Android.Packed.35796

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.3394
Android.DownLoader.635.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) w####.xinma####.net:80
TCP(HTTP/1.1) www.xinma####.net:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) www.s####.net:8080
TCP(HTTP/1.1) 1####.205.163.87:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) msg.umengc####.com:443
TCP umengj####.m.ta####.com:80
TCP 1####.205.160.76:443

Запросы DNS:

a####.b####.qq.com
a####.u####.com
aexcep####.b####.qq.com
ag####.m.ta####.com
and####.b####.qq.com
api.xinma####.net
cgi.con####.qq.com
com####.xinma####.net
fb.u####.com
msg.umengc####.com
pi####.qq.com
re####.xinma####.net
umengj####.m.ta####.com
w####.xinma####.net
www.s####.net
www.xinma####.net

Запросы HTTP GET:

cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
w####.xinma####.net/199461524/res/logo_detail.jpg?ver=####
w####.xinma####.net/217038395/res/logo_detail.jpg?ver=####
w####.xinma####.net/223205042/res/logo_detail.jpg?ver=####
w####.xinma####.net/246144454/res/logo_2.jpg?ver=####
w####.xinma####.net/256136749/1/s/1_efc3c6210284d2cb.jpg?ver=####
w####.xinma####.net/256136749/1/s/2_bbeea5a2d0b540cb.jpg?ver=####
w####.xinma####.net/256136749/1/s/3_1e35c530db1ff83b.jpg?ver=####
w####.xinma####.net/256136749/1/s/4_1167862592935c87.jpg?ver=####
w####.xinma####.net/256136749/1/s/5_23e7b2656f1b71ed.jpg?ver=####
w####.xinma####.net/256136749/res/logo_detail.jpg?ver=####
w####.xinma####.net/256136749/res/playurl.jpg?ver=####
w####.xinma####.net/278559999/res/logo_detail.jpg?ver=####
w####.xinma####.net/299669339/res/logo_rolling.jpg?ver=####
w####.xinma####.net/316986593/res/logo_detail.jpg?ver=####
w####.xinma####.net/319243688/res/logo_detail.jpg?ver=####
w####.xinma####.net/335320228/res/logo_detail.jpg?ver=####
w####.xinma####.net/365045338/res/logo_rolling.jpg?ver=####
w####.xinma####.net/366490031/res/logo_2.jpg?ver=####
w####.xinma####.net/368568669/res/logo_detail.jpg?ver=####
w####.xinma####.net/388255302/res/logo_2.jpg?ver=####
w####.xinma####.net/388868968/res/logo_detail.jpg?ver=####
w####.xinma####.net/390296649/res/logo_detail.jpeg?ver=####
w####.xinma####.net/391381916/res/logo_detail.jpg?ver=####
w####.xinma####.net/391381916/res/playurl.jpg?ver=####
w####.xinma####.net/392471801/res/logo_detail.jpg?ver=####
w####.xinma####.net/393540513/res/logo_detail.jpg?ver=####
w####.xinma####.net/394545896/res/logo_detail.jpeg?ver=####
w####.xinma####.net/422221260/res/logo_rolling.jpg?ver=####
w####.xinma####.net/436695960/res/logo_rolling.jpg?ver=####
w####.xinma####.net/448469287/res/logo_detail.jpg?ver=####
w####.xinma####.net/524402933/res/logo_detail.jpg?ver=####
w####.xinma####.net/537616361/res/logo_detail.jpg?ver=####
w####.xinma####.net/544407231/res/logo_detail.jpg?ver=####
w####.xinma####.net/549633011/res/logo_detail.jpg?ver=####
w####.xinma####.net/567685718/res/logo_2.jpg?ver=####
w####.xinma####.net/common/avatars/18.jpg?ver=1472113031?ver=####
w####.xinma####.net/common/avatars/21.jpg?ver=1472113740?ver=####
w####.xinma####.net/common/gag/xmhd9d0cd1c88ec0a327e9ab8da12e876b5.jpg?v...
w####.xinma####.net/common/splash/xmhcb01f2b393bdb48f3f0e10f1a3aa6df4.pn...
w####.xinma####.net/common/xmh_common_1454470934.png
w####.xinma####.net/common/xmh_common_1454480961.png
w####.xinma####.net/useralbum/07451c8d796a23f7183a475a57ce1be5/avatar/av...

Запросы HTTP POST:

a####.b####.qq.com:8011/rqd/async
a####.u####.com/app_logs
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
pi####.qq.com/mstat/report
www.s####.net:8080/fview/getIp.action?key=####
www.xinma####.net/api/commoncfg?devid=####&userid=####&xid=####&iver=###...
www.xinma####.net/v2/chapcounter?devid=####&userid=####&xid=####&iver=##...
www.xinma####.net/v2/getchapqualitypages?devid=####&userid=####&xid=####...
www.xinma####.net/v2/getcomment?devid=####&userid=####&xid=####&iver=###...
www.xinma####.net/v2/getpreview?devid=####&userid=####&xid=####&iver=###...
www.xinma####.net/v2/getrecommend?devid=####&userid=####&xid=####&iver=#...
www.xinma####.net/v2/getscore?devid=####&userid=####&xid=####&iver=####&...
www.xinma####.net/v2/hotpage?devid=####&userid=####&xid=####&iver=####&n...
www.xinma####.net/v2/latestver?devid=####&userid=####&xid=####&iver=####...
www.xinma####.net/v2/recommend?devid=####&userid=####&xid=####&iver=####...
www.xinma####.net/v2/rolling?devid=####&userid=####&xid=####&iver=####&n...
www.xinma####.net/v2/splash?devid=####&userid=####&xid=####&iver=####&ne...
www.xinma####.net/v2/worksfeature?devid=####&userid=####&xid=####&iver=#...
www.xinma####.net/v2/worksinfo?devid=####&userid=####&xid=####&iver=####...
www.xinma####.net/v2/xwreport?devid=####&userid=####&xid=####&iver=####&...

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_gua/<Package>.apk
<Package Folder>/cache/####/-1039105015-1322689401
<Package Folder>/cache/####/-10391050151686828484
<Package Folder>/cache/####/-1064961887.tmp
<Package Folder>/cache/####/-1165801539.tmp
<Package Folder>/cache/####/-1265695935.tmp
<Package Folder>/cache/####/-1322730347734793458
<Package Folder>/cache/####/-1421380561.tmp
<Package Folder>/cache/####/-1432308238-1616373723
<Package Folder>/cache/####/-1463572171.tmp
<Package Folder>/cache/####/-1467351058433509892
<Package Folder>/cache/####/-1470474800.tmp
<Package Folder>/cache/####/-1527026541.tmp
<Package Folder>/cache/####/-1532627527.tmp
<Package Folder>/cache/####/-1544351032.tmp
<Package Folder>/cache/####/-158479944-1156510010
<Package Folder>/cache/####/-158479944-1200521239
<Package Folder>/cache/####/-1758000786.tmp
<Package Folder>/cache/####/-1770123113.tmp
<Package Folder>/cache/####/-1772698009.tmp
<Package Folder>/cache/####/-18076697241069791334
<Package Folder>/cache/####/-1813569347.tmp
<Package Folder>/cache/####/-1827376358.tmp
<Package Folder>/cache/####/-1921126847.tmp
<Package Folder>/cache/####/-2028768667.tmp
<Package Folder>/cache/####/-2038433948.tmp
<Package Folder>/cache/####/-2075957875.tmp
<Package Folder>/cache/####/-28000296.tmp
<Package Folder>/cache/####/-47419779-1853356018
<Package Folder>/cache/####/-474197791854177739
<Package Folder>/cache/####/-835955451890320011
<Package Folder>/cache/####/-859522599.tmp
<Package Folder>/cache/####/-903026420.tmp
<Package Folder>/cache/####/-905757426.tmp
<Package Folder>/cache/####/-912991796.tmp
<Package Folder>/cache/####/-973883206-224978539
<Package Folder>/cache/####/-973883206837430362
<Package Folder>/cache/####/1058223538.tmp
<Package Folder>/cache/####/1104157094.tmp
<Package Folder>/cache/####/1205371291.tmp
<Package Folder>/cache/####/1312939163.tmp
<Package Folder>/cache/####/1505696955.tmp
<Package Folder>/cache/####/1809428135-605476384
<Package Folder>/cache/####/1861843758394038300
<Package Folder>/cache/####/191941384.tmp
<Package Folder>/cache/####/20385918451974883250
<Package Folder>/cache/####/2038591845672600949
<Package Folder>/cache/####/20670704861966048703
<Package Folder>/cache/####/2067070486663766402
<Package Folder>/cache/####/2083828068.tmp
<Package Folder>/cache/####/2126600509-62475220
<Package Folder>/cache/####/233550600-902224215
<Package Folder>/cache/####/2335506002090460780
<Package Folder>/cache/####/248883625.tmp
<Package Folder>/cache/####/253862773.tmp
<Package Folder>/cache/####/26863275.tmp
<Package Folder>/cache/####/273070628.tmp
<Package Folder>/cache/####/306155203-1307206118
<Package Folder>/cache/####/380190907.tmp
<Package Folder>/cache/####/615950764.tmp
<Package Folder>/cache/####/7155817791408009315
<Package Folder>/cache/####/784215994657176137
<Package Folder>/cache/####/812102824.tmp
<Package Folder>/cache/####/903477574.tmp
<Package Folder>/cache/####/960012201-1533302997
<Package Folder>/cache/####/960012201-1577841374
<Package Folder>/cache/####/960012201-1745835130
<Package Folder>/cache/####/960012201394239511
<Package Folder>/cache/####/960012201834160792
<Package Folder>/cache/####/960012201974315586
<Package Folder>/cache/####/960012201982074947
<Package Folder>/cache/####/splash_1.jpg
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/newcomic.db
<Package Folder>/databases/newcomic.db-journal
<Package Folder>/databases/tencent_analysis.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/com.tencent.open.config.json.1104663120
<Package Folder>/files/local_crash_lock
<Package Folder>/files/native_record_lock
<Package Folder>/files/security_info
<Package Folder>/files/umeng_it.cache
<Package Folder>/mix.dex
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/ACCS_BIND.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml.bak
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/com.ulab.newcomics.reader.Portrai...ty.xml
<Package Folder>/shared_prefs/commoncfg.xml
<Package Folder>/shared_prefs/jsondata.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/tx_shell/libshella-2.10.3.1.so
<Package Folder>/tx_shell/libufix.so
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/6649971b8e6e48a096d6580c3216537b
<SD-Card>/Android/####/6fff4ff7815d4a20a3618e11d95fb248
<SD-Card>/Android/####/f7d1595f315142198fb5c38bfd0818d3
<SD-Card>/Download/####/accs_election
<SD-Card>/Tencent/####/.mid.txt

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:550059b4fd98c5f1d4000081","utdid":"Wg2DtxuGfV0DAGdzx1GUhE/9","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.3.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount
sh

Загружает динамические библиотеки:

Bugly
MtaNativeCrash
libnfix
libshella-2.10.3.1
libufix
nfix
tnet-3.1
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней