Android.Packed.26177

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.HiddenAds.76.origin
Android.Mixi.13.origin
Android.Mixi.16.origin
Android.Xiny.164.origin
Android.Xiny.166.origin
Android.Xiny.202.origin
Android.Xiny.72.origin
Android.Xiny.73.origin

Предлагает установить сторонние приложения.

Скрывает свою иконку с экрана устройства.

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

1####.####.85:8081
4####.####.123
4####.####.160
4####.####.161
4####.####.176
4####.####.241
4####.####.48
4####.####.75
a####.####.cn
g####.####.com
koapk####.com
koapk####.com:8081
okyes####.com
okyes####.com:8081
p####.####.com
regis####.####.com
s####.####.com
st####.####.com
tshar####.com

Запросы HTTP GET:

4####.####.123/admin201506/uploadApkFile/rt/20170405/dz_p868.data
4####.####.160/admin201506/uploadApkFile/rt/20170113/p_dzsd45.data
4####.####.161/admin201506/uploadApkFile/rt/20170113/gp41.data
4####.####.176/admin201506/uploadApkFile/rt/20170408/rs40.data
4####.####.241/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.48/admin201506/uploadApkFile/rt/20170617/N2029.data
4####.####.75/admin201506/uploadApkFile/rt/20170617/N2045.data
g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
s####.####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
st####.####.com/sfm/13201/51feb45c9d63fb18c535ecea3d2834b0.prop
st####.####.com/upload/13201/682c5e1c7bd624dc2b28db24a64c63f71.json

Запросы HTTP POST:

1####.####.85:8081/sm/sr/run/hy
a####.####.cn/report?v=####&c=####&e=####
koapk####.com/sm/sr/sp/py
koapk####.com:8081/sm/sr/rt/ry
okyes####.com/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=####
okyes####.com:8081/sdk/nsd.action?b=####
p####.####.com/v1/broadcast/binddevice
regis####.####.com/v1/r/ra
tshar####.com/api/v3

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/1478228129219.dex
/data/data/####/1478228129219.jar
/data/data/####/1478228129219.tmp
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/FBAdPrefs.xml
/data/data/####/MainAlex.xml
/data/data/####/MainAlex.xml.bak
/data/data/####/SDKIDFA.xml
/data/data/####/TShare.xml
/data/data/####/admob.xml
/data/data/####/alex.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/index
/data/data/####/interlaken.xml
/data/data/####/interlaken.xml.bak
/data/data/####/librx.so
/data/data/####/neptune.xml
/data/data/####/notification_manager_database
/data/data/####/notification_manager_database-journal
/data/data/####/notification_pre.xml
/data/data/####/pref_tsr.xml
/data/data/####/push_db-journal
/data/data/####/rg.xml
/data/data/####/rg.xml.bak
/data/data/####/smartlocker_pre.xml
/data/data/####/starkconfig_prefs.xml
/data/data/####/stat_pref.xml
/data/data/####/stat_pref.xml.bak
/data/data/####/user_share_prefs.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/app_DEX_OPT/03841868.dex
<Package Folder>/app_DEX_OPT/08721579.dex
<Package Folder>/app_DEX_OPT/14075565.dex
<Package Folder>/app_DEX_OPT/20961445.dex
<Package Folder>/app_DEX_OPT/23798098.dex
<Package Folder>/app_DEX_OPT/24787115.dex
<Package Folder>/app_DEX_OPT/26123787.dex
<Package Folder>/app_DEX_OPT/35855192.dex
<Package Folder>/app_DEX_OPT/39895178.dex
<Package Folder>/app_DEX_OPT/43128230.dex
<Package Folder>/app_DEX_OPT/45000745.dex
<Package Folder>/app_DEX_OPT/45054325.dex
<Package Folder>/app_DEX_OPT/46542855.dex
<Package Folder>/app_DEX_OPT/48490101.dex
<Package Folder>/app_DEX_OPT/49926420.dex
<Package Folder>/app_DEX_OPT/59920912.dex
<Package Folder>/app_DEX_OPT/65858413.dex
<Package Folder>/app_DEX_OPT/66887678.dex
<Package Folder>/app_DEX_OPT/70289573.dex
<Package Folder>/app_DEX_OPT/72909877.dex
<Package Folder>/app_DEX_OPT/77214105.dex
<Package Folder>/app_DEX_OPT/80680235.dex
<Package Folder>/app_DEX_OPT/82302059.dex
<Package Folder>/app_DEX_OPT/88053722.dex
<Package Folder>/app_DEX_OPT/88512858.dex
<Package Folder>/app_DEX_OPT/96539067.dex
<Package Folder>/com.init.env/####/SSP.xml
<Package Folder>/com.init.env/####/SSPPrefe.xml
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1501143502807.zip
<Package Folder>/com.init.env/####/enable_gazq_radish
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/kk.jar
<Package Folder>/com.init.env/####/kkk.jar
<Package Folder>/com.init.env/####/rc_qgza_hd
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1501143502820.zip
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/03841868.apk
<Package Folder>/files/####/08721579.apk
<Package Folder>/files/####/14075565.apk
<Package Folder>/files/####/20961445.apk
<Package Folder>/files/####/23798098.apk
<Package Folder>/files/####/24787115.apk
<Package Folder>/files/####/26123787.apk
<Package Folder>/files/####/35855192.apk
<Package Folder>/files/####/39895178.apk
<Package Folder>/files/####/43128230.apk
<Package Folder>/files/####/45000745.apk
<Package Folder>/files/####/45054325.apk
<Package Folder>/files/####/46542855.apk
<Package Folder>/files/####/48490101.apk
<Package Folder>/files/####/49926420.apk
<Package Folder>/files/####/59920912.apk
<Package Folder>/files/####/65858413.apk
<Package Folder>/files/####/66887678.apk
<Package Folder>/files/####/70289573.apk
<Package Folder>/files/####/72909877.apk
<Package Folder>/files/####/77214105.apk
<Package Folder>/files/####/80680235.apk
<Package Folder>/files/####/82302059.apk
<Package Folder>/files/####/88053722.apk
<Package Folder>/files/####/88512858.apk
<Package Folder>/files/####/96539067.apk
<Package Folder>/files/####/N2023.data
<Package Folder>/files/####/N2025.data
<Package Folder>/files/####/N2026.data
<Package Folder>/files/####/N2029.data
<Package Folder>/files/####/N2030.data
<Package Folder>/files/####/N2031.data
<Package Folder>/files/####/N2040.data
<Package Folder>/files/####/N2043.data
<Package Folder>/files/####/N2044.data
<Package Folder>/files/####/N2045.data
<Package Folder>/files/####/N2046.data
<Package Folder>/files/####/N2048.data
<Package Folder>/files/####/N2050.data
<Package Folder>/files/####/N2051.data
<Package Folder>/files/####/N2058.data
<Package Folder>/files/####/N2061.data
<Package Folder>/files/####/ROOTSDK_Plugin_initenv.data
<Package Folder>/files/####/dz_p866.data
<Package Folder>/files/####/dz_p868.data
<Package Folder>/files/####/gp41.data
<Package Folder>/files/####/p_dzpg48.data
<Package Folder>/files/####/p_dzsd45.data
<Package Folder>/files/####/p_dzwk44.data
<Package Folder>/files/####/rl23.data
<Package Folder>/files/####/rs40.data
<Package Folder>/files/####/ym43.data
<Package Folder>/files/201708032250.apk
<Package Folder>/files/c201708032250.apk
<Package Folder>/p.dz866/####/ODY2ZXhl
<Package Folder>/p.dz866/####/ODY2ZXhl1501143520775.zip
<Package Folder>/p.dz866/####/ZGV4ZXoy
<Package Folder>/p.dz866/####/ZGV4ZXoy1501143520011.zip
<Package Folder>/p.dz866/####/error
<Package Folder>/p.dz868/####/ODY4X2V4
<Package Folder>/p.dz868/####/ODY4X2V41501143550288.zip
<Package Folder>/p.dz868/####/error
<Package Folder>/p.dzpg48/####/ZDExMDN6
<Package Folder>/p.dzpg48/####/ZDExMDN61501143545141.zip
<Package Folder>/p.dzpg48/####/error
<Package Folder>/p.dzsd45/####/ZVhWdGFXVXpNZz09
<Package Folder>/p.dzsd45/####/ZVhWdGFXVXpNZz091501143534479.zip
<Package Folder>/p.dzsd45/####/error
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk9
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk91501143528812.zip
<Package Folder>/p.dzwk44/####/error
<Package Folder>/p.gp41/####/.md
<Package Folder>/p.gp41/####/1489ACE5DD2C3FC346A4B1D3C2022642
<Package Folder>/p.gp41/####/1501143557341.jar
<Package Folder>/p.gp41/####/2A63DF2C983CE370A9205B913A7F4B45
<Package Folder>/p.gp41/####/3C009D66CAABD433CCD1D841E6AF0BF3
<Package Folder>/p.gp41/####/408.jar
<Package Folder>/p.gp41/####/421.jar
<Package Folder>/p.gp41/####/430.jar
<Package Folder>/p.gp41/####/4AB712239B2BDBC7C0FFCE3039D3C027
<Package Folder>/p.gp41/####/610.jar
<Package Folder>/p.gp41/####/611.jar
<Package Folder>/p.gp41/####/617.jar
<Package Folder>/p.gp41/####/640.jar
<Package Folder>/p.gp41/####/806.jar
<Package Folder>/p.gp41/####/834C8EAFCA3DB238A4EF547DDC644C6B
<Package Folder>/p.gp41/####/9736F0C22830D365D59E26ABED4AF856
<Package Folder>/p.gp41/####/A148B677DB524630C21ECA13C2D9E225
<Package Folder>/p.gp41/####/B11C222F5B18FADD2FFA4C70E35F4AC8
<Package Folder>/p.gp41/####/E8EE0B0E8C98EFCC1566F520B5CF12B0
<Package Folder>/p.gp41/####/forever.sh
<Package Folder>/p.gp41/####/gpdu
<Package Folder>/p.gp41/####/p.gp41_preferences.xml
<Package Folder>/p.gp41/####/p.gp41_preferences.xml.bak
<Package Folder>/p.gp41/####/test
<Package Folder>/p.rl23/####/forever.sh
<Package Folder>/p.sr40/####/cnVuc2hlbGwy
<Package Folder>/p.sr40/####/cnVuc2hlbGwy1501143503524.zip
<Package Folder>/p.sr40/####/forever.sh
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51501143541572.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ae.xml.bak
<SD-Card>/APPMarket/####/148103703.jpg.tmp
<SD-Card>/APPMarket/####/223201800.png.tmp
<SD-Card>/APPMarket/####/5202520.apk
<SD-Card>/Android/####/journal
<SD-Card>/Android/####/journal.tmp
<SD-Card>/test1501143501423 (deleted)

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
/data/data/com.cleaner.atracefresh/p.gp41/files/.play/test /data/data/com.cleaner.atracefresh/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
app_process /system/bin com.android.commands.pm.Pm path com.onegogo.explorer
c201708032250.apk -c com.cleaner.atracefresh:vd3
chmod 0755 <Package Folder>/com.init.env
chmod 0771 /data/data/com.cleaner.atracefresh/p.gp41/.syslib-
chmod 0771 <Package Folder>/p.gp41/.syslib-
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dz866/files/ODY2ZXhl
chmod 0777 <Package Folder>/p.dz866/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz866/files/error
chmod 0777 <Package Folder>/p.dz868/files/ODY4X2V4
chmod 0777 <Package Folder>/p.dz868/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz868/files/error
chmod 0777 <Package Folder>/p.dzpg48/files/ZDExMDN6
chmod 0777 <Package Folder>/p.dzpg48/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzpg48/files/error
chmod 0777 <Package Folder>/p.dzsd45/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzsd45/files/ZVhWdGFXVXpNZz09
chmod 0777 <Package Folder>/p.dzsd45/files/error
chmod 0777 <Package Folder>/p.dzwk44/files/ZDJsdWEyeGxNekk9
chmod 0777 <Package Folder>/p.dzwk44/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzwk44/files/error
chmod 0777 <Package Folder>/p.gp41/files/forever.sh
chmod 0777 <Package Folder>/p.rl23/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.rl23/files/forever.sh
chmod 0777 <Package Folder>/p.sr40/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.sr40/files/forever.sh
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 6777 <Package Folder>/files/c201708032250.apk
chmod 770 /data/data/com.cleaner.atracefresh/p.gp41/files/.play/test
chmod 770 <Package Folder>/p.gp41/files/.play/test
date
df
getenforce
getprop ro.build.hw_emui_api_level
getprop ro.build.version.codename
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.lenovo.rom
getprop ro.miui.ui.version.code
getprop ro.miui.ui.version.name
getprop ro.oppo.theme.version
getprop ro.versions.huawei_sw_version
getprop sys.lenovo.ideaui.version.sdk
id
logcat -d -v time
ls -l /system/bin/su
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
rc_qgza_hd
rc_qgza_hd -c id
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c echo MTU5ODM3QjNFQzkxNDI5NkU2OEY2RDY0MEJBQURFREUyNjY4M0M6QjA1NkM5OkZGQTlGQQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo MTU5ODM3QjNFQzkxNDI5NkU2OEY2RDY0MEJBQURFREUyNjY4M0M6QjA1NkM5OkZGQTlGQQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo NDlCNDkwNEM2Mzc5QTc5M0Y4NzBCRkE5MjFEQUQ3NDgxNTAxMTQzNTY0MzAx > <SD-Card>/../../../../../..<SD-Card>/.lut
sh -c echo NDlCNDkwNEM2Mzc5QTc5M0Y4NzBCRkE5MjFEQUQ3NDgxNTAxMTQzNTY0MzAx > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/lut
sh -c echo QTQyMkY4REIzOEJFRDkxNkYyNzVCMzA3NjJFRkI1MEY3MkVFNDY6NDc2OEY1OjREQzM4Qw== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo QTQyMkY4REIzOEJFRDkxNkYyNzVCMzA3NjJFRkI1MEY3MkVFNDY6NDc2OEY1OjREQzM4Qw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTc4NDE5NDE3NkU3MjFFNkIzOUU2RkM1RDE4N0I2MjMxNTAxMTQzNTg2 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RTc4NDE5NDE3NkU3MjFFNkIzOUU2RkM1RDE4N0I2MjMxNTAxMTQzNTg2 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/p.gp41/files/.play/test <Package Folder>/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
syssp -h e4e9bd1629b64d73b7c51387df1e1406 /data/data/com.cleaner.atracefresh/p.gp41/.syslib-

Загружает динамические библиотеки:

libjni-lodsvd3

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
DES

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об активных администраторах устройства.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней