Android.Xiny.693

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Banker.190.origin
Android.Xiny.164.origin
Android.Xiny.202.origin
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.bonga####.com:80
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) 45.33.1####.188:80
TCP(HTTP/1.1) of.okyes####.com:80
TCP(HTTP/1.1) c####.amazing####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) www.go####.com:80
TCP(HTTP/1.1) t####.snapbac####.com:80
TCP(HTTP/1.1) stoneca####.com:80
TCP(HTTP/1.1) 45.79.1####.142:80
TCP(HTTP/1.1) newrota####.com:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) a####.btr####.com:80
TCP(HTTP/1.1) api.l####.com:80
TCP(HTTP/1.1) bonga####.com:80
TCP(HTTP/1.1) c.a####.com:80
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) fantast####.accountant:80
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) offence####.accountant:80
TCP(HTTP/1.1) m.face####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) w.hippo-g####.com:8080
TCP(HTTP/1.1) clk.apxadtr####.net:80
TCP(HTTP/1.1) www.fl####.com:80
TCP(HTTP/1.1) gl####.top####.com:9090
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) 1####.241.242.234:80
TCP(HTTP/1.1) r.fl####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(TLS/1.0) c####.cloudf####.com:443
TCP(TLS/1.0) m.face####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) face####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
TCP(TLS/1.0) adse####.leblonm####.com:443
TCP(TLS/1.0) nl.bonga####.com:443
TCP(TLS/1.0) i.bonga####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) digital####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) bonga####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) r.fl####.com:443
TCP(TLS/1.0) s####.i9.bonga####.net:443

Запросы DNS:

a####.btr####.com
ads.iches####.net
adse####.leblonm####.com
api.l####.com
bonga####.com
c####.amazing####.com
c####.cloudf####.com
c.a####.com
clk.apxadtr####.net
d31qbv1####.cloudf####.net
digital####.com
f####.com
f####.google####.com
f####.net
face####.com
fantast####.accountant
gl####.top####.com
h####.b####.com
hy####.com
i.bonga####.com
i1.bonga####.com
i2.bonga####.com
i3.bonga####.com
m.face####.com
mt####.go####.com
newrota####.com
nl.bonga####.com
of.okyes####.com
offence####.accountant
offer####.online
p####.lead####.com
questio####.com
r.fl####.com
ssl.google-####.com
st####.xx.f####.net
stoneca####.com
t####.bonga####.com
t####.snapbac####.com
thester####.com
w.hippo-g####.com
www.fl####.com
www.go####.com
www.google-####.com
www.koapk####.com
www.okyes####.com

Запросы HTTP GET:

a####.btr####.com/click/s/?id=####&aff_click_id=####
api.l####.com/redirect?s=####&at=####&rt=####&cid=####&pid=####&publish_...
bonga####.com/track?c=####&subid2=####&subid=####
bonga####.com/track?c=####&subid2=####&subid=####&
c####.amazing####.com/?utm_medium=####&utm_campaign=####&1=####&2=####&c...
c####.amazing####.com/?utm_term=####&clickverify=####
c####.amazing####.com/favicon.ico
c####.amazing####.com/proc.php?23af503####
c.a####.com/ck/sl/w6kYOx3c?tfc_id=####&sc=####&pub_click_id=####
clk.apxadtr####.net/iclk/redirect.php?id=####&trafficsourceid=####&track...
fantast####.accountant/10.jpg
fantast####.accountant/11.jpg
fantast####.accountant/7.jpg
fantast####.accountant/8.jpg
fantast####.accountant/9.jpg
fantast####.accountant/?brand=####&model=####&browser=####&td=####&swim=...
fantast####.accountant/flag.png
fantast####.accountant/index.html
fantast####.accountant/ip7.png
fantast####.accountant/iphone6.jpg
fantast####.accountant/iphone7.jpg
fantast####.accountant/item1.png
fantast####.accountant/item2.png
fantast####.accountant/item3.png
fantast####.accountant/like.png
fantast####.accountant/search.png
gl####.top####.com:9090/NkpAU0Q/?offer=####&cid=####&aff_sub8=####
m.face####.com/
newrota####.com/apple-touch-icon.png
newrota####.com/campaign/20611|3764?website=####&tag=####
newrota####.com/campaign/20611|3764?website=####&tag=####&
newrota####.com/css/lost.css
of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
offence####.accountant/10.jpg
offence####.accountant/11.jpg
offence####.accountant/7.jpg
offence####.accountant/8.jpg
offence####.accountant/9.jpg
offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
offence####.accountant/favicon.ico
offence####.accountant/flag.png
offence####.accountant/index.html
offence####.accountant/ip7.png
offence####.accountant/iphone6.jpg
offence####.accountant/iphone7.jpg
offence####.accountant/item1.png
offence####.accountant/item2.png
offence####.accountant/item3.png
offence####.accountant/like.png
offence####.accountant/search.png
offer####.online/favicon.ico
offer####.online/r/f5870b32-01be-11e8-a267-11447c886ea0/0/
offer####.online/r/f5870b32-01be-11e8-a267-11447c886ea0/1/
r.fl####.com/red/?code=####&a=####&pubid=####&a=####
r.fl####.com/red/?code=####&a=####&pubid=####&a=####&
stoneca####.com/21Y12/2JXS/zJaW/2YeF/mt7befi7DpHaNvTC9-JgRmhRw7JKoOoZnoz...
stoneca####.com/21Y12/zJaW/wpKG/mt7befi7DpHaNvTC9-JgRmhRw7JKoOoZnozhH79G...
stoneca####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKh...
stoneca####.com/WH29N/8jaS/5jXW/8yTF/sH2TsGBwYjJogVEBIFph9x-4C78WQB_-JPg...
stoneca####.com/get/iad/1-1195-f87dff3d9664a320c1fdbc376d10af7a?cl=####&...
t####.bonga####.com/hit.php?c=####&subid2=####&subid=####
t####.snapbac####.com/12fbf703-ea48-44ad-bd01-00c40405d02c?companyid=###...
t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
w.hippo-g####.com:8080/download/chestnut_dex_bat.jar
w.hippo-g####.com:8080/download/chestnut_dex_gp.jar
w.hippo-g####.com:8080/download/chestnut_dex_lovin.jar
www.fl####.com/rc/941320d975?affclick=####&pubid=####
www.go####.com/complete/search?hl=####&client=####&q=####

Запросы HTTP POST:

w.hippo-g####.com:8080/check?ver=####&cl=####&sv=####&api=####&b=####
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Изменения в файловой системе:

Создает следующие файлы:

/data/.xbin/api
/data/.xbin/bkoatdump_pooj_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkload_jpoo_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/bin/oatdump_pooj_radish
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/load_jpoo_hd
/system/xbin/supolicy
<Package Folder>/app_DEX_OPT/01441330.dex
<Package Folder>/app_DEX_OPT/11588687.dex
<Package Folder>/app_DEX_OPT/30440228.dex
<Package Folder>/app_DEX_OPT/46675486.dex
<Package Folder>/app_DEX_OPT/47070345.dex
<Package Folder>/app_DEX_OPT/48825620.dex
<Package Folder>/app_DEX_OPT/77998376.dex
<Package Folder>/app_ass/lib.zip
<Package Folder>/app_gp/1.dex
<Package Folder>/app_gp/t
<Package Folder>/app_lbb/libcocos2dcpp.so
<Package Folder>/app_lbb/libcom.worldsen.mike.so
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/app_mdex/classes10.dex
<Package Folder>/cache/####/-835154443
<Package Folder>/cache/####/2597031
<Package Folder>/cache/####/3015911
<Package Folder>/cache/####/94627080
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/data_0
<Package Folder>/com.init.env/####/data_1
<Package Folder>/com.init.env/####/data_2
<Package Folder>/com.init.env/####/data_3
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510833494653.zip
<Package Folder>/com.init.env/####/f_000001
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/index
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/load_jpoo_hd
<Package Folder>/com.init.env/####/oatdump_pooj_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510833495510.zip
<Package Folder>/com.init.env/####/webview.db-journal
<Package Folder>/com.init.env/####/webviewCookiesChromium.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/files/####/01441330.apk
<Package Folder>/files/####/11588687.apk
<Package Folder>/files/####/30440228.apk
<Package Folder>/files/####/46675486.apk
<Package Folder>/files/####/47070345.apk
<Package Folder>/files/####/48825620.apk
<Package Folder>/files/####/77998376.apk
<Package Folder>/files/####/N2051.data
<Package Folder>/files/####/dk356.data
<Package Folder>/files/####/dk910.data
<Package Folder>/files/####/dk938.data
<Package Folder>/files/####/ja201801152050.data
<Package Folder>/files/####/p_dzpg48.data
<Package Folder>/files/####/ym43.data
<Package Folder>/files/201712260950.apk
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1510833486849
<Package Folder>/files/__send_data_1510833499077
<Package Folder>/files/c201712260950.apk
<Package Folder>/files/chestnut_dex_bat.jar
<Package Folder>/files/chestnut_dex_gp.jar
<Package Folder>/files/chestnut_dex_lovin.jar
<Package Folder>/files/gaClientId
<Package Folder>/files/libcuid.so
<Package Folder>/p.dk356/####/forever.sh
<Package Folder>/p.dk356/####/krcfg.txt
<Package Folder>/p.dk356/####/krmain
<Package Folder>/p.dk356/####/krmain1510833548445.zip
<Package Folder>/p.dk356/####/krsdk.cert
<Package Folder>/p.dk910/####/forever.sh
<Package Folder>/p.dk910/####/krcfg.txt
<Package Folder>/p.dk910/####/krmain
<Package Folder>/p.dk910/####/krmain1510833496602.zip
<Package Folder>/p.dk910/####/krsdk.cert
<Package Folder>/p.dk938/####/forever.sh
<Package Folder>/p.dk938/####/krcfg.txt
<Package Folder>/p.dk938/####/krmain
<Package Folder>/p.dk938/####/krmain1510833536528.zip
<Package Folder>/p.dk938/####/krsdk.cert
<Package Folder>/p.dzpg48/####/ZDExMDN6
<Package Folder>/p.dzpg48/####/ZDExMDN61510833524078.zip
<Package Folder>/p.dzpg48/####/ZGV4ZXoy
<Package Folder>/p.dzpg48/####/ZGV4ZXoy1510833523333.zip
<Package Folder>/p.dzpg48/####/error
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51510833530637.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/refer_watch
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/af.xml
<Package Folder>/shared_prefs/af.xml.bak
<Package Folder>/shared_prefs/alive_shared.xml
<Package Folder>/shared_prefs/com.google.android.gms.analytics....leted)
<Package Folder>/shared_prefs/com.google.android.gms.analytics....ml.bak
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
<Package Folder>/shared_prefs/system_device_id.xml
<SD-Card>/APPMarket/####/204102004.jpg.tmp
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/test1510833494120

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh <Package Folder>/p.dk910/files/forever.sh
<Package Folder>/refer_watch <Package>/com.chestnut.alive.keep.KeepService 0 300
c201712260950.apk -p <Package> -c <Package>:mike
chmod 0755 <Package Folder>/com.init.env
chmod 0755 <Package Folder>/refer_watch
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk356/files/forever.sh
chmod 0777 <Package Folder>/p.dk356/files/krmain
chmod 0777 <Package Folder>/p.dk910/files/forever.sh
chmod 0777 <Package Folder>/p.dk910/files/krmain
chmod 0777 <Package Folder>/p.dk910/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk938/files/forever.sh
chmod 0777 <Package Folder>/p.dk938/files/krmain
chmod 0777 <Package Folder>/p.dzpg48/files/ZDExMDN6
chmod 0777 <Package Folder>/p.dzpg48/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzpg48/files/error
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 777 <Package Folder>/p.dk356/files/krcfg.txt
chmod 777 <Package Folder>/p.dk910/files/krcfg.txt
chmod 777 <Package Folder>/p.dk938/files/krcfg.txt
getprop
load_jpoo_hd
load_jpoo_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
sh
sh /system/bin/load_jpoo_hd
sh /system/bin/load_jpoo_hd -c id
sh <Package Folder>/refer_watch <Package>/com.chestnut.alive.keep.KeepService 0 300
su
su -c id

Загружает динамические библиотеки:

cocos2dcpp
com.worldsen
com_zhuoyian_beautyparkour

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
DES

Использует повышенные привилегии.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней