Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) w####.q####.dn.####.com:80
- TCP(HTTP/1.1) www.zu####.com:80
- TCP(HTTP/1.1) m####.mal####.com:80
- TCP(HTTP/1.1) m.zu####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) ui.ki.u####.cn:80
- TCP(HTTP/1.1) d####.g####.com:8008
- TCP(HTTP/1.1) t####.qq.com:8080
- TCP(HTTP/1.1) w####.q####.s####.####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) www.zuoye####.com.cn:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(TLS/1.0) ps.3f####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) p####.xnh####.com:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP t####.qq.com:8080
- TCP t####.qq.com:80
Запросы DNS:
- a####.u####.com
- au.u####.co
- au.u####.com
- cdn.static####.org
- cms####.zu####.com
- d####.g####.com
- dup.baidust####.com
- er.dl####.com
- files####.zu####.com
- gkb####.oss-cn-####.aliy####.com
- h####.b####.com
- hm.b####.com
- i####.zu####.com
- j####.qin####.com
- m####.mal####.com
- m.zu####.com
- oc.u####.co
- oc.u####.com
- p####.xnh####.com
- pi####.qq.com
- ps.3f####.com
- s22.c####.com
- t####.qq.com
- ui.ki.u####.cn
- www.zu####.com
- www.zuoye####.com.cn
Запросы HTTP GET:
- d####.g####.com:8008/?aspx=####
- dup.baidust####.com/js/dm.js
- dup.baidust####.com/js/zm.js
- hm.b####.com/h.js?1b9d92d####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- m####.mal####.com/sn.php?id=####
- m.zu####.com/e/20090901/4b8bcef00bcaa.shtml?from=####
- m.zu####.com/js/tongji.js?gx=####
- m.zu####.com/mobile/images/news_sprites.png
- m.zu####.com/mobile/images/sprites_20150105.png
- m.zu####.com/mobile/js/common.js?2015####
- m.zu####.com/mobile/js/jquery.min.js
- m.zu####.com/mobile/js/loginapi.js
- m.zu####.com/zuowen/css/content_m.css?2015####
- ui.ki.u####.cn/j?a=####
- w####.q####.dn.####.com/app_capture-help/app.capture.help-2.css
- w####.q####.dn.####.com/app_capture-help/arrow_right.png
- w####.q####.dn.####.com/app_capture-help/capture_1.png
- w####.q####.dn.####.com/app_capture-help/capture_2.png
- w####.q####.dn.####.com/app_capture-help/capture_3.png
- w####.q####.dn.####.com/app_capture-help/dash.png
- w####.q####.dn.####.com/app_capture-help/help_capture.png
- w####.q####.dn.####.com/app_capture-help/help_right.png
- w####.q####.dn.####.com/app_capture-help/help_wrong.png
- w####.q####.dn.####.com/app_capture-help/right_1.png
- w####.q####.dn.####.com/app_capture-help/right_2.png
- w####.q####.dn.####.com/app_capture-help/wrong_1.png
- w####.q####.dn.####.com/app_capture-help/wrong_2.png
- w####.q####.dn.####.com/app_capture-help/wrong_3.png
- w####.q####.dn.####.com/app_capture-help/wrong_4.png
- w####.q####.dn.####.com/app_capture-help/wrong_5.png
- w####.q####.dn.####.com/app_capture-help/wrong_6.png
- w####.q####.dn.####.com/app_capture-help/wrong_7.png
- w####.q####.s####.####.com/jquery/1.11.0/jquery.min.js
- www.zu####.com/e/20090901/4b8bcef00bcaa.shtml?from=####
- www.zu####.com/e/20130912/5231cf2ca90f9.shtml?from=####
- www.zuoye####.com.cn/activity/check/4?uid=####
- www.zuoye####.com.cn/app/splash/null?w=####
- www.zuoye####.com.cn/client/getPreviewChildInfo?topicID=####&childImgUrl...
- www.zuoye####.com.cn/css/searchArticle/art.css
- www.zuoye####.com.cn/html/app-capture-help.html?
- www.zuoye####.com.cn/img/searchArticle/plane.png
- www.zuoye####.com.cn/security/ocrtoken?id=####&sn=####
- www.zuoye####.com.cn/tk/pointRandom
- www.zuoye####.com.cn/upload/images/androidImg/20150829/5bb618e9321e3157a...
Запросы HTTP POST:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
- s.wagbr####.alibaba####.com/api/check_app_update
- t####.qq.com/203.205.146.122:80/
- t####.qq.com:8080/203.205.146.122:8080/
- www.zuoye####.com.cn/security/jytoken
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_libs/result_xml_pdf_template.so
- <Package Folder>/cache/####/-11711265601425525583
- <Package Folder>/cache/####/-771132034-12413057
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/index
- <Package Folder>/databases/JingYouMath.db-journal
- <Package Folder>/databases/pri_tpush_tencent_analysis.db_<Packa...ournal
- <Package Folder>/databases/push_message.db-journal
- <Package Folder>/databases/tpush_tencent_analysis.db_<Package>;...ournal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/com.topicn.edu.mibtz.jar
- <Package Folder>/files/mobclick_agent_cached_<Package>71
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/.tpns.xml.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.jingyou.math.xml
- <Package Folder>/shared_prefs/device_id.xml
- <Package Folder>/shared_prefs/f34ae.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/jingyoumath/####/2017-11-16.report
- <SD-Card>/tencent/####/.mid.txt
Другие:
Запускает следующие shell-скрипты:
- sh <Package Folder>/lib/libtpnsWatchdog.so <Package>,2100050458; 55337 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.38 , mf : unknown , apn : %s }}] 0 18
- sh <Package Folder>/lib/libtpnsWatchdog.so <Package>,2100050458;<Package>,2100050458; 55337 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : ba3dfc86f3a93752ac8c7d36258747d61fae2928 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.38 , mf : unknown , apn : %s }}] 0 18
Загружает динамические библиотеки:
- bspatch
- tpnsSecurity
Использует следующие алгоритмы для шифрования данных:
- AES-CFB8-NoPadding
- DES
- RSA-ECB-PKCS1PADDING
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB8-NoPadding
- DES
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
