Google Online Security Blog: PHA Family Highlights: Triada

Security Blog

The latest news and insights from Google on security and safety on the Internet

PHA Family Highlights: Triada

June 6, 2019

Posted by Lukasz Siewierski, Android Security & Privacy Team

PHA family highlightsspam apps History of Triadaa blog post on the Kaspersky Lab websitea follow-up blog postod2gf04pd9ac32dorbdqshweight watchingweight

su binary accepts two passwords com.android.browsercom.qihoo.browsercom.oupeng.browserour blog post about the Zen PHA family09 00 00 50 4B 01 02 14 00 14 00 08 00 08 00 4F ...PK..........O 91 F3 48 AE CF 91 D5 B1 04 00 00 52 09 00 00 04 ..H........R.... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 32 33 38 36 50 4B 05 06 00 00 00 00 01 00 01 .2386PK......... 00 32 00 00 00 E3 04 00 00 00 00 .2......... [collect_Head]device=Nexus 5X [collect_Space]xadevicekey=xxxxx … [collect_Space]collentmod=opappresultmode [collect_Space]registerUser=true [collect_End] When rooting doesn’t work…LABEL+13: V18 = -1; LABEL_18: j___config_log_println(v7, v6, v10, v11, "cf89450001"); if ( v10 ) described by Dr.Web in July 2017