Android.Triada.5438

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.573.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) api.applove####.com:80
TCP(HTTP/1.1) img.atomhik####.com:80
TCP(HTTP/1.1) sdk-####.ro####.io:80
TCP(HTTP/1.1) lo####.applove####.com:80
TCP(HTTP/1.1) stset####.ro####.io:80
TCP(TLS/1.0) app.appsf####.com:443
TCP(TLS/1.0) p####.tut####.com:443
TCP(TLS/1.0) a####.ampli####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) lo####.suibyu####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) g####.atomhik####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) o####.azh####.com:9190
TCP(TLS/1.0) af.a####.pro:443
TCP(TLS/1.0) t####.mob####.com:443
TCP(TLS/1.0) seven####.com:443
TCP(TLS/1.0) analy####.atomhik####.com:443
TCP(TLS/1.0) c####.atomhik####.com:443
TCP(TLS/1.0) httpk####.unit####.uni####.com:443
TCP(TLS/1.0) adash####.man.aliy####.com:443
TCP(TLS/1.0) img.atomhik####.com:443
TCP(TLS/1.0) impres####.appsf####.com:443
TCP(TLS/1.0) ap####.tut####.net:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) www.glb.pa####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) zi####.b####.com:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) publish####.unit####.uni####.com:443
TCP(TLS/1.2) 64.2####.165.139:443
TCP(TLS/1.2) www.google####.com:443
TCP a####.ampli####.com:443
TCP openj####.m.ta####.com:80
TCP zb-cent####.m.ta####.com:443
UDP www.google####.com:443
TCP www.glb.pa####.com:443

Запросы DNS:

a####.ampli####.com
a####.man.aliy####.com
a####.u####.com
af.a####.pro
afn####.atom####.com
amdc####.m.ta####.com
analy####.atomhik####.com
ap####.tut####.com
ap####.tut####.net
api.applove####.com
api.atomhik####.com
app.appsf####.com
auction####.unit####.uni####.com
c####.atomhik####.com
co####.unit####.uni####.com
conf####.unit####.uni####.com
er####.u####.com
f####.gst####.com
g####.atomhik####.com
httpk####.unit####.uni####.com
img.atomhik####.com
impres####.appsf####.com
lo####.applove####.com
lo####.suibyu####.com
log.u####.com
m####.go####.com
msg.umengc####.com
o####.azh####.com
p####.f####.com
p####.f####.com.####.8
p####.tut####.com
publish####.unit####.uni####.com
pv.s####.com
sdk-####.ro####.io
sdk.adti####.com
sett####.atomhik####.com
seven####.com
stset####.ro####.io
t####.mob####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
www.google####.com
www.pa####.com

Запросы HTTP GET:

af.a####.pro:443/ru.tinkoff.investing?pid=####&af_siteid=####&c=####&af_...
api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
app.appsf####.com:443/com.apegroup.mcdonaldsrussia?pid=####&af_siteid=##...
app.appsf####.com:443/com.zvooq.openplay?pid=####&af_siteid=####&c=####&...
app.appsf####.com:443/robot.zaimer.ru?pid=####&af_siteid=####&c=####&af_...
app.appsf####.com:443/ru.filit.mvideo.b2c?pid=####&af_siteid=####&c=####...
app.appsf####.com:443/ru.kfc.kfc_delivery?pid=####&af_siteid=####&c=####...
app.appsf####.com:443/ru.more.play?pid=####&af_siteid=####&c=####&af_cli...
app.appsf####.com:443/ru.tinkoff.investing?pid=####&af_siteid=####&c=###...
app.appsf####.com:443/ru.vkusvill?pid=####&af_siteid=####&c=####&af_clic...
def####.duals####.cn.####.com:443/bar/get/541835c1fd98c51ee3010b68/?pcv=...
gd.a.s####.com:443/cityjson
img.atomhik####.com/static/sdk/AD_mark.png
img.atomhik####.com:443/static/sdk/AD_close.png
img.atomhik####.com:443/static/sdk/AD_mute.png
img.atomhik####.com:443/static/sdk/AD_voice.png
img.atomhik####.com:443/static/sdk/AD_webview_close.png
impres####.appsf####.com:443/com.zvooq.openplay?pid=####&af_siteid=####&...
impres####.appsf####.com:443/ru.banki.banki?pid=####&af_siteid=####&c=##...
lo####.applove####.com/agreement/v1/upload?consent_value=####&consent_ty...
lo####.suibyu####.com:443/android/v1/impression?slot=####&doimp=####&pkg...
p####.tut####.com:443/photo/da/2022/08/02/08/rxliqxt341hz.jpg
p####.tut####.com:443/photo/da/2022/08/17/16/w8b8ixrn9opi.jpg
p####.tut####.com:443/photo/da/2022/08/18/11/uw9w34urib6k.jpg
p####.tut####.com:443/photo/da/2022/08/25/15/n9rzbiql66ha.jpg
p####.tut####.com:443/photo/da/2022/09/09/14/70b4n1wub0qv.jpg
p####.tut####.com:443/photo/da/2022/09/09/14/toknabh7xrs9.jpg
p####.tut####.com:443/photo/da/2022/09/16/14/092desmb7dad.jpg
p####.tut####.com:443/photo/da/2022/09/16/15/uzh9xedzta73.jpg
p####.tut####.com:443/photo/da/2022/09/22/17/5b8dsn1gxqps.jpg
p####.tut####.com:443/photo/da/2022/09/22/17/couw29mt7s5e.jpg
p####.tut####.com:443/picture/app_android/en/002/51/05/56/cover_2510556_...
p####.tut####.com:443/picture/app_android/us/2021/04/21/gn03hbu0lngcfv6j...
p####.tut####.com:443/picture/app_ios/us/2022/05/05/09/iag2b5rs54z8.jpg
p####.tut####.com:443/picture/app_ios/us/2022/08/23/14/edggu2tcx1nv.jpg
p####.tut####.com:443/picture/app_ios/us/2022/09/09/10/tw0nungzwzu7.jpg
p####.tut####.com:443/picture/app_ios/us/2022/09/27/14/wtcnxdwrc2ed.jpg
publish####.unit####.uni####.com:443/games/3810785/configuration?deviceM...
publish####.unit####.uni####.com:443/webview/4.1.0/release/config.json?t...
sdk.adti####.com:443/ck?v=####&sdkv=####&k=####&make=####&brand=####&mod...
stset####.ro####.io/ad/v1?mc=####&mb=####&ifa=####&os_v=####&ma=####&mcc...
t####.mob####.com:443/offer?offer_id=####&aff_id=####&aff_sub####&aff_pu...
t####.mob####.com:443/offer?offer_id=####&aff_id=####&aff_sub=####&aff_p...
unit####.edges####.net:443/webview/4.0.0/fde563b7ed73f6e5a167186c35cf95c...
zi####.b####.com:443/ws?udid=####

Запросы HTTP POST:

adash####.man.aliy####.com:443/man/api?ak=####&s=####
al####.u####.com:443/umpx_push_launch
al####.u####.com:443/umpx_push_register
al####.u####.com:443/umpx_share
al####.u####.com:443/unify_logs
al####.u####.com:443/zcfg
analy####.atomhik####.com:443/offerd/v2
analy####.atomhik####.com:443/v1/ads
analy####.atomhik####.com:443/v1/sdk_event
ap####.tut####.net:443/apiandroid/api/CheckTutuVersion
ap####.tut####.net:443/apiandroid/api/checkTutuAdsCompany
ap####.tut####.net:443/apiandroid/apiAndroid/GetHomeSpecialList
ap####.tut####.net:443/apiandroid/apiAndroid/adSwitcher
ap####.tut####.net:443/apiandroid/apiAndroid/chaos
ap####.tut####.net:443/apiandroid/apiAndroid/checkAppVersion
ap####.tut####.net:443/apiandroid/apiAndroid/getDomainByIp
ap####.tut####.net:443/apiandroid/apiAndroid/getListDataIntl
ap####.tut####.net:443/apiandroid/apiAndroid/getMessageTotalNum
ap####.tut####.net:443/apiandroid/apiAndroid/getMostPlayList
ap####.tut####.net:443/apiandroid/apiAndroid/getNewGameAndAppList
ap####.tut####.net:443/apiandroid/apiAndroid/getRecentUpdateList
ap####.tut####.net:443/apiandroid/apiAndroid/getSearchBoxKeywordIntl
ap####.tut####.net:443/apiandroid/apiAndroid/getServerTime
ap####.tut####.net:443/apiandroid/apiAndroid/getSpecialShow
c####.atomhik####.com:443/myapi/event
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
g####.atomhik####.com:443/gate/auth
g####.atomhik####.com:443/gate/cfg
httpk####.unit####.uni####.com:443/v1/events
lo####.applove####.com/android/v2/click_redirect
msg.umengc####.com:443/alias
new-####.u####.com:443/api/postZdata
nginx-a####.unit####.uni####.com:443/v6/games/3810785/requests?idfi=####...
o####.azh####.com:9190/downSdkEncryption
publish####.unit####.uni####.com:443/privacy/3810785/state
sdk-####.ro####.io/sdk_analytics
sdk.adti####.com:443/al?did=####&k=####&v=####&sdkv=####
sdk.adti####.com:443/cl?v=####&plat=####&mv=####&sdkv=####
sdk.adti####.com:443/conf?v=####&plat=####&k=####&sv=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.old_file_converted
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex.flock (deleted)
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex.temp
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/Language.db-journal
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/REDAOLNWODELIF1UTUT0DIORD0GNEF0MOC.st
/data/data/####/TutuApp_ID.xml
/data/data/####/TutuMarket.db-journal
/data/data/####/TutuUser.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UTUT0DIORD0GNEF0MOC.st
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp.bak
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/accs.db-journal
/data/data/####/al.xml
/data/data/####/androidxcorealc0z.
/data/data/####/androidxcorealc0z.dex (deleted)
/data/data/####/androidxcorealc0z.dex.flock (deleted)
/data/data/####/apfiledownloader.db-journal
/data/data/####/cdt.wa
/data/data/####/com.amplitude.api
/data/data/####/com.amplitude.api-journal
/data/data/####/com.feng.droid.tutu.xml
/data/data/####/com.feng.droid.tutu.xml.bak
/data/data/####/com.feng.droid.tutu_ct_default.xml
/data/data/####/com.feng.droid.tutu_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info_com.fe...loader
/data/data/####/core.xml
/data/data/####/cr.wa
/data/data/####/crash_log_sp.xml
/data/data/####/dt.wa
/data/data/####/efsid3553
/data/data/####/excellent_appic_sdk.xml
/data/data/####/excellent_appic_sdk.xml.bak
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/filedownloader_umeng_common_config.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_enable.xml
/data/data/####/i==1.2.0&&4.1.6_1664496530023_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/model.xml
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/p==6.3.3&&4.1.6_1664496534317_dW1weF9wdXNoX3JlZ...y;.log
/data/data/####/p==6.3.3&&4.1.6_1664496539760_dW1weF9wdXNoX2xhd...=;.log
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/rx_user.xml
/data/data/####/rxsdk.db-journal
/data/data/####/s==7.1.4&&4.1.6_1664496528768_dW1weF9zaGFyZQ==;.log
/data/data/####/sendlock
/data/data/####/share.db-journal
/data/data/####/shell_config
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/sp_ytuetryetr.xml
/data/data/####/t==9.3.8&&4.1.6_1664496532491_dW5pZnlfbG9ncw==;.log
/data/data/####/temp-index
/data/data/####/temp_log_file
/data/data/####/tutu_crash.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/unique
/data/data/####/unityads-installinfo.xml
/data/data/####/ver
/data/data/####/wa_gzip_1_1_3553_6158_1664496583418
/data/data/####/wa_gzip_1_1_3553_6451_1664496562767
/data/data/####/wa_none_1_1_3553_9514_1664496523362
/data/data/####/z==1.2.0&&4.1.6_1664496521466_emNmZw==;.log
/data/media/####/.nomedia
/data/media/####/017D614924ADB89C3C7BA46068549B06
/data/media/####/02491668F0A8727C8237682D53EA89F2
/data/media/####/024E741D3CBF289612401A21D1DBC3A2
/data/media/####/025A542A5B8733CC335AADD6192B6867
/data/media/####/04A9F583B603D068BF68BF7238C371FD
/data/media/####/05DA00BA89A0C9540E4F1EC6EE4E801F
/data/media/####/065BE5ED3B86995B33FE7F5EC3B2D208
/data/media/####/08D43291968908030C84E5902D38A860
/data/media/####/0A8448439C2E29A8123A07B258D94D1D
/data/media/####/0DFEBA1E678BC92B3256E7D185A0B9EE
/data/media/####/157F638E839818C6D9B4EBFB56DBB5CD
/data/media/####/16B21C4C9E3C0F3B2160CD8AFAE6190F
/data/media/####/21325BC6472BE8A903CFE1E34A56E008
/data/media/####/21D02530C0F6C0A6C242A1B5E477AA38
/data/media/####/2429CF59B5A6A4653699B5FB3EEFB4DB
/data/media/####/278DA0DC014D39B052E4B352D6B90763
/data/media/####/2B4B8365953926CE0A5CBD0C9B9B90B0
/data/media/####/2B6782682BC4016ABE23BAA9BC769C21
/data/media/####/2D7E168BD1406081A7A624D5D3D93CBC
/data/media/####/2F309E789EDF45B7208411417CB9EF8E
/data/media/####/34DA66B1226519CAD6272A3C42A12048
/data/media/####/3844C6AE92787AA510BE3093B493AF86
/data/media/####/3EF961ACD537449422B808D517E7A9F6
/data/media/####/462CBC74B99700A449511407ADBBE41C
/data/media/####/466CC7432BDD65FB9A4E6DB29E68B7D7
/data/media/####/49AE355201728671B3ECAB3A85B8A2F7
/data/media/####/4E268401CCB6BAED4851446C2C57F35B
/data/media/####/50F329DA85144624861188FA7B50AEB8
/data/media/####/52C1084E9EF9EA1D963828CE39411636
/data/media/####/53B556790A6C7B5470C1025B9C3E44A7
/data/media/####/560E1CD02D107A9760BE1BC6D3600636
/data/media/####/56E5F2C7CA805A196F945069F2217052
/data/media/####/5A45B7D04A36CB5FECA19453BFBE6C5D
/data/media/####/5C31C75A38EC160C76E3588B91274DD2
/data/media/####/62B45097E57CD531FA20B23DB7403D29
/data/media/####/6BC06E65DB888985742186E4DA320FA4
/data/media/####/6E4DE0D3A5CC3944EED3BA49C8448D01
/data/media/####/74A7067BFB1891623C14AC40E45ED2DB
/data/media/####/77623068E14B09CE972BEAD970D8F215
/data/media/####/7D2799A692F861718DCB72DF030F042F
/data/media/####/7DD1E53023CEF7D4925E8D8FBCF76B37
/data/media/####/7E89D03BEFB0C56ADC0B0B48AAFE0E78
/data/media/####/80C241A3FBF0D77BEB6A7B1AD1BA1A3A
/data/media/####/81067917945403B41B928EED040020FB
/data/media/####/82522DBC9D91E8FD3FCF45AD36CACD46
/data/media/####/843BD8DACDABE7226763824C981BA3CB
/data/media/####/84CB0BFD9725F8C88780871E86359273
/data/media/####/86D2782342FCE44BFA0AA9BF1F26F1DA
/data/media/####/8A9742AD8531D03C23650ABC0CB2B56E
/data/media/####/8A9B0CEB58E516E4DC78EEEE52C0850B
/data/media/####/8F15BB71ABD521563E357B8E63020E74
/data/media/####/9088A2827166219A323F7B9A1A54DC9A
/data/media/####/9288E38C16A737D75DDA35CA902F2292
/data/media/####/94AED0049822FDE0850B22FB45A0E296
/data/media/####/970D4214E438245C03690BB59AAE7C54
/data/media/####/984B599B6B201AA31E74EFD484F4E55E
/data/media/####/985A56D11C4ABF96218305D0381476B6
/data/media/####/993CB7238F0724BCD10C2EBEE29D1E7D
/data/media/####/9E6610FC3EA6DF0FC591A0203ABFF487
/data/media/####/A5172A7ACCE39E0719D4B075D0A3343F
/data/media/####/A6D0896EB7F8372AE4D5CF0088B70945
/data/media/####/AF0F898C17C7D9CEC0D5DA20D6E9105B
/data/media/####/Alvin2.xml
/data/media/####/B352A6C307D85E43EADA3308F431CA1D
/data/media/####/BA580F70093BB516954A4D08313A90FB
/data/media/####/C458B340901578D733FB20410E7186A0
/data/media/####/C5B51F11F622CF342792FE919498F445
/data/media/####/C746EBC504973FDD78611D69F673656E
/data/media/####/CDCA4DEF3412208E599D95F2935946FB
/data/media/####/CECD7C1E4947BFD7599552D6F099A578
/data/media/####/ContextData.xml
/data/media/####/D0BBD894AF2BCA7FFF043E73C341ACB3
/data/media/####/D53B3FA5D6172CE675CF0770B42E86BC
/data/media/####/D89D2AA7F3F2F1C9059F7A5075358E31
/data/media/####/DCD916F725AA0EA7ECD83E1039500CDF
/data/media/####/E1CF4644484E67C03706E60873464481
/data/media/####/E292AE0EF7270E01BE674B22AB7FF5D5
/data/media/####/E4FFDEE3CF092EF5AC74E3B82C5A10E5
/data/media/####/E6743317B8C97D586EF48D2804A1EAC8
/data/media/####/E7CBFA49020D656CE79876629F0CB7F4
/data/media/####/E91F6E6588EFB86DE75FF755D2C2C6FB
/data/media/####/E9C0E7C7A40E4FD86FEB8C0D1D37ADF2
/data/media/####/EDB73614AE77213AC15604C4F9E7EE7B
/data/media/####/F59C957CB4148FD01326B2B519542D9B
/data/media/####/F9B8757A27CB468DD433239069073641
/data/media/####/FA24781306B1741EF1EF582A8DCA7CF8
/data/media/####/FC2C82988C28EF3147BDCFA139D403F2
/data/media/####/FC40C8E11FD4C274F5ACCF12B4C952D9
/data/media/####/FD800A7615AE1618570E7A7165A79038
/data/media/####/TutuApp.bin
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/self/cgroup
getprop
getprop ro.debuggable
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list package -3
sh
sh -c type su

Загружает динамические библиотеки:

libcrashsdk
libtnet-3.1.14
libumeng-spy

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS7Padding
DES

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней