Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106575206321505460: dyl#null,<IMEI>,6000076-1-144-exo_rlys_1-0
- 10658000: SSDS
- 1065800830195200: 100#H9SXC01
- 10690400330213: myqxt<IMSI>
- 106904006189121: myqxt<IMSI>
- 10691009: @8DYL#null,<IMEI>,6000076-1-144-exo_rlys_1-0
Загружает на исполнение код следующих детектируемых угроз:
- Android.Exploit.52
- Android.SmsSend.21305
- Android.SmsSend.22526
- Android.Triada.236.origin
- Android.Triada.243
- Android.Triada.247.origin
- Android.Triada.248.origin
- Tool.SilentInstaller.3.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) pay.lik####.com:7820
- TCP(HTTP/1.1) sms.yy####.com:80
- TCP(HTTP/1.1) wap####.b####.com:80
- TCP(HTTP/1.1) bus####.yy####.com:80
- TCP(HTTP/1.1) api.lik####.com:7830
- TCP(HTTP/1.1) box.jom####.com:80
- TCP(HTTP/1.1) do####.abc####.info:8010
- TCP(HTTP/1.1) pass####.b####.com:80
- TCP(HTTP/1.1) dws.you####.com.####.com:8080
- TCP(HTTP/1.1) 2####.243.193.31:80
- TCP(HTTP/1.1) supermo####.jom####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) sdk.hzzr####.com:80
- TCP(HTTP/1.1) s####.hzzr####.com:80
- TCP(HTTP/1.1) do####.abc####.info:6020
- TCP(HTTP/1.1) d####.to####.net.####.com:80
- TCP(HTTP/1.1) hpd.b####.com:80
- TCP(HTTP/1.1) 1####.27.154.102:1234
- TCP(HTTP/1.1) nsc####.b####.com:80
- TCP(HTTP/1.1) p1.i####.cc:80
- TCP(HTTP/1.1) air.abc####.info:8400
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) www.huangda####.com:80
- TCP(HTTP/1.1) m.b####.com:80
- TCP(HTTP/1.1) a####.xctr####.com:12580
- TCP(HTTP/1.1) air.abc####.info:8200
- TCP(HTTP/1.1) air.abc####.info:8010
- TCP(HTTP/1.1) j####.hzzr####.com:9999
- TCP(TLS/1.0) pass####.b####.com:443
- TCP(TLS/1.0) ti####.jom####.com:443
- TCP(TLS/1.0) ss1.b####.com:443
- TCP(TLS/1.0) qia####.b####.com:443
- TCP(TLS/1.0) baif####.b####.com:443
- TCP(TLS/1.0) m.b####.com:443
- TCP(TLS/1.0) www.baif####.com:443
- TCP(TLS/1.0) f####.b####.com:443
- TCP(TLS/1.0) ss0.bdst####.com:443
- TCP(TLS/1.0) g####.bdst####.com:443
Запросы DNS:
- a####.u####.com
- a####.xctr####.com
- air.abc####.info
- api.lik####.com
- baif####.b####.com
- bus####.yy####.com
- col####.yy####.com
- d####.abc####.info
- d####.to####.net
- do####.abc####.info
- dws.you####.com
- f####.b####.com
- g####.bdst####.com
- hm.b####.com
- hpd.b####.com
- j####.hzzr####.com
- m.b####.com
- nsc####.b####.com
- p1.i####.cc
- pass####.b####.com
- pay.lik####.com
- qia####.b####.com
- s####.hzzr####.com
- s.bdst####.com
- sdk.hzzr####.com
- sm.b####.com
- sms.yy####.com
- ss0.b####.com
- ss0.bdst####.com
- ss1.b####.com
- ss2.b####.com
- timg####.b####.com
- up####.abc####.info
- wap####.b####.com
- www.baif####.com
- www.huangda####.com
Запросы HTTP GET:
- a####.xctr####.com:12580/log2?c=####
- api.lik####.com:7830/cdsapi?appid=####&merchantid=####&imsi=####&imei=##...
- api.lik####.com:7830/openplg?appid=####&channelid=####
- box.jom####.com/common/openjs/openBox.js?_v=####
- d####.to####.net.####.com/update/plugin-release-v4.9.3.zip
- hm.b####.com/h.js?294dbbd####
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep=30986,30515&et=3&j...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep=pv*login&et=4&ja=0...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&ep={"netAll":0,"netDn...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&et=0&ja=0&ln=en-us&lo...
- hpd.b####.com/v.gif?ssid=####&logid=####&pu=####&from=####&ct=####&logFr...
- hpd.b####.com/v.gif?tid=####&ct=####&cst=####&logFrom=####&logInfo=####&...
- hpd.b####.com/v.gif?tid=####&funcSta=####&sourceSta=####&actionSta=####&...
- j####.hzzr####.com:9999/main/getFeeData.wckj?IMSI=####&V=####&imei=####&...
- nsc####.b####.com/v.gif?v=####&page=####&source=####&tpl=####&auto_st####
- pass####.b####.com/cgi-bin/genimage?
- pass####.b####.com/cgi-bin/genimage?njG3506####
- pass####.b####.com/passport/getpass?enableExternalWeb=1&adapter=0&client...
- pass####.b####.com/static/touch/js/base_5410050.js
- pass####.b####.com/static/touch/js/login_15eb1ee.js
- pass####.b####.com/static/wpsecurity/css/base.css?cdnversion=####
- pass####.b####.com/static/wpsecurity/css/forgot_new.css?cdnversion=####
- pass####.b####.com/static/wpsecurity/css/mod/error.css?cdnversion=####
- pass####.b####.com/static/wpsecurity/css/secure_manager.css?cdnversion=#...
- pass####.b####.com/static/wpsecurity/css/ui/dialog.css?cdnversion=####
- pass####.b####.com/static/wpsecurity/css/ui/input.css?cdnversion=####
- pass####.b####.com/static/wpsecurity/img/kefu.png
- pass####.b####.com/static/wpsecurity/js/base.js?cdnversion=####
- pass####.b####.com/static/wpsecurity/js/forgot_new.js?cdnversion=####
- pass####.b####.com/static/wpsecurity/js/secure_manager.js?cdnversion=####
- pass####.b####.com/v3/security/manager?clientfrom=&adapter=0&ssid=&from=...
- pass####.b####.com/wp/api/login/history?item=####&token=####&clientfrom=...
- pay.lik####.com:7820/?igtcmd=####&iccid=####&imsi=####&imei=####&order=#...
- pay.lik####.com:7820/?igtcmd=####&nativePayCmd=####
- pay.lik####.com:7820/?igtcmd=####&nativePayCmd=####&iccid=####&price=###...
- pay.lik####.com:7820/?igtcmd=####&nativePayCmd=####&imsi=####
- pay.lik####.com:7820/?igtcmd=####&order=####&state=####&paymsg=####&fing...
- s####.hzzr####.com/SdkNotity.aspx?i=####&v=####&c=####&av=####&dm=####&t...
- sdk.hzzr####.com/getconfig.aspx
- sdk.hzzr####.com/getjar.aspx?pno=####
- sdk.hzzr####.com/versioncheck.aspx
- supermo####.jom####.com/static/wiseindex/iconfont/iconfont_32c1eb34.ttf
- supermo####.jom####.com/static/wiseindex/img/ns_diff_color_v2_3d39b4dd.png
- supermo####.jom####.com/static/wiseindex/img/w_icon2.png
- www.huangda####.com/active!activeLog.action?provider=####&clickId=####&m...
- www.huangda####.com/payres!getResource.action?resTypes=####&appid=####&c...
Запросы HTTP POST:
- air.abc####.info:8010/
- air.abc####.info:8200/
- air.abc####.info:8400/
- bus####.yy####.com/business-analysis-cmp/zhuabao/needCatch.do
- bus####.yy####.com/pay-data-collect/collectAppStartUserData.json
- bus####.yy####.com/pay-data-collect/uploadChannelNormalData.json
- p1.i####.cc/index.php/MC/HB
- pay.lik####.com:7820/
- pay.lik####.com:7820/newsetlog
- sms.yy####.com/pay-sms-access//getAccessPayChannel.json
- sms.yy####.com/pay-sms-access//uploadOpenPayOrderResult.json?
- www.huangda####.com/shop/shop_upload_log
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/Plugin/####/.imprint
- <Package Folder>/Plugin/####/3245C0D0r256c6j9y9i1o8p7g7r4u3.xml
- <Package Folder>/Plugin/####/57CSXG4AkRf8mBYZ.zip
- <Package Folder>/Plugin/####/67FrdcF4gl2hImERCnpAug==.new
- <Package Folder>/Plugin/####/9acbb2e6-0c4c-46fe-acc6-a203d6fad745.zip
- <Package Folder>/Plugin/####/CONFIG.xml
- <Package Folder>/Plugin/####/DATA_DB-journal
- <Package Folder>/Plugin/####/KooVrmclnZxDD3BodBEzDw==.new
- <Package Folder>/Plugin/####/LGXEUljdGWi27Y-ctaxaHg==
- <Package Folder>/Plugin/####/OcSDK_statistics_prom-journal
- <Package Folder>/Plugin/####/Signature_0.key
- <Package Folder>/Plugin/####/appStatus.xml
- <Package Folder>/Plugin/####/b9a5ad6b-8ec1-4f86-a076-f2bb5e4da7a2.zip
- <Package Folder>/Plugin/####/base-1.apk
- <Package Folder>/Plugin/####/base-1.dex
- <Package Folder>/Plugin/####/base-1.dex (deleted)
- <Package Folder>/Plugin/####/config.xml
- <Package Folder>/Plugin/####/d6c2beaa-fef7-46bc-9d3e-6697cf1d74a9.tmp
- <Package Folder>/Plugin/####/eOaNAKS7ZFL-EL5m7K1DVQ==
- <Package Folder>/Plugin/####/ef0edab6-34c3-46b7-8b65-e6be16f23036.zip
- <Package Folder>/Plugin/####/exchangeIdentity.json
- <Package Folder>/Plugin/####/heajva_f.zip
- <Package Folder>/Plugin/####/j6c652r0D0C5423-journal
- <Package Folder>/Plugin/####/n2-lXTPq9At8Dxrw
- <Package Folder>/Plugin/####/ocean_primary_ad_sp.xml
- <Package Folder>/Plugin/####/plugin.jar
- <Package Folder>/Plugin/####/pretw.xml
- <Package Folder>/Plugin/####/pretw6000076.xml
- <Package Folder>/Plugin/####/rdata_comwjkziukz.new
- <Package Folder>/Plugin/####/sy_pay_record-journal
- <Package Folder>/Plugin/####/tmp.Tz2103
- <Package Folder>/Plugin/####/tmp.ko2103
- <Package Folder>/Plugin/####/twc.xml
- <Package Folder>/Plugin/####/umeng_general_config.xml
- <Package Folder>/Plugin/####/umeng_it.cache
- <Package Folder>/Plugin/####/update.db
- <Package Folder>/Plugin/####/update.db-journal
- <Package Folder>/Plugin/####/webview.db-journal
- <Package Folder>/Plugin/####/wochi_v4.db-journal
- <Package Folder>/Plugin/####/wpspay.xml
- <Package Folder>/app_payload_lib/done
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/0fbe2c48.apk
- <Package Folder>/files/4958257798d0b33d389c0e0e6da871be.apk
- <Package Folder>/files/dp.apk
- <Package Folder>/files/net.tt.plugin.damai (deleted)
- <Package Folder>/files/net.tt.plugin.damai.apk
- <Package Folder>/files/net.tt.plugin.miwan (deleted)
- <Package Folder>/files/net.tt.plugin.miwan.apk
- <Package Folder>/files/net.tt.plugin.myadv (deleted)
- <Package Folder>/files/net.tt.plugin.myadv.apk
- <Package Folder>/files/net.tt.plugin.mysdk (deleted)
- <Package Folder>/files/net.tt.plugin.mysdk.apk
- <Package Folder>/files/net.tt.plugin.qipa (deleted)
- <Package Folder>/files/net.tt.plugin.qipa.apk
- <Package Folder>/files/net.tt.plugin.shangan (deleted)
- <Package Folder>/files/net.tt.plugin.shangan.apk
- <Package Folder>/files/net.tt.plugin.taiku (deleted)
- <Package Folder>/files/net.tt.plugin.taiku.apk
- <Package Folder>/files/net.tt.plugin.utadv (deleted)
- <Package Folder>/files/net.tt.plugin.utadv.apk
- <Package Folder>/files/net.tt.plugin.yiyou (deleted)
- <Package Folder>/files/net.tt.plugin.yiyou.apk
- <Package Folder>/files/net.tt.plugin.yufeng.apk
- <Package Folder>/files/net.tt.plugin.zhongzhi.apk
- <Package Folder>/shared_prefs/session.xml
- <SD-Card>/.d080d3a37b0be7bc7c15c0a5ac76bc64/####/08286ee6-58db-...53.zip
- <SD-Card>/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2289.zip
- <SD-Card>/com.zckj.files/u.apk
Другие:
Запускает следующие shell-скрипты:
- /system/bin/netcfg
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- chmod -R 755 <Package Folder>/Plugin
Загружает динамические библиотеки:
- fcvkoasj
- ktpescxg
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES-ECB-NoPadding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
- DES-ECB-NoPadding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
