TT Malware Log

マルウェア / サイバー攻撃 / 解析技術 に関する「個人」の調査・研究・参照ログ

Xhelper: Persistent Android dropper app infects 45K devices in past 6 months

【ブログ】

◆Xhelper: Persistent Android dropper app infects 45K devices in past 6 months (Symantec, 2019/10/29)

Malicious app hides itself, downloads other threats, displays ads, and is mainly targeting users in India, U.S., and Russia.

https://www.symantec.com/blogs/threat-intelligence/xhelper-android-malware


【関連まとめ記事】

全体まとめ
 ◆マルウェア / Malware (まとめ)
  ◆Android マルウェア (まとめ)

◆xHelper (まとめ)
https://malware-log.hatenablog.com/entry/xHelper


【インディケータ情報】

■ハッシュ情報(Sha256) - Xhelper -

4373399d2c811d005277ef6811cc41e4a92a60505d88d7ac91f2f08752ce2ff0
a4aecd3333a3adb656fe6e119e24d0eb7c29bd8672b491c27cbd757b584aa0d0
b9c7c80332ff547151d32760e0743c0fe3ca3c7f97596ac3e2ab3303de44f721
b9e826253ba52ec03358caca64477c9e7a9391d4bf3eb819ce29c023eed432ca
22a7bfdd671aea4ace8eed37cd1416c5ad59bb5896745b73fb887093254aed13
1334d510308ab4f55cc9d9834d3b44d6641918895bb7971a470a07a75e5c24af
79d89d710a49bf29dfb3d8245382928c8f0356ed9389d660888b234a7388ebe0
255ce4346e01ae9f53d12cf0079d8bd4360454eabf662212628c7af50bba0dba
64e5270dcc38621163bafd8a350986706305c42feab85b0bd79b2b2c0db969de
23c6363721b0dc6f37157cd3e26e2555a8e5907db79723c5d00936e57b5d8889
d9e523cae411d2bc2211489d32184dbd14dc1318367bae67bfd30d88d56265e5
ada3450218a44734a3fdf8f58d0831e8e761629f05f95e6942881e768f8205e5
f98e0d7bbec1508ef8ac387b031b555b0398b3f4ec45676b0c76287c14ab1398
43094eb380f95cf4ae0e441fad5085330def95f25fbbeccc35300f87bb0623dc
2a5a9695c36eaeebff5fb2232dc2c10097b01f537c529a33602691c98c3f770d
326990a80c10e9d90701194bdcc6f9513ce77b341649d820c8a614d9bfa85875
bd8465332c84cae03a1ef41277b6f3fae9ae90f9f1db8233d868ad9c160de5f5
5285ab74997fafa587ed4c5408cb55887a3005a567fe779da4fd826a8c5822b4
11d09288a53a34c8fe0911865f98adc1019489a633a5060af5a293cdc96c44dc
bf1bea1b759f9264a51e9241b1c27b1001658c9052285e8beadf2edd6ea42a19
31f8620a467279cbfa516e368cd96a72ffb8cc0aebb299acea9221035e0cf60e
abd00d9125528eace1c490fc280a56797181d1d078de85aac9cb474d36dc02df
9871c0df77c47c185804335744c7fa6fa67b8d5ce0de94eead8e2bfc778e8de6
f39e219a2357d64b55c9117ef5a6e92c26fb233dec87bf542fd2060a4db6d4ca
9ce80c16891cc295d0742378d6b5fad00982aeb5ce7c2e34bac27b5007ea85be
69344c280d9c6efe22758c2e008920f0823f5bacef27e9c4eb3eab28117d927d
2309a39573f84331110497ca6ecff95c0379e5c9ac2a4c52720953e202f6f096
4ac12fcda5360f73c69e49a5069c562251ac3fba1246fdeb7a97ca23f88dcedb
aeb63b0855c81534cdcda8497c4c4b8f8183d0673338488d8934876034438849
0480ac675bdbcf1a3f4e9f87164f2facb191ac194c10d9c98a17739081aa1dae
ec3346787e6e22581b2c671849afc49531ffcf7f691c8f7c6c109e27b5503b69
939f30e257cd59fa357a95a38864c1f42e93a29b230013bf48f616d073a19d8a
9a6322b70cb85d5d950283ee04b8f102d24cb558d5d52a8b302f264a8e3447df
39f890c7a46088087035c161cd9d52eac0aa736bb8b87ae46c604178bcd99728
2e79e3130059790f82111b83b6a283707b3eca824c36a028348babd42e68b548
bfe62982ecdac35ed007564bdf7c8a1a396f47a20e440682b8431365522e5d24
4bab445630e8a284d35000ac8ec9e8c9575890b0507be922b7f8c67aa3ffecfe
7b57f83be8558983ea1eb11e2e79167e10406c602583493fc99700b871ab08b2
c67f21542c0ed8d310478d7c9c86bac4a4def5472e505be1ee1426e7e9b5f9b3
e9beca3876e92051e040cfd865cb2cac30564f685e14d311c81cf0e615442090
35047b8abce8443d1e9b1f29274358062753db37deb22420e4a6dd6a51ac9d7b
07912685295f656583545549f9fb06e9a218ebe7684d865fa965fdf406b5d841
344bb021da5cfb53ba01ada37e1372f92f2c00263dc94a91d962bd418ecdb3ab
6e5c5645407f34f05fe68caed52f02b48e82a09852da7342d5524b96deafd5e1
58cec0a891164373f3826235da6cda804eb13cc9d896491f8a8f920fd7e1227c
38f44528faade6b6204df7c7a9570601f959f1b4bec80018c1f1536be27197d9
716dd2306c0a60f7f06151e3d48ee6d2642a1460724fc7f9b6592d59e0621393
75121f4f208c61add444244da900efc3dce87ce5a109cca20a6a3f8524a16b96
d64bf64d86a01b3932c263d7ebed0340804b81ec5b53ba9add142b605553ed53
4b639d832750bf40ebf59fe11ec574082e2ddeaff0d6b38476ca9bcbb98a6e24
44c8d16e0a8c98b14aae02f1f5e7de8fcd0542b34b4204c061fbf01ad0a726ca
ca34031c69e7b58371c401d845e3a335d8589ded646a37a24601e7cc76e7f60f
f4c180bad494ac6ac235bd0204bf0887db814903f637eecb2bd0133eeab3520e
7d534cc5f48b5a078dec65fc5e4467cb754818741a7ee0686c7c2f23c73ad7c2
80e98a1ee69f3866300b6b07507982e071a89ac403f309b24b442ee771639831
c9e5a848929d316adcb5a10b32a9764732dc3867a606457472fa2e5fb6b40cb8
5de0dc197c330e0a7f86da5fcc831132567e91db4bc7427c285ccae2b5e38522
38a1576841436574ae99dfd17071660347f48d95bf76885b30e43f5f63943da8
bb2189c474799109b4c5ad16d269898cce87943dfad523317fd37fa88e72a9ce
85db2868a4ab56d81d3def4542b8442e1bd73dc46c86c28bb5afc469c653a049
be5b3a1fe2ff4b826a66fc514ad78ed1593c3ecd03ec4d698adc0f2c076666b5
45e5dcd46dead2505d295e3bcf46e6d925447faa45b4bb24422b7e2dfc7cf9b1
268979f9b5faf1e0f83c0300bb3721141423b2baca98a881d34c3f607b35f05a
479d533ad9ea5a708430537a21edd54d7d522cef4501b57ee0ae2bbcd655564e
a8182d60f647c392175561ac6b31bd34ab6ae1efbfd5f7ad71a8e5acaa3460e1
7dbf76019802100718e81250e0ba861f3182b16dd95e2d29b2ab5629459c2cf1
f7eb07ae0956ac77dbc2b8b547ba8a650b804b4d7e96e06c5f3207ce06246c50
c93f4b9ff8f571b41ff5ac795f69fe9d0e737d360857624e883daa98aae32c33
a0863bda9439150a28bc52b1f8bfd67a79b305f5416aa46539fed0de985e0c28
a2315fc0abab6c60d066322033e5ffdec9229e46e217a7bb890600e5d3f32c91
c6df87fdb9f6c509f9ae1ee7cac331414774c7a0bda15b8c92d1a90a3f342256
3aa51bcbe4f073bcfe74c5a131888e915ec915116fae92e974e5823a707fad91
ebc121f15e6f554ffaecb8a61ec9e01c01d578e9d0b1406decc32b7453125cbd
8123e134a85fc61bfaaf96501e8e82916cde76a77e57374313c9a67771d7d104
921150b5009e65b0869820baff62a98c0ef31e3419e484145c1ed95c573b6c33
2415588df7d1f58e324c673afaf3ce912881a222c6a8ef69e2f617c7b8c2931b
f2d6377fb85b54315eb6b86eefef0bba7fbeb2ea5df0e5c4765deff1df73fb42
049f08d17d569b23f5860d0befbd984862a59c56c6ee968bd70255763498f7b3
2f0e1f0df88582ad902b47442609316d1f5afc81eed748cdc10eb057241cf86d
83ecd9012207b9941e86fc416cb3be8bd573027b9407f36e88103bde7965c6bc
a865273ff9108c0accc7227da8b4f68317aafb42a9ee0500ba11d1572da58170
bcc63e78c25537615ea3fe46b3fa0278656afc93a6f0d37241bbb673a78387e6
792eeb6e5ec8886e44b0441bee902f3ad799cb49f7693f3f95c9dd5e5fea626e
275592849bcf478b9eb87860c7b6f8a7e0ce0950520c96fe05edde95bb338872
77923a45300635eb90421f4017e4212a9c5888d64faac7a347675f9c8e49fc66
829f9147cef4675e02a3613816b485674d6f5012a49a2e8741ebe582e328a88b
b2112ea58427e5acef1a51cfb2e918a59c7a2db2bb55121cae0391e726edc7ac
64ec69f1c8b71693d44be1749b0a0d6e67572dab5ff7c508dc2bfa9debc5132d
81d855ef3bbd1df9ec9c91425b6b985329b957166e13643700c44bb97652a5ad
f94bb4b8a3b68c19454a5bc1e9805bd97f5eb7b96fd268f598341c034700dd7c
40e448443a3da6cb109356a1dfb03763554e2965291babb8e6806e70e486ac35
afb06f250447c7ec43b1a10f097df44022a6ad1ed788098387781f16479641d0
d45b38198005b9de44994347e9d40ad822abaa969c3a53ec63cc31adcfb9772d
c254004236f7b16a6dda1ab52d99dc6bf2ebb53703f66a8f1c6d70ce9fc49ebb
4f2bafca2e437962d9df2534f46a0712d454483ecbd2db6052e7c2f26ac3e716
a75c9f78bf7a7e4bff34e245c8c0e43753d9ccface4f4fb8b4e7bfa7f295c9ad
97ab24f4647ef3deb71aacac4ddf835dc6dc5af009b27019a1c9a985081a47b3
c46e09f2173c4479301d0418a48e710dfbbf93de4a17f80009c45afeb0fe5f7c
4f7bed15483d471fdcd562ac9db693eb164434a863e9661cd583f8fb37e1e0eb
d6592f915bf119974f4f99bc0adbd687d3329ba1ff13179f827596b0bfee6b76
bd64665690891defc4dbed564d2ae493d800b3abc329ef6d77c0f11d2fce3cc4
81893218e3d1d6660ca9c21afb87ebc19722805817f65a5a2074406636c9cb1b
ed0efe8b09f417c48b6f9c96f6ed5e9ca5f3a73ee2cab913379a568248d806c8
3ba7e401b631f9b4b7e183618491bf68b0665c82ec9869e72594ebaeda2fe46a
a1185f5df7aaa49c160ccef342c39d1863f886f5e11e7f3591b2e399fff73a78
e97d8a8acbf17da9cb04b33d01eda4b5a9c7fcc34d39c2c30cbc8aba4949d9ae
5e8bdc8d4b8747b67d847e084b03852f347a058730802df3d516da82e7e849f1
d40e27b8aa95bc8f7d5b364125292b53c46797c90fe2b2c33b2140363b4b60d0
f5c38f79f6db661bda44332ea2984b2f70694d16bdd7b236482075e4ddc51f91
14a733f58bed8321ae2901349b3a0c1e2c953c67974d971e7329027858e5c52f
9a696fdca8dc163d42fd80354e9a2ad0e76fbad7794ea9bff001df0ccb174151
7780a0b403453a440cb7822bb620a3139b00499110bca3ae7814fcb38064b4bd
2168fe2de45c322373899da8250c8bea3e4256ca0f249976d414046beec37447
914d393e3671b161b1ad794468676a0caf0d93fba02d003113aa46d08f1d93c4
4e1ab4552f9f95f185af398074b48204f02df7abbe00d8003e58d45d3bb67609
f09c402587cf26fa30e9a8d1dee5ebbb09725036d5d1ef423a8ce02b01df3b0c
a611df41aad0904cf4e5f9442e90a3317b3e68d081be727b6825b46fe02cc494
377cb335552a36e13c6d3a364f43af49445132bd6b6770bd3bc34411e5363f1c
326a55dd6a552d4a37c7e72d7494dd8117a0aff81c7afd87b3a95a3ae94d4356
a5928b79f6ac5906a72242b84d5ddc1c6f05f3d98250b1d417645298d29e7289
38e8484e56367949f9c2203db155269312603be8744e0204744bea758021add0
423c8ca46e76b747696b1fd481636d889f06245e7e45e22a95371e2a76186fbd
014fc04ae03a19b308d0b8691ec118d0c013f0966ac3fad7e2316e53cb090ebb
28e4d955366e585866d3577224daf993dfc897e2806dfcab2ad257aebf1bd84c
3995a5cfd5f7fbd0025e06a022806a0431c9af0bf942f9adc069929fe8be3fbd
cdbc2250929414d8d8ba0cad4e5ac8a7363385888910d3f1d988b97f85f08ea6
8c2fe18199fc64466eccebf0c7323f3f96fa5ddb527b71e6f6117b271436fcaf
69004b1f3130bc8c5d1472fa386247dc132d0d3bb9194d36525a7eb203e29e45
684774e8f06ae6e8015c2f3c0d32fc341daff264433c300810e87c46993c868c
f73e3ca7361b7b87ec04f8e17a02c5512eebb282f93f4c97aab526c33b2f0a43
edd3d4d6bea1fc43488bf16f231e2d2f537b4b64599ab1fd3e07dea007c0e87c
56ea2a000e3b6adfcddbcf8c96d920c46dfaf5c14497584ed6def20fdda7918e
e32d812c3e94dbbcc1acae7b806b93df573c5ca10091e2940e3d92efbf5db23b
bf842045b78c3e97b6107b307f3a869d7f0f073a1167e233f1b63379619d10b6
0e3a63d940b8104a9db9ae6474b5026752de068f992d075a22ba72a8ebc47d22
8b938351d3c8085f579284cb7fb786d8de43cf990edb603a59950ef80314a252
e07c61308ff10a515256a5f4cb5d962a019f1f10c5311217b23d2a162041558c

(以上は Symantecの情報: 引用元は https://content.connect.symantec.com/sites/default/files/2019-10/Xhelper_IOCs_0.txt )


Copyright (C) 谷川哲司 (Tetsuji Tanigawa) 1997 - 2020