Android.Packed.36124

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.698.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) 1####.205.203.99:8033
TCP(HTTP/1.1) u####.umengc####.com:80
TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) wild####.q####.cn.####.net:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) c-54d19####.i####.ali####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) m####.q####.t####.####.com:80
TCP(HTTP/1.1) mp.we####.qq.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) m####.q####.t####.####.com:443

Запросы DNS:

a####.b####.qq.com
a####.m.ta####.com
a####.u####.com
aexcep####.b####.qq.com
and####.b####.qq.com
api.wsq.u####.com
c-54d19####.i####.ali####.com
imgc####.qq.com
m####.q####.cn
m####.q####.cn
mi.g####.qq.com
mp.we####.qq.com
msg.umengc####.com
mt####.go####.com
oc.u####.com
pi####.qq.com
qzones####.g####.cn
r####.wx.qq.com
s####.e.qq.com
u####.umengc####.com
u####.umengc####.com

Запросы HTTP GET:

api.m.ta####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
c-54d19####.i####.ali####.com/2017-12-13/55d5834a7019c93edf3bc794/a08c02...
c-54d19####.i####.ali####.com/2017-12-13/55d5834a7019c93edf3bc794/c3fcb5...
c-54d19####.i####.ali####.com/2017-12-15/55d5834a7019c93edf3bc794/b61f92...
c-54d19####.i####.ali####.com/2017-12-17/55d5834a7019c93edf3bc794/32be8b...
c-54d19####.i####.ali####.com/2017-12-17/55d5834a7019c93edf3bc794/cee4d3...
c-54d19####.i####.ali####.com/2018-03-08/55d5834a7019c93edf3bc794/394345...
c-54d19####.i####.ali####.com/2018-03-08/55d5834a7019c93edf3bc794/abcd63...
c-54d19####.i####.ali####.com/2018-03-09/55d5834a7019c93edf3bc794/254b83...
c-54d19####.i####.ali####.com/2018-03-09/55d5834a7019c93edf3bc794/8810fd...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/images/icon/appmsg...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/images/pic/appmsg/...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/a/a3bb523.js,/m...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/a/cpc_a_tpl.htm...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/appmsg/cdn_spee...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/appmsg/emotion/...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/appmsg/log3a696...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/appmsg/share3c0...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/biz_common/util...
m####.q####.t####.####.com/mmbizwap/en_US/htmledition/js/new_video/playe...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
mp.we####.qq.com/s?__biz=M####&mid=####&idx=####&sn=####&scene=####&srci...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
sh.wagbr####.alibaba####.com/v2/feeds/rank?dt=####&imei=####&os=####&en=...
sh.wagbr####.alibaba####.com/v2/feeds/stream?dt=####&imei=####&os=####&e...
sh.wagbr####.alibaba####.com/v2/topics/?dt=####&imei=####&os=####&en=###...
sh.wagbr####.alibaba####.com/v2/user/recommended_feed?dt=####&imei=####&...
u####.umengc####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=##...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####...
wild####.q####.cn.####.net/mmbiz/VlicZI6wymBo5sCCc68dMkBquuHRicqTuG9I44W...
wild####.q####.cn.####.net/mmbiz/VlicZI6wymBo5sCCc68dMkBquuHRicqTuGKZYic...

Запросы HTTP POST:

a####.b####.qq.com:8011/rqd/async
a####.m.ta####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&s...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
msg.umengc####.com/v2/launch
msg.umengc####.com/v2/register
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
pi####.qq.com/mstat/report/?index=####
s####.e.qq.com/activate

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
<Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
<Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
<Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
<Package Folder>/app_e_qq_com_plugin/update_lc
<Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
<Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
<Package Folder>/app_e_qq_com_setting/gdt_suid
<Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
<Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
<Package Folder>/app_tbs/####/core_info
<Package Folder>/app_tbs/####/debug.conf
<Package Folder>/app_tbs/####/tbscoreinstall.txt
<Package Folder>/app_tbs/####/tbslock.txt
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/index
<Package Folder>/databases/GDTSDK.db
<Package Folder>/databases/GDTSDK.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/pri_wxop_tencent_analysis.db-journal
<Package Folder>/databases/umeng_community.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/wxop_tencent_analysis.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/1510835232135b.jar
<Package Folder>/files/1510835233663b.jar
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/local_crash_lock
<Package Folder>/files/mobclick_agent_cached_<Package>63
<Package Folder>/files/native_record_lock
<Package Folder>/files/security_info
<Package Folder>/files/umeng_it.cache
<Package Folder>/mix.dex
<Package Folder>/shared_prefs/.mta-wxop.xml
<Package Folder>/shared_prefs/AGOO_CONNECT.xml
<Package Folder>/shared_prefs/AGOO_HOST.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/PhoneUtil.xml
<Package Folder>/shared_prefs/UTMCBase.xml
<Package Folder>/shared_prefs/UTMCConf160831877.xml
<Package Folder>/shared_prefs/UTMCLog160831877.xml
<Package Folder>/shared_prefs/UTMCLog160831877.xml.bak (deleted)
<Package Folder>/shared_prefs/component_name.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/fbappInfo_pre.xml
<Package Folder>/shared_prefs/fbconf_pre.xml
<Package Folder>/shared_prefs/futuregods_config.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/s_update.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_message_state.xml
<Package Folder>/shared_prefs/umeng_socialize_qq.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.4.1.so
<Package Folder>/tx_shell/libufix.so
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/Android/####/0a59a26d36019afcecda27a75022336a.0.tmp
<SD-Card>/Android/####/169000d60d0e7cf2aa50e6303d8f8097.0.tmp
<SD-Card>/Android/####/20620116a31764bf6b8b4cb6fe00a1d7.0.tmp
<SD-Card>/Android/####/260d7d00d36c83861b38ef11f5c2de01.0.tmp
<SD-Card>/Android/####/4e285cb2b9a872e84b48892fa1975e65.0.tmp
<SD-Card>/Android/####/6cc65511e4a1257f5f1ebfa67bdaa947.0.tmp
<SD-Card>/Android/####/8f4bd59b4df0cb93d3e3e4a2a21c8597.0.tmp
<SD-Card>/Android/####/ApplicationCache.db-journal
<SD-Card>/Android/####/ad5867ce11b9adaa8e7d7db1bea99f76.0.tmp
<SD-Card>/Android/####/c1a92ee69f2d3de7ea1b91fd93a92b8d.0.tmp
<SD-Card>/Android/####/c3d13f28ad6016cb5532ff083739a0e2.0.tmp
<SD-Card>/Android/####/journal.tmp
<SD-Card>/bddownload/.nomedia
<SD-Card>/everybodydrawing/####/-1912764307
<SD-Card>/everybodydrawing/####/-534515231
<SD-Card>/everybodydrawing/####/-535438752
<SD-Card>/everybodydrawing/####/-536362273
<SD-Card>/everybodydrawing/####/-537285794
<SD-Card>/everybodydrawing/####/-538209315
<SD-Card>/everybodydrawing/####/.nomedia
<SD-Card>/everybodydrawing/####/0001.png
<SD-Card>/everybodydrawing/####/0002.jpg
<SD-Card>/everybodydrawing/####/0003.jpg
<SD-Card>/everybodydrawing/####/0004.jpg
<SD-Card>/everybodydrawing/####/0005.jpg
<SD-Card>/everybodydrawing/####/0006.jpg
<SD-Card>/everybodydrawing/####/0007.jpg
<SD-Card>/everybodydrawing/####/0008.jpg
<SD-Card>/everybodydrawing/####/0009.jpg
<SD-Card>/everybodydrawing/####/0010.jpg
<SD-Card>/everybodydrawing/####/0011.png
<SD-Card>/everybodydrawing/####/0012.png
<SD-Card>/everybodydrawing/####/0013.png
<SD-Card>/everybodydrawing/####/0014.png
<SD-Card>/everybodydrawing/####/0015.png
<SD-Card>/everybodydrawing/####/0016.jpg
<SD-Card>/everybodydrawing/####/0017.png
<SD-Card>/everybodydrawing/####/0018.jpg
<SD-Card>/everybodydrawing/####/0019.png
<SD-Card>/everybodydrawing/####/0020.png
<SD-Card>/everybodydrawing/####/0021.jpg
<SD-Card>/everybodydrawing/####/0022.png
<SD-Card>/everybodydrawing/####/0023.jpg
<SD-Card>/everybodydrawing/####/0024.png
<SD-Card>/everybodydrawing/####/0025.png
<SD-Card>/everybodydrawing/####/0026.jpg
<SD-Card>/everybodydrawing/####/0027.jpg
<SD-Card>/everybodydrawing/####/0028.jpg
<SD-Card>/everybodydrawing/####/0029.jpg
<SD-Card>/everybodydrawing/####/0030.png
<SD-Card>/everybodydrawing/####/10000.png
<SD-Card>/everybodydrawing/####/10001.png
<SD-Card>/everybodydrawing/####/10002.png
<SD-Card>/everybodydrawing/####/10003.png
<SD-Card>/everybodydrawing/####/10004.png
<SD-Card>/everybodydrawing/####/10005.png
<SD-Card>/everybodydrawing/####/10006.png
<SD-Card>/everybodydrawing/####/10007.png
<SD-Card>/everybodydrawing/####/10008.png
<SD-Card>/everybodydrawing/####/10009.png
<SD-Card>/everybodydrawing/####/10010.png
<SD-Card>/everybodydrawing/####/10011.png
<SD-Card>/everybodydrawing/####/10012.png
<SD-Card>/everybodydrawing/####/10013.png
<SD-Card>/everybodydrawing/####/10014.png
<SD-Card>/everybodydrawing/####/10015.png
<SD-Card>/everybodydrawing/####/10016.png
<SD-Card>/everybodydrawing/####/10017.png
<SD-Card>/everybodydrawing/####/10018.png
<SD-Card>/everybodydrawing/####/10019.png
<SD-Card>/everybodydrawing/####/1155548812
<SD-Card>/everybodydrawing/####/1167435470
<SD-Card>/everybodydrawing/####/1569981557
<SD-Card>/everybodydrawing/####/1975195906
<SD-Card>/everybodydrawing/####/407310705
<SD-Card>/everybodydrawing/####/446535983
<SD-Card>/everybodydrawing/####/bannerswatched.cfgs
<SD-Card>/everybodydrawing/####/bgpics.mp3
<SD-Card>/everybodydrawing/####/innnerpic.mp3
<SD-Card>/everybodydrawing/####/topics.xml

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:53a0ee1356240be04d0635fc","utdid":"Wg2EIGDYfzwDAGdzx1Er4uKS","sdkVersion":"20150423"} -I 100.69.168.33 -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.4.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh

Загружает динамические библиотеки:

Bugly
libnfix
libshella-2.10.4.1
libufix
nfix
tnet-2.0
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней