Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106575206321505460: dyl#null,<IMEI>,6000098-1-214748-ddssys_00394-0
- 10691009: @8DYL#null,<IMEI>,6000098-1-214748-ddssys_00394-0
- 106912114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
- 106912114: HZSY#<IMSI>
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 6####.####.140
- a####.####.cn
- huangda####.com
- i####.####.cn
- i####.####.com
- l####.####.com
- p####.####.cn
- s####.####.com
- v####.####.cn
Запросы HTTP GET:
- a####.####.cn/video-app/server/css/style.css
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.cn/iplookup/iplookup.php?format=####
- i####.####.com/ando-res/ads/black/640x270.png
- v####.####.cn/start_20170413.jpg?imageMo####
Запросы HTTP POST:
- 6####.####.140/ando/v1/x/ap?app_id=####&r=####
- l####.####.com/sdk.php
- p####.####.cn/index.php/API
- s####.####.com/pay-sms-access//getAccessPayChannel.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/23uiusfjc.bin
- <Package Folder>/app_apCoreplugn/sinner.apk
- <Package Folder>/app_apCoreplugn/sky.apk
- <Package Folder>/app_apCoreplugn/smap.apk
- <Package Folder>/app_apCoreplugn/sms.apk
- <Package Folder>/app_apCoreplugn/sqq.apk
- <Package Folder>/app_apCoreplugn/sweb.apk
- <Package Folder>/app_apCoreplugn/syl.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/sinner.apk.apk
- <Package Folder>/cache/sky.apk.apk
- <Package Folder>/cache/smap.apk.apk
- <Package Folder>/cache/sms.apk.apk
- <Package Folder>/cache/sqq.apk.apk
- <Package Folder>/cache/sweb.apk.apk
- <Package Folder>/cache/syl.apk.apk
- <Package Folder>/code-2410648/sYNxtKiygLwlmWNE
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/TestinAgent.db
- <Package Folder>/databases/TestinAgent.db-journal
- <Package Folder>/databases/com.core.main.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_BqfpHuslx8lg4VmHnTpJaA==
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_BqfpHuslx8lg4VmHnTpJaA==-journal
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_H-GK-j2SXFYGcP4_
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_H-GK-j2SXFYGcP4_-journal
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_OH8A6MbUVAQ=-journal
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_tixTQcY5_VyS84-CXKEHxQHwQ8g=
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_tixTQcY5_VyS84-CXKEHxQHwQ8g=-journal
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_way4mEheK1T5PtbtFEY41A==
- <Package Folder>/databases/mof9Pl9Bl2sMigm6DAuI9fDm01lvH54-_way4mEheK1T5PtbtFEY41A==-journal
- <Package Folder>/databases/mp.db
- <Package Folder>/databases/mp.db-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db-journal (deleted)
- <Package Folder>/files/####/-YutQL2B_1YqPflqX0ODing-HjR6RjQg.new
- <Package Folder>/files/####/0ZXEwvwcB0nCBiHtyo3O1ifngLdSYV_MBHMJotcnTjY=.new
- <Package Folder>/files/####/1W_1wuFNvLJWJ_B1TlOl3n-U-AP602OU
- <Package Folder>/files/####/1W_1wuFNvLJWJ_B1TlOl3n-U-AP602OU.new
- <Package Folder>/files/####/2a8412a1-2430-4c59-89b1-b089369c5c6b.pic.temp
- <Package Folder>/files/####/4c0853ff-df14-4645-b394-d52e88c23e09.pic.temp
- <Package Folder>/files/####/54ae73ad-b850-43a4-a504-a3745cbc5bf4.pic.temp
- <Package Folder>/files/####/72uqxNbcEns98R6X
- <Package Folder>/files/####/812975eb-f8ff-4093-95e7-cc3c64767beb.pic
- <Package Folder>/files/####/9zEhPfBCTpI5m3gb24hOqhklr689vnqajAKLDg==.new
- <Package Folder>/files/####/AAKIhGC5yXdel2hgQ7ctig==.new
- <Package Folder>/files/####/FADVng6qeP2BP6mI17nvjgHje4Z0cBffpI-uLk7OGdA=.new
- <Package Folder>/files/####/H7COmH6v3G6EY0YA--kHVBHLrK_UtF0u.new
- <Package Folder>/files/####/J6eQtqeoTFaHBJrkSCyg9g==
- <Package Folder>/files/####/J6eQtqeoTFaHBJrkSCyg9g==.new
- <Package Folder>/files/####/Mx630lxULCk_o9YsGAzParlgbK0=
- <Package Folder>/files/####/Nonxe-kcH3gKaVCzjtAByBJNG6w=.new
- <Package Folder>/files/####/OAomVjm9Ldas52VKWDvcgw==
- <Package Folder>/files/####/OVnrMMKnS_RPBTsYK84TseUzJysbI4cEKQ5ZHsA8tig=.new
- <Package Folder>/files/####/RX-EbhZM0dlnk5D_l2yNdViaRJ0=
- <Package Folder>/files/####/RrhEKAvasRj6j7wu.zip
- <Package Folder>/files/####/T0Y7xOKroaKZspywjMziH-xsEWg=.new
- <Package Folder>/files/####/YAyAs8B7gsC40loT88CbWlGdROE=.new
- <Package Folder>/files/####/b9BevN8QC4U2Jnrcs_DP0N6dpE0Dlu_6.new
- <Package Folder>/files/####/bdb76346-1f56-4360-b449-8d939fd5b678.pic
- <Package Folder>/files/####/cuMloWDA6qfW7X22i6goeA==
- <Package Folder>/files/####/dDkL5gkottd2MAg8K4glsxsEBaw5tYF9.new
- <Package Folder>/files/####/f3135a87-e2fa-491e-a11e-90fa2496275d.pic.temp
- <Package Folder>/files/####/hsCWhYbPBLgivVcY1KRo0r2kT1XC2o0uUyjQtw==.new
- <Package Folder>/files/####/kApIy6xI7eViOuKadFpXth3g2GqfMv0OdwSOUOOZ6qI=.new
- <Package Folder>/files/####/laOqA9d-K7fdvFTfMte-S6QUy6pVAPxY.new
- <Package Folder>/files/####/mXCFwJbKLiyLK4pp1pA7Q1topVc=
- <Package Folder>/files/####/mXCFwJbKLiyLK4pp1pA7Q1topVc=.new
- <Package Folder>/files/####/povDFG3VuUNm5ejFk8m8gBBC_16YglRr.new
- <Package Folder>/files/####/qTzwwZwycFY5BK1HnKx7-KLl2WoVs_hfzKacJA==.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sDlsqh7y2zFQi8Q-AaKqdNhzsHHIYoHz.new
- <Package Folder>/files/####/senzbq_f.zip
- <Package Folder>/files/####/x7ZrIPadK36HiG-Hy0BwAg==.new
- <Package Folder>/files/####/xHFUz5Mt606VnW11.new
- <Package Folder>/files/rdata_commfeoxpnhq
- <Package Folder>/shared_prefs/CHECK_VERSION_TIME.xml
- <Package Folder>/shared_prefs/CONFIGS.xml
- <Package Folder>/shared_prefs/LOGIN_TIME.xml
- <Package Folder>/shared_prefs/SAFETIPS.xml
- <Package Folder>/shared_prefs/TestinAgent.xml
- <Package Folder>/shared_prefs/UPDATE_VERSION.xml
- <Package Folder>/shared_prefs/USER_EXTRA_INFO.xml
- <Package Folder>/shared_prefs/com.core.main.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/cpMsg.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/umengEnable.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/userInfo.xml
- <SD-Card>/.armsd/####/0fae26c8-6561-42ad-b143-587af8dd4aec.res
- <SD-Card>/.armsd/####/11bb533e-97f7-4bab-aa19-c77a35b1f5bf.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/aec22c58-d660-4e96-b2f0-cee99b19213e.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3001_2274.zip
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1235034122.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-2410648/sYNxtKiygLwlmWNE -p <Package> -c com.mfeo.xpnhq.uzgba.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- sh <Package Folder>/code-2410648/sYNxtKiygLwlmWNE -p <Package> -c com.mfeo.xpnhq.uzgba.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Загружает динамические библиотеки:
- NativeCrash
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-PKCS7Padding
- DES
Может автоматически отправлять СМС-сообщения.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
Осуществляет доступ к информации об отправленых/принятых смс.
