Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.RemoteCode.93.origin
- Android.Xiny.232.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) premium####.com:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) t####.snapbac####.com:80
- TCP(HTTP/1.1) us-scp####.ali####.com:80
- TCP(HTTP/1.1) nrc.t####.net:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) go.oncl####.com:80
- TCP(HTTP/1.1) api.mob####.b####.com:80
- TCP(HTTP/1.1) offence####.accountant:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) co####.du####.com:80
- TCP(HTTP/1.1) pop####.net:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) hy####.com:80
- TCP(HTTP/1.1) del####.com:80
- TCP(HTTP/1.1) c####.interna####.b####.com:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) www.estr####.com:80
- TCP(TLS/1.0) t.appsf####.com:443
- TCP(TLS/1.0) m.ali####.com:443
- TCP(TLS/1.0) us-scp####.ali####.com:443
- TCP(TLS/1.0) gj.mm####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) billmsc####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
Запросы DNS:
- akw.e####.space
- api.mo####.sdk.####.com
- api.mob####.b####.com
- as####.al####.com
- billmsc####.com
- c####.ali####.com
- c####.ali####.com
- c####.interna####.b####.com
- co####.du####.com
- del####.com
- g####.face####.com
- gj.mm####.com
- go.oncl####.com
- h####.b####.com
- hy####.com
- m.ali####.com
- mo.freeind####.com
- mt####.go####.com
- nrc.t####.net
- offence####.accountant
- offer####.online
- pop####.net
- premium####.com
- rts.mo####.sdk.####.com
- s####.mob####.b####.com
- ssl.google-####.com
- t####.snapbac####.com
- t.appsf####.com
- u.al####.com
- www.admobim####.com
- www.estr####.com
- www.mmmmmm####.com
Запросы HTTP GET:
- api.mob####.b####.com/index.php?r=####
- api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
- api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
- c####.interna####.b####.com/index.php/Sample/getConf?source=####&country...
- del####.com/?r=####&zoneid=####&pbk3=####&empty=####&var=####&uuid=####&...
- del####.com/afu.php?var=####&zoneid=####
- go.oncl####.com/afu.php?var=####&zoneid=####
- hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
- nrc.t####.net/adunion/slot/fetchConfig?h=####&w=####&model=####&vendor=#...
- nrc.t####.net/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####&...
- nrc.t####.net/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=##...
- nrc.t####.net/get?model=####&signmd5=####&op=####&vendor=####&locale=###...
- offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
- offer####.online/r/b38759a0-0216-11e8-8c23-114853a9736b/0/
- offer####.online/r/b38759a0-0216-11e8-8c23-114853a9736b/1/
- pop####.net/world/go/118844/282334
- pop####.net/world/sgo/ad?p=####&w=####&t=####&r=####&vw=####&vh=####
- premium####.com/d/46064259b9f90e4c211?sub=####
- premium####.com/gw?sub=####&source=####&url=####&vId=####&hash=####&ete=...
- premium####.com/gw?sub=5YzXu9mZhdWZt91UV9FNygDRfFzX1ITNyYjMfB3bw5CZp9mck...
- premium####.com/l/46064259b9f90e4c211?sub=####&code=####
- t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
- us-scp####.ali####.com/rd/kdopppr6?pid=####&tp1=####&cv=####&cn=####
- www.estr####.com/console/service/sample/index.php?source=####&country=##...
Запросы HTTP POST:
- co####.du####.com/appLock/getConf?model=####&signmd5=####&op=####&vendor...
- mo.freeind####.com/detail/getOfferListNew?enc=####
- nrc.t####.net/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dpi...
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- www.admobim####.com/surl/api2_reg.action?ecy=####
- www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
- www.mmmmmm####.com/osp/oaen_reg.action
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/app_lib/libtyria.so
- <Package Folder>/app_plugins/####/com.jecelyin.common.app.crash...ty.dex
- <Package Folder>/app_plugins/####/com.jecelyin.editor.v2.ui.Mai...ty.dex
- <Package Folder>/app_plugins/####/com.jecelyin.editor.v2.ui.set...ty.dex
- <Package Folder>/app_plugins/editor
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-180227130.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes904544492.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes96351177.zip
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/d-journal
- <Package Folder>/databases/i-journal
- <Package Folder>/databases/lock.db
- <Package Folder>/databases/lock.db-journal
- <Package Folder>/databases/my.db
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/notify_items.sp-journal
- <Package Folder>/databases/scanner.db
- <Package Folder>/databases/scanner.db-journal
- <Package Folder>/databases/scenery_app_info-journal
- <Package Folder>/databases/sk
- <Package Folder>/databases/sk-journal
- <Package Folder>/databases/toolbox.db-journal
- <Package Folder>/databases/toolbox_cache.db-journal
- <Package Folder>/databases/toolbox_ts.db-journal
- <Package Folder>/databases/u.db
- <Package Folder>/databases/u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/z
- <Package Folder>/databases/z-journal
- <Package Folder>/files/AF_INSTALLATION
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1510835412145
- <Package Folder>/files/__send_data_1510835414856
- <Package Folder>/files/__send_data_1510835420128
- <Package Folder>/files/__send_data_1510835420487
- <Package Folder>/files/d.zip
- <Package Folder>/files/f.zip
- <Package Folder>/files/google.db
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/ob.zip
- <Package Folder>/files/skip_auth
- <Package Folder>/files/subc__local_stat_cache.json
- <Package Folder>/shared_prefs/<Package>_duscene_private_download.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_scene_global.xml
- <Package Folder>/shared_prefs/<Package>_scene_private.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_global....leted)
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_global.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_global.xml.bak
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_private.xml
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/AliveTimerStoragePreference.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/D824hunter_config.xml
- <Package Folder>/shared_prefs/D824other_config.xml
- <Package Folder>/shared_prefs/D824service_config.xml
- <Package Folder>/shared_prefs/D824sp_config.xml
- <Package Folder>/shared_prefs/DianxinDXB.xml
- <Package Folder>/shared_prefs/DuSwipeSharedPref.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak (deleted)
- <Package Folder>/shared_prefs/_search_prefs.xml
- <Package Folder>/shared_prefs/_search_prefs.xml (deleted)
- <Package Folder>/shared_prefs/_search_prefs.xml.bak (deleted)
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak (deleted)
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml (deleted)
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/charging_configs_sp.xml
- <Package Folder>/shared_prefs/cms_pref.xml
- <Package Folder>/shared_prefs/d.xml
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/documentExtlistdb.xml
- <Package Folder>/shared_prefs/h.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/ls_sp_date.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pref_splash.xml
- <Package Folder>/shared_prefs/rrpolicy.xml
- <Package Folder>/shared_prefs/runtime.xml
- <Package Folder>/shared_prefs/runtime.xml (deleted)
- <Package Folder>/shared_prefs/runtime.xml.bak
- <Package Folder>/shared_prefs/runtime.xml.bak (deleted)
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/shared_prefs/utils.xml
- <Package Folder>/shared_prefs/video_pref_def.xml
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/.estrongs/.dontedit_v1
- <SD-Card>/.estrongs/.sp_check_dontedit_v6
- <SD-Card>/.estrongs/1510835411944
- <SD-Card>/.estrongs/1510835412238
- <SD-Card>/.estrongs/1510835416304
- <SD-Card>/.estrongs/1510835426986
- <SD-Card>/.estrongs/folder_app.db
- <SD-Card>/.estrongs/folder_app.db-journal
- <SD-Card>/.userReturn
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/pid
- <SD-Card>/Android/####/setting.download.tmp.tmp
- <SD-Card>/Android/####/setting.download.tmp.tmp (deleted)
- <SD-Card>/Android/####/testDB
- <SD-Card>/Android/####/testDB-journal
- <SD-Card>/DCIM/####/.escheck.tmp
- <SD-Card>/LogN/####/sp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
- <SD-Card>/dianxin/####/3e15b66bea226d332cd45e6e96cb8de5.0
- <SD-Card>/dianxin/####/48aad6384e2a53cfe528627079d73804.0
- <SD-Card>/dianxin/####/journal
- <SD-Card>/dianxin/####/journal (deleted)
- <SD-Card>/dianxin/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk2/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.iky.bzk.Pg
- chmod 777 <Package Folder>/btyria
- dd if=<Package Folder>/lib/libtyria.so of=<Package Folder>/btyria
- sh
Загружает динамические библиотеки:
- acceleratecoreproxy
- libacceleratecoreproxy
- libtyria
- myaes
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
- AES-ECB-PKCS5Padding
- RSA
- RSA-ECB-PKCS1Padding
- desede-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- desede-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
