Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.190:8088
- 1####.####.1:8088
- 6####.####.140
- a####.####.com
- g####.####.com
- i####.####.com
- l####.####.com
- m####.####.com
- mo####.####.com
- pco####.####.com
- pl####.####.com
- r####.####.com
- res####.####.com
- st####.####.com
- y####.####.com
Запросы HTTP GET:
- 1####.####.190:8088/sdkserver/adData/adInfo/sdk/1501432303194.jar
- 6####.####.140/ando/i/mon?k=####&d=####
- g####.####.com/alilog/??s/7.5.1####
- g####.####.com/yt/youkuplayer.fdl.h5send?cache=####&gmkey=####&gokey=###...
- i####.####.com/ando-res/ads/3/2/eff3c843-7d88-43f5-8d7e-c94c4a29226a/e1c...
- l####.####.com/yt.gif?logtype=####&title=####&pre=####&cache=####&scr=##...
- m####.####.com/mf?aw=####&vs=####&pver=####&tict=####&vr=####&wintype=##...
- mo####.####.com/cpro/ui/mads.php?code2=####&b1501143508092=####
- pco####.####.com/app.gif?&cna=####
- pl####.####.com/unifull/images/new_player_icons.png
- r####.####.com/054104085134346F6A0A417977811B61
- res####.####.com/v3/ip?key=####
- st####.####.com/h5/html/sb/ykbannerLoader/ykbannerLoader.min.js
- y####.####.com/yt/vp.vtslog?vvid=####&vid=####&cf=####&cpt=####&full=###...
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/device
- 1####.####.1:8088/sdkserver/v2/addSdk
- a####.####.com/app_logs
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__164caf85-5273-4daf-b334-88b18e1a6a08.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal (deleted)
- <Package Folder>/app_database/ApplicationCache.db-journal
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/index
- <Package Folder>/code-9637657/6eGuk1OR48gWkCs6
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_LYxnLZ-D1fyb5GZph4Is0w==
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_LYxnLZ-D1fyb5GZph4Is0w==-journal
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_lEgRn2PYlVNkZZPbC7fQow==
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_lEgRn2PYlVNkZZPbC7fQow==-journal
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_lFWAnbueBKeBMYeJFo3d7ZnZDqM=
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_lFWAnbueBKeBMYeJFo3d7ZnZDqM=-journal
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_pExOza9wbk3_01jo
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_pExOza9wbk3_01jo-journal
- <Package Folder>/databases/kMwI-WeEVax8dBZ9amJU6AVhsm8zt2R9GMIyVQ==_t8YVETBMtJE=-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/-1P-rR0Y-OZlsjod3ukCCkItOBqjZi23.new
- <Package Folder>/files/####/-OpVAMbkJhi-GxqNWSDcUTXUIUbTEezcRcJEfDgmqTg=.new
- <Package Folder>/files/####/00a9ef02-b2aa-4bd9-8aba-91ac75e7942d.pic.temp
- <Package Folder>/files/####/036b6452-e043-42b0-9188-1af4b3460150.pic.temp
- <Package Folder>/files/####/0dd41ae2-d20c-40e1-829b-0cdb850a5abd.pic.temp
- <Package Folder>/files/####/0e544cfd-2e6f-436e-9c2d-5077298ace0b.pic.temp
- <Package Folder>/files/####/168c51ff-f3c7-45b1-ac1d-e65ef01f9449.pic.temp
- <Package Folder>/files/####/1v8QB1qysaoUZbksxxgnXpFVGY_wtqMt.new
- <Package Folder>/files/####/2gW9ZLF5iWlYbo8USncYhgvyme7DS0GHbkS-1xTADQ0=.new
- <Package Folder>/files/####/6DIcEHX5BzY-lVNbojLZsVeBsLVxyCWj.new
- <Package Folder>/files/####/6DNkEIad2n67cicXcPK7j0p5M5M=
- <Package Folder>/files/####/77GU98a40v3qlDfxtPlaWphmZ_x4VL-0.new
- <Package Folder>/files/####/7JD37qYx2_uPHa6SN1HtOrREMdfqb6_hk5AAPA==.new
- <Package Folder>/files/####/88xZRv1ViJf57s8Y.new
- <Package Folder>/files/####/8lErJDwlR2d0D3vC
- <Package Folder>/files/####/95b11af1-89ab-440b-9df4-817c6847f9b4.pic
- <Package Folder>/files/####/9c32db72-ea9a-408d-9819-b59f0c3e77d9.pic
- <Package Folder>/files/####/AvKcTXMKd9StbF9gmGCqu7li1_fZI0jY.new
- <Package Folder>/files/####/EpZDRt4Hhd3ZpggyuoWDhQ==
- <Package Folder>/files/####/IGixrbQ0xiSRiRFT2DlW5b97yH2_Sy5z
- <Package Folder>/files/####/IGixrbQ0xiSRiRFT2DlW5b97yH2_Sy5z.new
- <Package Folder>/files/####/JntgIMx_QVh4oD1pAXdOjw1oB-s=.new
- <Package Folder>/files/####/N8gP6hnm2ofNZGxW114KuAjQHyk=.new
- <Package Folder>/files/####/Re9v3ny84XaR5oigUuJ0lu4vq-4=.new
- <Package Folder>/files/####/VRr6f9uxV8hn89nSRklSnA==.new
- <Package Folder>/files/####/WIvjp2JMzrKXaxo7.zip
- <Package Folder>/files/####/X_e8EdreoA5NIXv-j1JXA9oUylV8RIz6VMU0C9h9IBQ=.new
- <Package Folder>/files/####/cPFMSHNFxkOlj9E9V_Vi7aSTR5w=
- <Package Folder>/files/####/d2655f2a-183c-4852-88ac-36acbf785ee1.pic.temp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/htmuNeIfmFTSHWZLz-2XFp3EiEctQYSiBxQF2Q==.new
- <Package Folder>/files/####/hurbuw_f.zip
- <Package Folder>/files/####/iQ7KwPex3cQSOdeuhNiPi9MNRK0=.new
- <Package Folder>/files/####/iv0INuPt1o57GCKjuckCVIw6NYXt-yZv.new
- <Package Folder>/files/####/jhT-x7h9P1hD-Gioass_Bg==
- <Package Folder>/files/####/k5Y5mlJDGeg-n2hXW0QMby6j248zSq_1.new
- <Package Folder>/files/####/oWHHvh_IYajpcfgTCSC4WwYiyQ0Q1teDVRlNG4lV33Q=.new
- <Package Folder>/files/####/rkGmG4P5WSN4NCN5wFmYyQ==
- <Package Folder>/files/####/rkGmG4P5WSN4NCN5wFmYyQ==.new
- <Package Folder>/files/####/rkGmG4P5WSN4NCN5wFmYyQ==.old (deleted)
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/vUQvbcXkIZVrGHNtMEGzJCOjqqUt2o-jh53AQw==.new
- <Package Folder>/files/####/w8jYc-4v8OK0DKdDJp3I0w==.new
- <Package Folder>/files/.imprint
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comgithubclient.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.armsd/####/26618eea-5836-40f5-851a-e4ed3819dc36.res
- <SD-Card>/.armsd/####/3f2b8582-b253-47b9-9500-6bb521a5115b.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/ae7013a2-a5f2-42ff-b67a-e0f813c1546f.res
- <SD-Card>/.armsd/####/bec29603-3c19-4526-9a52-2670b25f809f.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.xlink.zwsjshiping5/code-9637657/6eGuk1OR48gWkCs6 -p com.xlink.zwsjshiping5 -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- sh <Package Folder>/code-9637657/6eGuk1OR48gWkCs6 -p <Package> -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Использует следующие алгоритмы для шифрования данных:
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
