Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- 1####.####.100
- 1####.####.100:8005
- 3460dc7####.####.com
- 94d9733####.####.com
- 9f367e7####.####.com
- a####.####.com
- a1da734####.####.net
- a30159e####.####.net
- a4d506e####.####.net
- a86e323####.####.net
- af048a7####.####.net
- b####.####.com
- c####.####.com
- c####.####.net
- c####.####.org
- c2f2208####.####.com
- ce####.####.org
- cloudfr####.####.com
- con####.####.net
- d####.####.com
- d####.####.net
- e####.####.com
- f####.####.com
- google-####.com
- h####.com
- i####.####.cc
- imgs####.####.nl
- j####.####.net
- lo####.####.org
- m####.####.com
- m####.####.nl
- p####.####.cc
- p####.####.com
- po####.####.com:84
- st####.####.com
- stat####.####.com
- syn####.####.net
- t####.####.com
- teleg####.nl
- tra####.####.com
- u####.####.com
- w####.####.com
Запросы HTTP GET:
- 1####.####.100/m/umeng:59818d6482b63570ad00062f/601/Ar8ncXh1Vx2RV4typVcD...
- 1####.####.100:8005/m/umeng:59818d6482b63570ad00062f/601/Ar8ncXh1Vx2RV4t...
- 3460dc7####.####.com/59824682761f5548032457f1_500x339.jpg
- 94d9733####.####.com/59826208761f554803272bcf_500x375.jpg
- 9f367e7####.####.com/5980e320761f554803000a90_500x333.jpg
- a1da734####.####.net/test.png
- a30159e####.####.net/test.png
- a4d506e####.####.net/test.png
- a86e323####.####.net/test.png
- af048a7####.####.net/test.png
- b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=...
- c####.####.com/cms?partner_id=####
- c####.####.com/dp/navegg.php?pid=####&uid=####
- c####.####.com/files/6c556240a16103d254f6b583c15258ba
- c####.####.com/js/2759701342.js
- c####.####.net/ctjs/controltag.js.c3a35cae6beb84887ab6a83973d97fa9
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- c####.####.org/2015-12-12/e1c580fb5598be38f748da04d16dd59e.jpeg!240
- c####.####.org/v2/system/version-1-126.json
- c2f2208####.####.com/51652252bbddbd1468000b5f.ico
- ce####.####.org/v2/content/getItemDetails-1511721.json
- cloudfr####.####.com/x.png
- con####.####.net/en_US/sdk.js
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/33569636203/
- d####.####.com/v.gif?a=####&d=####&u=####&h=####&r=####
- d####.####.net/ibs:dpid=822&dpuuid=33569636203&redir=https%3A//sync.navd...
- e####.####.com/js/tags.js
- f####.####.com/css?family=####
- f####.####.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- google-####.com/analytics.js
- h####.com/content?url=####
- i####.####.cc/s
- imgs####.####.nl/v1/_-_zsz_MN-Ga3sKpBVcdRJgYfic=/80x80/smart/filters:for...
- j####.####.net/gateway/gw.js?csid=####&auto=####
- lo####.####.org/api/search/KeywordSearch?MaxHits=####&QueryString=####
- m####.####.nl/static/img/icon-share.png
- p####.####.cc/api/ads/check?md5=####&secret=####&app_v=####&app=####&sdk...
- p####.####.com/sync/img?redir=####&mm####&mm####
- p####.####.com/ul_cb/aa/y8a2thbi7v8xdodcoa82
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####&verify=####
- st####.####.com/async.js
- st####.####.com/c/hotjar-27367.js?sv=####
- stat####.####.com/connect/xd_arbiter/r/XBwzv5Yrm_1.js?version=####
- syn####.####.net/upi/pid/DuqQKWX7/?redir=####
- t####.####.com/site/31436?dt=####&r=####&sig=####&bkca=####
- t####.####.com/sync?prtid=####&aolid=####
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.20.js?utv=####
- teleg####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e05.png
- tra####.####.com/redir/?bl=####&tgds=####&tgda=####&tgdid=####&tgdredir=...
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
- u####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
- w####.####.com/6ed84a8b77cf.js?lv=####
Запросы HTTP POST:
- a####.####.com/app_logs
- e####.####.com/e
- m####.####.com/v2/register
- po####.####.com:84/sdk/aff_getpolicy
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_dex/mocean-sdk.zip
- <Package Folder>/app_dex/mocean-sdk.zip.tmp
- <Package Folder>/app_tmpdex/mocean-sdk.zip
- <Package Folder>/cache/####/542324769-1749282151
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/mocean.database.ad-journal
- <Package Folder>/databases/track_event
- <Package Folder>/databases/track_event-journal
- <Package Folder>/databases/virgo_mpsp.db
- <Package Folder>/databases/virgo_mpsp.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/EVENTS_EXT_SP.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/shared_prefs/MO.xml.bak
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/shared_prefs/track_event.<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/v2_local_login.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/<Package>/####/9098e514a90a687f951299c684e2c0d8.jpg
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1z6zvfpz292r66bw5lmgi6f8b.0.tmp
- <SD-Card>/Android/####/25rq5n07ym2zjjisy8bf92jc0.0.tmp
- <SD-Card>/Android/####/2ql0blcc9oztuoqwf5zxfinte.0.tmp
- <SD-Card>/Android/####/4iy7jxd7mwrjkadxsu7xh0o2j.0.tmp
- <SD-Card>/Android/####/59bdjkv1xkb26ovo7t487fgha.0.tmp
- <SD-Card>/Android/####/5j5d90d4rstsz20wimgudy55o.0.tmp
- <SD-Card>/Android/####/5pkon9g2vsjkxno38qbwi40nh.0.tmp
- <SD-Card>/Android/####/6i37snv1m9z7hxvuic474q7jn.0.tmp
- <SD-Card>/Android/####/72ua7q3op5xoe7k7l5r4xq8ne.0.tmp
- <SD-Card>/Android/####/delay_20170727081648164_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081653336_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081700329_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081705433_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081708621_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081715201_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081719282_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/delay_20170727081719450_20c4587cf35a9f6f11b0f423a4b165e3_s.dat
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A59818d6482b63570ad00062f%22%2C%22utdid%22%3A%22WXmhbSJnJc4DAGdzx1FsyOT2%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- sh
Загружает динамические библиотеки:
- tnet-2.1.20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
