Taking a Deeper Dive into Leech: One of the Three Families of Malware Dubbed as Triada

This report analyzes the Leech member of the Triada mobile Trojan family targeting Android (notably Android 4.4.4 and earlier). Leech escalates to root, injects into the Zygote process to persist across system apps, installs malicious APKs under /system/priv-app, modifies /system/etc/install-recovery.sh for persistence, and communicates with multiple command-and-control IPs; the report provides extensive IOCs (file paths, numerous hashes, and network addresses) and notes observed activity across several countries.