Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) 52.52.2####.56:80
- TCP(HTTP/1.1) ipv6-wi####.appl####.com.####.net:80
- TCP(HTTP/1.1) pose####.mobile####.com:80
- TCP(HTTP/1.1) www.tinyp####.net:80
- TCP(HTTP/1.1) cdn-hig####.unit####.uni####.com:80
- TCP(HTTP/1.1) down####.wild####.appl####.####.net:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) pwe.3####.top:80
- TCP(HTTP/1.1) cdnyxzf####.b0.a####.com:80
- TCP(HTTP/1.1) 6####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(TLS/1.0) l####.chartb####.com:443
- TCP(TLS/1.0) im####.appli####.com:443
- TCP(TLS/1.0) a3.chartb####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
Запросы DNS:
- 6####.com
- a.appl####.com
- a3.chartb####.com
- ads.mobile####.com
- as####.appl####.com
- cdn-hig####.unit####.uni####.com
- cdn.app.kac####.cn
- cdn.game####.org
- d.appl####.com
- im####.appli####.com
- img.appl####.com
- l####.chartb####.com
- mt####.go####.com
- os.scmp####.com
- pose####.mobile####.com
- pwe.3####.top
- ssl.google-####.com
- www.tinyp####.net
Запросы HTTP GET:
- cdn-hig####.unit####.uni####.com/impact/videos/23013/a0ecc6e41f670c36/sh...
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- down####.wild####.appl####.####.net/b39c339bf134cc0173c3d6c9ba1afc23ef30...
- down####.wild####.appl####.####.net/c243938de68de9da077fed7dc6452c8a2ccd...
- down####.wild####.appl####.####.net/spinner4.gif
- down####.wild####.appl####.####.net/zepto-1.1.3.min.js
- ipv6-wi####.appl####.com.####.net/2.0/ad?os=####&platform=####&model=###...
Запросы HTTP POST:
- ipv6-wi####.appl####.com.####.net/device?api_key=####
- pose####.mobile####.com/
- pwe.3####.top/jzbdt/fzlyd/k
- pwe.3####.top/jzbdt/lcev/ckp/nexp
- pwe.3####.top/jzbdt/rwpd/jor
- pwe.3####.top/sdf/jq
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/Matrix
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/ddexe
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/debuggerd
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/device.db
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/fileWork
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/insta...ery.sh
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/pidof
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/root3
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/su
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/supolicy
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/toolbox
- <Package Folder>/app_0cdb0fbb-b8e5-480e-af54-9893255f37fb/wsroot.sh
- <Package Folder>/app_16e20824-e09e-4c6c-af45-08ceaa4ccd6a/checker.dex
- <Package Folder>/app_16e20824-e09e-4c6c-af45-08ceaa4ccd6a/checker.jar
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/Matrix
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/ddexe
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/debuggerd
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/fileWork
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/insta...ery.sh
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/pidof
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/su
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/supolicy
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/toolbox
- <Package Folder>/app_3ac02f20-cc39-4236-97a9-bce0ccc21da5/wsroot.sh
- <Package Folder>/app_6383fdb0-cc8f-4a2f-b6ae-98a879666b6c/checker.jar
- <Package Folder>/app_6706e897-282c-437d-a32a-f0af325f82aa/checker.jar
- <Package Folder>/app_eacb157c-3646-42d5-93fa-f7a5d971dd8f/checker.jar
- <Package Folder>/app_plugin_download/10a5f2cf-615f-40d6-ab85-fa50b03e7c15
- <Package Folder>/app_plugin_download/2ccaf2ae-d882-40fe-8a07-a6642a8667d1
- <Package Folder>/app_plugin_download/47ac7992-1667-4c6b-888d-b1df3b33b647
- <Package Folder>/app_plugin_download/7a4c6aac-d364-44ce-8c07-8fd95098d655
- <Package Folder>/app_plugin_download/7e1c1b01-24b6-4a4d-9c99-814db260aca3
- <Package Folder>/app_plugin_download/a1600240-589e-4014-bb04-365114958efb
- <Package Folder>/app_plugin_download/c437f114-224c-4519-8dcc-899026285c1c
- <Package Folder>/app_plugin_download/f1673c08-735c-417d-8b71-b47c80a86eda
- <Package Folder>/app_sslcache/a3.chartboost.com.443
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/325310d8-934a-4207-a894-777d8c414cfe
- <Package Folder>/app_subox_download/447b615b-6245-4f99-af5c-3a7d165242a8
- <Package Folder>/app_subox_download/708a06cb-97b1-4166-8960-9c20e5633ffe
- <Package Folder>/app_subox_download/b1764f0d-1eeb-41ee-b917-62fcbf3f6aba
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ads38722631.jar
- <Package Folder>/cache/ads639207971.jar
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/preloader_0001.png
- <Package Folder>/files/####/preloader_0002.png
- <Package Folder>/files/####/preloader_0003.png
- <Package Folder>/files/####/preloader_0004.png
- <Package Folder>/files/####/preloader_0005.png
- <Package Folder>/files/####/preloader_0006.png
- <Package Folder>/files/####/preloader_0007.png
- <Package Folder>/files/####/preloader_0008.png
- <Package Folder>/files/####/preloader_0009.png
- <Package Folder>/files/####/preloader_0010.png
- <Package Folder>/files/####/preloader_0011.png
- <Package Folder>/files/####/preloader_0012.png
- <Package Folder>/files/.flurryagent.18052955
- <Package Folder>/files/.flurryappcircle.18052955
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/ai.jar
- <Package Folder>/files/gaClientId
- <Package Folder>/files/preloader.zip
- <Package Folder>/files/up.jar
- <Package Folder>/shared_prefs/1%dss#gfs#ge1%dr1%dps#g_s#gds#ge1...dm.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml.bak
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/cbPrefs.xml.bak
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/592fbe5e5e8faf0ee7cb825f-m31-1000.mp4
- <SD-Card>/Android/####/7e265867124e773e7ee5144c9e05b36f20fe43bc.png
- <SD-Card>/Android/####/V2.7.8.txt
- <SD-Card>/Android/####/a799bc09e13c051b4476112fcca392e997e0bfdf.png
- <SD-Card>/Android/####/abcce95ff069a1f8a3692d2b27d0766357cfda31.png
- <SD-Card>/Android/####/b39c339bf134cc0173c3d6c9ba1afc23ef30a5f6...1.jpeg
- <SD-Card>/Android/####/c243938de68de9da077fed7dc6452c8a2ccdf8cd...1.jpeg
- <SD-Card>/Android/####/spinner4.gif
- <SD-Card>/Android/####/zepto-1.1.3.min.js
Другие:
Запускает следующие shell-скрипты:
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- _vkns867
- cocos2dcpp
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
