Android.Packed.30848

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.234
Android.DownLoader.463.origin
Android.HiddenAds.76.origin
Android.Loki.10.origin
Android.Loki.15.origin
Android.RemoteCode.58
Android.RemoteCode.88.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) a####.zhuo####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) t####.admobim####.com:8080
TCP(HTTP/1.1) uswild####.al####.com.####.net:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) t####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) a####.bay####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) c####.howdo####.net:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) c####.u####.u####.com:80
TCP(HTTP/1.1) ins####.insc####.net:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) ns1.newspo####.hk:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(TLS/1.0) eu####.al####.com.####.net:443
TCP(TLS/1.0) con####.face####.net:443
TCP(TLS/1.0) trans####.google####.com:443
TCP(TLS/1.0) trans####.go####.com:443
TCP(TLS/1.0) us-scp####.ali####.com:443
TCP(TLS/1.0) c####.superma####.top:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) aligt####.mm####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) cdnapph####.b0.a####.com:443
TCP(TLS/1.0) atracki####.appf####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP sdk.o####.t####.####.net:5224
TCP c####.g####.ig####.com:5226

Запросы DNS:

7j####.c####.z0.####.com
a####.bay####.com
a####.u####.com
a####.zhuo####.com
ak.icec####.org
aligt####.mm####.com
api.zhuo####.com
atracki####.appf####.com
b####.aliexp####.com
c####.g####.ig####.com
c####.howdo####.net
c####.superma####.top
c####.u####.u####.com
c-h####.g####.com
c.sz.gt.####.com
cdn.app.superma####.top
con####.face####.net
down####.zhuo####.com
h####.b####.com
i.al####.com
is.al####.com
j.bay####.com
l.a####.com
lighth####.aliexp####.com
ns1.newspo####.hk
oc.u####.co
oc.u####.com
p####.a####.com
pm.zhuo####.com
s.c####.aliexp####.com
s1.ibt####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
styl####.ali####.com
t####.admobim####.com
trans####.go####.com
trans####.google####.com
u.al####.com
www.cu####.com
www.google-####.com
www.mmmmmm####.com
www.zfr####.com

Запросы HTTP GET:

a####.zhuo####.com/Api/UnifiedAccess?PBindKey=####&data=ey####
a####.zhuo####.com/Api/getVideoBoxApp
a####.zhuo####.com/upload/700900CBFFFFFFE242F4EDA9C90A4E51.png
c####.u####.u####.com/index.php?service=####&pub=####&offer_id=####&uc_t...
ins####.insc####.net/sites/www.ibtimes.com/files/styles/embed/public/201...
ins####.insc####.net/sites/www.ibtimes.com/files/styles/md/public/2017/0...
ns1.newspo####.hk/v1/articles?channel=####&country=####&language=####&li...
p####.a####.com/img/bdar40641.png
t####.c####.l####.####.com/config/hz-hzv3.conf
uswild####.al####.com.####.net/app/umeng?pid=####&dp=####&af=####&sk=###...
www.cu####.com/20170907171543.ExpDex_5.2.1_201709071714.zip

Запросы HTTP POST:

l.a####.com/pv.php
l.a####.com/sal.php
oc.u####.com/check_config_update
t####.admobim####.com:8080/surl/api2_reg.action
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.zfr####.com/up.do

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_indicators/indicator_d
<Package Folder>/app_indicators/indicator_p
<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_libs/.atmp_8.log (deleted)
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/app_process_lock/2325821242035.55
<Package Folder>/app_process_lock/2325821242035.55 (deleted)
<Package Folder>/app_process_lock/2325821242145.56
<Package Folder>/app_process_lock/2325821242145.56 (deleted)
<Package Folder>/app_process_lock/2325821243014.46
<Package Folder>/app_process_lock/2325821243055.1
<Package Folder>/app_process_lock/2325821243055.1 (deleted)
<Package Folder>/app_process_lock/2325821243145.9
<Package Folder>/app_process_lock/2325821243145.9 (deleted)
<Package Folder>/app_process_lock/2325821243529.6
<Package Folder>/app_process_lock/2325821243529.6 (deleted)
<Package Folder>/app_process_lock/2325821243582.85
<Package Folder>/app_process_lock/2325821243582.85 (deleted)
<Package Folder>/app_process_lock/2325821244542.77
<Package Folder>/app_process_lock/2325821244542.77 (deleted)
<Package Folder>/app_process_lock/2325821244675.94
<Package Folder>/app_process_lock/7836592361473.64
<Package Folder>/app_process_lock/7836592361473.64 (deleted)
<Package Folder>/app_process_lock/7836592361844.32
<Package Folder>/app_process_lock/7836592361844.32 (deleted)
<Package Folder>/app_process_lock/7836592364771.98
<Package Folder>/app_process_lock/7836592364908.91
<Package Folder>/app_process_lock/7836592364908.91 (deleted)
<Package Folder>/app_process_lock/7836592365214.85
<Package Folder>/app_process_lock/7836592365214.85 (deleted)
<Package Folder>/app_process_lock/7836592366507.69
<Package Folder>/app_process_lock/7836592366507.69 (deleted)
<Package Folder>/app_process_lock/7836592366687.1
<Package Folder>/app_process_lock/7836592366687.1 (deleted)
<Package Folder>/app_process_lock/7836592369921.47
<Package Folder>/app_process_lock/7836592369921.47 (deleted)
<Package Folder>/app_process_lock/7836592370370.17
<Package Folder>/app_process_lock/7836592370370.17 (deleted)
<Package Folder>/app_process_lock/880107239918.541
<Package Folder>/app_process_lock/880107239918.541 (deleted)
<Package Folder>/app_process_lock/880107239960.17
<Package Folder>/app_process_lock/880107240288.969
<Package Folder>/app_process_lock/880107240288.969 (deleted)
<Package Folder>/app_process_lock/880107240304.347
<Package Folder>/app_process_lock/880107240304.347 (deleted)
<Package Folder>/app_process_lock/880107240338.706
<Package Folder>/app_process_lock/880107240338.706 (deleted)
<Package Folder>/app_process_lock/880107240483.902
<Package Folder>/app_process_lock/880107240504.05
<Package Folder>/app_process_lock/880107240504.05 (deleted)
<Package Folder>/app_process_lock/880107240867.293
<Package Folder>/app_process_lock/880107240867.293 (deleted)
<Package Folder>/app_process_lock/880107240917.686
<Package Folder>/app_process_lock/880107240917.686 (deleted)
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/databases/xUtils_http_cache.db-journal
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1501849347209
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/fvtJnMjmeqSIAyqBdaemon.so
<Package Folder>/files/gIfjPueBQyJvvggLdynamicloader.jar
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/kk.jar (deleted)
<Package Folder>/files/kkk.jar
<Package Folder>/files/libcuid.so
<Package Folder>/files/liblLHskInykSsQmpoGbootstrap.so
<Package Folder>/files/mobclick_agent_cached_<Package>56
<Package Folder>/files/ob.zip
<Package Folder>/files/oleWYEvaUzeGwmApstub.jar
<Package Folder>/files/push.pid
<Package Folder>/files/qJewZKOocpjgzNilsa.jar
<Package Folder>/files/run.pid
<Package Folder>/files/tdata_yNX857
<Package Folder>/files/tdata_yNX857.jar
<Package Folder>/files/tdata_zzD387
<Package Folder>/files/tdata_zzD387.jar
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml.bak
<Package Folder>/shared_prefs/HETEENHAPPYFAMILYDATA.xml
<Package Folder>/shared_prefs/HETEENHAPPYFAMILYDATA.xml.bak
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/SSP.xml
<Package Folder>/shared_prefs/SSPPrefe.xml
<Package Folder>/shared_prefs/SSPPrefe.xml (deleted)
<Package Folder>/shared_prefs/SSPPrefe.xml.bak
<Package Folder>/shared_prefs/SSPPrefe.xml.bak (deleted)
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml.bak
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml (deleted)
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml.bak
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/other_config.xml.bak
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/settingsLog.xml.bak (deleted)
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/sp_config.xml.bak
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/upgrade_config.xml
<Package Folder>/shared_prefs/upgrade_config.xml.bak
<Package Folder>/shared_prefs/vbz.xml
<SD-Card>/.salvia/<Package>
<SD-Card>/.salvia/tick
<SD-Card>/Android/####/03e1665592339a396807b2abc1771073
<SD-Card>/Android/####/03e1665592339a396807b2abc1771073.tmp
<SD-Card>/Android/####/09104fdcb0daca6b579050d847a4832c.0
<SD-Card>/Android/####/0fdf62f6b53e83cfb56ad9e65fcb28a1.0
<SD-Card>/Android/####/1972dd9f540a194ce4466c9e9fc0c65a.0
<SD-Card>/Android/####/1e93e9b1c8135824aafef094c9a899da.0
<SD-Card>/Android/####/2c6a883d44bbe73591c05734d567f2fc.0
<SD-Card>/Android/####/30a276b2bc14c11c5241b790b09dc67a.0
<SD-Card>/Android/####/3aea88904218f246751056c6f7dbad4e.0
<SD-Card>/Android/####/3cb5250ea30f410c3eef93a7be8b4c74.0
<SD-Card>/Android/####/4850bab3bdae0ae72441120d1ea059da
<SD-Card>/Android/####/4850bab3bdae0ae72441120d1ea059da.tmp
<SD-Card>/Android/####/5f330306918a47e4e7d4a2cb85b7f9dd.0
<SD-Card>/Android/####/605943c8b291a3ce6b1d0ab0be5f03a4.0
<SD-Card>/Android/####/64dfa0bc7ef6653b8fd843ef80ba0562.0
<SD-Card>/Android/####/67ef0c387d87cfb85d414edde0c717a3.0
<SD-Card>/Android/####/736a9de97e6ac88a9513867544dcb1a8.0
<SD-Card>/Android/####/77b75bf21b25b385b1bf58612c27e62c
<SD-Card>/Android/####/77b75bf21b25b385b1bf58612c27e62c.tmp
<SD-Card>/Android/####/781f4011b859c3570bcf27f329352a67.0
<SD-Card>/Android/####/7c334bfdc5621de59bf73cb8b7623222
<SD-Card>/Android/####/7c334bfdc5621de59bf73cb8b7623222.tmp
<SD-Card>/Android/####/82d670b6aa1851638b7892806c8c590f.0
<SD-Card>/Android/####/8acb231b8f533e9c9f43871bd3ded8ee.0
<SD-Card>/Android/####/8e5a23b0e56f668145fc82e62960ab87.0
<SD-Card>/Android/####/912560a4a3b2617d6a96759b29e00caf
<SD-Card>/Android/####/912560a4a3b2617d6a96759b29e00caf.tmp
<SD-Card>/Android/####/a28ed47a663710ae671ad5d33bd50787.0
<SD-Card>/Android/####/a510f921622935bd2a754779634ed0f7.0
<SD-Card>/Android/####/b443a0821651210b7b7c7bff5073553d
<SD-Card>/Android/####/b443a0821651210b7b7c7bff5073553d.tmp
<SD-Card>/Android/####/ba5071dd18cb789d491af9efa506b92c.0
<SD-Card>/Android/####/c010d92f2cbf8e3edf7b46e607e86b14.0
<SD-Card>/Android/####/c01c91231b259b6b2f13ac84f327b24d.0
<SD-Card>/Android/####/c0aaff85d98c3ab342a676899d7c7b8a.0
<SD-Card>/Android/####/c48fe17b388d897fc676445af666b042.0
<SD-Card>/Android/####/c5f04fcf82093d118ed35ff6e78f782b.0
<SD-Card>/Android/####/d3a468fb64de0f7e673b3951689dcaff.0
<SD-Card>/Android/####/e0fd27b07ad4d2ce615fbcb7572ff00e
<SD-Card>/Android/####/e0fd27b07ad4d2ce615fbcb7572ff00e.tmp
<SD-Card>/Android/####/e3340db6f8b6ad8d2b93d9e1c7491763.0
<SD-Card>/Android/####/e41faeb2ed4b22f54d558da2a1c95bd6
<SD-Card>/Android/####/e41faeb2ed4b22f54d558da2a1c95bd6.tmp
<SD-Card>/Android/####/e6551ba67bc34b26d7338444f64e5cbe.0
<SD-Card>/Android/####/e70c150df470279537f9f47fd9b9b4f9
<SD-Card>/Android/####/e70c150df470279537f9f47fd9b9b4f9.tmp
<SD-Card>/Android/####/e9c09db9823920c8aa0b9c1323b97daf.0
<SD-Card>/Android/####/f86a71066f20582305caf8912cfdf99b.0
<SD-Card>/Android/####/fa8e6ace37f9829523cdc0adbf63f757.0
<SD-Card>/Android/####/fd6b3c5ec36d4e3f79ab318cccc0a4d4.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/LogG/####/sp
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.getui.sdk.deviceId.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db
<SD-Card>/libs/test.log
<SD-Card>/system/####/tdata_yNX857
<SD-Card>/system/####/tdata_zzD387

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25761 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25761 300 0

Загружает динамические библиотеки:

com_zhuoyian_horsebrowser101
fvtJnMjmeqSIAyqBdaemon
getuiext2
liblLHskInykSsQmpoGbootstrap
webpbackport

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
desede-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES
DES
DES-CBC-PKCS5Padding

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней