Android.DownLoader.3505

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Adtiming.1.origin
Android.HiddenAds.246.origin
Android.Xiny.1.origin
Android.Xiny.231.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.HiddenAds.246.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) img.adti####.com:80
TCP(HTTP/1.1) s.grav####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) www.you####.com:80
TCP(HTTP/1.1) api-ce####.coo####.org:80
TCP(HTTP/1.1) stat####.face####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) r1.b####.co:80
TCP(HTTP/1.1) www.esq####.tw:80
TCP(HTTP/1.1) con####.face####.net:80
TCP(HTTP/1.1) s####.wp.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) c####.api.coo####.org:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) www.google-####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) sdk.adti####.com:80
TCP(TLS/1.0) ma####.bootstr####.com:443
TCP(TLS/1.0) box.jom####.com:443
TCP(TLS/1.0) mbd.b####.com:443
TCP(TLS/1.0) ti####.jom####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) s####.wp.com:443
TCP(TLS/1.0) stat####.face####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) api.insta####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) ss2.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) www.you####.com:443
TCP(TLS/1.0) i####.wp.com:443
TCP(TLS/1.0) sdk.adti####.com:443

Запросы DNS:

aexcep####.b####.qq.com
ali.f####.cdn.####.com
and####.b####.qq.com
api-ce####.coo####.org
api.insta####.com
c####.api.coo####.org
con####.face####.net
ea.sno####.1####.com
en.sno####.1####.com
f####.b####.com
f####.google####.com
g####.bdst####.com
hpd.b####.com
i####.wp.com
i####.wp.com
i####.wp.com
img.adti####.com
m.b####.com
ma####.bootstr####.com
mbd.b####.com
mt####.go####.com
p####.wp.com
r1.b####.co
r1.s####.co
s####.wp.com
s####.wp.com
s.bdst####.com
s.grav####.com
s.y####.com
scon####.cdninst####.com
sdk.adti####.com
ss0.b####.com
ss1.b####.com
ss2.b####.com
stat####.face####.com
timg####.b####.com
www.b####.com
www.esq####.tw
www.face####.com
www.google-####.com
www.you####.com

Запросы HTTP GET:

ali.f####.cdn.####.com/2018/02/28/182023699.zip
api-ce####.coo####.org/v2/content/getItemDetails-49309845.json?&id=####&...
api-ce####.coo####.org/v2/content/getItemList-cn.json?&min=####&category...
api-ce####.coo####.org/v2/content/getLangList.json
api-ce####.coo####.org/v3/system/querytopicBycountry.json?&countryCode=#...
c####.api.coo####.org/v2/contentss/getListbyKeywords?&keywords=####
con####.face####.net/en_GB/sdk.js
f####.google####.com/css?family=####&subset=####&ver=####
img.adti####.com/upload/sdk/hotfix/7890itrename-90.jar
r1.b####.co/c/d_ab
r1.b####.co/de
r1.b####.co/v1/c/sf
s####.wp.com/g.gif?v=####&j=####&blog=####&post=####&tz=####&srv=####&ho...
s.grav####.com/css/hovercard.css?ver=####
s.grav####.com/css/services.css?ver=####
s.grav####.com/js/gprofiles.js?ver=####
sdk.adti####.com/hotfix?v=####&a=####&sv=####
stat####.face####.com/connect/xd_arbiter/r/Nh1oH0K63yz.js?version=####
www.esq####.tw/esq-choice/歲月的洗禮/
www.esq####.tw/esq-choice/歲月的洗禮/?relatedposts=####
www.esq####.tw/wp-content/plugins/instagram-feed/css/sb-instagram.min.cs...
www.esq####.tw/wp-content/plugins/instagram-feed/img/loader.png
www.esq####.tw/wp-content/plugins/instagram-feed/img/small-logo.png
www.esq####.tw/wp-content/plugins/instagram-feed/js/sb-instagram.min.js?...
www.esq####.tw/wp-content/plugins/jetpack/_inc/social-logos/social-logos...
www.esq####.tw/wp-content/plugins/jetpack/css/jetpack.css?ver=####
www.esq####.tw/wp-content/plugins/jetpack/modules/related-posts/related-...
www.esq####.tw/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?...
www.esq####.tw/wp-content/plugins/jetpack/modules/wpgroho.js?ver=####
www.esq####.tw/wp-content/plugins/lazy-load/images/1x1.trans.gif
www.esq####.tw/wp-content/plugins/lazy-load/js/jquery.sonar.min.js?ver=#...
www.esq####.tw/wp-content/plugins/lazy-load/js/lazy-load.js?ver=####
www.esq####.tw/wp-content/plugins/photo-gallery/css/bwg_frontend.css?ver...
www.esq####.tw/wp-content/plugins/photo-gallery/css/font-awesome/font-aw...
www.esq####.tw/wp-content/plugins/photo-gallery/css/font-awesome/fonts/f...
www.esq####.tw/wp-content/plugins/photo-gallery/css/jquery.mCustomScroll...
www.esq####.tw/wp-content/plugins/photo-gallery/css/sumoselect.css?ver=#...
www.esq####.tw/wp-content/plugins/photo-gallery/js/bwg_frontend.js?ver=#...
www.esq####.tw/wp-content/plugins/photo-gallery/js/bwg_gallery_box.js?ve...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.fullscreen-0.4...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.mCustomScrollb...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.mobile.js?ver=...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.sumoselect.min...
www.esq####.tw/wp-content/plugins/tablepress/css/default.min.css?ver=####
www.esq####.tw/wp-content/plugins/youtube-channel-gallery/magnific-popup...
www.esq####.tw/wp-content/plugins/youtube-channel-gallery/styles.css?ver...
www.esq####.tw/wp-content/plugins/youtube-embed/css/main.min.css?ver=####
www.esq####.tw/wp-content/themes/GRay/library/css/fontawesome/css/font-a...
www.esq####.tw/wp-content/themes/GRay/library/css/fontawesome/fonts/font...
www.esq####.tw/wp-content/themes/GRay/library/css/style.css?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/cb-scripts.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/cookie.min.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.ext.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.flexslider-min.j...
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.fs.boxer.min.js?...
www.esq####.tw/wp-content/themes/GRay/library/js/modernizr.custom.min.js...
www.esq####.tw/wp-content/themes/GRay/library/js/selectivizr-min.js?ver=...
www.esq####.tw/wp-content/themes/GRay/plugins/login-with-ajax/login-with...
www.esq####.tw/wp-content/themes/GRay/plugins/login-with-ajax/widget.css...
www.esq####.tw/wp-content/uploads/2015/07/ESQUIRE_360xH500pix-01.jpg
www.esq####.tw/wp-content/uploads/2015/07/ESQUIRElogo-1.png
www.esq####.tw/wp-content/uploads/2015/07/Esquire-club360x215.jpg
www.esq####.tw/wp-content/uploads/2015/08/3381.jpg
www.esq####.tw/wp-content/uploads/2016/03/IMG_0985-480x240.jpg
www.esq####.tw/wp-content/uploads/2016/03/w-480x240.jpg
www.esq####.tw/wp-content/uploads/2017/03/江宏傑網頁大圖比例-480x240.jpg
www.esq####.tw/wp-content/uploads/2017/04/2017-04-06_152835-480x240.png
www.esq####.tw/wp-content/uploads/2017/08/2017-08-16_145525-480x240.png
www.esq####.tw/wp-content/uploads/2017/10/網頁大圖比例-烏鴉-80x60.jpg
www.esq####.tw/wp-content/uploads/2017/11/網頁大圖比例-2-80x60.jpg
www.esq####.tw/wp-content/uploads/2017/12/11-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/01/44443-480x240.jpg
www.esq####.tw/wp-content/uploads/2018/02/2018-02-23_185011-80x60.png
www.esq####.tw/wp-content/uploads/2018/02/27751718_1779880275390901_2540...
www.esq####.tw/wp-content/uploads/2018/02/DSC1094拷貝-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/02/Lady-M特別在情人節前一週的週末三天，推出限定雙人套餐，...
www.esq####.tw/wp-content/uploads/2018/02/Street-Style-主視覺-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/02/UNADJUSTEDNONRAW_thumb_1c32-80...
www.esq####.tw/wp-content/uploads/2018/02/UNADJUSTEDNONRAW_thumb_1d96-80...
www.esq####.tw/wp-content/uploads/2018/02/VCE-To-Go巡迴貨櫃正於台中UNO市集巡迴中！-80x...
www.esq####.tw/wp-content/uploads/2018/02/sc01_17_valentinesday_pr_shots...
www.esq####.tw/wp-content/uploads/2018/02/網頁大圖比例-3-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/2.adidas鼓勵每個人專注眼前挑戰，管他誰的眼光，堅持「...
www.esq####.tw/wp-content/uploads/2018/03/SP18_19D_IvoryGold_Group_17090...
www.esq####.tw/wp-content/uploads/2018/03/TAG-Heuer發表全鑲鑽Connected-Modula...
www.esq####.tw/wp-content/uploads/2018/03/annihilation-movie-poster-snip...
www.esq####.tw/wp-content/uploads/2018/03/普吉島邁考安納塔拉度假會-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/網頁大圖比例-1-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/網頁大圖比例-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/設計師網頁大圖比例-80x60.jpg
www.esq####.tw/wp-includes/js/comment-reply.min.js?ver=####
www.esq####.tw/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
www.esq####.tw/wp-includes/js/jquery/jquery.js?ver=####
www.esq####.tw/wp-includes/js/wp-embed.min.js?ver=####
www.esq####.tw/wp-includes/js/wp-emoji-release.min.js?ver=####
www.google-####.com/yts/jsbin/www-widgetapi-vflZ8rDo4/www-widgetapi.js
www.you####.com/iframe_api

Запросы HTTP POST:

aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/msg/error
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/ad/hull_v2
en.sno####.1####.com:8088/sdk/api/log/record

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/index
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/####/sf_file_provider.dat
<Package Folder>/files/<Package>.zip
<Package Folder>/files/<Package>.zip (deleted)
<Package Folder>/files/cache_v1.jar
<Package Folder>/files/coolook_bk.db
<Package Folder>/files/coolook_bk.db-journal
<Package Folder>/files/dat.dat
<Package Folder>/files/lib_v22h1.dat
<Package Folder>/files/local_crash_lock
<Package Folder>/files/mesosphere_v22h1.jar
<Package Folder>/files/native_record_lock
<Package Folder>/files/new_v1.jar
<Package Folder>/files/security_info
<Package Folder>/files/snowfox_mid_v22h1.so
<Package Folder>/files/snowfox_sdk_so-v22h1.jar
<Package Folder>/files/snowfox_v22h1.jar
<Package Folder>/files/snowfox_v22h1.so
<Package Folder>/mix.dex
<Package Folder>/servi
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/adtiminginfo.xml
<Package Folder>/shared_prefs/appKey.xml
<Package Folder>/shared_prefs/appshell.xml
<Package Folder>/shared_prefs/coolook.xml
<Package Folder>/shared_prefs/crash_log_sp.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.7.1.so
<Package Folder>/tx_shell/libufix.so
<SD-Card>/Android/####/dev_7aa0fb27.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.init.NewsService
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
chmod 777 <Package Folder>/servi
dd if=<Package Folder>/lib/libservi.so of=<Package Folder>/servi
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh

Загружает динамические библиотеки:

Bugly
libnfix
libshella-2.10.7.1
libufix
nfix
servi
ufix

Использует следующие алгоритмы для шифрования данных:

AES
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней