Android.Triada.5393

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.573.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) clk.byte####.net:80
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) valu####.g2####.com:80
TCP(HTTP/1.1) img.atomhik####.com:80
TCP(HTTP/1.1) cdn-sto####.unit####.uni####.####.net:80
TCP(HTTP/1.1) tkc####.smard####.com:80
TCP(HTTP/1.1) ip####.com:80
TCP(HTTP/1.1) set####.ro####.io:80
TCP(HTTP/1.1) lo####.applove####.com:80
TCP(HTTP/1.1) cdn-cre####.acq####.unity3d####.####.net:80
TCP(HTTP/1.1) sdk-####.ro####.io:80
TCP(TLS/1.0) sett####.atomhik####.com:443
TCP(TLS/1.0) seven####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) adash####.man.aliy####.com:443
TCP(TLS/1.0) ap####.tut####.net:443
TCP(TLS/1.0) p####.go####.com:443
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) pla####.googleu####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) zi####.b####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) httpk####.unit####.uni####.com:443
TCP(TLS/1.0) re####.atomhik####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) www.go####.ru:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) au####.unit####.uni####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) img.atomhik####.com:443
TCP(TLS/1.0) api.atomhik####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) ads-sdk####.unit####.uni####.com:443
TCP(TLS/1.0) valu####.g2####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) img.adti####.com:443
TCP(TLS/1.0) p####.tut####.com:443
TCP(TLS/1.0) nowtraf####.com:443
TCP(TLS/1.0) 1####.194.221.138:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP(TLS/1.2) p####.go####.com:443
TCP(TLS/1.2) 1####.250.150.94:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) zi####.b####.com:443
UDP www.google####.com:443
UDP rr2---s####.g####.com:443
TCP www.pa####.c####.####.net:443
UDP rr1---s####.g####.com:443
TCP a####.ampli####.com:443

Запросы DNS:

a####.ampli####.com
a####.man.aliy####.com
a####.u####.com
afn####.atom####.com
ap####.tut####.com
ap####.tut####.net
api.applove####.com
api.atomhik####.com
au####.unit####.uni####.com
auc####.unit####.uni####.com
cdn-cre####.acq####.unity3d####.com
cdn-sto####.unit####.uni####.com
clk.byte####.net
co####.unit####.uni####.com
conf####.unit####.uni####.com
er####.u####.com
f####.gst####.com
g####.atomhik####.com
httpk####.unit####.uni####.com
img.adti####.com
img.atomhik####.com
ip####.com
lo####.applove####.com
log.u####.com
m####.go####.com
nowtraf####.com
p####.go####.com
p####.google####.com
p####.tut####.com
pla####.googleu####.com
publish####.unit####.uni####.com
pv.s####.com
re####.atomhik####.com
rr1---s####.g####.com
rr2---s####.g####.com
s####.g.doublec####.net
sdk-####.ro####.io
sdk.adti####.com
set####.ro####.io
sett####.atomhik####.com
seven####.com
ssl.gst####.com
tkc####.smard####.com
u####.u####.com
valu####.g2####.com
www.go####.com
www.go####.ru
www.google####.com
www.google-####.com
www.gst####.com
www.pa####.com

Запросы HTTP GET:

ads-sdk####.unit####.uni####.com:443/games/3810785/configuration?deviceM...
ads-sdk####.unit####.uni####.com:443/webview/4.1.0/release/config.json?t...
api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
api.atomhik####.com:443/tracking/mO6WgepouNLk22iMqGFuURWdraBsJjsTWsZ5YTI...
cdn-cre####.acq####.unity3d####.####.net/assets/62d2b3f6560c339d3fbbbac2...
cdn-cre####.acq####.unity3d####.####.net/assets/62d2b3f67ac264397e3e2e06...
cdn-sto####.unit####.uni####.####.net/store-icons/4d4c0a11-fcfc-49bc-acb...
clk.byte####.net/click?id=####&aff=####&ost=####&click_id=####&aff_sub=#...
def####.duals####.cn.####.com:443/bar/get/541835c1fd98c51ee3010b68/?pcv=...
gd.a.s####.com:443/cityjson
img.adti####.com:443/fetch/https://play-lh.googleusercontent.com/oP67ur4...
img.adti####.com:443/fetch/https://play-lh.googleusercontent.com/tCABmsT...
img.adti####.com:443/sw/fbec0.html?v=####
img.adti####.com:443/upload/creative/2022/01/11/12d10c1a9dc6274b79fef838...
img.atomhik####.com/static/sdk/AD_mark.png
img.atomhik####.com:443/static/sdk/AD_close.png
img.atomhik####.com:443/static/sdk/AD_mute.png
img.atomhik####.com:443/static/sdk/AD_voice.png
img.atomhik####.com:443/static/sdk/AD_webview_close.png
ip####.com/json/?lang=####
lo####.applove####.com/agreement/v1/upload?consent_value=####&consent_ty...
p####.tut####.com:443/photo/da/2022/06/30/17/ffu7jcmi9i0j.jpg
p####.tut####.com:443/photo/da/2022/07/04/14/i1n6sdqa5ex1.jpg
p####.tut####.com:443/photo/da/2022/07/05/13/0zpflxczadat.jpg
p####.tut####.com:443/photo/da/2022/07/13/09/ntmd4xp63f47.jpg
p####.tut####.com:443/photo/da/2022/07/14/15/ly6g6c0diejt.jpg
p####.tut####.com:443/photo/da/2022/07/14/16/dr76o3okldg9.jpg
p####.tut####.com:443/photo/da/2022/07/14/17/bz57hpasr510.jpg
p####.tut####.com:443/photo/da/2022/07/15/10/84u363pa2e8i.jpg
p####.tut####.com:443/photo/da/2022/07/20/16/jcnp0mjp5b3u.jpg
p####.tut####.com:443/picture/app_android/en/002/51/05/56/cover_2510556_...
p####.tut####.com:443/picture/app_android/us/2021/04/26/s2fzj0xu91gqiyji...
p####.tut####.com:443/picture/app_ios/us/2021/09/23/14/oennajd9xda4.jpg
p####.tut####.com:443/picture/app_ios/us/2022/05/18/16/6dvaxs7z1afh.jpg
p####.tut####.com:443/picture/app_ios/us/2022/07/20/09/q4z0ukcgl4gj.jpg
p####.tut####.com:443/picture/app_ios/us/2022/07/20/14/5w9xbcdplulj.jpg
sdk.adti####.com:443/ck?v=####&sdkv=####&k=####&make=####&brand=####&mod...
set####.ro####.io/sdk?appid=####&system=####&os_v=####&ma=####&timezone=...
set####.ro####.io/sdk_app?appid=####&system=####&os_v=####&ma=####&timez...
tkc####.smard####.com/agentapi/click?aid=####&cid=####&subid=####&ext1=#...
unit####.edges####.net:443/webview/4.0.0/8feeb750d760ca2210cf41d05a97266...
valu####.g2####.com/disabled.html
zi####.b####.com:443/ws?udid=####

Запросы HTTP POST:

adash####.man.aliy####.com:443/man/api?ak=####&s=####
ads-sdk####.unit####.uni####.com:443/privacy/3810785/state
ap####.tut####.net:443/apiandroid/api/CheckTutuVersion
ap####.tut####.net:443/apiandroid/api/checkTutuAdsCompany
ap####.tut####.net:443/apiandroid/apiAndroid/GetHomeSpecialList
ap####.tut####.net:443/apiandroid/apiAndroid/adSwitcher
ap####.tut####.net:443/apiandroid/apiAndroid/chaos
ap####.tut####.net:443/apiandroid/apiAndroid/checkAppVersion
ap####.tut####.net:443/apiandroid/apiAndroid/getDomainByIp
ap####.tut####.net:443/apiandroid/apiAndroid/getListDataIntl
ap####.tut####.net:443/apiandroid/apiAndroid/getMessageTotalNum
ap####.tut####.net:443/apiandroid/apiAndroid/getMostPlayList
ap####.tut####.net:443/apiandroid/apiAndroid/getNewGameAndAppList
ap####.tut####.net:443/apiandroid/apiAndroid/getRecentUpdateList
ap####.tut####.net:443/apiandroid/apiAndroid/getSearchBoxKeywordIntl
ap####.tut####.net:443/apiandroid/apiAndroid/getServerTime
ap####.tut####.net:443/apiandroid/apiAndroid/getSpecialShow
api.atomhik####.com:443/offerd/v2
api.atomhik####.com:443/v1/ads
au####.unit####.uni####.com:443/v1/category/experiment
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
httpk####.unit####.uni####.com:443/v1/events
new-####.u####.com:443/api/postZdata
nginx-a####.unit####.uni####.com:443/v6/games/3810785/requests?idfi=####...
re####.atomhik####.com:443/myapi/event
sdk-####.ro####.io/sdk_analytics
sdk.adti####.com:443/al?did=####&k=####&v=####&sdkv=####
sdk.adti####.com:443/cl?v=####&plat=####&mv=####&sdkv=####
sdk.adti####.com:443/conf?v=####&plat=####&k=####&sv=####
sett####.atomhik####.com:443/gate/auth
sett####.atomhik####.com:443/gate/cfg
seven####.com:443/AAService.svc/dsxssw
u####.u####.com:443/umpx_share
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/0105efdc14b9c7e0_0
/data/data/####/03e43ad1522445c1_0
/data/data/####/05e6419f62b3d322_0
/data/data/####/068bda1aca1f7c8b_0
/data/data/####/09170fd9d643c097_0
/data/data/####/0edfa6bc7e1421ea_0
/data/data/####/0edfa6bc7e1421ea_1
/data/data/####/1693b4936a3f77d5_0
/data/data/####/1693b4936a3f77d5_1
/data/data/####/1d3b8d10fc20ab5d_0
/data/data/####/1e8ae787ceaedab5_0
/data/data/####/249517f2f7d373b4_0 (deleted)
/data/data/####/2940195bd9870d6e_0
/data/data/####/2940195bd9870d6e_1
/data/data/####/296137e121bfae6e_0
/data/data/####/296137e121bfae6e_1
/data/data/####/29a25bab2af987ed20809529e3521263
/data/data/####/29a25bab2af987ed20809529e3521263-header
/data/data/####/29a25bab2af987ed20809529e3521263cache (deleted)
/data/data/####/3f2f9f72cd83918b_0 (deleted)
/data/data/####/40fd943af6f743a9_0
/data/data/####/41676c7de5d0ed62_0
/data/data/####/4190642db667d826_0
/data/data/####/4190642db667d826_1
/data/data/####/499bff5583db6005_0
/data/data/####/554af6f213a28345_0
/data/data/####/554af6f213a28345_1
/data/data/####/559ab4ae0ece4775_0
/data/data/####/559d2eb009d64ad6_0
/data/data/####/559d2eb009d64ad6_1
/data/data/####/56854927baa18234_0
/data/data/####/626fbf25f5a63c0a_0
/data/data/####/62cac2fef68d7a01_0
/data/data/####/62cac2fef68d7a01_1
/data/data/####/6c39c58e0a91c597_0
/data/data/####/6c7b5a24ce668f8f_0
/data/data/####/7609f4c33ab4c2ce_0
/data/data/####/788b16dbec763fde3a86434734effe76-header
/data/data/####/788b16dbec763fde3a86434734effe76cache
/data/data/####/82e9b6ec21b301a2_0
/data/data/####/881b712587d6f0c1_0
/data/data/####/8953b190443d8068_0
/data/data/####/8abecbf8b4759ea8_0
/data/data/####/90cd765c3133686f_0
/data/data/####/92c1ccfb201228a0_0
/data/data/####/92c1ccfb201228a0_1
/data/data/####/95f85c4a61c8be60_0
/data/data/####/98a550b07b3bf2a3_0 (deleted)
/data/data/####/9bdbb1133904f701_0
/data/data/####/9e1a7ea60430c2fb_0
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/Language.db-journal
/data/data/####/MessageStore.db-journal
/data/data/####/P-2797
/data/data/####/TutuApp_ID.xml
/data/data/####/TutuMarket.db-journal
/data/data/####/TutuUser.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UTUT0DIORD0GNEF0MOC.st
/data/data/####/UnityAdsCache-b883b1971981b666d824a1fd514e55c43...d.webm
/data/data/####/UnityAdsCache-c87977a6fe18866a438137eb181616593...fd.png
/data/data/####/UnityAdsCache-e99f94e7f4f6e11931009bee4ae1f14e2...dc.jpg
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/UnityAdsTest.txt (deleted)
/data/data/####/UnityAdsWebApp.html
/data/data/####/UnityAdsWebViewConfiguration.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp.bak
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/a1803008fc940ae8_0
/data/data/####/a1803008fc940ae8_1
/data/data/####/a21ac668c4bd394d_0
/data/data/####/a21ac668c4bd394d_1
/data/data/####/a6a1550ae3b2a1ab_0
/data/data/####/ab401fff41f8e847aee5333e9be798d6
/data/data/####/ab401fff41f8e847aee5333e9be798d6-header
/data/data/####/ab401fff41f8e847aee5333e9be798d6cache (deleted)
/data/data/####/al.xml
/data/data/####/androidxcorealc0z.
/data/data/####/androidxcorealc0z.dex
/data/data/####/androidxcorealc0z.dex.flock (deleted)
/data/data/####/b6d08604c3e917f7_0
/data/data/####/b8a3ae4cae3d7cad_0
/data/data/####/b8fc8f02647985e4_0
/data/data/####/c15f7f54d4b26817_0 (deleted)
/data/data/####/c51b67da189385ef_0
/data/data/####/cd2e53b5a788bbce_0
/data/data/####/cd2e53b5a788bbce_1
/data/data/####/cdt.wa
/data/data/####/cf407382fa254e7b_0
/data/data/####/com.amplitude.api
/data/data/####/com.amplitude.api-journal
/data/data/####/com.feng.droid.tutu.xml
/data/data/####/com.feng.droid.tutu_ct_default.xml
/data/data/####/com.feng.droid.tutu_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core.xml
/data/data/####/cr.wa
/data/data/####/crash_log_sp.xml
/data/data/####/d9e326f8882a3dc4_0
/data/data/####/dbcaa4ffa94f9301_0
/data/data/####/dda0d067ae181864_0
/data/data/####/dda0d067ae181864_1
/data/data/####/ddfa71e0bb44c077_0
/data/data/####/dt.wa
/data/data/####/e0e4fde25ef820c8_0
/data/data/####/efsid3522
/data/data/####/excellent_appic_sdk.xml
/data/data/####/excellent_appic_sdk.xml.bak
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f1af79109bd28cf4_0
/data/data/####/f554859bc5ce3d24_0
/data/data/####/f554859bc5ce3d24_1
/data/data/####/f5560755909bda41_0 (deleted)
/data/data/####/fc8f2ddc38709b92201a5d3bc1bf9004
/data/data/####/fc8f2ddc38709b92201a5d3bc1bf9004-header
/data/data/####/fc8f2ddc38709b92201a5d3bc1bf9004cache
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_enable.xml
/data/data/####/https_play.google.com_0.localstorage-journal
/data/data/####/https_www.google.com_0.localstorage-journal
/data/data/####/i==1.2.0&&4.1.5_1658447076627_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/metrics_guid
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/rsdk_place_cache.xml
/data/data/####/rsdk_url_cache.xml
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s==7.1.4&&4.1.5_1658447075560_dW1weF9zaGFyZQ==;.log
/data/data/####/sendlock
/data/data/####/share.db-journal
/data/data/####/shell_config
/data/data/####/sonic.db-journal
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/sp_ytuetryetr.xml
/data/data/####/t==9.3.8&&4.1.5_1658447079644_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_log_file
/data/data/####/the-real-index
/data/data/####/tutu_crash.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_common_config.xml.bak (deleted)
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/unityads-installinfo.xml
/data/data/####/ver
/data/data/####/wa_gzip_1_1_3522_351_1658447128998
/data/data/####/wa_none_1_1_3522_9431_1658447068733
/data/data/####/z==1.2.0&&4.1.5_1658447066189_emNmZw==;.log
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
getprop
getprop ro.debuggable
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Загружает динамические библиотеки:

libcrashsdk
libumeng-spy

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS7Padding
DES
desede-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней