Android.Triada.5496

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Triada.573.origin
Android.Triada.587.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) sdk-####.ro####.io:80
TCP(HTTP/1.1) lo####.applove####.com:80
TCP(HTTP/1.1) stset####.ro####.io:80
TCP(HTTP/1.1) img.atomhik####.com:80
TCP(HTTP/1.1) api.applove####.com:80
TCP(TLS/1.0) seven####.com:443
TCP(TLS/1.0) p####.tut####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) pv.s####.com.####.com:443
TCP(TLS/1.0) adash####.man.aliy####.com:443
TCP(TLS/1.0) img.atomhik####.com:443
TCP(TLS/1.0) and####.tut####.com:443
TCP(TLS/1.0) afn####.atom####.com:443
TCP(TLS/1.0) publish####.unit####.uni####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) o####.azh####.com:9190
TCP(TLS/1.0) and-re####.tut####.com:443
TCP(TLS/1.0) a####.ampli####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) rr8---s####.g####.com:443
TCP(TLS/1.0) ads-sdk####.unit####.uni####.com:443
TCP(TLS/1.0) sdk.adti####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.0) sett####.atomhik####.com:443
TCP(TLS/1.0) rr16---####.g####.com:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) www.glb.pa####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) 1####.250.150.94:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) c####.atomhik####.com:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) httpk####.unit####.uni####.com:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.250.150.94:443
TCP(TLS/1.2) www.google####.com:443
TCP openj####.m.ta####.com:80
TCP a####.ampli####.com:443
TCP www.glb.pa####.com:443
TCP zb-cent####.m.ta####.com:443
TCP openj####.m.ta####.com:443

Запросы DNS:

a####.ampli####.com
a####.man.aliy####.com
a####.u####.com
afn####.atom####.com
amdc####.m.ta####.com
analy####.atomhik####.com
and####.cli####.go####.com
and####.tut####.com
and-re####.tut####.com
api.applove####.com
api.atomhik####.com
api.atomhik####.com.####.8
auction####.unit####.uni####.com
c####.atomhik####.com
co####.unit####.uni####.com
conf####.unit####.uni####.com
digital####.google####.com
er####.u####.com
f####.gst####.com
g####.atomhik####.com
httpk####.unit####.uni####.com
img.atomhik####.com
lo####.applove####.com
log.u####.com
m####.go####.com
msg.umengc####.com
o####.azh####.com
p####.f####.com
p####.f####.com.####.8
p####.tut####.com
pla####.googleu####.com
publish####.unit####.uni####.com
pv.s####.com
re####.atomhik####.com
rr16---####.g####.com
rr18---####.g####.com
rr8---s####.g####.com
sdk-####.ro####.io
sdk.adti####.com
sett####.atomhik####.com
seven####.com
stset####.ro####.io
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
www.google####.com
www.pa####.com

Запросы HTTP GET:

ads-sdk####.unit####.uni####.com:443/webview/4.1.0/release/config.json?t...
and-re####.tut####.com:443/ws?udid=####
api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
def####.duals####.cn.####.com:443/bar/get/541835c1fd98c51ee3010b68/?pcv=...
img.atomhik####.com/static/sdk/AD_mark.png
img.atomhik####.com:443/static/sdk/AD_close.png
img.atomhik####.com:443/static/sdk/AD_mute.png
img.atomhik####.com:443/static/sdk/AD_voice.png
img.atomhik####.com:443/static/sdk/AD_webview_close.png
lo####.applove####.com/agreement/v1/upload?consent_value=####&consent_ty...
p####.tut####.com:443/photo/da/2022/10/27/15/f0x3l5jlua22.jpg
p####.tut####.com:443/photo/da/2022/11/11/14/5w1mfaw9js3n.jpg
p####.tut####.com:443/photo/da/2022/11/18/14/ja7u9d4x8jy2.jpg
p####.tut####.com:443/photo/da/2022/12/02/15/n6bid25y9l6x.jpg
p####.tut####.com:443/photo/da/2023/02/10/13/3rgbkgcv5az3.jpg
p####.tut####.com:443/photo/da/2023/02/10/13/b4s8pr2s4r4d.jpg
p####.tut####.com:443/photo/da/2023/02/10/13/gisylnec5n3r.jpg
p####.tut####.com:443/photo/da/2023/02/10/13/omyrnj4m6511.jpg
p####.tut####.com:443/photo/da/2023/02/10/15/25hs1dy3q8wi.jpg
p####.tut####.com:443/picture/app_android/en/002/51/05/56/cover_2510556_...
p####.tut####.com:443/picture/app_ios/us/2021/09/23/14/oennajd9xda4.jpg
p####.tut####.com:443/picture/app_ios/us/2022/11/22/11/sdxoo2rw4u59.jpg
p####.tut####.com:443/picture/app_ios/us/2023/01/12/14/okhpdf8htt16.jpg
p####.tut####.com:443/picture/app_ios/us/2023/02/06/17/uorwp927122j.jpg
p####.tut####.com:443/picture/app_ios/us/2023/02/07/11/6oo9n1yybse3.jpg
p####.tut####.com:443/picture/app_ios/us/2023/02/14/14/65u81nunb2ep.jpg
publish####.unit####.uni####.com:443/games/3810785/configuration?deviceM...
pv.s####.com.####.com:443/cityjson
sdk.adti####.com:443/ck?v=####&sdkv=####&k=####&make=####&brand=####&mod...
stset####.ro####.io/ad/v1?mc=####&mb=####&ifa=####&os_v=####&ma=####&mcc...
unit####.edges####.net:443/webview/4.0.0/068dfe90aca99e3f4829d72e834a644...

Запросы HTTP POST:

adash####.man.aliy####.com:443/man/api?ak=####&s=####
ads-sdk####.unit####.uni####.com:443/privacy/3810785/state
afn####.atom####.com:443/offerd/v2
afn####.atom####.com:443/v1/sdk_event
and####.tut####.com:443/apiandroid/api/CheckTutuVersion
and####.tut####.com:443/apiandroid/api/checkTutuAdsCompany
and####.tut####.com:443/apiandroid/apiAndroid/GetHomeSpecialList
and####.tut####.com:443/apiandroid/apiAndroid/adSwitcher
and####.tut####.com:443/apiandroid/apiAndroid/chaos
and####.tut####.com:443/apiandroid/apiAndroid/checkAppVersion
and####.tut####.com:443/apiandroid/apiAndroid/getDomainByIp
and####.tut####.com:443/apiandroid/apiAndroid/getListDataIntl
and####.tut####.com:443/apiandroid/apiAndroid/getMessageTotalNum
and####.tut####.com:443/apiandroid/apiAndroid/getMostPlayList
and####.tut####.com:443/apiandroid/apiAndroid/getNewGameAndAppList
and####.tut####.com:443/apiandroid/apiAndroid/getRecentUpdateList
and####.tut####.com:443/apiandroid/apiAndroid/getSearchBoxKeywordIntl
and####.tut####.com:443/apiandroid/apiAndroid/getServerTime
and####.tut####.com:443/apiandroid/apiAndroid/getSpecialShow
c####.atomhik####.com:443/myapi/event
c####.atomhik####.com:443/myapi/pull
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
httpk####.unit####.uni####.com:443/v1/events
msg.umengc####.com:443/alias
new-####.u####.com:443/api/postZdata
nginx-a####.unit####.uni####.com:443/v6/games/3810785/requests?idfi=####...
o####.azh####.com:9190/downSdkEncryption
sdk-####.ro####.io/sdk_analytics
sdk.adti####.com:443/al?did=####&k=####&v=####&sdkv=####
sdk.adti####.com:443/cl?v=####&plat=####&mv=####&sdkv=####
sdk.adti####.com:443/conf?v=####&plat=####&k=####&sv=####
sett####.atomhik####.com:443/gate/auth
sett####.atomhik####.com:443/gate/cfg
seven####.com:443/AAService.svc/eweddsds
u####.u####.com:443/umpx_push_launch
u####.u####.com:443/umpx_push_register
u####.u####.com:443/umpx_share
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.old_file_converted
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex.flock (deleted)
/data/data/####/1454CF7407CD57BAF0B274D2BF8CA808.dex.temp
/data/data/####/5198275C9B059F3F59D3072BED34CE6B.dex
/data/data/####/5198275C9B059F3F59D3072BED34CE6B.dex.flock (deleted)
/data/data/####/5198275C9B059F3F59D3072BED34CE6B.dex.temp
/data/data/####/6a655f2a56a94c939b0833966df4d2c9
/data/data/####/ACCS_BINDdefault.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Language.db-journal
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/REDAOLNWODELIF1UTUT0DIORD0GNEF0MOC.st
/data/data/####/StrategyConfig
/data/data/####/TutuApp_ID.xml
/data/data/####/TutuMarket.db-journal
/data/data/####/TutuUser.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/UTUT0DIORD0GNEF0MOC.st
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp
/data/data/####/Y29uZmlnXzU0MTgzNWMxZmQ5OGM1MWVlMzAxMGI2OA.sp.bak
/data/data/####/_nohttp_cache_db.db
/data/data/####/_nohttp_cache_db.db-journal
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/accs.db-journal
/data/data/####/al.xml
/data/data/####/androidxcorealc0z.
/data/data/####/androidxcorealc0z.dex
/data/data/####/androidxcorealc0z.dex.flock (deleted)
/data/data/####/apfiledownloader.db-journal
/data/data/####/appicplay_ad.db
/data/data/####/appicplay_ad.db-journal
/data/data/####/cdt.wa
/data/data/####/com.amplitude.api
/data/data/####/com.amplitude.api-journal
/data/data/####/com.feng.droid.tutu.xml
/data/data/####/com.feng.droid.tutu.xml.bak
/data/data/####/com.feng.droid.tutu_ct_default.xml
/data/data/####/com.feng.droid.tutu_preferences.xml
/data/data/####/com.feng.droid.tutuye_after_install_pkg.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info_com.fe...loader
/data/data/####/core.xml
/data/data/####/cr.wa
/data/data/####/crash_log_sp.xml
/data/data/####/dt.wa
/data/data/####/efsid
/data/data/####/efsid3498
/data/data/####/excellent_appic_sdk.xml
/data/data/####/excellent_appic_sdk.xml.bak
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/filedownloader_umeng_common_config.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_enable.xml
/data/data/####/i==1.2.0&&4.1.9_1676589614334_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/metrics_guid
/data/data/####/model.xml
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/p==6.3.3&&4.1.9_1676589614708_dW1weF9wdXNoX3JlZ...y;.log
/data/data/####/p==6.3.3&&4.1.9_1676589623395_dW1weF9wdXNoX2xhd...=;.log
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/proc_auxv
/data/data/####/pv.wa
/data/data/####/rx_user.xml
/data/data/####/rxsdk.db-journal
/data/data/####/s1s1k1_c2o3n23f2i3g2.xml
/data/data/####/s==7.1.4&&4.1.9_1676589613997_dW1weF9zaGFyZQ==;.log
/data/data/####/sendlock
/data/data/####/share.db-journal
/data/data/####/shell_config
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/sp_ytuetryetr.xml
/data/data/####/sp_ytuetryetr.xml.bak
/data/data/####/t==9.3.8&&4.1.9_1676589616137_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_log_file
/data/data/####/the-real-index
/data/data/####/tutu_crash.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/unityads-installinfo.xml
/data/data/####/ver
/data/data/####/wa_gzip_1_1_3607_2951_1676589670473
/data/data/####/wa_gzip_1_1_3607_4636_1676589639729
/data/data/####/wa_none_1_1_3607_5447_1676589610465
/data/data/####/z==1.2.0&&4.1.9_1676589606052_emNmZw==;.log
/data/media/####/.nomedia
/data/media/####/017D614924ADB89C3C7BA46068549B06
/data/media/####/02491668F0A8727C8237682D53EA89F2
/data/media/####/024E741D3CBF289612401A21D1DBC3A2
/data/media/####/025A542A5B8733CC335AADD6192B6867
/data/media/####/04A9F583B603D068BF68BF7238C371FD
/data/media/####/05DA00BA89A0C9540E4F1EC6EE4E801F
/data/media/####/065BE5ED3B86995B33FE7F5EC3B2D208
/data/media/####/08D43291968908030C84E5902D38A860
/data/media/####/0A8448439C2E29A8123A07B258D94D1D
/data/media/####/0DFEBA1E678BC92B3256E7D185A0B9EE
/data/media/####/157F638E839818C6D9B4EBFB56DBB5CD
/data/media/####/16B21C4C9E3C0F3B2160CD8AFAE6190F
/data/media/####/21325BC6472BE8A903CFE1E34A56E008
/data/media/####/21D02530C0F6C0A6C242A1B5E477AA38
/data/media/####/2429CF59B5A6A4653699B5FB3EEFB4DB
/data/media/####/278DA0DC014D39B052E4B352D6B90763
/data/media/####/2B4B8365953926CE0A5CBD0C9B9B90B0
/data/media/####/2B6782682BC4016ABE23BAA9BC769C21
/data/media/####/2D7E168BD1406081A7A624D5D3D93CBC
/data/media/####/2F309E789EDF45B7208411417CB9EF8E
/data/media/####/34DA66B1226519CAD6272A3C42A12048
/data/media/####/3844C6AE92787AA510BE3093B493AF86
/data/media/####/3EF961ACD537449422B808D517E7A9F6
/data/media/####/462CBC74B99700A449511407ADBBE41C
/data/media/####/466CC7432BDD65FB9A4E6DB29E68B7D7
/data/media/####/49AE355201728671B3ECAB3A85B8A2F7
/data/media/####/4E268401CCB6BAED4851446C2C57F35B
/data/media/####/50F329DA85144624861188FA7B50AEB8
/data/media/####/52C1084E9EF9EA1D963828CE39411636
/data/media/####/53B556790A6C7B5470C1025B9C3E44A7
/data/media/####/560E1CD02D107A9760BE1BC6D3600636
/data/media/####/56E5F2C7CA805A196F945069F2217052
/data/media/####/5A45B7D04A36CB5FECA19453BFBE6C5D
/data/media/####/5C31C75A38EC160C76E3588B91274DD2
/data/media/####/62B45097E57CD531FA20B23DB7403D29
/data/media/####/6BC06E65DB888985742186E4DA320FA4
/data/media/####/6E4DE0D3A5CC3944EED3BA49C8448D01
/data/media/####/74A7067BFB1891623C14AC40E45ED2DB
/data/media/####/77623068E14B09CE972BEAD970D8F215
/data/media/####/7DD1E53023CEF7D4925E8D8FBCF76B37
/data/media/####/7E89D03BEFB0C56ADC0B0B48AAFE0E78
/data/media/####/80C241A3FBF0D77BEB6A7B1AD1BA1A3A
/data/media/####/81067917945403B41B928EED040020FB
/data/media/####/82522DBC9D91E8FD3FCF45AD36CACD46
/data/media/####/843BD8DACDABE7226763824C981BA3CB
/data/media/####/84CB0BFD9725F8C88780871E86359273
/data/media/####/86D2782342FCE44BFA0AA9BF1F26F1DA
/data/media/####/8A9742AD8531D03C23650ABC0CB2B56E
/data/media/####/8A9B0CEB58E516E4DC78EEEE52C0850B
/data/media/####/8B5B08A2EE6CC66FB01E48CE2CB79151
/data/media/####/8F15BB71ABD521563E357B8E63020E74
/data/media/####/8FF11575F6C38AFEAE76F84D9AE383BA
/data/media/####/9088A2827166219A323F7B9A1A54DC9A
/data/media/####/9288E38C16A737D75DDA35CA902F2292
/data/media/####/94AED0049822FDE0850B22FB45A0E296
/data/media/####/970D4214E438245C03690BB59AAE7C54
/data/media/####/984B599B6B201AA31E74EFD484F4E55E
/data/media/####/985A56D11C4ABF96218305D0381476B6
/data/media/####/993CB7238F0724BCD10C2EBEE29D1E7D
/data/media/####/9E6610FC3EA6DF0FC591A0203ABFF487
/data/media/####/A5172A7ACCE39E0719D4B075D0A3343F
/data/media/####/A6D0896EB7F8372AE4D5CF0088B70945
/data/media/####/AF0F898C17C7D9CEC0D5DA20D6E9105B
/data/media/####/Alvin2.xml
/data/media/####/B352A6C307D85E43EADA3308F431CA1D
/data/media/####/BA580F70093BB516954A4D08313A90FB
/data/media/####/C458B340901578D733FB20410E7186A0
/data/media/####/C5B51F11F622CF342792FE919498F445
/data/media/####/C746EBC504973FDD78611D69F673656E
/data/media/####/CDCA4DEF3412208E599D95F2935946FB
/data/media/####/CECD7C1E4947BFD7599552D6F099A578
/data/media/####/ContextData.xml
/data/media/####/D0BBD894AF2BCA7FFF043E73C341ACB3
/data/media/####/D53B3FA5D6172CE675CF0770B42E86BC
/data/media/####/D89D2AA7F3F2F1C9059F7A5075358E31
/data/media/####/DCD916F725AA0EA7ECD83E1039500CDF
/data/media/####/E1CF4644484E67C03706E60873464481
/data/media/####/E292AE0EF7270E01BE674B22AB7FF5D5
/data/media/####/E4FFDEE3CF092EF5AC74E3B82C5A10E5
/data/media/####/E6743317B8C97D586EF48D2804A1EAC8
/data/media/####/E7CBFA49020D656CE79876629F0CB7F4
/data/media/####/E91F6E6588EFB86DE75FF755D2C2C6FB
/data/media/####/E9C0E7C7A40E4FD86FEB8C0D1D37ADF2
/data/media/####/EDB73614AE77213AC15604C4F9E7EE7B
/data/media/####/F59C957CB4148FD01326B2B519542D9B
/data/media/####/F9B8757A27CB468DD433239069073641
/data/media/####/FA24781306B1741EF1EF582A8DCA7CF8
/data/media/####/FC2C82988C28EF3147BDCFA139D403F2
/data/media/####/FC40C8E11FD4C274F5ACCF12B4C952D9
/data/media/####/FD800A7615AE1618570E7A7165A79038
/data/media/####/TutuApp.bin
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsTest.txt (deleted)
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.pm.Pm list package -3
cat /proc/self/cgroup
getprop
getprop ro.debuggable
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
ls -l /system/bin/su
ls /
ls /sys/class/thermal
pm list package -3
sh
sh -c type su

Загружает динамические библиотеки:

libcrashsdk
libumeng-spy

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5PADDING
AES-CBC-PKCS7Padding
DES
desede-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней