{"id":58133,"date":"2018-12-05T09:00:34","date_gmt":"2018-12-05T01:00:34","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=58133"},"modified":"2018-12-04T16:37:43","modified_gmt":"2018-12-04T08:37:43","slug":"google-play%e5%87%ba%e7%8f%be%e5%81%87%e8%aa%9e%e9%9f%b3%e6%87%89%e7%94%a8%e7%a8%8b%e5%bc%8f%ef%bc%8c%e7%ab%8a%e5%8f%96%e5%a7%93%e5%90%8d%e9%9b%bb%e8%a9%b1%e4%bd%8f%e5%9d%80%e7%ad%89%e5%80%8b%e8%b3%87","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=58133","title":{"rendered":"Google Play\u51fa\u73fe\u5047\u8a9e\u97f3\u61c9\u7528\u7a0b\u5f0f\uff0c\u7aca\u53d6\u59d3\u540d\u96fb\u8a71\u4f4f\u5740\u7b49\u500b\u8cc7"},"content":{"rendered":"

\u8da8\u52e2\u79d1\u6280<\/a><\/u>\u6ce8\u610f\u5230Google Play\u4e0a\u6709\u597d\u5e7e\u500b\u507d\u88dd\u6210\u8a9e\u97f3\u8a0a\u606f\u5e73\u53f0\u7684App(\u61c9\u7528\u7a0b\u5f0f),\u6703\u81ea\u52d5\u8df3\u51fa\u5047\u8abf\u67e5\u548c\u9032\u884c\u6b3a\u8a50\u6027\u5ee3\u544a\u9ede\u64ca\u3002\u9019\u4e9b\u60e1\u610f\u61c9\u7528\u7a0b\u5f0f\u8b8a\u7a2e\u5f9e10\u6708\u958b\u59cb\u9678\u7e8c\u51fa\u73fe\uff0c\u672a\u4f86\u53ef\u80fd\u767c\u52d5\u6bad\u5c4d\u7db2\u8def\u7b49\u60e1\u610f\u653b\u64ca\u3002\u96d6\u7136\u76ee\u524d\u611f\u67d3\u6578\u91cf\u4ecd\u4e0d\u5927\u56b4\u91cd\uff0c\u4f46\u56e0\u70ba\u5176\u5feb\u901f\u7684\u767c\u5c55\u53ca\u5728\u884c\u52d5\u751f\u614b\u7cfb\u5167\u7684\u6563\u64ad\u884c\u70ba\uff0c\u4ecd\u9808\u6301\u7e8c\u89c0\u5bdf\u76f8\u95dc\u61c9\u7528\u7a0b\u5f0f\u4e0a\u50b3\u548c\u4f7f\u7528\u8005\u4e0b\u8f09\u7684\u72c0\u6cc1\u3002<\/p>\n

\"\"<\/a><\/p>\n

\u4f86\u81ea\u4e03\u500b\u5df2\u77e5\u61c9\u7528\u7a0b\u5f0fID\u7684\u6240\u6709\u6a23\u672c\u6709\u8457\u76f8\u4f3c\u7684\u7de8\u78bc\u548c\u884c\u70ba\uff0c\u4ee4\u4eba\u61f7\u7591\u7db2\u8def\u72af\u7f6a\u5206\u5b50\u9084\u5728\u958b\u767c\u5176\u4ed6\u6a21\u7d44\u4e26\u5c07\u90e8\u7f72\u66f4\u591a\u7684\u60e1\u610f\u61c9\u7528\u7a0b\u5f0f\u3002<\/p>\n

\"botnet<\/p>\n

\u57161<\/em>\u3001\u4e0a\u50b3\u5230Google Play<\/em>\u4e0a\u507d\u88dd\u6210\u8a9e\u97f3\u8a0a\u606f\u61c9\u7528\u7a0b\u5f0f\u7684\u5176\u4e2d\u4e4b\u4e00<\/em><\/p>\n

\"botnet<\/p>\n

\u57162<\/em>\u3001\u60e1\u610f\u8a9e\u97f3\u8a0a\u606f\u61c9\u7528\u7a0b\u5f0f\u88ab\u5b89\u88dd\u6578\u5343\u6b21\u7684\u7d00\u9304<\/em><\/p>\n

 <\/p>\n

\u884c\u70ba<\/em><\/strong><\/p>\n

AndroidOS_FraudBot.OPS<\/a>,\u6703\u8a66\u8457\u5077\u5077\u5229\u7528\u8f15\u91cf\u6a21\u584a\u5316\u4e0b\u8f09\u7a0b\u5f0f\u4f86\u4fb5\u5bb3\u4e0d\u77e5\u60c5\u4f7f\u7528\u8005\u7684\u884c\u52d5\u88dd\u7f6e\u3002\u96d6\u7136\u9019\u4e9b\u61c9\u7528\u7a0b\u5f0f\u7684\u767c\u5e03\u4e0a\u50b3\u8005\u4e0d\u540c\uff0c\u4f46\u6211\u5011\u61f7\u7591\u61c9\u7528\u7a0b\u5f0f\u90fd\u4f86\u81ea\u540c\u4e00\u4f5c\u8005\uff0c\u56e0\u70ba\u7a0b\u5f0f\u78bc\u5f7c\u6b64\u76f8\u4f3c\u3002\u4e0b\u8f09\u5f8c\uff0c\u7b2c\u4e00\u500b\u7d44\u4ef6\u6703\u9023\u5230C&C\u4f3a\u670d\u5668\uff0c\u7136\u5f8c\u89e3\u5bc6\u4e26\u57f7\u884c\u6709\u6548\u8f09\u8377\uff08payload\uff09\u3002<\/p>\n

\"botnet<\/p>\n

\u57163<\/em>\u3001\u6709\u6548\u8f09\u8377\uff08payload<\/em>\uff09\u57f7\u884c\u9806\u5e8f\u3002<\/em><\/p>\n

 <\/p>\n

\u6709\u6548\u8f09\u8377\uff08payload\uff09\u57f7\u884c\u5982\u4e0b\uff1a<\/p>\n

 <\/p>\n

    \n
  1. \u540d\u70ba\u201cIcon\u201d\u7684\u6a21\u7d44\u6703\u96b1\u85cf\u61c9\u7528\u7a0b\u5f0f\u5716\u793a\u4f86\u9632\u6b62\u4f7f\u7528\u8005\u5378\u8f09\u3002<\/li>\n<\/ol>\n

    \"botnet<\/p>\n

    \u57164<\/em>\u3001\u96b1\u85cf\u5716\u793a<\/em><\/p>\n

     <\/p>\n

      \n
    1. \u6a21\u7d44\u201cWpp\u201d\u53ef\u4ee5\u958b\u555f\u700f\u89bd\u5668\u4f86\u9023\u4e0a\u4efb\u610f\u7db2\u5740\u3002<\/li>\n<\/ol>\n

      \"botnet<\/p>\n

      \u57165<\/em>\u3001\u6a21\u7d44\u6536\u96c6\u700f\u89bd\u5668\u5167\u7684\u7279\u5b9a\u7db2\u5740<\/em><\/p>\n

       <\/p>\n

      \u5728\u5206\u6790\u6a23\u672c\u6642\uff0c\u61c9\u7528\u7a0b\u5f0f\u6703\u986f\u793a\u8072\u7a31\u63db\u53d6\u79ae\u54c1\u5361\u7684\u5047\u8abf\u67e5\u8868\u4f86\u6536\u96c6\u4f7f\u7528\u8005\u7684\u500b\u4eba\u8eab\u4efd\u8cc7\u6599\uff08PII\uff09\uff0c\u5982\u59d3\u540d\u3001\u96fb\u8a71\u865f\u78bc\u548c\u4f4f\u5bb6\u4f4f\u5740\u3002\u5047\u8abf\u67e5\u8868\u6703\u7528\u88dd\u7f6e\u7684\u9810\u8a2d\u700f\u89bd\u5668\u8f09\u5165\u3002\u5982\u679c\u7121\u6cd5\u8b58\u5225\u9810\u8a2d\u700f\u89bd\u5668\uff0c\u5247\u6703\u7528\u4e0b\u5217\u6211\u5011\u5f9eC&C\u56de\u61c9\u770b\u904e\u7684\u700f\u89bd\u5668\u4f86\u8f09\u5165\u8abf\u67e5\u8868\uff0c\u5305\u62ec\uff1aBoat Browser\u3001Brave\u3001Chrome\u3001Cheetah\u3001Dolphin\u3001DU\u3001Firefox\u3001Jiubang Digital Portal\u3001Link Bubble\u3001Opera\u3001Opera Mini\u3001Puffin\u548cUC\u3002<\/p>\n

      \"botnet<\/p>\n

      \u57166<\/em>\u3001\u5047\u61c9\u7528\u7a0b\u5f0f\u6536\u96c6\u4f7f\u7528\u8005\u8cc7\u6599<\/em><\/p>\n

       <\/p>\n

      Wpp\u9084\u6703\u900f\u904e\u96a8\u6a5f\u61c9\u7528\u7a0b\u5f0f\u89f8\u63a7\u4e8b\u4ef6\u4f86\u9032\u884c\u6b3a\u8a50\u6027\u5ee3\u544a\u9ede\u64ca\u3002<\/p>\n

      \"botnet<\/p>\n

      \u57167<\/em>\u3001\u9032\u884c\u6b3a\u8a50\u6027\u5ee3\u544a\u9ede\u64ca\u7684\u96a8\u6a5f\u61c9\u7528\u7a0b\u5f0f\u89f8\u63a7\u4e8b\u4ef6<\/em><\/p>\n

       <\/p>\n

        \n
      1. \u6a21\u7d44\u201cSocks\u201d\u7684\u529f\u7528\u662f\u52d5\u614b\u7a0b\u5f0f\u5eab\uff0c\u5b83\u6574\u5408\u4e86C-Ares\uff08\u7528\u4f86\u9032\u884c\u975e\u540c\u6b65DNS\u8acb\u6c42\u7684C\u7a0b\u5f0f\u5eab\uff09\u4ee5\u53ca\u540d\u7a31\u89e3\u6790\u3002\u96d6\u7136\u6211\u5011\u6c92\u6709\u770b\u5230\u8207\u4f3a\u670d\u5668\u7684\u9023\u7dda\uff0c\u4f46\u76f8\u4fe1\u6b64\u529f\u80fd\u4ecd\u5728\u958b\u767c\u4e2d\u3002<\/li>\n<\/ol>\n

        \"botnet<\/p>\n

        \u57168<\/em>\u3001Socks<\/em>\u6574\u5408\u4e86C-Ares<\/em><\/p>\n

         <\/p>\n

        \u9632\u79a6\u6b64\u5a01\u8105\uff1a\u8da8\u52e2\u79d1\u6280\u89e3\u6c7a\u65b9\u6848<\/em><\/strong><\/p>\n

         <\/p>\n

        \u5728\u672c\u6587\u64b0\u5beb\u6642\uff0cGoogle\u5df2\u7d93\u5f9e\u5546\u5e97\u4e2d\u79fb\u9664\u9019\u4e9b\u60e1\u610f\u8a9e\u97f3\u61c9\u7528\u7a0b\u5f0f\u3002\u4f46\u6211\u5011\u53ef\u4ee5\u9810\u671f\u66f4\u591a\u9019\u985e\u5a01\u8105\u7684\u51fa\u73fe\uff0c\u800c\u4e14\u5177\u5099\u4e0d\u65b7\u9032\u5316\u7684\u529f\u80fd\uff0c\u7279\u5225\u662f\u8eb2\u907f\u5075\u6e2c\u7684\u90e8\u5206\u3002\u9019\u985e\u60e1\u610f\u8edf\u9ad4\u986f\u793a\u51fa\u7db2\u8def\u72af\u7f6a\u5206\u5b50\u80fd\u5920\u8f15\u9b06\u5730\u64cd\u4f5c\u60e1\u610f\u529f\u80fd\u4f86\u900f\u904e\u61c9\u7528\u7a0b\u5f0f\u653b\u64ca\u884c\u52d5\u88dd\u7f6e\u3002\u6240\u4ee5\u61c9\u8a72\u8981\u5b89\u88dd\u5168\u9762\u6027\u7684\u884c\u52d5\u5b89\u5168\u9632\u8b77\u4f86\u62b5\u79a6\u884c\u52d5\u60e1\u610f\u8edf\u9ad4\u3002<\/p>\n

         <\/p>\n

        \u8da8\u52e2\u79d1\u6280\u884c\u52d5\u5b89\u5168\u9632\u8b77\u500b\u4eba\u7248<\/a>\u548c\u884c\u52d5\u5b89\u5168\u9632\u8b77\u89e3\u6c7a\u65b9\u6848<\/a>\u53ef\u4ee5\u4fdd\u8b77\u88dd\u7f6e\u514d\u65bc\u76f8\u95dc\u5a01\u8105\u7684\u4fb5\u5bb3\u3002\u8da8\u52e2\u79d1\u6280\u7684\u884c\u52d5\u61c9\u7528\u7a0b\u5f0f\u4fe1\u8b7d\u8a55\u6bd4\u670d\u52d9<\/a>\uff08MARS\uff09\u4f7f\u7528\u696d\u754c\u9818\u5148\u7684\u6c99\u7bb1\u548c\u6a5f\u5668\u5b78\u7fd2\u6280\u8853\u4f86\u6db5\u84cbAndroid\u548ciOS\u5a01\u8105\uff0c\u4fdd\u8b77\u4f7f\u7528\u8005\u514d\u65bc\u60e1\u610f\u8edf\u9ad4\u3001\u96f6\u6642\u5dee\u548c\u5df2\u77e5\u6f0f\u6d1e\u653b\u64ca\u3001\u96b1\u79c1\u6d29\u6f0f\u548c\u61c9\u7528\u7a0b\u5f0f\u6f0f\u6d1e\u7b49\u5a01\u8105\u4fb5\u5bb3\u3002<\/p>\n

         <\/p>\n

        \u5165\u4fb5\u6307\u6a19<\/em><\/strong><\/p>\n

         <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        \u61c9\u7528\u7a0b\u5f0f<\/td>\nSHA256<\/td>\n<\/tr>\n
        com.bitv.freeaudiomessages<\/td>\n3f7b367488e761f89b4adeb5dc1b961766c238d41ebb9fbd726da8499d1fce26<\/p>\n

         <\/td>\n<\/tr>\n

        com.wififree.messenger<\/td>\n7a4813f68936a37fce366154a608ad307084336abc205b55f80b0a6788d067ac<\/p>\n

        811f12ea658f9325eede5afcc9898aaf37d1e0eafab84e94b9d3b13adcc6131f<\/td>\n<\/tr>\n

        com.onlinevoice.playerapp<\/td>\n92ea01d0198506d5a43e3cfccf7b2661c131c57e8d260fbf34760f01a897b0cb<\/td>\n<\/tr>\n
        com.bestvoice.messenger<\/td>\n9742148afe109e8ab25ec81f58aee8befed6be20affa7b2a71702a65d4bc377c<\/td>\n<\/tr>\n
        com.netaudio.vam<\/td>\ncabe057cf19ddd54a1489e0db74d0c8833cea501c4b4a22b7953a6e7d1fd9391<\/td>\n<\/tr>\n
        com.voicedata.justvoicemessenger<\/td>\ndddb84da1b4f8914f31781a1a8a46c028dbb776a891d198b5d4b78c3c9a62c8d<\/td>\n<\/tr>\n
        <\/td>\n<\/td>\n<\/tr>\n
        \u5075\u6e2c\u540d\u7a31<\/td>\nAndroidOS_FraudBot.OPS<\/a><\/td>\n<\/tr>\n
        Google Play\u61c9\u7528\u7a0b\u5f0f\u7db2\u5740<\/td>\nhttps:\/\/play.google.com\/store\/apps\/details?id=com.bitv.freeaudiomessages<\/p>\n

        https:\/\/play.google.com\/store\/apps\/details?id=com.wififree.messenger<\/p>\n

        https:\/\/play.google.com\/store\/apps\/details?id=com.onlinevoice.playerapp<\/p>\n

        https:\/\/play.google.com\/store\/apps\/details?id=com.bestvoice.messenger<\/p>\n

        https:\/\/play.google.com\/store\/apps\/details?id=com.netaudio.vam<\/p>\n

        https:\/\/play.google.com\/store\/apps\/details?id=com.voicedata.justvoicemessenger<\/td>\n<\/tr>\n

        C&C\u7db2\u5740<\/td>\nhxxp:\/\/vilayierie.live:443<\/p>\n

        hxxp:\/\/aspiet.club:443<\/p>\n

        hxxp:\/\/213.239.222.7:8081<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

         <\/p>\n

        @\u539f\u6587\u51fa\u8655\uff1aFake Voice Apps on Google Play, Botnet Likely in Development<\/a> \u4f5c\u8005\uff1a Echo Duan<\/p>\n

        PC-cillin \u96f2\u7aef\u7248\u6574\u5408 AI \u4eba\u5de5\u667a\u6167\u7684\u591a\u5c64\u5f0f\u9632\u8b77\uff0c\u7cbe\u6e96\u9810\u6e2c\u5373\u6642\u62b5\u79a6\u672a\u77e5\u5a01\u8105 >>\u5373\u523b\u514d\u8cbb\u4e0b\u8f09\u8a66\u7528<\/a><\/p>\n

        <\/a><\/p>\n

        \u300a \u60f3\u4e86\u89e3\u66f4\u591a\u95dc\u65bc\u7db2\u8def\u5b89\u5168\u7684\u79d8\u8a23\u548c\u5efa\u8b70\uff0c\u53ea\u8981\u5230\u8da8\u52e2\u79d1\u6280\u7c89\u7d72\u7db2\u9801<\/a> \u6216\u4e0b\u9762\u7684\u6309\u9215\u6309\u8b9a \u300b<\/p>\n