Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1848.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) s8.q####.com:80
- TCP(HTTP/1.1) msg.v####.q####.com:80
- TCP(HTTP/1.1) api.s####.b####.com:80
- TCP(HTTP/1.1) t7z.c####.i####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) territo####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) se####.v####.i####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) s.3####.cn:80
- TCP(HTTP/1.1) i####.i####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) 1####.147.217.119:3398
- TCP(HTTP/1.1) js.pass####.qih####.com:80
- TCP(HTTP/1.1) 1####.42.157.151:8080
- TCP(HTTP/1.1) qiy####.com.edg####.net:80
- TCP(HTTP/1.1) a.cs####.top:8090
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ds-ak####.akam####.net.####.net:80
- TCP(HTTP/1.1) msg.i####.com:80
- TCP(HTTP/1.1) m####.f####.com:518
- TCP(HTTP/1.1) q####.com.edg####.net:80
- TCP(HTTP/1.1) c####.m.i####.com:80
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) secu####.i####.com:443
- TCP bg.vas####.cn:8090
Запросы DNS:
- a####.u####.com
- a.cs####.top
- api.s####.b####.com
- b.scoreca####.com
- bg.vas####.cn
- c####.m.i####.com
- d####.b####.com
- ds-ak####.akam####.net
- hm.b####.com
- i####.i####.com
- i5fd3be####.akam####.net
- js.pass####.qih####.com
- m####.71.am
- m####.f####.com
- m.i####.com
- msg.v####.q####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.qiy####.com
- p####.zhanz####.b####.com
- s.3####.cn
- s8.q####.com
- se####.v####.i####.com
- secu####.i####.com
- st####.i####.com
- st####.q####.com
- t7z.c####.i####.com
- territo####.oss-cn-####.aliy####.com
- u0.qiy####.com
- u1.qiy####.com
- u2.qiy####.com
- u3.qiy####.com
- u4.qiy####.com
- u5.qiy####.com
- u6.qiy####.com
- u8.qiy####.com
- u9.qiy####.com
- www.qiy####.com
Запросы HTTP GET:
- a.cs####.top:8090/afee?cpid=####&appfee_id=####&fee=####&smsc=####&imsi=...
- a.cs####.top:8090/getdata?cpid=####&packagename=####
- a.cs####.top:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=#...
- api.s####.b####.com/s.gif?l=####
- api.s####.b####.com/s.gif?l=/m.iqiyi.com/search.html?source=####&vfrm=##...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=#...
- hm.b####.com/hm.js?5df871a####
- i####.com.edg####.net/css/2017050311/h5-search.css
- i####.com.edg####.net/css/2017061919/h5-comment.css
- i####.com.edg####.net/css/20170809/h5-v3.css
- i####.com.edg####.net/css/20170825/h5-paopao-play.css
- i####.com.edg####.net/css/20170831/h5-pc.css
- i####.com.edg####.net/ext/common/iconography/iconfont.ttf
- i####.com.edg####.net/feedback.html
- i####.com.edg####.net/js/common/ares-2-18-6-1602ab75ada3f4198d28.min.js
- i####.com.edg####.net/js/common/ares-4-0-31-e0a4a8f51dcd8118e3a9.min.js
- i####.com.edg####.net/search.html?source=####&vfrm=####&key=####
- i####.com.edg####.net/vip/
- i####.com.edg####.net/w_19rv7iezdd.html
- i####.com.edg####.net/w_19rv8g0e99.html
- i####.com.edg####.net/w_19rvj6ddip.html
- m####.f####.com:518/ic_res_j.png
- q####.com.edg####.net/js/common/52ba69c7b1d54420bec46c52cec587c6.js
- q####.com.edg####.net/js/html5/js/lib/h5lib.removesea.1.0.1.js
- q####.com.edg####.net/js/html5/js/lib/lib.2.0.5.min.js?sea1.2.####
- q####.com.edg####.net/js/html5/js/lib/qoe.min.js?v=####
- q####.com.edg####.net/js/html5/js/page/feedback/0e44d4f360!app.js
- q####.com.edg####.net/js/html5/js/page/playMovie/4d1aaa2897!app.js
- q####.com.edg####.net/js/html5/js/page/search/db22fcf042!app.js
- qiy####.com.edg####.net/common/fix/h5-v3/foot.png
- qiy####.com.edg####.net/common/fix/h5-v3/icon-share-weixin-2x.png
- qiy####.com.edg####.net/common/fix/h5-v3/iqiyi-logo.png
- qiy####.com.edg####.net/common/fix/h5-v3/logoH5-play.png
- qiy####.com.edg####.net/common/fix/h5-v3/wx-share-guide.png
- qiy####.com.edg####.net/common/fix/headicons/female06-130.png
- qiy####.com.edg####.net/common/fix/iqiyi-wechat/logo.jpg
- qiy####.com.edg####.net/image/20160106/37/4c/uv_3054612150_m_601_160_90....
- qiy####.com.edg####.net/image/20170224/cb/ee/uv_2037883455_m_601_m1_160_...
- qiy####.com.edg####.net/image/20170331/78/e1/uv_3062182888_m_601_160_90....
- qiy####.com.edg####.net/image/20170707/73/bb/v_112728470_m_601_160_90.jpg
- qiy####.com.edg####.net/image/20170809/e4/b9/uv_2042578504_m_601_160_90....
- qiy####.com.edg####.net/image/20170811/83/c3/huv_2042694230_m_601_m1_160...
- qiy####.com.edg####.net/image/20170814/a7/8a/huv_3066231678_m_601_m1_160...
- qiy####.com.edg####.net/image/20170819/1f/c5/huv_2043037409_m_601_m1_160...
- qiy####.com.edg####.net/image/20170822/f9/5f/v_113199969_m_601_160_90.jpg
- qiy####.com.edg####.net/image/20170825/07/32/uv_3066727265_m_601_160_90....
- qiy####.com.edg####.net/image/20170825/5e/4d/huv_3066760237_m_601_m1_160...
- qiy####.com.edg####.net/image/20170825/88/67/huv_2043300117_m_601_m1_160...
- qiy####.com.edg####.net/image/20170825/b2/92/huv_2043308002_m_601_m1_160...
- qiy####.com.edg####.net/image/20170826/71/3b/huv_3066776749_m_601_m1_160...
- qiy####.com.edg####.net/image/20170826/db/f0/huv_3066790281_m_601_m1_160...
- qiy####.com.edg####.net/image/20170901/ca/fe/huv_2043619814_m_601_m1_160...
- qiy####.com.edg####.net/image/20170901/da/4e/huv_2043598352_m_601_m1_160...
- qiy####.com.edg####.net/image/20170904/29/5b/uv_2043727001_m_601_160_90....
- qiy####.com.edg####.net/image/20170905/4e/d8/huv_3067213473_m_601_m1_160...
- qiy####.com.edg####.net/image/20170906/ce/75/v_113353586_m_601_160_90.jpg
- s####.jom####.com/push.js
- se####.v####.i####.com/m?if=####&key=####
- se####.v####.i####.com/o?channel_name=####&if=####&pageNum=####&pageSize...
- territo####.oss-cn-####.aliy####.com/load.bat
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_cache/ic_res.png
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/index
- <Package Folder>/databases/MA_epay_db
- <Package Folder>/databases/MA_epay_db-journal
- <Package Folder>/databases/bil_db
- <Package Folder>/databases/bil_db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/cl.sh
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/ib
- <Package Folder>/files/####/ic_res.png
- <Package Folder>/files/####/install-recovery.sh
- <Package Folder>/files/####/libxbmc.so
- <Package Folder>/files/####/mkhy
- <Package Folder>/files/####/nyopi
- <Package Folder>/files/####/poiu
- <Package Folder>/files/####/poix
- <Package Folder>/files/####/wert
- <Package Folder>/files/####/x.sh
- <Package Folder>/files/####/x.zip
- <Package Folder>/files/.imprint
- <Package Folder>/files/mobclick_agent_cached_<Package>1250
- <Package Folder>/files/sdk.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/pspace/nexor.jar
- <Package Folder>/pspace/prim.jar
- <Package Folder>/shared_prefs/1043|account_file.xml
- <Package Folder>/shared_prefs/STORE_MAIN.xml
- <Package Folder>/shared_prefs/abs.xml
- <Package Folder>/shared_prefs/abs.xml.bak
- <Package Folder>/shared_prefs/b_setting.xml
- <Package Folder>/shared_prefs/b_share.xml
- <Package Folder>/shared_prefs/b_share.xml.bak
- <Package Folder>/shared_prefs/ma_call.xml
- <Package Folder>/shared_prefs/ma_data.xml
- <Package Folder>/shared_prefs/ma_data.xml.bak
- <Package Folder>/shared_prefs/ma_epay_share.xml
- <Package Folder>/shared_prefs/ma_epay_share.xml.bak
- <Package Folder>/shared_prefs/ma_phone.xml
- <Package Folder>/shared_prefs/ma_phone.xml.bak
- <Package Folder>/shared_prefs/nnt_data.xml
- <Package Folder>/shared_prefs/share_ecd.xml
- <Package Folder>/shared_prefs/share_version.xml
- <Package Folder>/shared_prefs/um_g_cache.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Download/####/load.bat
- <SD-Card>/Download/####/ver.txt
- <SD-Card>/gooogle/userid.cfg
Другие:
Запускает следующие shell-скрипты:
- /system/bin/chmod 777 <Package Folder>/files/hytf
- /system/bin/chmod 777 <Package Folder>/files/hytf/busybox
- /system/bin/chmod 777 <Package Folder>/files/hytf/cl.sh
- /system/bin/chmod 777 <Package Folder>/files/hytf/ib
- /system/bin/chmod 777 <Package Folder>/files/hytf/ic_res.png
- /system/bin/chmod 777 <Package Folder>/files/hytf/install-recovery.sh
- /system/bin/chmod 777 <Package Folder>/files/hytf/libxbmc.so
- /system/bin/chmod 777 <Package Folder>/files/hytf/mkhy
- /system/bin/chmod 777 <Package Folder>/files/hytf/nyopi
- /system/bin/chmod 777 <Package Folder>/files/hytf/poiu
- /system/bin/chmod 777 <Package Folder>/files/hytf/poix
- /system/bin/chmod 777 <Package Folder>/files/hytf/wert
- /system/bin/chmod 777 <Package Folder>/files/hytf/x.sh
- chmod 777 <Package Folder>/files/hytg acct cache config d data default.prop dev etc file_contexts init init.rc init.superuser.rc init.trace.rc init.usb.rc init.x86.rc lib mnt proc property_contexts sbin sdcard seapp_contexts selinux sepolicy storage sys system ueventd.android_x86.rc ueventd.rc vendor x86.prop
- mkdir <Package Folder>/files/hytg -p
- sh -c chmod 777 <Package Folder>/files/hytg *
Загружает динамические библиотеки:
- libxbmc
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
- DES
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
Осуществляет доступ к информации о входящих/исходящих звонках.
Осуществляет доступ к информации об отправленых/принятых смс.
