Android.Triada.4770

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.4567
Android.Triada.482.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) v2.g####.qq.com:80
TCP(HTTP/1.1) 4####.98.31.107:901
TCP(HTTP/1.1) now####.pes####.com:18001
TCP(HTTP/1.1) ln####.jqshe####.com:80
TCP(HTTP/1.1) v3-be-####.pglstat####.com:80
TCP(HTTP/1.1) sf1-be-####.pglstat####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) c####.7####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) qzones####.g####.cn.####.com:80
TCP(HTTP/1.1) p####.ugd####.com.####.com:80
TCP(HTTP/1.1) tys####.wwe####.com:17001
TCP(HTTP/1.1) shop-####.7####.com:80
TCP(HTTP/1.1) 6z####.njt####.com:10091
TCP(TLS/1.0) analy####.map.qq.com:443
TCP(TLS/1.0) dig.b####.net:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) ssl.zd####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) im####.pindu####.com.####.com:443
TCP(TLS/1.0) sf16-fe####.i18n-pg####.com.####.net:443
TCP(TLS/1.0) aa.birdg####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) 1####.217.17.74:443
TCP(TLS/1.0) securit####.sp####.mig.####.net:443
TCP(TLS/1.0) sf-t####.ibyte####.com.####.net:443
TCP(TLS/1.0) bds.sn####.com:443
TCP(TLS/1.0) to####.ctobsn####.com:443
TCP(TLS/1.0) sf3-fe####.pglstat####.com:443
TCP(TLS/1.0) tk.anythin####.com:443
TCP(TLS/1.0) mi.g####.qq.com:443
TCP(TLS/1.0) sf1-be-####.pglstat####.com:443
TCP(TLS/1.0) api.anythin####.com:443
TCP(TLS/1.0) pangol####.sgsn####.com.####.net:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) p####.birdg####.com:443
TCP(TLS/1.0) p####.x####.com:443
TCP(TLS/1.0) log.sgsn####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) ga.cp####.net:443
TCP(TLS/1.0) da.anythin####.com:443
TCP(TLS/1.2) 1####.217.17.74:443
TCP(TLS/1.2) 1####.217.19.195:443
TCP(TLS/1.2) 1####.217.20.78:443
TCP(TLS/1.2) 1####.217.17.78:443

Запросы DNS:

6z####.njt####.com
aa.birdg####.com
analy####.map.qq.com
and####.google####.com
android####.go####.com
api.anythin####.com
bds.sn####.com
c####.7####.com
c####.x####.com
da.anythin####.com
dig.b####.net
dm.tou####.com
ga.cp####.net
iji####.pes####.com
im####.pindu####.com
instant####.google####.com
l####.tbs.qq.com
ln####.jqshe####.com
log.sgsn####.com
m####.go####.com
md####.google####.com
mi.g####.qq.com
now####.pes####.com
p####.birdg####.com
p####.google####.com
p####.ugd####.com
p####.x####.com
pang####.sn####.com
pangol####.sgsn####.com
qzones####.g####.cn
s####.e.qq.com
s####.sn####.com
sf-t####.ibyte####.com
sf1-be-####.pglstat####.com
sf1-fe####.pglstat####.com
sf16-fe####.i18n-pg####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
shop-####.7####.com
ssl.zd####.com
t####.m.qq.com
tk.anythin####.com
to####.ctobsn####.com
tys####.wwe####.com
v2.g####.qq.com
v3-be-####.pglstat####.com
www.google####.com

Запросы HTTP GET:

c####.7####.com/index.php/Sdk/index/GetFunctionListV2?DeviceID=####&Pass...
ln####.jqshe####.com/u/qwertyuasj.zip
p####.ugd####.com.####.com/gdt/0/EAA611nAIAAIAAAAMX9Be6yO3Dmsm7BUm.jpg/0...
p####.ugd####.com.####.com/gdt/0/EAApPUIAEsAEsAAAJ9_BeKAHDBdJt8GZ9.jpg/0...
p####.ugd####.com.####.com/gdt/0/EABCIMRAQ4AeAAAAXCvBfJkO_ADzQXmW_.jpg/0...
qzones####.g####.cn.####.com/qzone/biz/gdt/mob/sdk/v2/android03/js-relea...
sf1-be-####.pglstat####.com/img/ad.union.api/62db5299532c872ca0b55879a6f...
sf1-be-####.pglstat####.com/img/ad.union.api/82c331076e8972981cc6be044d5...
sf1-be-####.pglstat####.com/img/web.business.image/202007295d0d5acf2d297...
sf1-be-####.pglstat####.com/img/web.business.image/202008235d0db1ca3da86...
shop-####.7####.com/index.php/home/index/getControllDataForGameApp?game_...
v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&mu_p=####
v3-be-####.pglstat####.com/a37664339e9ad2bf5bb2cc655e015870/5f43b363/vid...

Запросы HTTP POST:

6z####.njt####.com:10091/wisdom/marking
c####.7####.com/index.php/sdk/CollectRequest?
l####.tbs.qq.com/ajax?c=####&k=####
now####.pes####.com:18001/begzf1/
now####.pes####.com:18001/w0619s/
s####.e.qq.com/activate
s####.e.qq.com/getad
tys####.wwe####.com:17001/an2y3z/
tys####.wwe####.com:17001/cbcvu9/
tys####.wwe####.com:17001/karawc/

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/-1418382786-1965904496
/data/data/####/-29560771-955401760
/data/data/####/.appInfo
/data/data/####/.bak
/data/data/####/.cl
/data/data/####/.hptc.cache_dolls.wdj.zhiqu
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.kkid
/data/data/####/.turing.dat
/data/data/####/.usdis
/data/data/####/105498_auMini_1
/data/data/####/152826603-1509997924
/data/data/####/1598262535575_3300
/data/data/####/1598262536357_3300
/data/data/####/1598262537393_3300
/data/data/####/1598262539859_3300
/data/data/####/1598262541285_3300
/data/data/####/1598262541577_3300
/data/data/####/1598262542042_3300
/data/data/####/1598262567775_3300
/data/data/####/1598262589499_3300
/data/data/####/1598262589880_3300
/data/data/####/1598262590001_3300
/data/data/####/1598262590140_3300
/data/data/####/1598262590305_3300
/data/data/####/1598262591663_3300
/data/data/####/1598262592013_3300
/data/data/####/1598262595500_3300
/data/data/####/1598262595820_3300
/data/data/####/1598262601728_3300
/data/data/####/1598262602125_3300
/data/data/####/1598262602979_3300
/data/data/####/1598262608227_3300
/data/data/####/1598262610304_3300
/data/data/####/161f50a16c420b2932782e339acf014c
/data/data/####/161f50a16c420b2932782e339acf014c#header
/data/data/####/27fdc7ba492f3b9e_0
/data/data/####/2EC68123E317AA1FD3F2E11EBECF4D88.xml
/data/data/####/3300.yaqcookie
/data/data/####/33f7331df8330773c2b6d59fb101a836;account_file.xml
/data/data/####/341E3B4223B33EE3BA2F3AA1AA934D7F
/data/data/####/341E3B4223B33EE3BA2F3AA1AA934D7F.dex
/data/data/####/341E3B4223B33EE3BA2F3AA1AA934D7F.dex.flock (deleted)
/data/data/####/341E3B4223B33EE3BA2F3AA1AA934D7F.jar
/data/data/####/341E3B4223B33EE3BA2F3AA1AA934D7F.temp
/data/data/####/37c6e28dcc6d9ce4_0
/data/data/####/3A0BC3C0D4BC531841993226451CFE45.xml
/data/data/####/496903a053fc0bf8581756a4531b1ff4#header
/data/data/####/496903a053fc0bf8581756a4531b1ff4#temp
/data/data/####/7b4258c4328b3b69_0
/data/data/####/7b4258c4328b3b69_1
/data/data/####/7da24acf7e061dc0949e0c227f33025b
/data/data/####/883efe5122e76a4b_0
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/901638bc2dc4d1908cff8e85df086922.temp
/data/data/####/Archimedes_p1
/data/data/####/Archimedes_p2
/data/data/####/Archimedes_p3
/data/data/####/Archimedes_p4
/data/data/####/Archimedes_p5
/data/data/####/BuglySdkInfos.xml
/data/data/####/Cookies-journal
/data/data/####/DE90C826B19E14EEEB385DD0F7C756EF
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/GameDataCache
/data/data/####/TD_IP_CACHE.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_cloudcontrol3.xml
/data/data/####/TDpref_cloudcontrol3.xml.bak
/data/data/####/TDpref_game.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime3.xml
/data/data/####/TDpref_longtime3.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime3.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__zad_uuid__
/data/data/####/_db_zad_.xml
/data/data/####/_p.xml
/data/data/####/_pn
/data/data/####/_sh.xml
/data/data/####/_shn
/data/data/####/anythink.db-journal
/data/data/####/anythink_agent_log
/data/data/####/anythink_myoffer-journal
/data/data/####/anythink_placement_load.xml
/data/data/####/anythink_placement_strategy_update_check.xml
/data/data/####/anythink_sdk.xml
/data/data/####/anythink_sdk.xml.bak
/data/data/####/anythink_sdk.xml.bak (deleted)
/data/data/####/anythink_temp_log
/data/data/####/applog_stats.xml
/data/data/####/b1239076a545c34bc0780b7f64aba667
/data/data/####/b1239076a545c34bc0780b7f64aba667.tmp
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bd_tea_agent.db-journal
/data/data/####/bjss_at_banner.xml
/data/data/####/bjss_at_banner_down.xml
/data/data/####/bjss_at_inter.xml
/data/data/####/bjss_at_native.xml
/data/data/####/bjss_at_video.xml
/data/data/####/ce99e272d7ed3097b264ea7b6f1659ef
/data/data/####/ce99e272d7ed3097b264ea7b6f1659ef.tmp
/data/data/####/cid
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.qq.e.sdkconfig.xml
/data/data/####/com.qq.e.sdkconfig.xml.bak
/data/data/####/com.zhangdong.dolls.wdj.zhiqu_preferences.xml
/data/data/####/config
/data/data/####/core_info
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/ebamof.png
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gdt_config.cfg
/data/data/####/gdt_download.db
/data/data/####/gdt_download.db-journal
/data/data/####/gdt_plugin.dex
/data/data/####/gdt_plugin.dex.flock (deleted)
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/index
/data/data/####/irjvtdat.dex (deleted)
/data/data/####/irjvtdat.dex.flock (deleted)
/data/data/####/irjvtdat.jar
/data/data/####/iv
/data/data/####/journal.tmp
/data/data/####/kk_datas_info.xml
/data/data/####/last_sp_session.xml
/data/data/####/libMMANDKSignature.eb42346a.so
/data/data/####/libjiagu.so
/data/data/####/libturingau.eb42346a.so
/data/data/####/libvqbtwl.so
/data/data/####/libvqbtwl.so-32
/data/data/####/libvqbtwl.so-64
/data/data/####/libyaqbasic.eb42346a.so
/data/data/####/libyaqpro.eb42346a.so
/data/data/####/metrics_guid
/data/data/####/mpdc_105498_1
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/proc_auxv
/data/data/####/runtime-dex.dex
/data/data/####/runtime-dex.dex.flock (deleted)
/data/data/####/runtime-dex.jar_temp
/data/data/####/sR.dex (deleted)
/data/data/####/sR.dex.flock (deleted)
/data/data/####/sR.jar
/data/data/####/salt
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_multi_ttadnet_config.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_reward_video_adslot.xml
/data/data/####/ss_app_config.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/tool.egret-labs.org.xml
/data/data/####/tool.egret-labs.org.xml.bak
/data/data/####/tramini.db-journal
/data/data/####/tramini.xml
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_materialMeta.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/tt_sp_app_list.xml
/data/data/####/tt_sp_app_list.xml.bak
/data/data/####/tt_splash.xml
/data/data/####/ttnet_tnc_config.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak (deleted)
/data/data/####/ttopensdk.db-journal
/data/data/####/turingfd_conf_105498_auMini.xml
/data/data/####/turingfd_conf_105498_auMini.xml.bak
/data/data/####/turingfd_protect_105498_45_auMini.xml
/data/data/####/update_lc
/data/data/####/yaq.eb42346a.sec
/data/data/####/yaq2.eb42346a.sec
/data/data/####/yaq3_0.eb42346a.sec
/data/data/####/yaqsdkcookie
/data/data/####/yd_config_c.xml
/data/media/####/.turing.dat
/data/media/####/54ccc4d3c7742edf79be46932302ec79.tmp
/data/media/####/87c335e4a3052e52013850eea0dba08f.tmp
/data/media/####/a281cb8fc6b09fb494ecf7c20cb10d29
/data/media/####/a281cb8fc6b09fb494ecf7c20cb10d29.tmp
/data/media/####/c69ceef3eb32fe5de5e232e5c8deb6a3.tmp
/data/media/####/tbslog.txt
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/files/cid
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.edifa/irjvtdat.jar --oat-fd=64 --oat-location=/data/user/0/<Package>/.edifa/irjvtdat.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_e_qq_com_plugin_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.jar --oat-fd=178 --oat-location=/data/user/0/<Package>/app_e_qq_com_dex_74304d2fb6be1d11e99f8bb9d1b6ad1e/gdt_plugin.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/data/<Package>/files/341E3B4223B33EE3BA2F3AA1AA934D7F.jar --oat-fd=60 --oat-location=/data/user/0/<Package>/files/341E3B4223B33EE3BA2F3AA1AA934D7F.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/runtime-dex.jar --oat-fd=184 --oat-location=/data/user/0/<Package>/files/runtime-dex.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=<Package Folder>/extfiles/sR.jar --oat-fd=51 --oat-location=<Package Folder>/extfiles/sR.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=<Package Folder>/extfiles/sR.jar --oat-fd=69 --oat-location=<Package Folder>/extfiles/sR.dex --compiler-filter=speed
/system/bin/df
/system/bin/getprop
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/cache/Download
chmod 777 /data/user/0/<Package>/files/cid
getprop
getprop ro.board.platform
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.build.version
mount
sh

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RC4-ECB-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1PADDING
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о привязанных к устройству аккаунтах (Google, Facebook и т. д.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней