{"id":1524,"date":"2021-11-25T12:11:57","date_gmt":"2021-11-25T04:11:57","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=1524"},"modified":"2021-11-25T12:11:58","modified_gmt":"2021-11-25T04:11:58","slug":"%e7%a0%94%e7%a9%b6%e4%ba%ba%e5%93%a1%e5%9c%a8%e8%8f%af%e7%82%ba%e7%9a%84appgallery%e4%b8%ad%e7%99%bc%e7%8f%be%e4%ba%86190-%e5%a4%9a%e6%ac%be%e5%8c%85%e5%90%abandroid-cynos-7-origin%e6%9c%a8%e9%a6%ac","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=1524","title":{"rendered":"\u7814\u7a76\u4eba\u54e1\u5728\u83ef\u70ba\u7684AppGallery\u4e2d\u767c\u73fe\u4e86190 \u591a\u6b3e\u5305\u542bAndroid.Cynos.7.origin\u6728\u99ac\u7684\u904a\u6232\uff0c\u7d04930\u842c\u90e8Android\u624b\u6a5f\u53d7\u611f\u67d3"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"857\" height=\"429\" src=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/11\/image-14.png\" alt=\"\" class=\"wp-image-1525\" srcset=\"https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/11\/image-14.png 857w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/11\/image-14-300x150.png 300w, https:\/\/blog.billows.com.tw\/wp-content\/uploads\/2021\/11\/image-14-768x384.png 768w\" sizes=\"auto, (max-width: 857px) 100vw, 857px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/st.drweb.com\/static\/new-www\/news\/2021\/november\/Android.Cynos.7_5.1.png\" alt=\"\"\/><figcaption>\u5b89\u88dd\u91cf\u8d85\u904e 2,000,000 \u6b21\u7684 \u201c\u5feb\u9ede\u8eb2\u8d77\u4f86\u201d\u904a\u6232<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/st.drweb.com\/static\/new-www\/news\/2021\/november\/Android.Cynos.7_3.1.png\" alt=\"#drweb\"\/><figcaption>\u5b89\u88dd\u91cf\u8d85\u904e 427,000 \u6b21\u7684\u201cCat adventures\u201d\u904a\u6232\uff1a<\/figcaption><\/figure>\n\n\n\n<p>\u5927\u7d04930\u500b Android\u6728\u99ac\u507d\u88dd\u6210190\u591a\u500b\u4e0d\u540c\u7684\u61c9\u7528\u7a0b\u5f0f\uff0c\u4e0a\u67b6\u5728\u83ef\u70ba AppGallery\uff0c\u4e26\u5df2\u88ab\u5927\u91cf\u4e0b\u8f09\u4f5c\uff0c\u6210\u70ba\u5927\u898f\u6a21\u60e1\u610f\u8edf\u9ad4\u6d3b\u52d5\u3002\u4fc4\u7f85\u65af\u9632\u6bd2\u516c\u53f8<a href=\"https:\/\/news.drweb.com\/show\/?i=14360&amp;lng=en\">Dr. Web<\/a>\u7684\u5831\u544a\uff0c\u5df2\u5c07\u8a72\u6728\u99ac\u8b58\u5225\u70baAndroid.Cynos.7.origin\uff0c\u7528\u9014\u5728\u6536\u96c6\u7684\u7528\u6236\u654f\u611f\u6578\u64da\uff0c\u8a72\u6728\u99ac\u7a0b\u5f0f\u70ba Cynos\u60e1\u610f\u8edf\u9ad4\u7684\u8b8a\u7a2e\u3002<\/p>\n\n\n\n<p>\u76ee\u524dDr.Web\u5df2\u7d93\u5c07\u6b64\u767c\u73fe\u548c\u5831\u544a\u901a\u5831\u7d66\u83ef\u70ba\uff0c\u4e26\u5354\u52a9\u83ef\u70ba\u5f9e\u4ed6\u5011\u7684AppGallery\u4e2d\u522a\u9664\u4e86\u6aa2\u6e2c\u5230\u7684\u61c9\u7528\u7a0b\u5f0f\uff0c\u4f46\u5728Android\u624b\u6a5f\u4e0a\u5df2\u5b89\u88dd\u61c9\u7528\u7a0b\u5f0f\u7684\u7528\u6236\u9084\u662f\u9700\u8981\u624b\u52d5\u9032\u884c\u522a\u9664\u3002<\/p>\n\n\n\n<p>\u64da\u4e86\u89e3\u5728Android\u61c9\u7528\u7a0b\u5f0f\u4e2d\uff0c\u653b\u64ca\u8005\u5c07\u4ed6\u5011\u7684\u60e1\u610f\u8edf\u9ad4\u507d\u88dd\u6210\u6a21\u64ec\u5668\u3001\u8857\u6a5f\u904a\u6232\u3001\u5e73\u53f0\u904a\u6232\u3001RTS \u7b56\u7565\u904a\u6232\u4ee5\u53ca\u5206\u5225\u70ba\u4fc4\u8a9e\u3001\u4e2d\u6587\u8207\u570b\u969b\u7528\u6236\u63a8\u51fa\u7684\u5c04\u64ca\u904a\u6232\uff0c\u53d7\u60e1\u610f\u8edf\u9ad4\u611f\u67d3\u7684\u71b1\u9580\u904a\u6232\u5305\u62ec Drive school \u6216 Cat Adventures\u7b49\u3002\u5728\u5b89\u88dd\u9019\u4e9b\u61c9\u7528\u7a0b\u5f0f\u5f8c\u6728\u99ac\u7684\u653b\u64ca\u6027\u5c31\u986f\u73fe\u51fa\u4f86\uff0c\u4f8b\u5982\u5b83\u6703\u8acb\u6c42\u5141\u8a31\u57f7\u884c\u8207\u904a\u6232\u7121\u95dc\u7684\u6d3b\u52d5\uff0c\u64a5\u6253\u96fb\u8a71\u3001\u5075\u6e2c\u4f7f\u7528\u8005\u4f4d\u7f6e\u7b49\u3002\u8a72\u60e1\u610f\u8edf\u9ad4\u9084\u5141\u8a31\u653b\u64ca\u8005\u7aca\u53d6\u4ee5\u4e0b\u6578\u64da\uff1a<\/p>\n\n\n\n<p>\u96fb\u8a71\u865f\u78bc<\/p>\n\n\n\n<p>\u5730\u7406\u4f4d\u7f6e\u6578\u64da<\/p>\n\n\n\n<p>WiFi \u7db2\u8def\u7684\u8a73\u7d30\u8cc7\u8a0a<\/p>\n\n\n\n<p>\u884c\u52d5\u7db2\u8def\u53c3\u6578\u548c\u6a19\u8b58\u7b26<\/p>\n\n\n\n<p>\u96fb\u8a71\u786c\u9ad4\u548c\u8edf\u9ad4\u898f\u683c<\/p>\n\n\n\n<p>Dr.Web\u7814\u7a76\u4eba\u54e1<a href=\"https:\/\/news.drweb.com\/show\/?i=14360&amp;lng=en\">\u8aaa<\/a>\uff0c\u4e4d\u4e00\u770b\uff0c\u624b\u6a5f\u865f\u78bc\u5916\u6d29\u4f3c\u4e4e\u662f\u4e00\u500b\u5fae\u4e0d\u8db3\u9053\u7684\u554f\u984c\u3002\u7136\u800c\uff0c\u5be6\u969b\u4e0a\uff0c\u5b83\u6703\u56b4\u91cd\u50b7\u5bb3\u7528\u6236\uff0c\u7279\u5225\u662f\u8003\u616e\u5230\u5152\u7ae5\u662f\u904a\u6232\u7684\u4e3b\u8981\u76ee\u6a19\u53d7\u773e\u3002\u5373\u4f7f\u624b\u6a5f\u865f\u78bc\u662f\u6210\u4eba\u8a3b\u518a\u7684\uff0c\u4f46\u5f9e\u4e0b\u8f09\u7684\u904a\u6232\u4e5f\u5f88\u53ef\u80fd\u8868\u660e\u5b69\u5b50\u662f\u5be6\u969b\u4f7f\u7528\u624b\u6a5f\u7684\u4eba\u3002\u503c\u5f97\u601d\u8003\u7684\u662f\uff0c\u7236\u6bcd\u662f\u5426\u5e0c\u671b\u4e0a\u8ff0\u624b\u6a5f\u6578\u64da\u4e0d\u50c5\u50b3\u5230\u672a\u77e5\u7684\u5916\u570b\u4f3a\u670d\u5668\uff0c\u6216\u767c\u9001\u5230\u4efb\u4f55\u5916\u4eba\u4e0a\u3002<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/DoctorWebLtd\/malware-iocs\/blob\/master\/Android.Cynos\/README.adoc\">\u6b64\u8655<\/a>\u63d0\u4f9b\u4e86Dr.Web \u6b78\u985e\u70ba\u611f\u67d3\u4e86Cynos\u60e1\u610f\u8edf\u9ad4\u7248\u672c\u7684\u6240\u6709\u904a\u6232<\/p>\n\n\n\n<p>\u5165\u4fb5\u6307\u6a19(Indicator of compromise -IOCs):<\/p>\n\n\n\n<p>URL | App name | Package name | SHA-1<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C102937601 | 3D City Hunting | com.sns.csls3d.huawei | 8b1de0c1fdea45ff8f4ae250307c0a8f69c3d426<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103277985 | 3D Cartoon man Parkour | com.szlh.zhebushikualan.huawei | f70f195fd9deffbde2ee812c93b327d07e18443f<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103662071 | 3D City Wild Racing | com.zjld.tejimotuoche.huawei | fda4bc7b3883b3db3df13b0e1b07ad53bbe22a4d<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104481373 | 3d Man action run | com.zjld.zbsklmar.huawei | e6024ce99966f4ecaff0efdae7781d9d448b2c79<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104633441 | Ace of sky hero | com.hsrj.zhandoujiash.huawei | e5ed0eda9513f41b5c9ebd7b14529180a4e5d822<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104684815 | Acrobatics diving training | com.zjld.xytsadt.huawei | d4c1b4b2a65279b768338f2c0d12b695572b101b<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103622351 | Adventures of Magical Girl | com.yly.mengdongjielong.huawei | 532b2d05f528ee68a1f89d02fa2477a8fac7c88b<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104374449 | Airplane master | com.hxy.fzfjam.huawei | fec03ced8741a8241fcb5f272ede566a634ba539<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103616693 | All-Star Basketball Championship &nbsp;com.cchl.guanlandazuozhan.huawei | f4b9517b19f8c4cee7295f653dca4af8f9e62a13<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103768237 | almighty carry company | com.ccsk.quannenglaosiji.huawei | d4a1e722adda57f72f9daafdfd338630b48ae55f<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104284813 | Ancient escape | com.yly.ywscae.huawei | 5599dfea0b274e4edbfdabad72d68e271b99e72d<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103895857 | Anti-terrorism actions | com.xstk.csata.huawei | aeb5f642538bfdf6b2a8eb5cf3214035a634506f<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103562987 | Anti-terrorist police battle | com.sns.qingsongduobi.huawei | b1112a4847c4006f126f0a5ab08b191df039adb7<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103623983 | Ants survive in the wilderness | com.cchl.mayishengcunmoniqi.huawei | fb1b5402a51ebc00b17670d6e6b49dba28d36704<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103171043 | Armed air attack at sea | com.zjld.jisulingyun.huawei | f05119b12fc28aca89f48b5a939d6e1928c04bc6<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103562027 | Armed escort prisoners | com.hs.wuzhuangyajieqiufan.huawei | 7bf6516b2176363de9d7a7993445ede9f697260d<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104457167 | Armed shooting raid | com.hxy.csasr.huawei | c4f1405bba22826a69e94ef20763cb664bc3b44c<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103233993 | Armed zombie Tower Defense | com.cchl.baoweixiangrikui.huawei | c30291b34ec74128196612b0a80034424de2ea67<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104338383 | Army car transport prisoners | com.sns.wzyjqfactp.huawei | f56151b7fd4096f73574717075f6c08e32ff4765<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104661821 | Assassination Sniper | com.xstk.yjbzas.huawei | fca6cb15168ac7b256da4bbb442cf93050981b61<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104338933 | Assassination time 3D | com.hsrj.yjbzat.huawei | 78e48efac48d7ed9ea53a7a7df294da0a97de066<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104143713 | Battle of tanks | com.zjld.xintankebot.huawei | c80fee5ffccf9ce85ff15b7d085d700ae70aef98<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104694107 | Battlefield assault team | com.yly.csbat.huawei | 4a4abab1e69ef629c1c622fd3be280c013e4e9fd<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104173375 | Beach ambulance | com.hsrj.htjydba.huawei | b860d5303d8921fed08c5e374483ac127ee2385e<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104735997 | Beach Emergency team | com.cchl.htyjxz.huawei | b936c97eb91bf6071aa38ead5fb5b8ce11d9a0c1<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104516919 | Beach rescue driving | com.sns.htjydbrd.huawei | 38ab82696f45fdf52c04d3ba760e8b752b07df6d<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104151447 | Beat the buddy | com.szlh.mtcrbtb.huawei | a4dbe44e0cbef5db32651050189848e9207e28ed<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103162445 | Brave Ninja saves Princess | com.zjld.jiantoudaren.huawei | 1a17dd8b6bb1a08ab53b2d096535d251a8d7a8cb<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104859673 | Bumper Car Arena | com.hsrj.debibca.huawei | 81ae7a0fac2f385b2984669356d92cf7e807fbb7<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104621857 | Busy road driving | com.cchl.jyztcbrd.huawei | 7795827b9feb3e6d8a86f30a48686d3fe816ab30<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104276919 | Car battle ground | com.xstk.kbphwcng.huawei | 6c748786e3d18321b7e2f6c64b578ecb310d5b82<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103920731 | Car destruction war | com.yly.kbphwcdw.huawei | 195bad41d7c0cee3a388ec072353e9b62c923c67<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103920329 | Car drive master | com.zjld.jcddcdm.huawei | 664e47cebb0464339d5e75efb4279c1fa86e131a<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103955065 | Car merge shooting | com.szlh.xxlpdcms.huawei | f57efc2ee390c43d42dde0e6dde81a2c5dd1958b<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104402277 | Car shooting defend war | com.yly.xxlpdcsdw.huawei | 6cc4c02dc12afeadd1e1c41f5a55f9be35aeca72<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104114723 | Cat adventures | com.hxy.xmlxjca.huawei | 18558dca2734d6b098d91d570e0ca13623e0a851<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104415377 | Cat cute diary | com.szlh.xmlxjccd.huawei | aa2f1784fe24b564fdeb577a340d439661db1571<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C103823729 | Cat game room | com.hs.xiaomaolixianji.huawei | 79ddb48ac25eb392c9e92dc44d32bbc522e19fae<\/p>\n\n\n\n<p>http:\/\/appgallery.huawei.com\/#\/app\/C104429049 | City car parking test | com.sns.jyztcccpt.huawei | 30abca107e63b3858bc661f27e2ab56ee3fbb471<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5927\u7d04930\u500b Android\u6728\u99ac\u507d\u88dd\u6210190\u591a\u500b\u4e0d\u540c\u7684\u61c9\u7528\u7a0b\u5f0f\uff0c\u4e0a\u67b6\u5728\u83ef\u70ba AppGallery\uff0c\u4e26\u5df2\u88ab\u5927\u91cf\u4e0b <a class=\"read-more\" href=\"https:\/\/blog.billows.com.tw\/?p=1524\">READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[183,174],"class_list":["post-1524","post","type-post","status-publish","format-standard","hentry","category-6","tag-iocs","tag-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1524"}],"version-history":[{"count":1,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1524\/revisions"}],"predecessor-version":[{"id":1526,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/1524\/revisions\/1526"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}