Android.Triada.5150

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.1007.origin
Android.RemoteCode.231.origin
Android.Triada.4567
Android.Triada.510.origin
Android.Triada.573.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) o####.cz####.com:10051
TCP(HTTP/1.1) nu####.js####.com:12029
TCP(HTTP/1.1) q####.m####.com:13002
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) ua####.f6####.com:80
TCP(HTTP/1.1) q####.m####.com:16002
TCP(HTTP/1.1) gc4####.9####.com:80
TCP(HTTP/1.1) hw9####.new####.com:80
TCP(HTTP/1.1) fung####.ly####.com:80
TCP(HTTP/1.1) dwq.fs####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) d####.dd7####.com:80
TCP(TLS/1.0) 1####.177.14.95:443
TCP(TLS/1.0) newas####.hcap####.com:443
TCP(TLS/1.0) def####.cn.zb.####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) 74.1####.131.95:443
TCP(TLS/1.0) wcf.seven####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) fo####.site:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.177.14.95:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) 64.2####.161.95:443
UDP 64.2####.161.95:443
UDP 1####.177.14.95:443

Запросы DNS:

36####.ob####.com
a####.r####.com
a####.u####.com
and####.cli####.go####.com
and####.google####.com
android####.go####.com
api.applove####.com
d####.dd7####.com
dwq.fs####.com
f####.gst####.com
fo####.site
fung####.ly####.com
gc4####.9####.com
hcap####.com
hw9####.new####.com
jz####.mc####.com
m####.go####.com
newas####.hcap####.com
nu####.js####.com
o####.cz####.com
pv.s####.com
q####.m####.com
u####.u####.com
ua####.f6####.com
wcf.seven####.com
z5.c####.com
z9.c####.com

Запросы HTTP GET:

api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
d####.dd7####.com/upload/hw/batdex20191010.jar
d####.dd7####.com/upload/hw/c1005dex20190527.jar
d####.dd7####.com/upload/hw/h5rq20191022.jar
d####.dd7####.com/upload/hw/kklz02dex20200414.jar
d####.dd7####.com/upload/hw/lsdk20200506.jar
d####.dd7####.com/upload/hw/mf20200508.jar
d####.dd7####.com/upload/hw/qcdex20200316.jar
d####.dd7####.com/upload/plog/cy1105.jar
d####.dd7####.com/upload/plog/hwsdk1111.jar
d####.dd7####.com/upload/plog/hx0409.jar
d####.dd7####.com/upload/plog/jar20190515.jar
d####.dd7####.com/upload/plog/jrw20210630.jar
d####.dd7####.com/upload/plog/kk20201106.jar
d####.dd7####.com/upload/plog/ps20210219.jar
d####.dd7####.com/upload/plog/sdk0625.jar
d####.dd7####.com/upload/plog/sh290_20210810.jar
d####.dd7####.com/upload/plog/skk20210416.jar
d####.dd7####.com/upload/plog/xianmm0512.jar
d####.dd7####.com/upload/plog/zcoup1118.jar
dwq.fs####.com/FB/nsa_100008_20211110.zip
dwq.fs####.com/dtbx/liangzong/hwlz06.zip
dwq.fs####.com/dtbx/liangzong/lz04.zip
dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
dwq.fs####.com/dtbx/yunshi/awli-release.zip
dwq.fs####.com/plugins/applh0723.zip
dwq.fs####.com/plugins/dp2.zip
dwq.fs####.com/plugins/yz058Uc30i0913.zip
fo####.site:443/ewewew/s20211101220628.1
fung####.ly####.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v...
fung####.ly####.com/cdn-cgi/images/browser-bar.png?137675####
fung####.ly####.com/cdn-cgi/images/cf-no-screenshot-warn.png
fung####.ly####.com/cdn-cgi/images/trace/captcha/nojs/h/transparent.gif?...
fung####.ly####.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=...
fung####.ly####.com/cdn-cgi/styles/cf.errors.css
fung####.ly####.com/lym07ly07/game/synthetic-number-13/
gc4####.9####.com/zsyunsxda
gc4####.9####.com/zsyunsxda/
gd.a.s####.com:443/cityjson
ua####.f6####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
ua####.f6####.com/textlog/45F03BF30CFDFF6CC100728555A3878D.log
ua####.f6####.com/textlog/92F4C7A4386C2735C57F5C0FC90BCF30.log
ua####.f6####.com/textlog/FFA6813C118243858FFF1E5CDFF99A3B.log
z.c####.com/stat.htm?id=####&cnzz_eid=####

Запросы HTTP POST:

al####.u####.com:443/unify_logs
al####.u####.com:443/zcfg
def####.cn.zb.####.com:443/api/postZdata
fung####.ly####.com/cdn-cgi/challenge-platform/h/b/flow/ov1/0.2252241520...
hw9####.new####.com/api/activite
hw9####.new####.com/api/offer
hw9####.new####.com/api/tbdynamic
hw9####.new####.com/apidata/showeb
nu####.js####.com:12029/hfdlls/
nu####.js####.com:12029/i3v8nb/
nu####.js####.com:12029/lfkdnr/
o####.cz####.com:10051/getjar/
o####.cz####.com:10051/getsol/
o####.cz####.com:10051/repsol/
q####.m####.com:13002/84gcjmo/
q####.m####.com:13002/ck0k66o/
q####.m####.com:13002/v1jyved/
q####.m####.com:16002/h7bj93/
wcf.seven####.com:443/BBService.svc/wewrdcazxpkl

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.dl
/data/data/####/.imprint
/data/data/####/.udusid
/data/data/####/0437750A541C5BE283568783752E76EF.xml
/data/data/####/0d14514d21dc78fe8462b2bfef0d6fef.temp
/data/data/####/20b690529a2eb88515f2edce6b4017f8.temp
/data/data/####/2118BF62061AA81849864E1FA899D952
/data/data/####/2118BF62061AA81849864E1FA899D952.dex
/data/data/####/2118BF62061AA81849864E1FA899D952.dex.flock (deleted)
/data/data/####/2118BF62061AA81849864E1FA899D952.temp
/data/data/####/2118BF62061AA81849864E1FA899D952.zip
/data/data/####/3e2wssr.xml
/data/data/####/3uy5r.xml
/data/data/####/47AB7209AD7ACF4EB1EA636A3039D803
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.dex
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.dex.flock (deleted)
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.temp
/data/data/####/4B8D49FB58D68A9143C86DF5979F4158.zip
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.dex
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.dex.flock (deleted)
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.jar
/data/data/####/5A064F2364D48401E82059BE1BFB3FC6.temp
/data/data/####/5af4a0c507f58979be02d3e085923db9.dex
/data/data/####/5af4a0c507f58979be02d3e085923db9.dex.flock (deleted)
/data/data/####/5af4a0c507f58979be02d3e085923db9.jar
/data/data/####/61e492
/data/data/####/61e492.tmp
/data/data/####/7d8d6b
/data/data/####/8083FF58735015297E7624C9CFAC3D8C.xml
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.dex
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.dex.flock (deleted)
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.temp
/data/data/####/8B2295FFDEF6CE6F86C2F73C8F44D4FE.zip
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.dex
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.dex.flock (deleted)
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.jar
/data/data/####/90FCBC4E72D8C499954E2A48BD6A2C19.temp
/data/data/####/92803EBB7D87B2E67FB0CEF6704D2D24
/data/data/####/934bbf
/data/data/####/934bbf.tmp
/data/data/####/9dbe505aa81ac42179c879a331f908d5.temp
/data/data/####/C3B2481BF31F7E7DF213B1679D8AFC65
/data/data/####/CsKaitno.d
/data/data/####/D177CA2FC204D1D92FCFD2A8E1DB9061.xml
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.dex
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.dex.flock (deleted)
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.temp
/data/data/####/D8F16C74A9F4A46858B5318DD414F7D6.zip
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.dex
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.dex.flock (deleted)
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.temp
/data/data/####/E7C8A3F6E0E20F381FF38DF485FCE16E.zip
/data/data/####/F73811C2013B84778D431A6EE070420A.dex
/data/data/####/F73811C2013B84778D431A6EE070420A.dex.flock (deleted)
/data/data/####/F73811C2013B84778D431A6EE070420A.jar
/data/data/####/F73811C2013B84778D431A6EE070420A.temp
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/androidxcorefreec7z.
/data/data/####/androidxcorefreec7z.dex
/data/data/####/androidxcorefreec7z.dex.flock (deleted)
/data/data/####/c851260083e895b72efca803fd33dd4a.temp
/data/data/####/ccddefde.dex
/data/data/####/ccddefde.dex.flock (deleted)
/data/data/####/ccddefde.jar
/data/data/####/cd23423423423
/data/data/####/chzn
/data/data/####/com.android.google.cdcore.db
/data/data/####/com.noteanan.simplenotebased_ct_default.xml
/data/data/####/com.noteanan.simplenotebased_preferences.xml
/data/data/####/df4essr.xml
/data/data/####/df4essr.xml.bak (deleted)
/data/data/####/e3f4r3ed.data
/data/data/####/e3f4r3ed.data-journal
/data/data/####/e3h75rd.data
/data/data/####/e3h75rd.data-journal
/data/data/####/e3wg5rd.data
/data/data/####/e3wg5rd.data-journal
/data/data/####/ep.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gczt.png
/data/data/####/i==1.2.0&&2.0_1637729062868_dW5pZnlfbG9ncw==;.log
/data/data/####/info.xml
/data/data/####/jbo
/data/data/####/knj
/data/data/####/ld_config_cc.xml
/data/data/####/libkezc.so
/data/data/####/libkezc.so-32
/data/data/####/libkezc.so-64
/data/data/####/libsszf.so
/data/data/####/libsszf.so-32
/data/data/####/libsszf.so-64
/data/data/####/libunrt.so
/data/data/####/metrics_guid
/data/data/####/notes.db
/data/data/####/notes.db-journal
/data/data/####/ofew.png
/data/data/####/ooooooooooooooooooooooooooooooooooooooooooooooo...oooooo
/data/data/####/proc_auxv
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s3p43_W12312312.xml
/data/data/####/s3p43_W12312312.xml.bak
/data/data/####/sp_dojz.xml
/data/data/####/sp_flny.xml
/data/data/####/t==9.4.0&&2.0_1637729063064_dW5pZnlfbG9ncw==;.log
/data/data/####/tmp
/data/data/####/tmp.zip
/data/data/####/ttttttttttttttttttttttttttttttttttttttttttttttt...tttttt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/voooooooooooooooooooooooooooooooooooooooooooooo...oooooo
/data/data/####/webview_data.lock
/data/data/####/xmiqcwxg.dex
/data/data/####/xmiqcwxg.dex.flock (deleted)
/data/data/####/xmiqcwxg.jar
/data/data/####/z==1.2.0&&2.0_1637729057577_emNmZw==;.log
/data/data/####/zetj.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/.libs/1_1001/.soldx/61e492 dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/data/user/0/<Package>/.libs/1_1001/.soldx/jbo -Z u:r:shell:s0 -c /data/user/0/<Package>/.libs/1_1001/.soldx//CsKaitno.d
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/lib/arm/houdini /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/system/lib64/arm64/houdini64 /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b dIEmu9C/AF+Xr8MtYZD5FJRt3xTzT93LYe9Ywe0tHHv+IABa2bFXo6QfUnTvuXP1euogebkbuRBrOtAUpoO0BSQgun+ItYWQyo+QDijCkRzx+vXez6CpKQSbf1xZXCnbjP87s9LyEz+W72/lQ5J6jrY3oINjNzomuh8rR4cApfU= /data/user/0/<Package>/.libs/1_1001/.soldx/ /system/xbin/ckajvybh
/system/lib64/arm64/houdini64 /data/user/0/<Package>/.libs/1_1001/.soldx/jbo /data/user/0/<Package>/.libs/1_1001/.soldx/jbo HF8Cyjmi1cDd3JCn152ah3T6LO9GefXCk2eqWVyu2Yjmu3Md+QyWSS6rFUOxZbPk7OdhiTbItuWlDo3z3Kt+xaA7RnTU7+oUrodHgLTJIqiz+n6JyKSJkYGYRSs1ZsZi/FGpvTNIgHWlvTkK8Gggoh1u+L4HFCp3MhTxiVRaW1tl+mE7rUNEJlR5PlGvr9W0Q6SkwiyAM88KTRpXw92i8nuwV5Y1e4s8BrWMO1iYy9HAf9dEfm29mGexfKMYYJCn5/bFeA7lSU825KWr3hXocI9eDi1T6icaxpoVTpKQTprnHLqzEPnPcu4fM9G/0TTAAqgwNCiCbu3Q
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/61e492
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/7d8d6b
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/934bbf
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/CsKaitno.d
chmod 777 /data/user/0/<Package>/.libs/1_1001/.soldx/com.android.google.cdcore.db
getprop
getprop ro.board.platform
getprop ro.product.cpu.abi
getprop ro.yunos.build.version
ls /
ls /sys/class/thermal
mkdir <Package Folder>/files/1637729125/j0
mkdir <Package Folder>/files/1637729125/j1
mkdir <Package Folder>/files/1637729125/j2
mkdir <Package Folder>/files/1637729125/j3
mkdir <Package Folder>/files/1637729125/j5
mkdir <Package Folder>/files/1637729125/j6
rm -rf /data/user/0/<Package>/.libs/1_1001/.soldx/
rm -rf <Package Folder>/files/1637729125/*
sh
sh -c rm -rf /data/user/0/<Package>/.libs/1_1001/.soldx/ 2>/dev/null
sh -c rm -rf <Package Folder>/files/1637729125/*

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-None-PKCS1Padding
desede-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней