Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.235.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) box.jom####.com:80
- TCP(HTTP/1.1) kc6.lvche####.com:80
- TCP(HTTP/1.1) t####.jom####.com:80
- TCP(HTTP/1.1) gs.a.s####.com:80
- TCP(HTTP/1.1) hpd.b####.com:80
- TCP(TLS/1.0) im####.s####.com.####.com:443
- TCP(TLS/1.0) p####.3.cn:443
- TCP(TLS/1.0) www.j####.com:443
- TCP(TLS/1.0) x.j####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) ti####.jom####.com:443
- TCP(TLS/1.0) gs.a.s####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) i####.j####.com:443
- TCP(TLS/1.0) usa.gd.a.####.com:443
Запросы DNS:
- a####.xctr####.com
- api.lik####.com
- c####.baidu####.cn
- f####.b####.com
- fc####.b####.com
- g####.bdst####.com
- g####.bdst####.com
- hm.b####.com
- hpd.b####.com
- i####.360bu####.com
- i####.jd.com
- i.go.s####.com
- i8.b####.com
- im####.s####.com
- imp.op####.com
- js.s####.com
- kc6.lvche####.com
- m.b####.com
- m.s####.com
- p####.3.cn
- pay.lik####.com
- pus####.to####.net
- pv.s####.com
- s.bdst####.com
- s.go.s####.com
- s1.rr.i####.cn
- s6.rr.i####.cn
- s7.rr.i####.cn
- s8.rr.i####.cn
- s9.rr.i####.cn
- se####.b####.com
- sm.b####.com
- ss0.b####.com
- ss1.b####.com
- ss2.b####.com
- st####.360bu####.com
- static-####.360bu####.com
- t11.b####.com
- t12.b####.com
- timg####.b####.com
- w####.s####.com
- wu####.e####.s####.com
- x.j####.com
- zz.m.s####.com
Запросы HTTP GET:
- hpd.b####.com/v.gif?logid=####&ssid=####&sid=####&from=####&pu=####&ct=#...
- hpd.b####.com/v.gif?tid=####&ct=####&cst=####&logFrom=####&logInfo=####&...
- hpd.b####.com/v.gif?tid=####&funcSta=####&sourceSta=####&actionSta=####&...
- kc6.lvche####.com/?apid=####&impid=####
- kc6.lvche####.com/images/04-61B3.jpg
- kc6.lvche####.com/images/1.jpg
- kc6.lvche####.com/images/2.jpg
- kc6.lvche####.com/images/3.jpg
- kc6.lvche####.com/images/31-17F.jpg
- kc6.lvche####.com/images/3be861B.jpg
- kc6.lvche####.com/images/4.jpg
- kc6.lvche####.com/images/501CD16.jpg
- kc6.lvche####.com/images/52186C1.jpg
- kc6.lvche####.com/images/9f23CB5.jpg
- kc6.lvche####.com/images/green.jpg
- kc6.lvche####.com/images/hand.jpg
- kc6.lvche####.com/images/mha412.jpg
- kc6.lvche####.com/images/qb_icon.png
- kc6.lvche####.com/images/rBA36A3.jpg
- kc6.lvche####.com/images/style.css
- kc6.lvche####.com/images/tou_1.jpg
- kc6.lvche####.com/images/tou_3.jpg
- kc6.lvche####.com/images/tou_4.jpg
- kc6.lvche####.com/images/tou_5.jpg
- kc6.lvche####.com/images/tou_8.jpg
- kc6.lvche####.com/images/tpu_7.jpg
- kc6.lvche####.com/images/u15A0C.jpg
- kc6.lvche####.com/images/u2A52A.jpg
- kc6.lvche####.com/weixin.js
- si####.jom####.com/common/openjs/openBox.js?_v=####
- si####.jom####.com/it/u=1299366784,1816623146&fm=58&s=C903C61200C053F157...
- si####.jom####.com/it/u=1497065737,246734551&fm=88&s=F351D4AEC04244F706A...
- si####.jom####.com/it/u=3829291322,2259992746&fm=58&s=7DC63872C7804F4108...
- si####.jom####.com/it/u=4143874120,3865787991&fm=88&s=21E52AAE71FA159A86...
- t####.jom####.com/timg?wiseala####&size=####&quality=####&sec=####&di=##...
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/app_payload_lib/done
- <Package Folder>/app_payload_lib/libcocos2dcpp.so
- <Package Folder>/app_payload_lib/libcrypt_sign.so
- <Package Folder>/app_payload_lib/libgoldcoast.so
- <Package Folder>/app_payload_lib/libkjOnlinePay.so
- <Package Folder>/app_payload_odex/980c07ea3b8d4fcbd75fdf93a8713...leted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/980c07ea3b8d4fcbd75fdf93a87132f5.apk
- <Package Folder>/files/a0c175d0.apk
Другие:
Запускает следующие shell-скрипты:
- /system/bin/netcfg
Загружает динамические библиотеки:
- kpdywbvg
- udemnjro
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
