Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) kanke-i####.b0.a####.com:80
- TCP(HTTP/1.1) go.1mi####.cn:80
- TCP(HTTP/1.1) cl####.kan####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) wx.q####.cn:80
- TCP(HTTP/1.1) kanke-####.b0.a####.com:80
- TCP(HTTP/1.1) 2####.243.193.48:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) l.m####.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) ui.ptlo####.qq.com:80
- TCP(HTTP/1.1) kanke-d####.b0.a####.com:80
- TCP(HTTP/1.1) openmo####.qq.com:80
- TCP(HTTP/1.1) con####.qq.com:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) cap####.qq.com:80
- TCP(HTTP/1.1) ty.cap####.qq.com:80
- TCP(HTTP/1.1) 2####.91.228.29:81
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(HTTP/1.1) cap####.g####.com.####.com:80
- TCP(HTTP/1.1) 1####.213.69.195:1028
- TCP(TLS/1.0) con####.qq.com:443
- TCP(TLS/1.0) ty.cap####.qq.com:443
- UDP 2####.255.255.250:1900
Запросы DNS:
- a####.kan####.com
- a####.u####.com
- api.s####.mob.com
- cap####.g####.com
- cap####.qq.com
- cl####.kan####.com
- con####.qq.com
- d.kan####.com
- d.xiongj####.com.cn
- go.1mi####.cn
- imgc####.qq.com
- l.m####.com
- openmo####.qq.com
- ping####.qq.com
- r.eli####.cn
- t####.qq.com
- tv.kan####.com
- ty.cap####.qq.com
- ui.ptlo####.qq.com
- wx.q####.cn
- xml.kan####.com
Запросы HTTP GET:
- con####.qq.com/sdk/pic/pt_QQ_logo.png
- d.xiongj####.com.####.com/jfile/gou.jar
- kanke-i####.b0.a####.com/api/v1/behavior/behavioralAll.json?appKey=####&...
- kanke-i####.b0.a####.com/api/v1/mv/behavioralAll.json?appKey=####&appScr...
- kanke-i####.b0.a####.com/api/v1/oauth/accessToken.json?code=####
- kanke-i####.b0.a####.com/api/v1/video/comments.json?appKey=####&appScrec...
- kanke-i####.b0.a####.com/api/v1/video/getvideostate.json?columnType=####...
- kanke-i####.b0.a####.com/image/film/android/360x480/86/86B1BDB8763270CF1...
- openmo####.qq.com/api/check?page=shareindex.html&style=9&action=shareToQ...
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=sty####&hln_...
- t####.qq.com/stats?sId=####
- ty.cap####.qq.com/code?siteKey=####&Action=####
- ui.ptlo####.qq.com/cgi-bin/login?style=####&hln_css=####&appid=####&daid...
- ui.ptlo####.qq.com/cgi-bin/report?id=####&t=####
- ui.ptlo####.qq.com/ptui_ver.js?ptui_identifier=####&v=####
- ui.ptlo####.qq.com/style/8/images/info.png
Запросы HTTP POST:
- api.s####.mob.com/conf4
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- l.m####.com/url/ShareSdkMapping.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_database/####/http_ui.ptlogin2.qq.com_0.lo...leted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/KanKe_Database-journal
- <Package Folder>/databases/KanKe_Database_DownLoad
- <Package Folder>/databases/KanKe_Database_DownLoad-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/sharesdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/KankePlayerUrl.apk
- <Package Folder>/files/####/_temp
- <Package Folder>/files/####/_temp (deleted)
- <Package Folder>/files/####/libckeygenerator.so
- <Package Folder>/files/1aaaa
- <Package Folder>/files/content_all
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/files/poster
- <Package Folder>/libs/.lock
- <Package Folder>/libs/libarm.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml.bak
- <Package Folder>/shared_prefs/KankeSharedPreferences.xml
- <Package Folder>/shared_prefs/RayArrayingSharedPreferences.xml
- <Package Folder>/shared_prefs/RayArrayingSharedPreferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/bg.xml
- <Package Folder>/shared_prefs/com.iflytek.msc.xml
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/shared_prefs/share_sdk_0.xml
- <Package Folder>/shared_prefs/share_sdk_0.xml.bak
- <Package Folder>/shared_prefs/soft.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/10ga1ql0xt1qt4sxzod2lcbav.0.tmp
- <SD-Card>/Android/####/10ga1ql0xt1qt4sxzod2lcbav.0.tmp (deleted)
- <SD-Card>/Android/####/156dcmlhgui7rnvqih83gghv9.0.tmp
- <SD-Card>/Android/####/1fiqhwgitcx5act9midwl1f19.0.tmp
- <SD-Card>/Android/####/2bdnm8w2yx7r1bfgjlce2s9la.0.tmp
- <SD-Card>/Android/####/2nse5jtrhqn43i202csgnzmus.0.tmp
- <SD-Card>/Android/####/4hrds0fb4qj0p20fczul7zes3.0.tmp
- <SD-Card>/Android/####/4ny9ay94zbq774eh9ap2i7n13.0.tmp
- <SD-Card>/Android/####/4qsv3aewiqolvvrnqjyoiy1oo.0.tmp
- <SD-Card>/Android/####/6iyas53qv95hp34yerx2ymoms.0.tmp
- <SD-Card>/Android/####/6lerpv8hlxxpl02agbi1s2gp5.0.tmp
- <SD-Card>/Android/####/73crpqvf2ekol4mmd0u1am32a.0.tmp
- <SD-Card>/Android/####/7i0zeiahdejec0qetczjzho22.0.tmp
- <SD-Card>/Android/####/7j8vdm033qe593d1uiysxv6pb.0.tmp
- <SD-Card>/Android/####/backgroundbg.jpg
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/q5eejgffupzd52rgxguakfcq.0.tmp
- <SD-Card>/Download/####/4.8_gou.jar.tmp
- <SD-Card>/ShareSDK/.ba
- <SD-Card>/ShareSDK/.dk
- <SD-Card>/dt/restime.dat
- <SD-Card>/iflyworkdir_test
- <SD-Card>/msc/####/u.data
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /storage/emulated/0/Android/data/com.kanke.video/KankeDownLoad/
Загружает динамические библиотеки:
- msc
- vinit
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-NoPadding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
