Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.433.origin
- Android.DownLoader.552.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 7j####.####.com
- a####.####.com
- and####.####.com
- c####.####.com
- c-h####.####.com
- dce####.####.com
- i####.####.com
- p####.####.com:6088
- pac####.####.com
- s####.####.com
- t####.####.com
- u####.####.com
Запросы HTTP GET:
- 7j####.####.com/tdata_kwS356
- a####.####.com/v7/policy.php?d=8h61T####&t=####
- a####.####.com/v7/switch.php?type=####&app_channel=####&ckey=####
- c####.####.com/s?v####
- c####.####.com/title.png
- dce####.####.com/api/apps/isblacklist
- dce####.####.com/api/client/upgrade
- dce####.####.com/api/client/upgrade/manual
- dce####.####.com/api/index-popup?id=####
- dce####.####.com/api/popup
- dce####.####.com/api/search-ads
- dce####.####.com/api/start
- i####.####.com/acenter.json
- i####.####.com/mms/icon/v1/1/b2/1ab19f3419ae9b10fc82e1d05660db21_100_100...
- i####.####.com/uploads/carousels/8/5/85eb8a91e5f2bddaab9ae9c13d8eed91.jpg
- i####.####.com/uploads/icons/1/d/1d05ed6aa91ac581c997824ad35ad62a.png
- i####.####.com/uploads/icons/3/6/3658d5632935e8ae6c245d06f8d0353d.png
- i####.####.com/uploads/icons/5/d/5d8aad346fbab9e1a3e571f793cd8124.png
- i####.####.com/uploads/icons/9/5/9576f71568530dd29ef210b7c8ecfe47.png
- i####.####.com/uploads/icons/9/c/9c00dddd02a3eb3eb1028e8bf4b322a1.png
- i####.####.com/uploads/icons/a/8/a842aaaa0f9617698ddeba18e8f5f7a9.png
- i####.####.com/uploads/icons/b/1/b16c4e55d6dabeaf26ca82e32324fe0a.png
- i####.####.com/uploads/icons/f/e/fe2109acc190c654335b4d791af08200.png
- p####.####.com:6088/c/1501850214300
- s####.####.com/config/hz-hzv3.conf
- t####.####.com/guidthv600.php?uuid=####&platform=####&channel=####&kerne...
- t####.####.com/update.php?channel=####&uid=####&from=####&kernelVersion=...
Запросы HTTP POST:
- and####.####.com/rqd/async
- and####.####.com/rqd/async?aid=####
- c-h####.####.com/api.php?format=####&t=####
- dce####.####.com/
- dce####.####.com/api/apps/upgrade
- dce####.####.com/api/client/report/info
- p####.####.com:6088/p/1501850214570
- p####.####.com:6088/s/
- pac####.####.com/api/v3/report/exposure?app_id=####&bssid=####&channel_i...
- s####.####.com/api.php?format=####&t=####
- t####.####.com/checkRG.php
- t####.####.com/v7/dsp_stat.php
- u####.####.com/frontend/web/index.php?r=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_cache/res.png
- <Package Folder>/app_cache/res.zip
- <Package Folder>/app_crashrecord/1004
- <Package Folder>/app_yoqdqb/7088BB206A20A43737D38624566171FB.jar
- <Package Folder>/cache/####/14b8816a92dcd3c8075226f81ffefa6e90938eff60f0cb90d30618dbd81743a7.0.tmp
- <Package Folder>/cache/####/25da928a4f1b35745b4bc50db7f3ccbd2cb7e37a176bd7ee31400488910bff11.0.tmp
- <Package Folder>/cache/####/709012d941baee173834f63a17e754bf588b0d2c9d71a916d89e2d1cbba51229.0.tmp
- <Package Folder>/cache/####/82e0aab3cc85770a13a944c2ea2352c22e32746230d31ba91335bc5c38bcc2f8.0.tmp
- <Package Folder>/cache/####/9e908233fc7751980574d6b8d7789c2cd4794bd011ac8ac7a880c4274ce5f80a.0.tmp
- <Package Folder>/cache/####/c50cf60d68c15fa4f160640de0a7b94917bc1af557c9f8f6aecdfd0209aac293.0.tmp
- <Package Folder>/cache/####/c549d867cc058a324d91589d6c454c811e2257babfa0993ecb74725681177f0a.0.tmp
- <Package Folder>/cache/####/dc01a6a56ac790438577b999ba01fb9f5a23ff184fa06acfd5360155b5783c6f.0.tmp
- <Package Folder>/cache/####/f824edf15d94869e4c0210f6c810a24afad948acde27d0b6a6878dc11e8e3290.0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/_nohttp_cache_db.db
- <Package Folder>/databases/_nohttp_cache_db.db-journal
- <Package Folder>/databases/_nohttp_cookies_db.db
- <Package Folder>/databases/_nohttp_cookies_db.db-journal
- <Package Folder>/databases/ad_down_db-journal
- <Package Folder>/databases/bugly_db_-journal
- <Package Folder>/databases/bugly_db_legu-journal
- <Package Folder>/databases/filedownloader.db-journal
- <Package Folder>/databases/ghost_web_view.db
- <Package Folder>/databases/ghost_web_view.db-journal
- <Package Folder>/databases/lt_appstore_db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/files/####/flow_pack.apk
- <Package Folder>/files/INSTALLATION
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1501850200582
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/local_crash_lock
- <Package Folder>/files/local_crash_lock (deleted)
- <Package Folder>/files/native_record_lock
- <Package Folder>/files/native_record_lock (deleted)
- <Package Folder>/files/push.pid
- <Package Folder>/files/qhcgfl
- <Package Folder>/files/run.pid
- <Package Folder>/files/security_info
- <Package Folder>/files/tdata_kwS356
- <Package Folder>/files/tdata_kwS356.jar
- <Package Folder>/mix.dex
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/SP_CACHE.xml
- <Package Folder>/shared_prefs/SP_CACHE.xml.bak
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/advisers.xml
- <Package Folder>/shared_prefs/app_auto_upgrade.xml
- <Package Folder>/shared_prefs/app_auto_upgrade.xml.bak
- <Package Folder>/shared_prefs/crashrecord.xml
- <Package Folder>/shared_prefs/getui_sp.xml
- <Package Folder>/shared_prefs/gx_sp.xml
- <Package Folder>/shared_prefs/loadingImg.xml
- <Package Folder>/shared_prefs/lt_app_share_data.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/my_preferences.xml
- <Package Folder>/shared_prefs/my_preferences.xml.bak
- <Package Folder>/shared_prefs/policy.xml
- <Package Folder>/shared_prefs/policy.xml.bak
- <Package Folder>/shared_prefs/rg_sp_cache.xml
- <Package Folder>/shared_prefs/rg_sp_cache.xml.bak
- <Package Folder>/shared_prefs/umeng_socialize.xml
- <Package Folder>/shared_prefs/umeng_socialize.xml.bak
- <Package Folder>/shared_prefs/versionUpdate.xml
- <Package Folder>/tx_shell/libshella-2.10.5.6.so
- <Package Folder>/tx_shell/libufix.so
- <SD-Card>/Android/####/adv
- <SD-Card>/Android/####/config
- <SD-Card>/Android/####/deviceId
- <SD-Card>/Android/####/master
- <SD-Card>/Android/####/master.lock
- <SD-Card>/Android/####/sys_install
- <SD-Card>/TTData/data.txt
- <SD-Card>/TT_AppCenter/####/0fbce897541dd53e5c43eaba252d47cf
- <SD-Card>/TT_AppCenter/cuid.chon
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/libs/<Package>.bin
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/slc_log.txt
- <SD-Card>/system/####/tdata_kwS356
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.10.5.6.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- su
Загружает динамические библиотеки:
- Bugly
- crash_analysis
- getuiext2
- libnfix
- libshella-2.10.5.6
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- DES
- DES-CBC-PKCS5Padding
- DES-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- DES-ECB-NoPadding
Использует повышенные привилегии.
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
