Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Locker.4446
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) iptl####.ksmo####.com:80
- TCP(HTTP/1.1) 125275####.v####.myqc####.####.com:80
- TCP(HTTP/1.1) u####.l####.ksmo####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) www.li####.com.####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) l####.s####.c####.com:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) www.li####.com.####.com:443
- TCP(TLS/1.0) sni.c####.q####.####.com:443
- TCP(TLS/1.0) l####.ksmo####.net:443
- TCP(TLS/1.0) im.ac####.l####.####.net:443
Запросы DNS:
- 125275####.v####.myqc####.com
- ac####.l####.me
- aexcep####.b####.qq.com
- and####.b####.qq.com
- cdn.ron####.com
- iptl####.ksmo####.com
- l####.ksmo####.net
- l####.s####.c####.com
- u####.l####.ksmo####.net
- www.google-####.com
- www.li####.com
Запросы HTTP GET:
- 125275####.v####.myqc####.####.com/014807a0vodca1252759537/550680d374473...
- 125275####.v####.myqc####.####.com/014807a0vodca1252759537/d5ebef8074473...
- 125275####.v####.myqc####.####.com/014807a0vodca1252759537/ef9b3bee74473...
- iptl####.ksmo####.com/third/authorize?plat=17&display=iframe&redirect=ht...
- l####.s####.c####.com/big/liveme/cover-18bebd46e45dc16b25bd082739405c45_...
- l####.s####.c####.com/big/liveme/cover-1fe0a6049058698ff1d79160f7eab2ee_...
- l####.s####.c####.com/big/liveme/cover-3c282d56f92af8f11d45479bd0762f38_...
- l####.s####.c####.com/big/liveme/cover-5452dd37505d758f98b498b886b59262_...
- l####.s####.c####.com/big/liveme/cover-680417c5cd5ec579608431c63114a2ad_...
- l####.s####.c####.com/big/liveme/cover-6a54582f5c23b34bec87d02db0aec8f4_...
- l####.s####.c####.com/big/liveme/cover-7c26153d26f92d2734b3754c8470f245_...
- l####.s####.c####.com/big/liveme/cover-7c3918d4465dbc2c2569fa38607a2bb6_...
- l####.s####.c####.com/big/liveme/cover-8689db3f74a1f89e64ad5728d52b66a1_...
- l####.s####.c####.com/big/liveme/cover-8c640a4f6a54c0d993bb3c920fea3372_...
- l####.s####.c####.com/big/liveme/cover-9c0f70465b4020d7dd624a0acf592fb2_...
- l####.s####.c####.com/big/liveme/cover-a6f46e2a9afcf0a123eae622a249d553_...
- l####.s####.c####.com/big/liveme/cover-c320ffa95f9f8b301201db09cf73fe44_...
- l####.s####.c####.com/big/liveme/cover-c37dcb137b9f46b73f1a6bf506ec23b7_...
- l####.s####.c####.com/big/liveme/cover-c845e3f9a45fc3189a2c38870a923e4a_...
- l####.s####.c####.com/big/liveme/poster/8ca3d4b204ffea64645ab86574fdc57f...
- l####.s####.c####.com/big/liveme/poster/b74ff0217c8de92200bdcc0258692910...
- l####.s####.c####.com/big/liveme/poster/d023730fae98cd9a901d5bbd077ce459...
- l####.s####.c####.com/big/liveme/poster/eca21b260b36d4e6629dc47b0209015b...
- u####.l####.ksmo####.####.com/yolo-SLoW3FjYsM--20180226085246.jpg
- u####.l####.ksmo####.####.com/yolo-SLoW3FjYsM--20180226085301.jpg
- u####.l####.ksmo####.####.com/yolo-UM6v7ZMKcM--20180226085251.jpg
- u####.l####.ksmo####.####.com/yolo-UM6v7ZMKcM--20180226085306.jpg
- u####.l####.ksmo####.####.com/yolo-YFmgr0RvY4--20180226085258.jpg
- u####.l####.ksmo####.####.com/yolo-YFmgr0RvY4--20180226085313.jpg
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
- www.li####.com.####.com/
- www.li####.com.####.com/88bbdbe1635d4171ff318a2564f528e9.ttf
- www.li####.com.####.com/index.30923c0.css
- www.li####.com.####.com/media/liveshort/dist/?videoid=####&live=####&fro...
- www.li####.com.####.com/media/liveshort/dist/static/css/app.b2f6517ae457...
- www.li####.com.####.com/media/liveshort/dist/static/js/app.370d3496b2737...
- www.li####.com.####.com/media/liveshort/dist/static/js/manifest.a9f2c557...
- www.li####.com.####.com/media/liveshort/dist/static/js/vendor.0a3207cec9...
- www.li####.com.####.com/static/images/feed-back-icon-top.998e3cf.png
- www.li####.com.####.com/static/images/footer_apple.dfbe99a.png
- www.li####.com.####.com/static/images/footer_gp.b4e80e3.png
- www.li####.com.####.com/static/images/iboy-hover.e34f9de.png
- www.li####.com.####.com/static/images/icon_facebook_d.7f0a1c2.png
- www.li####.com.####.com/static/images/icon_hearts.0358c8c.png
- www.li####.com.####.com/static/images/icon_ins_d.fd0f61c.png
- www.li####.com.####.com/static/images/icon_twrrte_d.1892ca6.png
- www.li####.com.####.com/static/images/igame-hover.ccf9b08.png
- www.li####.com.####.com/static/images/incon_youtobe_d.aa7156b.png
- www.li####.com.####.com/static/images/iwomen-hover.4fc112b.png
- www.li####.com.####.com/static/images/logo.7932ddd.png
- www.li####.com.####.com/static/images/more.62bf9c5.png
- www.li####.com.####.com/static/images/play1.bd1b6e3.png
- www.li####.com.####.com/static/images/short-hover.220db3b.png
- www.li####.com.####.com/static/images/sqvashthehate.42cb855.jpg
- www.li####.com.####.com/static/js/common.467a504.js
- www.li####.com.####.com/static/js/index.30923c0.js
Запросы HTTP POST:
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/index
- <Package Folder>/databases/bugly_db_legu-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/a.sh
- <Package Folder>/files/a.txt
- <Package Folder>/files/local_crash_lock
- <Package Folder>/files/native_record_lock
- <Package Folder>/files/security_info
- <Package Folder>/mix.dex
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/data.xml
- <Package Folder>/tx_shell/libnfix.so
- <Package Folder>/tx_shell/libshella-2.10.6.0.so
- <Package Folder>/tx_shell/libufix.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.10.6.0.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
Загружает динамические библиотеки:
- Bugly
- libnfix
- libshella-2.10.6.0
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-GCM-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Отрисовывает собственные окна поверх других приложений.
