Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) com####.505####.com.####.com:80
- TCP(HTTP/1.1) m####.v####.i####.com:80
- TCP(HTTP/1.1) a.sm####.cn:80
- TCP(HTTP/1.1) msg.v####.q####.com:80
- TCP(HTTP/1.1) i####.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) dispat####.v####.q####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) t7z.c####.i####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) q####.com.edg####.net:80
- TCP(HTTP/1.1) d####.505####.com.####.com:80
- TCP(HTTP/1.1) qiy####.com.edg####.net:80
- TCP(HTTP/1.1) d####.b####.com:80
- TCP(HTTP/1.1) b####.s####.com.cn:80
- TCP(HTTP/1.1) m.439####.com.####.com:80
- TCP(HTTP/1.1) qq.com.yuchan####.####.cn:80
- TCP(HTTP/1.1) 4####.i####.com.####.com:80
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) eiv.b####.com:80
- TCP(HTTP/1.1) 2####.243.193.33:80
- TCP(HTTP/1.1) a.img####.com.####.com:80
- TCP(HTTP/1.1) i####.i####.com:80
- TCP(HTTP/1.1) c####.m.i####.com:80
- TCP(HTTP/1.1) i####.com.edg####.net:80
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) c####.i####.com:443
- TCP(TLS/1.0) secu####.i####.com:443
- TCP(TLS/1.0) hm.b####.com:443
Запросы DNS:
- 4####.i####.com
- a.img####.com
- a.sm####.cn
- b####.s####.com.cn
- b.scoreca####.com
- c####.i####.com
- c####.m.i####.com
- c####.mm####.com
- c.c####.com
- com####.505####.com
- d####.505####.com
- d####.b####.com
- d.xiongj####.com.cn
- dispat####.v####.q####.com
- eiv.b####.com
- h####.c####.com
- hm.b####.com
- i####.c####.com
- i####.i####.com
- m####.71.am
- m####.v####.i####.com
- m.439####.com
- m.i####.com
- mo####.b####.com
- mobads-####.b####.com
- msg.i####.com
- msg.v####.q####.com
- p####.qiy####.com
- qq.com.yuchan####.####.cn
- s16.c####.com
- secu####.i####.com
- st####.i####.com
- st####.q####.com
- t7z.c####.i####.com
- www.439####.com
- www.qiy####.com
Запросы HTTP GET:
- 4####.i####.com.####.com/mobile/cmdslztsrw/play.html
- b####.s####.com.cn/s/blog_dae7be800102wthm.html
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/stat.php?id=####&web_id=####&show=####
- d####.b####.com/x.gif?he=[mag####&prot_ver=####&app_id=####&rnd=####&log...
- d####.b####.com/x.js?si=####&dm=####
- d.xiongj####.com.####.com/jarFile/SDKAutoUpdate/lvs.jar
- dispat####.v####.q####.com/common/shareplayer.html?tvId=####&vid=####&co...
- eiv.b####.com/hmt/icon/21.gif
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?6bed68d####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=#...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep=9236,6701&et=3&ja=...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep={"netAll":0,"netDn...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&et=0&ja=0&ln=en-us&lo...
- i####.c####.com/img/pic.gif
- i####.com.edg####.net/css/201705261414/h5-outsitePlay.css
- i####.com.edg####.net/js/common/ares-4-0-31-e0a4a8f51dcd8118e3a9.min.js
- i####.com.edg####.net/js/pingback/iwt.js
- i####.com.edg####.net/js/pingback/qa.js
- i####.com.edg####.net/shareplay.html?tvId=####&vid=####&coop=####&cid=##...
- m####.v####.i####.com/jp/mixin/videos/744439100?select=####&callback=####
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/__pasys.apk
- mo####.b####.com/ads/pa/__pasys.php
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
- mo####.b####.com/cpro/ui/mads.php?code2=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849353420=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849353437=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849358353=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849367725=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849374685=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849383798=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849391097=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1501849414189=####
- q####.com.edg####.net/js/common/52ba69c7b1d54420bec46c52cec587c6.js
- q####.com.edg####.net/js/html5/js/lib/lib.2.0.5.min.js?sea1.2.####
- q####.com.edg####.net/js/html5/js/page/newShareplay/f5e9b6797f!app.js
- qiy####.com.edg####.net/common/fix/h5-outsitePlay/logo110-36.png
- qiy####.com.edg####.net/common/fix/h5-outsitePlay/logo350-118.png
- qiy####.com.edg####.net/common/fix/h5-outsitePlay/outsitePlay-bg.png
- qiy####.com.edg####.net/common/fix/h5-v3/logoH5-play.png
- qiy####.com.edg####.net/image/20170801/49/26/v_112989358_m_601_m2_480_27...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_database/####/http_4399.iqiyi.com_0.locals...leted)
- <Package Folder>/app_database/####/http_m.4399dmw.com_0.localst...leted)
- <Package Folder>/app_database/####/http_m.4399dmw.com_0.localst...ournal
- <Package Folder>/app_database/####/http_m.iqiyi.com_0.localstor...leted)
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.loca...leted)
- <Package Folder>/app_database/####/http_mobads.baidu.com_0.loca...ournal
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_database/Databases.db-journal
- <Package Folder>/app_database/Databases.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/__pasys.apk.beforesign
- <Package Folder>/files/__pasys_remote_banner.jar.beforesign
- <Package Folder>/files/__pasys_remote_banner.tmp.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Download/####/4.6_lvs.jar.tmp
- <SD-Card>/dt/restime.dat
Другие:
Загружает динамические библиотеки:
- dcae
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
