Android.Hidden.12843

Техническая информация

Вредоносные функции:

Скрывает свою иконку с экрана.

Сетевая активность:

Подключается к:

UDP(???) rr5---s####.g####.com:443
UDP(???) 64.2####.162.102:443
UDP(???) 2####.244.23.238:3074
UDP(???) p####.google####.com:443
UDP(???) pla####.google####.com:443
UDP(???) rr1---s####.g####.com:443
TCP(???) 2####.126.6.26:8082
UDP(???) rr3---s####.g####.com:443
TCP(DNS) <Google DNS>
UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) rr5---s####.g####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) rr1---s####.g####.com:443
TCP(TLS/1.2) 1####.251.154.119:443
TCP(TLS/1.2) 74.1####.131.94:443
TCP(TLS/1.2) 1####.177.14.102:443
TCP(TLS/1.2) p####.google####.com:443

Запросы DNS:

and####.a####.go####.com
and####.google####.com
android####.go####.com
app-mea####.com
connect####.gst####.com
p####.google####.com
pla####.google####.com
rr1---s####.g####.com
rr3---s####.g####.com
rr5---s####.g####.com
www.google####.com

Изменения в файловой системе:

Создает следующие файлы:

/data/adb/####/99comandroidproviderscloudsync
/data/app/####/.x86
/data/app/####/.x86_64
/data/app/####/com.google.android.gms.apk
/data/app/####/config.en
/data/app/####/config.mdpi
/data/app/####/libAppDataSearch.so
/data/app/####/libandroidx.graphics.path.so
/data/app/####/libashmem_utils_jni.so
/data/app/####/libbarhopper_qr_only_jni.so
/data/app/####/libbetocore.so
/data/app/####/libbluestar_jni_android.so
/data/app/####/libchreap_ar_airplane_napp.so
/data/app/####/libdatastore_shared_counter.so
/data/app/####/libframesequence.so
/data/app/####/libgeller_jni_lite_lib.so
/data/app/####/libgmscore.so
/data/app/####/libgoogle-ocrclient-v3.so
/data/app/####/libimage_processing_util_jni.so
/data/app/####/libinertial-anchor-jni.so
/data/app/####/libink.so
/data/app/####/libisolation_mgr_jni.so
/data/app/####/libjnidispatch.so
/data/app/####/libldt_np_jni.so
/data/app/####/liboak_attestation_verification_jni.so
/data/app/####/libodlh_proxy_jni.so
/data/app/####/libodlh_stub_jni.so
/data/app/####/libpqrnn_jni_gms_client.so
/data/app/####/libsemanticlocation_inference_jni.so
/data/app/####/libsslwrapper_jni.so
/data/app/####/libsurface_util_jni.so
/data/app/####/libtensorflowlite_jni_gms_client.so
/data/app/####/libwearable-selector.so
/data/app/####/libzwrapper.so
/data/app/####/tmp.2E9Pqo
/data/app/####/tmp.2Vp1GP
/data/app/####/tmp.7PdvCH
/data/app/####/tmp.8Q3Rgq
/data/app/####/tmp.CwY9nt
/data/app/####/tmp.H0GMZe
/data/app/####/tmp.JJb52v
/data/app/####/tmp.Js9mtA
/data/app/####/tmp.MqpuWY
/data/app/####/tmp.TsJbbX
/data/app/####/tmp.baMcGd
/data/app/####/tmp.gzRMzB
/data/app/####/tmp.pZz9ma
/data/app/####/tmp.rBvfoB
/data/app/####/tmp.y3bBn0
/data/dalvik-cache/####/system@framework@am.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
/data/dalvik-cache/####/system@framework@pm.jar@classes.dex.flo...leted)
/data/data/####/.cloud_shell_guard
/data/data/####/.cs_probe
/data/data/####/proc_auxv
/data/data/####/sync_guard
/data/local/shi5l2fn.tmp
/data/local/shirlx5c.tmp
/data/local/shre9clt.tmp
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c /data/user/0/<Package>/files/.compat/sync_guard </dev/null >/dev/null 2>&1 &
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c nohup /data/app/<Package>-1/lib/arm/libwatchdog.so <Package> /data/local/tmp/.cs_-760457492.apk & </dev/null >/dev/null 2>&1
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh /data/user/0/<Package>/files/.compat/sync_guard
/system/bin/su
/system/bin/su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 sh
/system/bin/su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su root sh
/system/bin/su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su sh
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libwatchdog.so /data/app/<Package>-1/lib/arm/libwatchdog.so <Package> /data/local/tmp/.cs_-760457492.apk
/system/xbin/su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.POST_NOTIFICATIONS
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
cat << 'BOOTEOF' > '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
cat << 'BOOTEOF' > '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
cat << 'BOOTEOF' > '/data/adb/service.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/service.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/service.d/99comandroidproviderscloudsync'
cmd activity set-standby-bucket <Package> active
cmd appops set <Package> RUN_ANY_IN_BACKGROUND allow
cmd appops set <Package> RUN_IN_BACKGROUND allow
cmd deviceidle except-idle-whitelist +<Package>
cmd deviceidle whitelist +<Package>
cp '/data/app/<Package>-1/base.apk' '/data/local/tmp/.cs_-760457492.apk' && chmod 644 '/data/local/tmp/.cs_-760457492.apk'
dumpsys batterystats --reset <Package>
dumpsys deviceidle whitelist +<Package>
echo -1000 > /proc/6053/oom_score_adj
echo -1000 > /proc/7087/oom_score_adj
echo -17 > /proc/6053/oom_adj
echo -17 > /proc/7087/oom_adj
for lock in <Package Folder>/files/.cloud_sync_guard /data/user/0/<Package>/files/.cloud_sync_guard <Package Folder>/files/.cloud_shell_guard /data/user/0/<Package>/files/.cloud_shell_guard /data/local/tmp/.csg_<Package>; do [ -f "$lock" ] && kill -9 "$(cat "$lock" 2>/dev/null)" 2>/dev/null; done; for f in /proc/[0-9]*/cmdline; do pid=${f#/proc/}; pid=${pid%/cmdline}; line=$(tr '\0' ' ' <"$f" 2>/dev/null); case "$line" in *libwatchdog.so*|*sync_guard*|*cloud_sync_guard*|*cloud_shell_guard*) kill -9 "$pid" 2>/dev/null; ;; esac; done; pkill -9 -f libwatchdog.so 2>/dev/null; pkill -9 -f libbot.so 2>/dev/null; pkill -9 -f libsynchelper.so 2>/dev/null; pkill -9 -f sync_guard 2>/dev/null; pkill -9 -f '/files/.compat/sync_guard' 2>/dev/null; pkill -9 -f '/files/.w' 2>/dev/null; true
id
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
mkdir -p '/data/adb/ksu/post-mount.d'
mkdir -p '/data/adb/post-fs-data.d'
mkdir -p '/data/adb/service.d'
pm grant <Package> android.permission.PACKAGE_USAGE_STATS
pm grant <Package> android.permission.POST_NOTIFICATIONS
pm grant <Package> android.permission.READ_EXTERNAL_STORAGE
pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
pm grant <Package> android.permission.SCHEDULE_EXACT_ALARM
pm grant <Package> android.permission.WRITE_EXTERNAL_STORAGE
rm -f '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
rm -f '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
rm -f '/data/adb/service.d/99comandroidproviderscloudsync'
rm -f /data/local/tmp/.cs_[0-9]*.apk
rm -f <Package Folder>/files/.cloud_sync_guard <Package Folder>/files/.cloud_shell_guard <Package Folder>/files/.compat/sync_guard <Package Folder>/files/.nwp <Package Folder>/files/.wp <Package Folder>/files/.w /data/user/0/<Package>/files/.cloud_sync_guard /data/user/0/<Package>/files/.cloud_shell_guard /data/user/0/<Package>/files/.compat/sync_guard /data/user/0/<Package>/files/.nwp /data/user/0/<Package>/files/.wp /data/user/0/<Package>/files/.w /data/local/tmp/.csg_<Package> /data/local/tmp/.nwp_<Package>
sh
su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su 0 id
su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
which su

Загружает динамические библиотеки:

libattack
libdns

Использует повышенные привилегии.

Отрисовывает собственные окна поверх других приложений.

Пытается определить окружение песочницы.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней