Android.Triada.4756

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.4567
Android.Triada.482.origin

Сетевая активность:

Подключается к:

UDP(DNS) 1####.114.114.114:53
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) u####.a####.top:80
TCP(HTTP/1.1) 47.1####.147.232:8080
TCP(HTTP/1.1) ln####.jqshe####.com:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) 47.1####.58.87:10080
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) ysr####.hpi####.com:10259
TCP(HTTP/1.1) api.meiju####.net:80
TCP(HTTP/1.1) dic####.hnn####.com:10317
TCP(HTTP/1.1) tinychi####.q####.com.####.com:80
TCP(HTTP/1.1) t####.a####.top:80
TCP(HTTP/1.1) app.a####.top:80
TCP(HTTP/1.1) filt####.a####.top:80
TCP(HTTP/1.1) pic.s####.cn.####.com:80
TCP(HTTP/1.1) mto####.hvf####.com:10259
TCP(HTTP/1.1) i####.doub####.com.####.com:80
TCP(HTTP/1.1) i####.doub####.com:80
TCP(TLS/1.0) img1-do####.b0.a####.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) p9.ps####.com.####.com:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) i####.doub####.com:443
TCP(TLS/1.0) 64.2####.165.95:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) sf1-ttc####.ps####.com:443
TCP(TLS/1.0) img.kuy####.com:443
TCP(TLS/1.0) i####.doub####.com.####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) ssls####.jom####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) cjs####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) ei.c####.com:443
TCP(TLS/1.0) ps.ssl.q####.com:443
TCP(TLS/1.0) log.sgsn####.com:443
TCP(TLS/1.0) api.icinep####.com:443
TCP(TLS/1.2) 1####.194.73.95:443
TCP(TLS/1.2) 1####.194.73.94:443

Запросы DNS:

617.a####.top
617.a####.top.####.8
a####.xapr####.com
adx####.hvf####.com
api.icinep####.com
api.meiju####.n####.####.8
api.meiju####.net
api.meiju####.net/
api.no4####.com
api.no4####.com.####.8
app.a####.top
bds.sn####.com
c####.mm####.com
c.c####.com
cjs####.oss-cn-####.aliy####.com
cn2.3####.cc
dic####.hnn####.com
dig.b####.net
ei.c####.com
filt####.a####.top
g####.bdst####.com
i####.doub####.com
i####.doub####.com
i####.doub####.com
img.kuy####.com
lhyysdk####.oss-cn-####.aliy####.com
ln####.jqshe####.com
log.sgsn####.com
mto####.hvf####.com
p9.ps####.com
pang####.sn####.com
pic.s####.cn
plb####.u####.com
ps.ssl.q####.com
res####.a####.top
s####.kt####.com
s####.kt####.com.####.8
s####.sn####.com
s3.ps####.com
s96.c####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
t####.a####.top
to####.ctobsn####.com
u####.a####.top
u####.u####.com
v3-be-####.pglstat####.com
ww1.sin####.cn
www.toutiao####.com
ysr####.hpi####.com
z2.c####.com

Запросы HTTP GET:

api.meiju####.net/plugins/80s.json
api.meiju####.net/plugins/kuaikan66.json
api.meiju####.net/plugins/micaitu.json
app.a####.top/anshuaControl.json
app.a####.top/api.json
app.a####.top/pingpaiAD.json
filt####.a####.top/filter_control_617.json
i####.doub####.com.####.com/view/photo/s_ratio_poster/public/p2559440149...
i####.doub####.com.####.com/view/photo/s_ratio_poster/public/p2571504716...
i####.doub####.com/49d27baa8d9f1b0c25afa30d9de658d5/5f2d04dc/video/tos/c...
i####.doub####.com/large/683cb5a1gy1g1mbi0xz6bj20go08cdg8.jpg
i####.doub####.com/view/photo/s_ratio_poster/public/p2558948000.jpg
ln####.jqshe####.com/u/481adanfhaf.zip
pic.s####.cn.####.com/img/3c083e77524fa192c4ac576ec317d5d0.jpg
res####.a####.top/LHYY.png
res####.a####.top/sdk10_2.png
t####.a####.top/anshua.json
t####.a####.top/armeabi-v7a/libcretenmv.png
t####.a####.top/req.json
tinychi####.q####.com.####.com/share_img.png
u####.a####.top/617.html
u####.a####.top/favicon.ico

Запросы HTTP POST:

api.meiju####.net/
dic####.hnn####.com:10317/widlth/
mto####.hvf####.com:10259/xhzsud/
ysr####.hpi####.com:10259/7471fc/
ysr####.hpi####.com:10259/7peta8/

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.bak
/data/data/####/.imprint
/data/data/####/00993f511c8b1b878830aa908a599c16c3d7ae512bc2c46....0.tmp
/data/data/####/029f3598556c673dec8a8d52ab4d3640.0.tmp
/data/data/####/029f3598556c673dec8a8d52ab4d3640.1.tmp
/data/data/####/0389ab9faa3d953a_0
/data/data/####/05efad698973b6f1c4afb8ca1e6b6122
/data/data/####/05efad698973b6f1c4afb8ca1e6b6122.tmp
/data/data/####/084e4efb33007a232417e10ee9a540cd.0.tmp
/data/data/####/084e4efb33007a232417e10ee9a540cd.1.tmp
/data/data/####/0c9d381dd6a79bbc_0
/data/data/####/0c9d381dd6a79bbc_1
/data/data/####/10_2.dex
/data/data/####/10_2.dex.flock (deleted)
/data/data/####/10_2.jar
/data/data/####/1202793bf9509d98_0
/data/data/####/152826603-1509997924
/data/data/####/18873752c3fbe12ffe85ee4952f33c449532fba942089c4....0.tmp
/data/data/####/1ab1a36d887a253edd1fe33ff509a07e.0.tmp
/data/data/####/1ab1a36d887a253edd1fe33ff509a07e.1.tmp
/data/data/####/223bb98e0e4fcfdd_0
/data/data/####/2d7dbb7560ef5d52_0
/data/data/####/30cdadfa89db04def13fdd757db510c9cfedc6d5267dcae....0.tmp
/data/data/####/35028982391CEDC44E842EACD979C7E7.dex
/data/data/####/35028982391CEDC44E842EACD979C7E7.dex.flock (deleted)
/data/data/####/36bd1ba46f08b1f74e67523b148cad7501751d6bb3c8789....0.tmp
/data/data/####/37116a26ba18672b143ffafc18e68aa4.0.tmp
/data/data/####/37116a26ba18672b143ffafc18e68aa4.1.tmp
/data/data/####/3db02e65bd7a5e04_0
/data/data/####/3db02e65bd7a5e04_1
/data/data/####/3f5ec4ce576a644231b6408643c9d4c3dd66afbb5d85bf9....0.tmp
/data/data/####/3f79616b0daf9500c63d9d793c7bd3536fd330cfba9a9cf....0.tmp
/data/data/####/42e3379b554d697429c03f7f78da57aa.0
/data/data/####/42e3379b554d697429c03f7f78da57aa.0.tmp
/data/data/####/42e3379b554d697429c03f7f78da57aa.1
/data/data/####/42e3379b554d697429c03f7f78da57aa.1.tmp
/data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
/data/data/####/4643ec5e1c3d664edec76444b838a96a.0.tmp
/data/data/####/4643ec5e1c3d664edec76444b838a96a.1.tmp
/data/data/####/465628ab20f1aed0618a18bc918b7ef66f6ffbf236c139e....0.tmp
/data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
/data/data/####/4c33038b63641114fac12b899a1ec99ff3f36d1f9c50e08....0.tmp
/data/data/####/4f118e10919f4aceba83a27652ccc452.0.tmp
/data/data/####/4f118e10919f4aceba83a27652ccc452.1.tmp
/data/data/####/51abac94d358e857be2cc1c8245c4324.0.tmp
/data/data/####/51abac94d358e857be2cc1c8245c4324.1.tmp
/data/data/####/51f06189a897969e0d01ee013769bb91.db
/data/data/####/579565eec49cc265_0
/data/data/####/579565eec49cc265_1
/data/data/####/592meiju_data.xml
/data/data/####/592meiju_data.xml.bak
/data/data/####/596b7d5e30df79df_0
/data/data/####/61b3e3a71cda4c03_0
/data/data/####/61d018678fdd98b9_0
/data/data/####/6389dc925305a7f3_0 (deleted)
/data/data/####/6cca847935c8af83b5386c466243959d.0.tmp
/data/data/####/6cca847935c8af83b5386c466243959d.1.tmp
/data/data/####/6d1e9d75a26645dd_0
/data/data/####/6f182f23ff9d74e8bc48ee4f8ad28391238807a2c249e7d....0.tmp
/data/data/####/71afa7e01944b9f411247e562d38d582.0.tmp
/data/data/####/71afa7e01944b9f411247e562d38d582.1.tmp
/data/data/####/7f5f52906458f040f1098883fcc08450.0.tmp
/data/data/####/7f5f52906458f040f1098883fcc08450.1.tmp
/data/data/####/832a02e1b74d201a74f7bd36f303204ad5523caff82e491....0.tmp
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/8d1c57f9cfc385dc_0
/data/data/####/8e60acd9aa3ec6e3_0
/data/data/####/8e60acd9aa3ec6e3_1
/data/data/####/8fd202430b8f7da6_0
/data/data/####/8fd202430b8f7da6_1
/data/data/####/Cookies-journal
/data/data/####/HttpDNSConstantsJson.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/ad_sp.xml
/data/data/####/b3bd7c1b3ae8637c_0
/data/data/####/b428357b7b257efc_0
/data/data/####/bb5e4afa4ec1f59a45520fdf7f12115f.0.tmp
/data/data/####/bb5e4afa4ec1f59a45520fdf7f12115f.1.tmp
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/be358d518ff63225_0 (deleted)
/data/data/####/c614d4d317cee99558a5e51c5eebfc31ab429db63276d7b....0.tmp
/data/data/####/c77b1a2e5ad78153e7b8e53badb1a1aa0e8c2445293504b....0.tmp
/data/data/####/cdc0c92332d359bb_0
/data/data/####/cdc0c92332d359bb_1
/data/data/####/cid
/data/data/####/com.ch.flowerlib.Flower_15.dex
/data/data/####/com.ch.flowerlib.Flower_15.dex.flock (deleted)
/data/data/####/com.wqmimqr.asdafgg_preferences.xml
/data/data/####/d3115502dea8a437a3ddcfd520cfa9fe.db
/data/data/####/d3115502dea8a437a3ddcfd520cfa9fe.so
/data/data/####/d7e05db2aae3996c47d3487915236ce2
/data/data/####/d7e05db2aae3996c47d3487915236ce2.tmp
/data/data/####/dES.dex
/data/data/####/dES.dex.flock (deleted)
/data/data/####/dES.jar
/data/data/####/dW1weF9pbnRlcm5hbF8xNTk2Nzc2NDQ4NTY1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTk2Nzc2NDUwODgx;
/data/data/####/db64144592e6c02b040383ecdf104e9c1d3c316f1fc6c34....0.tmp
/data/data/####/dns_ip_info.db
/data/data/####/dns_ip_info.db-journal
/data/data/####/downUmeng.dex
/data/data/####/downUmeng.dex.flock (deleted)
/data/data/####/downUmeng.jar
/data/data/####/downloader.db-journal
/data/data/####/e1f09243a8de6572_0
/data/data/####/ef3e3cf75ff31cb0af5d33e45b2eb39d.0.tmp
/data/data/####/ef3e3cf75ff31cb0af5d33e45b2eb39d.1.tmp
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f03a2b54d96ad247_0
/data/data/####/f26bd0b7c3376762_0
/data/data/####/f59b8354c2acd1e1e9059cad718b26fa.0.tmp
/data/data/####/f59b8354c2acd1e1e9059cad718b26fa.1.tmp
/data/data/####/fdjupnar.dex (deleted)
/data/data/####/fdjupnar.dex.flock (deleted)
/data/data/####/fdjupnar.jar
/data/data/####/fhyzcf.png
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/i==1.2.0&&3.1.45_1596776448584_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/kk_datas_info.xml
/data/data/####/libnms.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libzbmhpo.so
/data/data/####/libzbmhpo.so-32
/data/data/####/libzbmhpo.so-64
/data/data/####/meijuniaoV2.db-journal
/data/data/####/metrics_guid
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/pkgConfig.xml
/data/data/####/proc_auxv
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_reward_video_adslot.xml
/data/data/####/sp_reward_video_adslot_preload.xml
/data/data/####/sp_reward_video_cache_945235666.xml
/data/data/####/t==8.0.0&&3.1.45_1596776452813_envelope.log
/data/data/####/the-real-index
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/yd_config_c.xml
/data/media/####/.3deaedc28469674418c57af6b7cc832b
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.kkid
/data/media/####/.umm.dat
/data/media/####/.usdis
/data/media/####/0f4e1d5ae60f6339bf30f0a3de1b4923.png
/data/media/####/35028982391CEDC44E842EACD979C7E7
/data/media/####/35028982391CEDC44E842EACD979C7E7.jar
/data/media/####/35028982391CEDC44E842EACD979C7E7.temp
/data/media/####/45d123b5dea713159f74ad47ec25bfc6
/data/media/####/49b97039baa8651f2db5509fd3e7ff91.tmp
/data/media/####/57bd1085feaa98fc46090465981b9d70.tmp
/data/media/####/59FACF1EB83B89397406DBFC29EC1911
/data/media/####/685abcc465f979242f8f915850654b87.jpg
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/clientudid.dat
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/files/cid
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.ilvhq/fdjupnar.jar --oat-fd=68 --oat-location=/data/user/0/<Package>/.ilvhq/fdjupnar.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng.jar --oat-fd=62 --oat-location=/data/user/0/<Package>/cache/cacheUmeng/oatCache/downUmeng/downUmeng.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.jar --oat-fd=59 --oat-location=/data/user/0/<Package>/files/cache/cacheUmeng/10_2.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/com.ch.flowerlib.Flower_15.dex --oat-fd=172 --oat-location=/data/user/0/<Package>/com.ch.flowerlib.Flower_15.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/data/<Package>/files/35028982391CEDC44E842EACD979C7E7.jar --oat-fd=57 --oat-location=/data/user/0/<Package>/files/35028982391CEDC44E842EACD979C7E7.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=<Package Folder>/extfiles/dES.jar --oat-fd=174 --oat-location=<Package Folder>/extfiles/dES.dex --compiler-filter=speed
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/cid
getprop
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.sv.version
getprop ro.lenovo.lvp.version
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version
getprop ro.yunos.build.version
ls /
mount
sh

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DESede
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DESede
RSA-None-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней