####.com.cn:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) embe####.d####.com.cn:443
TCP(TLS/1.0) is.sn####.com.####.com:443
TCP(TLS/1.0) ad.c####.com:443
TCP(TLS/1.0) p####.ou####.com:4433
TCP(TLS/1.0) acti####.m.d####.####.cn:443
TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) abc.abcdse####.com:8888
TCP(TLS/1.0) d####.shu####.cn:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) a####.c####.com:443
TCP(TLS/1.0) g.al####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) daa.shu####.cn:443
UDP s.j####.cn:19000
TCP 2####.14.153.104:7002

Запросы DNS:

a####.c####.com
a####.u####.com
a####.umengc####.com
abc.abcdse####.com
acti####.m.d####.####.cn
ad.c####.com
adser####.go####.com
adser####.si####.cn
adx.c####.com
api.f2####.com
api.sdk.f####.cn
api.shu####.cn
client-####.c####.com
cxb####.c####.com
d####.shu####.cn
daa.shu####.cn
dai.shu####.cn
dc.si####.cn
dcc.shu####.cn
embe####.d####.com.cn
fp.fraudme####.cn
fp.ton####.net
g.al####.com
interfa####.c####.com
is.sn####.com
j####.lie####.cn
log.u####.com
p####.byt####.com
p####.ou####.com
s####.j####.cn
s####.u####.com
s.j####.cn
sdkc####.e.360.cn
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
sis.j####.io
ssl.gst####.com
st####.fraudme####.cn
up####.sdk.jig####.cn
www.d####.com.cn
www.go####.com
www.go####.nl
www.gst####.com
yun.d####.com.cn
yun.t####.cn
z####.c####.com

Запросы HTTP GET:

a####.c####.com/cx/intShop/duibashop?dbredirect=https://activity.m.duiba...
a####.c####.com/interface/list?version=####&appname=####
adx.c####.com/api/sdk/ad?count=####&ext=####&pid=####&appId=####
api.f2####.com/sdk/existedApps?data={"####&did=####
api.f2####.com/sdk/getApps?carrier=####&did=####&lastchecktime=####
interfa####.c####.com/interface/list?version=####&appname=####
sf1-ttc####.ps####.com/img/mosaic-legacy/2b9980003cba4acc9c942~cs_388x69...
sf3-ttc####.ps####.com/img/web.business.image/201907225d0db68511cbdf7947...

Запросы HTTP POST:

a####.c####.com/adConfigure/getAdConfigure?cnid=####&umeng=####&version=...
a####.c####.com/cx/ContendAppList
a####.c####.com/cx/tasklist?uid=####
a####.u####.com/app_logs
a####.umengc####.com/app_logs
j####.lie####.cn/v2/cp?appId=####
up####.sdk.jig####.cn/v1/push/sdk/postlist
z####.c####.com/validate!validateData.xhtml

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/-1127729055-1266689676
/data/data/####/-1371796542246136913
/data/data/####/-1666120506
/data/data/####/-1841727820778319663
/data/data/####/-504780239-1776915243
/data/data/####/-5998622401067643521
/data/data/####/-8037078161215672668
/data/data/####/-83273656-1190814141
/data/data/####/-908322109
/data/data/####/.imprint
/data/data/####/1021689741840853517
/data/data/####/13060482922053286298
/data/data/####/1565027501940.log
/data/data/####/17kAppPrefs.xml
/data/data/####/2047536988-2005331128
/data/data/####/2086810528.jar
/data/data/####/2086810665.jar (deleted)
/data/data/####/2086810719.jar
/data/data/####/2ca12abb-e8b2-4f61-b430-5b11e2daf10b
/data/data/####/339204258
/data/data/####/633fd3bd-2f33-4c3a-a313-e08cda27de00
/data/data/####/756c559e-9182-4755-9883-e6113a5550af
/data/data/####/9062518221039768842
/data/data/####/AKTorchDownload.db-journal
/data/data/####/BuriedPointConfig.xml
/data/data/####/JPushSA_Config.xml
/data/data/####/LY_AD_KEY.xml
/data/data/####/PreferanceUtil.xml
/data/data/####/add6ad0f83af60f0ad53ff118edfef064c9ca8b747c0fc5....0.tmp
/data/data/####/appPackageNames_v2
/data/data/####/app_crash_copy.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.Sigmob.Settings.xml
/data/data/####/com.mianfeia.book-1.apk.classes1037236368.zip
/data/data/####/com.mianfeia.book-1.apk.classes1500285149.zip
/data/data/####/com.mianfeia.book-1.apk.classes2062928896.zip
/data/data/####/com.mianfeia.book-1.apk.classes3.zip
/data/data/####/com.mianfeia.book_dna.xml
/data/data/####/com.mianfeia.book_prefs.xml
/data/data/####/config
/data/data/####/config.db-journal
/data/data/####/core_update
/data/data/####/core_update_locker
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dd327258-53c2-4b85-a2c0-b5172eb198ab
/data/data/####/device_collector
/data/data/####/device_collector_locker
/data/data/####/downloader.db-journal
/data/data/####/du.lock
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/fft_cfg.xml
/data/data/####/finalcore.jar
/data/data/####/freebook_comm.db-journal
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_local_notification.db-wal
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_statistics.db
/data/data/####/jpush_statistics.db-journal
/data/data/####/jpush_statistics.db-shm (deleted)
/data/data/####/jpush_statistics.db-wal
/data/data/####/locker
/data/data/####/log_reupload_task
/data/data/####/log_reupload_task_locker
/data/data/####/msg_queue
/data/data/####/multidex.version.xml
/data/data/####/profile_task
/data/data/####/profile_task_locker
/data/data/####/sp_global_info.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_template_delete.xml
/data/data/####/torch_sdk_config.xml
/data/data/####/torch_sdk_config.xml.bak
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_cache_1565027483619.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/uninstall_apk
/data/data/####/uninstall_apk_locker
/data/data/####/waitingDown
/data/data/####/waitingDown_locker
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/-1364308723.tmp
/data/media/####/-1827038104.tmp
/data/media/####/..ccdid
/data/media/####/..ccvid
/data/media/####/._android.dat
/data/media/####/._system.dat
/data/media/####/.ccdid
/data/media/####/.ccvid
/data/media/####/.cer
/data/media/####/.duid
/data/media/####/.fb
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.sfp
/data/media/####/.testf
/data/media/####/.ygzhang
/data/media/####/156e0cfdad63dc875ae8aaa263b297dc.tmp
/data/media/####/59391831.FBZ
/data/media/####/59391842.FBZ
/data/media/####/59391852.FBZ
/data/media/####/59391860.FBZ
/data/media/####/59391871.FBZ
/data/media/####/59391883.FBZ
/data/media/####/59391893.FBZ
/data/media/####/59391903.FBZ
/data/media/####/59391913.FBZ
/data/media/####/59391923.FBZ
/data/media/####/59391933.FBZ
/data/media/####/59391943.FBZ
/data/media/####/59391953.FBZ
/data/media/####/63761715.FBZ
/data/media/####/63761724.FBZ
/data/media/####/63761734.FBZ
/data/media/####/63761753.FBZ
/data/media/####/63761763.FBZ
/data/media/####/63761773.FBZ
/data/media/####/63761783.FBZ
/data/media/####/63761792.FBZ
/data/media/####/63761802.FBZ
/data/media/####/63761812.FBZ
/data/media/####/63761822.FBZ
/data/media/####/63761832.FBZ
/data/media/####/63761842.FBZ
/data/media/####/63761852.FBZ
/data/media/####/63761862.FBZ
/data/media/####/63761872.FBZ
/data/media/####/63761882.FBZ
/data/media/####/63761892.FBZ
/data/media/####/63761900.FBZ
/data/media/####/63761909.FBZ
/data/media/####/67367680.FBZ
/data/media/####/67367682.FBZ
/data/media/####/67367684.FBZ
/data/media/####/67367686.FBZ
/data/media/####/67367688.FBZ
/data/media/####/67367690.FBZ
/data/media/####/67367692.FBZ
/data/media/####/67367694.FBZ
/data/media/####/67367696.FBZ
/data/media/####/67367698.FBZ
/data/media/####/67367700.FBZ
/data/media/####/67367702.FBZ
/data/media/####/67367704.FBZ
/data/media/####/67367706.FBZ
/data/media/####/67367708.FBZ
/data/media/####/67367711.FBZ
/data/media/####/67367713.FBZ
/data/media/####/67367715.FBZ
/data/media/####/67367717.FBZ
/data/media/####/67367719.FBZ
/data/media/####/779e66f14b6157438e27eec3216f31d5.xml
/data/media/####/80050758.FBZ
/data/media/####/80050766.FBZ
/data/media/####/80050803.FBZ
/data/media/####/80050809.FBZ
/data/media/####/80050817.FBZ
/data/media/####/80050826.FBZ
/data/media/####/80050831.FBZ
/data/media/####/80050838.FBZ
/data/media/####/80050847.FBZ
/data/media/####/80050921.FBZ
/data/media/####/80050927.FBZ
/data/media/####/80050931.FBZ
/data/media/####/80051028.FBZ
/data/media/####/80051034.FBZ
/data/media/####/80051039.FBZ
/data/media/####/80051111.FBZ
/data/media/####/80051116.FBZ
/data/media/####/80051119.FBZ
/data/media/####/80051125.FBZ
/data/media/####/80051130.FBZ
/data/media/####/_android.dat
/data/media/####/_system.dat
/data/media/####/ad_id.conf
/data/media/####/cdd0065141fe12905397463471b6ee88.xml
/data/media/####/dbacd592a628c69de0d090c04c3f2f8f.tmp
/data/media/####/duid
/data/media/####/temp_pkg_info.json
/data/media/####/uninstall_apk_list

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
date
df
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
id
ip link
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh -c cat /proc/meminfo
sh -c cat /sys/class/net/eth0/address
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURlJNdWd5azVjSG43UnVjZ1VnOHM1RStxWUM1eEQ2YUdrZUNFc29vOHAzajNjbjJSWT0= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo QUFEMTgzMUQ0MTAwNjI0MUMzRjRGOUIyODYwREM5MTFjYTg4MmYwY2I3YTk0OTg3OGY0OGI3NjQ1ZTBmNWVkNwo= > <SD-Card>/../../../../../..<SD-Card>/.duid
sh -c echo QUFEMTgzMUQ0MTAwNjI0MUMzRjRGOUIyODYwREM5MTFjYTg4MmYwY2I3YTk0OTg3OGY0OGI3NjQ1ZTBmNWVkNwo= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/duid
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTE5NEEwOERGQzUxNzA5RDM0OUU1NjZCQTAzMzY5NkM2ODM4NTQ6NUQ1RTMwOkM2MEVFNA== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo RTE5NEEwOERGQzUxNzA5RDM0OUU1NjZCQTAzMzY5NkM2ODM4NTQ6NUQ1RTMwOkM2MEVFNA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat

Загружает динамические библиотеки:

du
jcore121

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
Des-ECB-NoPadding
RSA
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
Des-ECB-NoPadding
desede-CBC-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней