Android.DownLoader.3364

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.BackDoor.339
Android.Click.171.origin
Android.Click.173.origin
Android.Triada.63

Загружает из Интернета следующие детектируемые угрозы:

Android.BackDoor.339
Android.Click.173.origin
Android.Triada.63

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) api.info####.me:80
TCP(HTTP/1.1) m####.ads####.com:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) www.4g####.net:80
TCP(HTTP/1.1) www.rib####.com:8182
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) www.webserv####.net:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) 98.1####.228.226:80
TCP(HTTP/1.1) poket####.com:80
TCP(HTTP/1.1) o5####.com:80
TCP(HTTP/1.1) 1####.243.74.32:80
TCP(HTTP/1.1) gp.api.google####.com:80
TCP(HTTP/1.1) www.rib####.com:8081
TCP(HTTP/1.1) ip.mo####.cc:80
TCP(HTTP/1.1) new.havefun####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) cdn.pubna####.net:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) rockt####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) v####.ddf####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) m####.a####.com:80
TCP(HTTP/1.1) tek####.com:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) p.mo####.cc:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) 1####.241.180.55:80
TCP(HTTP/1.1) e####.a####.com:80
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) o5####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) tr.pubna####.net:443

Запросы DNS:

api.a####.com
api.bi####.com
api.info####.me
api.ki####.com
cdn.pubna####.net
e####.a####.com
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
gp.api.google####.com
ilv####.com
int.d####.s####.####.cn
ip.mo####.cc
m####.a####.com
m####.ads####.com
new.havefun####.com
o5####.com
p.mo####.cc
pag####.googles####.com
poket####.com
pv.s####.com
rockt####.com
sconten####.xx.f####.net
serv####.m####.com
st####.xx.f####.net
tek####.com
tr.pubna####.net
v####.ddf####.com
www.4g####.net
www.bigt####.com
www.cu####.com
www.face####.com
www.google-####.com
www.mmmmmm####.com
www.rib####.com
www.technol####.co.uk
www.technol####.net
www.webserv####.net

Запросы HTTP GET:

api.a####.com/api.php?&sk=####&osv=####&icc=####&chn=####&vc=####&tr=###...
api.a####.com/api.php?sk=####
api.a####.com/api.php?sk=####&whitemd5=####&blackmd5=####
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.info####.me/api/s2s/goto?id=####&channel=####&provider=####&appkey=#...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
cdn.pubna####.net/games/promo_images_landscape/default/1_dimension_1200x...
f####.google####.com/css?family=####&ver=####
f####.gst####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
f####.gst####.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
ip.mo####.cc/s
m####.a####.com/redirect/index?type=####&to=aHR0####&data=####&action=####
new.havefun####.com/?utm_medium=####&utm_campaign=####&cid=####&token1=#...
new.havefun####.com/?utm_term=####&clickverify=####&utm_content=####
new.havefun####.com/proc.php?6acaa8b####
new.havefun####.com/proc.php?6bf1813####
o5####.com/?a=####&c=####&s1=####&s2=####&s3=####
p.mo####.cc/api/s2s/goto?id=####&channel=####&provider=####&appkey=####&...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20170920/r20170110/show_ads_impl.js
serv####.m####.com/119987?t=0.22878791950643063&ref=&lu=http://www.techn...
serv####.m####.com/119987?t=0.822568975854665&ref=&lu=http://www.technol...
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
www.cu####.com/20170613_images.zip
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
www.rib####.com:8081/uploadImgs/apk/lib_plugin_cplplay_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_dyload_v1_c008.jar
www.rib####.com:8081/uploadImgs/apk/lib_plugin_huntmobi_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_keke_v2_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_ksad_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_kuyu_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_moslient_im_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_moslient_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_snmi_v1_c008.apk
www.rib####.com:8081/uploadImgs/apk/lib_plugin_web_v16_c008.apk
www.rib####.com:8182/api/online/show_back?cid=####

Запросы HTTP POST:

api.bi####.com/un
api.info####.me/api/ads/connect
api.info####.me/api/ads/fetch?_s=####
api.info####.me/api/ads/vas?_s=####&
gp.api.google####.com/gb/api/get-switch
p.mo####.cc/api/ads/connect
p.mo####.cc/api/ads/fetch?_s=####
p.mo####.cc/api/ads/vas?_s=####&
v####.ddf####.com/api/j
v####.ddf####.com/api/o
v####.ddf####.com/api/va
www.4g####.net/ad/adc?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=###...
www.mmmmmm####.com/osp/oaen_reg.action
www.rib####.com:8182/api/dynamic_report
www.rib####.com:8182/api/get/policy
www.rib####.com:8182/api/online/ad_message
www.rib####.com:8182/api/snmi/ad_message
www.rib####.com:8182/api/v3/jm_message
www.rib####.com:8182/api/v3/register
www.webserv####.net/geoipservice.asmx/GetGeoIPContext

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_libs/libnload
<Package Folder>/app_s_tmp_down/s_t.tmp
<Package Folder>/app_s_tmp_down/s_tt.tmp
<Package Folder>/app_third_apk/lib_plugin_cplplay_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_huntmobi_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_keke_v2_c008.apk
<Package Folder>/app_third_apk/lib_plugin_ksad_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_kuyu_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_moslient_im_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_moslient_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_snmi_v1_c008.apk
<Package Folder>/app_third_apk/lib_plugin_web_v16_c008.apk
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/index
<Package Folder>/cache/.nomedia
<Package Folder>/cache/194871a040e50982487fd5508f5c9134.temp
<Package Folder>/cache/1_dimension_1200x627.jpg
<Package Folder>/cache/5d5e9ad281467de93ab98e22d8a3fa3b
<Package Folder>/cache/5d5e9ad281467de93ab98e22d8a3fa3b.temp
<Package Folder>/cache/7721fdc946faf2857d985fca3c44e115.temp
<Package Folder>/cache/89a27f39cbc43372d1dbf9cd9611c069.temp
<Package Folder>/cache/b055740caf89c7a8683d828f3e2173af.temp
<Package Folder>/cache/ba4698df5af25f63e9cc3944a32bb84b.temp
<Package Folder>/cache/bc221689ad3f53f39bd3d51f522e68c3.temp
<Package Folder>/cache/c12b0e985ef92c29038bd75e2d4db52c.temp
<Package Folder>/cache/ee5d5773ee54ed91a213dc3f792e0537.temp
<Package Folder>/cache/f181f591d7beadf946f6c9c1024e06ee.temp
<Package Folder>/databases/active.db
<Package Folder>/databases/active.db-journal
<Package Folder>/databases/adStatistics.db-journal
<Package Folder>/databases/app.manager-journal
<Package Folder>/databases/dollargetter.db
<Package Folder>/databases/dollargetter.db-journal
<Package Folder>/databases/easv.data-journal
<Package Folder>/databases/filedownloader.db-journal
<Package Folder>/databases/im.database.ad-journal
<Package Folder>/databases/kdl.db-journal
<Package Folder>/databases/kmob.db-journal
<Package Folder>/databases/mocean.database.ad-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.DS_Store
<Package Folder>/files/####/._.DS_Store
<Package Folder>/files/####/.old_file_converted
<Package Folder>/files/####/ad_tag.png
<Package Folder>/files/####/ad_tag1.png
<Package Folder>/files/####/bg_touch.png
<Package Folder>/files/####/ic_del.png
<Package Folder>/files/####/ic_gp_tv.png
<Package Folder>/files/####/icon_add.png
<Package Folder>/files/####/icon_btn_more.png
<Package Folder>/files/####/icon_down_circle.png
<Package Folder>/files/####/icon_fb.png
<Package Folder>/files/####/icon_gloab.png
<Package Folder>/files/####/icon_great.png
<Package Folder>/files/####/icon_menu.png
<Package Folder>/files/####/icon_new.png
<Package Folder>/files/####/icon_ps.png
<Package Folder>/files/####/icon_search.png
<Package Folder>/files/####/icon_share.png
<Package Folder>/files/####/icon_start.png
<Package Folder>/files/####/icon_store.png
<Package Folder>/files/####/icon_three_line.png
<Package Folder>/files/####/title_bg.png
<Package Folder>/files/####/uuid1.data
<Package Folder>/files/####/uuid2.data
<Package Folder>/files/####/vok2v.o
<Package Folder>/files/.e.download
<Package Folder>/files/.uuid3.data
<Package Folder>/files/DEAB89CE10FEAA11
<Package Folder>/files/bb.jar
<Package Folder>/files/boxun.apk
<Package Folder>/files/code
<Package Folder>/files/images.zip
<Package Folder>/files/ksuid
<Package Folder>/files/mail.dex
<Package Folder>/files/pconfig
<Package Folder>/shared_prefs/.r.jar
<Package Folder>/shared_prefs/.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/IM.xml
<Package Folder>/shared_prefs/IM.xml.bak
<Package Folder>/shared_prefs/KmobAdpf.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak
<Package Folder>/shared_prefs/MO.xml
<Package Folder>/shared_prefs/MO.xml.bak
<Package Folder>/shared_prefs/MobikokCache_Type_2.xml
<Package Folder>/shared_prefs/MobikokConfig.xml
<Package Folder>/shared_prefs/MobikokConfig.xml.bak
<Package Folder>/shared_prefs/MobikokConfig_Type_2.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_2.xml.bak
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml.bak
<Package Folder>/shared_prefs/adcube.xml
<Package Folder>/shared_prefs/curtain_sp.xml
<Package Folder>/shared_prefs/curtain_sp.xml.bak
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/labelaAdTypeSpName.xml
<Package Folder>/shared_prefs/local_storage0.xml
<Package Folder>/shared_prefs/local_storage1.xml
<Package Folder>/shared_prefs/local_storage1.xml.bak
<Package Folder>/shared_prefs/local_storage33.xml
<Package Folder>/shared_prefs/local_storage33.xml.bak
<Package Folder>/shared_prefs/local_storage999.xml
<Package Folder>/shared_prefs/pluginLib.xml
<Package Folder>/shared_prefs/pluginLib.xml.bak
<Package Folder>/shared_prefs/sp.xml
<Package Folder>/shared_prefs/sp.xml.bak
<Package Folder>/shared_prefs/spPostServer.xml
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/trackshare_data.xml
<Package Folder>/shared_prefs/userAgentSp.xml
<Package Folder>/shared_prefs/w2g6c1f3x0.xml
<Package Folder>/shared_prefs/w2g6c1f3x0.xml.bak
<SD-Card>/.android/uuid1.data
<SD-Card>/.systemconfig/uuid2.data
<SD-Card>/.uuid3.data
<SD-Card>/Android/####/.CHID
<SD-Card>/Android/####/.UUID
<SD-Card>/Android/####/.imei
<SD-Card>/Android/####/.imsi
<SD-Card>/Juice/ksuid
<SD-Card>/LogN/####/sp

Другие:

Запускает следующие shell-скрипты:

cat /sys/class/net/wlan0/address

Загружает динамические библиотеки:

libnload
nload
s_tt

Использует следующие алгоритмы для шифрования данных:

DES
DES-CBC-PKCS5Padding
DESede

Использует следующие алгоритмы для расшифровки данных:

DES
DES-CBC-PKCS5Padding
DESede

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней