Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.190:8088
- 1####.####.1:8088
- 6####.####.140
- a####.####.com
- g####.####.com
- i####.####.com
- l####.####.com
- m####.####.com
- mo####.####.com
- mobads-####.####.com
- pco####.####.com
- pl####.####.com
- r####.####.com
- res####.####.com
- st####.####.com
- y####.####.com
Запросы HTTP GET:
- 1####.####.190:8088/sdkserver/adData/adInfo/sdk/1501432303194.jar
- 6####.####.140/ando/i/mon?k=####&d=####
- g####.####.com/secdev/sufei_data/3.0.9/index.js
- g####.####.com/yt/youkuplayer.fdl.h5send?cache=####&gmkey=####&gokey=###...
- i####.####.com/ando-res/ads/3/2/eff3c843-7d88-43f5-8d7e-c94c4a29226a/e1c...
- l####.####.com/yt.gif?logtype=####&title=####&pre=####&cache=####&scr=##...
- m####.####.com/mb?aw=####&vs=####&pver=####&tict=####&vr=####&wintype=##...
- mo####.####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=##...
- pco####.####.com/app.gif?&cna=####
- pl####.####.com/video/js/yksmartbanner.min.js?_t=####
- r####.####.com/0541080850F17EE26A0A4A24A1426410
- res####.####.com/v3/ip?key=####
- st####.####.com/h5/html/sb/ykbannerLoader/ykbannerLoader.min.js
- y####.####.com/yt/vp.vdoview?is_pread=####&REQID=####&replay=####&isRetr...
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/deploymentMode
- 1####.####.1:8088/sdkserver/v2/appActive
- a####.####.com/app_logs
- l####.####.com/sdk.php
- mobads-####.####.com/brwhis.log
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__02fb55fb-1b49-4f44-8305-fdc27f89654b.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__c6065a97-4ff4-41f7-a9a4-6351a2480dfc.jar
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.localstorage-journal (deleted)
- <Package Folder>/app_database/ApplicationCache.db-journal
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/index
- <Package Folder>/code-6071376/HkO_oRGqmZTbgYPy
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_6lHKOQFwXRgoa6e8q_tAqw==
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_6lHKOQFwXRgoa6e8q_tAqw==-journal
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_PvACdGvt7norfXx8jFWqbqnBsUY=
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_PvACdGvt7norfXx8jFWqbqnBsUY=-journal
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_eThYsodF2BYMVc2bzOKtlg==
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_eThYsodF2BYMVc2bzOKtlg==-journal
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_pZOH1JqQwk0=-journal
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_yySZ7ZUUjpEPMgFE
- <Package Folder>/databases/coN-L_9vW6IIgX_epsqUNO4xbu8LCu56yv_o_g==_yySZ7ZUUjpEPMgFE-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/-z_dkZlNrknDPf1YIFjHY6dXqqZQE_hb.new
- <Package Folder>/files/####/0N8gg8nNjW4m9mQv-s2nf9-5PMY=.new
- <Package Folder>/files/####/0jbfRiI1BzCCZF95DqJp6ygJVpnKWzgh
- <Package Folder>/files/####/0jbfRiI1BzCCZF95DqJp6ygJVpnKWzgh.new
- <Package Folder>/files/####/0jbfRiI1BzCCZF95DqJp6ygJVpnKWzgh.old (deleted)
- <Package Folder>/files/####/1HXZd90PcXkl1I8p7ZLdN-QqyhdlT82y.new
- <Package Folder>/files/####/3RfxoxuvZwS7LHWaRlojKmlKPvzZ_obKX8kMc9KEl7U=.new
- <Package Folder>/files/####/4lH-RMP3utAiMTpg3wrJUg==
- <Package Folder>/files/####/4lH-RMP3utAiMTpg3wrJUg==.new
- <Package Folder>/files/####/4lH-RMP3utAiMTpg3wrJUg==.old (deleted)
- <Package Folder>/files/####/6f657f81-629b-478c-bf4c-24150b4ce354.pic.temp
- <Package Folder>/files/####/6gck2_5q-aZAOLK0xP4fD1F_ZoPDCZASB5zbAw==.new
- <Package Folder>/files/####/735a1dab-24bc-4733-852a-12e253dfa0de.pic.temp
- <Package Folder>/files/####/9aQgsWuIrhGltEpD4gtOXgQbKsN8hgIeNNzWje7RmEk=.new
- <Package Folder>/files/####/9cd3d5cd-ca5b-4af3-af01-7719054a3544.pic
- <Package Folder>/files/####/CK0_qQA936kFFWQssXWwig==
- <Package Folder>/files/####/FLjzjatOC0ZFiaTf72yDPcCE6x68qW6rRDfVMvGyQ5I=.new
- <Package Folder>/files/####/KvmMJrcehwoEH9NVk9WdRGfaCtw=
- <Package Folder>/files/####/NAcGSmOZL_sFSmWC
- <Package Folder>/files/####/UZMUF4eN-LzPktNflmhq4ntS-1c6aV7g.new
- <Package Folder>/files/####/WesNc0285_zFmVLoyGzFMmY7cYAMEAZyZZW59Fe-Pqg=.new
- <Package Folder>/files/####/YEpy_7gkmhpozmO7K-ds6rkv_-g=.new
- <Package Folder>/files/####/_5QP_-w02AJ9aOiMaCM09w==.new
- <Package Folder>/files/####/a-MJ2tWEtslgAUlsI2x6K60rKIqaFiht.new
- <Package Folder>/files/####/aeeb8960-6337-49ad-8113-0b1143ec891b.pic.temp
- <Package Folder>/files/####/ay1KLF6khZpiYkaMfgZ6vOyGeDA=.new
- <Package Folder>/files/####/b1b88ef7-fbe1-4191-a548-ddd151677cfe.pic
- <Package Folder>/files/####/bc777e42-b05d-4a21-9bd7-26f86ff85ecc.pic.temp
- <Package Folder>/files/####/d36ebb25-3859-4141-9cc1-f441a882b5ce.pic.temp
- <Package Folder>/files/####/e58fe56f-43ae-4f8a-8a67-76a6193f7c80.pic.temp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/f_GrNOKoP91X4bGN8Xz0bRsGPm5EgP8FUZZhmw==.new
- <Package Folder>/files/####/hurbuw_f.zip
- <Package Folder>/files/####/jAxF25DP_9cBSDvT0FC2u_r014g=
- <Package Folder>/files/####/jKwvg-jOfNLNDkxg31iw22aGiMLKrNDs.new
- <Package Folder>/files/####/jMwR0iyRAEVSV1lq.new
- <Package Folder>/files/####/k1CsNX_GMtVgKa8jmTQM1rY21Bk=.new
- <Package Folder>/files/####/pNqPlqWsy4nbtwPsYVmcyUR41DVQYo4I.new
- <Package Folder>/files/####/q74D_v22sx3MSpGWxV5tGb5jtyCezjpr.new
- <Package Folder>/files/####/qgHOT2z0wvSAnd7annpsRA==.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sczrm0zDsTBjYBSMxBV9NCIHum8W1vYaug-mrQ==.new
- <Package Folder>/files/####/tBG0bO9l6_zUsdB_lj2qzw==
- <Package Folder>/files/####/uh-TCRZ7IAGqwt6j.zip
- <Package Folder>/files/.imprint
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comgithubclient.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/share_data.xml.bak (deleted)
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.armsd/####/30f61324-e437-48e8-91a1-70e6777c7e36.res
- <SD-Card>/.armsd/####/3c927f7f-dc68-44cc-b870-02ce3142e762.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/5ce35d24-ab14-45ed-8c2c-0466417e307e.res
- <SD-Card>/.armsd/####/62143136-d917-4fe4-b54d-07f83187d1df.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-6071376/HkO_oRGqmZTbgYPy -p <Package> -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- sh <Package Folder>/code-6071376/HkO_oRGqmZTbgYPy -p <Package> -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Использует следующие алгоритмы для шифрования данных:
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
