Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony)
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.1:8088
- 6####.####.140
- a####.####.com
- i####.####.com
- l####.####.com
- mo####.####.com
- res####.####.com
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/ads/black/640x270.png
- mo####.####.com/ads/index.htm
- res####.####.com/v3/ip?key=####
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/serviceConfig
- 1####.####.1:8088/sdkserver/v2/addSdk
- a####.####.com/app_logs
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__5c39cece-5a9e-4077-8de5-7b94623bd36d.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal (deleted)
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/code-4458087/huCuZENYh7nUD7G0
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_CNiUEYuzPJ0=-journal
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_Hp1VcPwCvB5FSRlsp-Pf4Nx7RaY=
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_Hp1VcPwCvB5FSRlsp-Pf4Nx7RaY=-journal
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_Nz4EvUY1ITGRl0AHSPoe_g==
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_Nz4EvUY1ITGRl0AHSPoe_g==-journal
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_d4Fa0tRpNr-wm_X3ly6z9Q==
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_d4Fa0tRpNr-wm_X3ly6z9Q==-journal
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_j7S59iZ77NJusosf
- <Package Folder>/databases/Szq2XauP0grIZRtHffCbpAWsTiq92oMtWdwwqw==_j7S59iZ77NJusosf-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/39abb4dc-924b-44c9-a544-43c4b74ca455.pic
- <Package Folder>/files/####/3ab173b5-fda1-4606-8c45-3f6705e7acd3.pic.temp
- <Package Folder>/files/####/624e2f03-4bd4-4fa7-82c0-40b729939c71.pic.temp
- <Package Folder>/files/####/7MP3rWDfwnpRWZz8RV7GEQpOHaElwKqGo_Hm_WI6mps=.new
- <Package Folder>/files/####/8a14a4d0-7201-4353-bffa-5082538ea5e7.pic
- <Package Folder>/files/####/950f9853-c0c1-4da5-867f-29c296d88ba8.pic.temp
- <Package Folder>/files/####/9d47c5b2-18fb-4f8e-b784-ac36ea5bfb64.pic.temp
- <Package Folder>/files/####/9gkX2CI-zpepgN2r3HZ0m0aBJPqmCz_-.new
- <Package Folder>/files/####/CV8J0rMAP7Xvl_0v.zip
- <Package Folder>/files/####/DJTngu4n5I_KNifWzCmJEZcsl15Ve1pd7gCJmw==.new
- <Package Folder>/files/####/E8jjGfxn9tg-lNltwc8huxzsoGMQH6AB
- <Package Folder>/files/####/E8jjGfxn9tg-lNltwc8huxzsoGMQH6AB.new
- <Package Folder>/files/####/E8jjGfxn9tg-lNltwc8huxzsoGMQH6AB.old (deleted)
- <Package Folder>/files/####/EQu-yqZJIzriszMqjuFHIg==
- <Package Folder>/files/####/EQu-yqZJIzriszMqjuFHIg==.new
- <Package Folder>/files/####/EQu-yqZJIzriszMqjuFHIg==.old (deleted)
- <Package Folder>/files/####/Eo6CKjDbMm-b36TT
- <Package Folder>/files/####/F9cRczbANj2BLxoMAA65MtVCfc0=
- <Package Folder>/files/####/FxzcU5nRpoel5yu7GWYt7sYQXPlkOJIUpKRpoQ==.new
- <Package Folder>/files/####/IWm__1lBBnBzhxnKFhFExgy23kqskGcIPr-n0A==.new
- <Package Folder>/files/####/K_STNksBG5_2OT9U_MWBlzqPcKw=.new
- <Package Folder>/files/####/L-2MTO2iXja69OrbCWapoNjNtjK8bA9A.new
- <Package Folder>/files/####/LLh10crEmxq5csq4fFEcnw==
- <Package Folder>/files/####/P4CA28Viy9mVx-sUbdlK5f_A-LNpCt90pf8B3dUoyYs=.new
- <Package Folder>/files/####/Seg1d1nw_IlrFKqnHoFwxw==
- <Package Folder>/files/####/TZgZ08XGnwnmTkXX.new
- <Package Folder>/files/####/XZG4CIMuXq84qrNx8ybjn5FYxdA3t5CK.new
- <Package Folder>/files/####/afc9e11d-7e04-4734-b1ab-55d5615c7663.pic.temp
- <Package Folder>/files/####/dGh058mk8DnlSCYB2u-A-oalgOjJoa9s.new
- <Package Folder>/files/####/eF5hRNBLsogPYiZ6SMh1EVWmN8xFrJKs.new
- <Package Folder>/files/####/eaf80815-ca4e-440d-80e3-dffc1899420d.pic.temp
- <Package Folder>/files/####/euaD6-Tlt2cqJNYJbNXYqiFxt5t4Q8fYe9I-dz9PxTc=.new
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/fD4a-M0JxeRQF91dWryEkjLX4yDVV2pCca63o-UN2YQ=.new
- <Package Folder>/files/####/hYV7n-xamXfpNGpASppqkk4eNrI=.new
- <Package Folder>/files/####/hdoEUqLKwrcfwGKiHG2d0A==.new
- <Package Folder>/files/####/hq61l6MhKYa2QZPARw8pqcfoXC8=.new
- <Package Folder>/files/####/hurbuw_f.zip
- <Package Folder>/files/####/k1mfW3JmVXst2JxxM3hA5UtiCV4=.new
- <Package Folder>/files/####/qP7DvXzbVKx2uKvsU9VOPQ==.new
- <Package Folder>/files/####/rPPsIWGYIU-ySm3lJsAFOCpgkimF7TbR.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/xp2JOVj6xOrTUcCHSypl-q-FRi7dbWUy.new
- <Package Folder>/files/####/y7dUfTdborOZXfC8cogfj1htQFU=
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comgithubclient.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.armsd/####/0fa977d0-41c6-408a-af7c-e28875139c98.res
- <SD-Card>/.armsd/####/4735f446-d021-4ec9-97bb-9210389ebcb4.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/77563a2f-12d3-415f-a2b9-ba15d88f5691.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/cb64c78a-be80-47c5-973b-082856e58aa1.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.bwlb.zwsj55/code-4458087/huCuZENYh7nUD7G0 -p com.bwlb.zwsj55 -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <error:2>
- sh <Package Folder>/code-4458087/huCuZENYh7nUD7G0 -p <Package> -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации
Осуществляет доступ к информации о сети
Осуществляет доступ к информации о телефоне (номер, imei и тд.)
Осуществляет доступ к информации об установленных приложениях
Осуществляет доступ к информации о запущенных приложениях
Добавляет задания в системный планировщик
Отрисовывает собственные окна поверх других приложений
