Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.627.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m.u####.cn:80
- TCP(HTTP/1.1) api.y.ig####.com:8888
- TCP(HTTP/1.1) sdk.o####.lbs.####.com:80
- TCP(HTTP/1.1) i####.uc.cn:80
- TCP(HTTP/1.1) plg.abcdse####.com:7901
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) l####.ou####.com:8888
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) www.9####.com:80
- TCP(HTTP/1.1) lmp.abe####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) n####.uc.cn:80
- TCP(HTTP/1.1) p####.ou####.com:9230
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) abc.abcdse####.com:7901
- TCP(HTTP/1.1) fasl####.ou####.com.####.com:80
- TCP(HTTP/1.1) t####.uc.cn:80
- TCP(TLS/1.0) s.c####.ta####.com:443
- TCP(TLS/1.0) lmp.abe####.com:443
- TCP c####.g####.ig####.com:5225
- TCP sdk.o####.t####.####.net:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- abc.abcdse####.com
- api.y.ig####.com
- c####.g####.ig####.com
- c-h####.g####.com
- fasl####.ou####.com
- i####.u####.cn
- i####.u####.cn
- i####.uc.cn
- l####.ou####.com
- lmp.abe####.com
- m.u####.cn
- n####.uc.cn
- oc.u####.com
- p####.ou####.com
- plg.abcdse####.com
- pub-####.qin####.com
- s.c####.ta####.com
- sdk.c####.ig####.com
- sdk.o####.lbs.####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.uc.cn
- www.9####.com
- www.h####.com.cn
Запросы HTTP GET:
- fasl####.ou####.com.####.com/abcds343234sdf8ewr/adjfou23r32u44324/2919df...
- i####.uc.cn/12944340716848072480.jpg?id=####&from=####&width=####&height...
- i####.uc.cn/13835702361995385763.jpg?id=####&from=####&width=####&height...
- i####.uc.cn/14012695721464142791.jpg?id=####&from=####&width=####&height...
- i####.uc.cn/16627633427010587517.jpg?id=####&from=####&width=####&height...
- i####.uc.cn/17737885174855265630.jpg?id=####&from=####&width=####&height...
- i####.uc.cn/4030724748964705005.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/4534744287476849335.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/4852875031074820738.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/4883603774734447350.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/7022755237594968174.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/854066110566613117.jpg?id=####&from=####&width=####&height=#...
- i####.uc.cn/8603865704466759091.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/8641899881853406617.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/8904338389281707782.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/9535785393670760089.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/9965071627506718161.jpg?id=####&from=####&width=####&height=...
- i####.uc.cn/e/uaeext/m;1y/libs/;sdklibs.shim.1.0.8.js;loader.ls.1.0.1.js
- i####.uc.cn/s/uae/g/1y/xiss.webapp/assets/png/cmt.d194acb20e.png?force-s...
- i####.uc.cn/s/uae/g/1y/xiss.webapp/assets/png/dislike.91c93cc37e.png?for...
- i####.uc.cn/s/uae/g/1y/xiss.webapp/assets/png/refresh.a03b01c374.png?for...
- i####.uc.cn/s/uae/g/1y/xiss.webapp/iflowsdk.254b70ed2f.js
- i####.uc.cn/s/uae/g/1y/xiss.webapp/newslist.d1cc4221ce.js
- i####.uc.cn/s/uae/g/36/per/1.1/m/c/performance.min.js
- m.u####.cn/iflow/api/v1/channel/100?app=####&zzd_from=####&uc_param_str=...
- m.u####.cn/log/api/v1/client/info?app=####&client_os=####&sn=####&fr=###...
- m.u####.cn/webview/newslist?app=####&zzd_from=####&uc_param_str=####&uc_...
- n####.uc.cn/3/classes/sdk_loader_maps/lists/xiss.webapp.iflowsdk.master?...
- n####.uc.cn/3/classes/xiss_admin/objects/ecc4fff05469ece3bf890301a54135a...
- t####.c####.q####.####.com/tdata_EDT356
- t####.c####.q####.####.com/tdata_JmZ606
- t####.c####.q####.####.com/tdata_TSb400
- t####.c####.q####.####.com/tdata_dro841
- t####.c####.q####.####.com/tdata_sYw275
- t####.uc.cn/collect?lt=####&appid=####&type=####&e_c=####&e_a=####&origi...
- www.9####.com/static/images/app_goods/132394_thumb_1521183768.jpg
- www.9####.com/static/images/app_goods/132413_thumb_1521186560.jpg
- www.9####.com/static/images/app_goods/132420_thumb_1521187560.jpg
- www.9####.com/static/images/app_goods/132421_thumb_1521187566.jpg
- www.9####.com/static/images/app_goods/132427_thumb_1521188594.jpg
- www.9####.com/static/images/app_goods/132429_thumb_1521189009.jpg
- www.9####.com/static/images/app_goods/132431_thumb_1521189264.jpg
- www.9####.com/static/images/app_goods/132436_thumb_1521189904.jpg
- www.9####.com/static/images/app_goods/132440_thumb_1521191194.jpg
- www.9####.com/static/images/app_goods/132466_thumb_1521439769.jpg
- www.9####.com/static/images/app_goods/132467_thumb_1521439871.jpg
- www.9####.com/static/images/app_goods/132468_thumb_1521439946.jpg
- www.9####.com/static/images/app_goods/132469_thumb_1521440039.jpg
- www.9####.com/static/images/app_goods/132470_thumb_1521440106.jpg
- www.9####.com/static/images/app_goods/132471_thumb_1521440203.jpg
- www.9####.com/static/images/app_goods/132473_thumb_1521442664.jpg
- www.9####.com/static/images/app_goods/132474_thumb_1521443062.jpg
- www.9####.com/static/images/app_goods/seller_3332_thumb.jpg
- www.9####.com/static/images/index_ad/ad_0/720@1280.jpg
Запросы HTTP POST:
- a####.u####.com/app_logs
- abc.abcdse####.com:7901/
- api.y.ig####.com:8888/s/sapi/api.sa
- c-h####.g####.com/api.php?format=####&t=####
- l####.ou####.com:8888/log/biz
- lmp.abe####.com/lmp/baseinfo/report
- oc.u####.com/check_config_update
- p####.ou####.com:9230/
- plg.abcdse####.com:7901/pl/config
- sdk.o####.lbs.####.com/api.htm?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- www.9####.com/?q=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_localdata/ApplicationCache.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/index
- <Package Folder>/cache/web1.jar
- <Package Folder>/cache/web2084.temp
- <Package Folder>/cache/web2084.temp (deleted)
- <Package Folder>/databases/gks_download.db-journal
- <Package Folder>/databases/jks.db-journal
- <Package Folder>/databases/landDivide
- <Package Folder>/databases/landDivide-journal
- <Package Folder>/databases/pusha.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/1357813461.jar (deleted)
- <Package Folder>/files/2078793401
- <Package Folder>/files/dd489a0f16d0
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_JmZ606
- <Package Folder>/files/tdata_JmZ606.jar
- <Package Folder>/files/tdata_TSb400
- <Package Folder>/files/tdata_TSb400.jar
- <Package Folder>/files/tdata_dro841
- <Package Folder>/files/tdata_dro841.jar
- <Package Folder>/files/tdata_sYw275
- <Package Folder>/files/tdata_sYw275.jar
- <Package Folder>/shared_prefs/getui_sp.xml
- <Package Folder>/shared_prefs/gjc.xml
- <Package Folder>/shared_prefs/gjc_Pre.xml
- <Package Folder>/shared_prefs/gx_sp.xml
- <Package Folder>/shared_prefs/loginInfo.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.17ba4e3b/####/cfg.xml
- <SD-Card>/.17ba4e3b/####/f01d8c3f0a498f90ad5cac2201a11cc4_1.f0
- <SD-Card>/.17ba4e3b/####/global.xml
- <SD-Card>/.17ba4e3b/####/list1.cache
- <SD-Card>/.17ba4e3b/####/list2.chche
- <SD-Card>/.17ba4e3b/####/plcfg.xml
- <SD-Card>/.17ba4e3b/####/webadlist.cache
- <SD-Card>/.17ba4e3b/####/webadlist.xml
- <SD-Card>/.17ba4e3b/####/webadlist_last.cache
- <SD-Card>/.17ba4e3b/####/webinfo.xml
- <SD-Card>/Android/####/-2041822563
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/com.my1net.hbll.service/pkg_<Package>
- <SD-Card>/libs/<Package>.bin
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/libs/test.log
- <SD-Card>/meiyin/####/132394_thumb_1521183768.jpg
- <SD-Card>/meiyin/####/132413_thumb_1521186560.jpg
- <SD-Card>/meiyin/####/132420_thumb_1521187560.jpg
- <SD-Card>/meiyin/####/132421_thumb_1521187566.jpg
- <SD-Card>/meiyin/####/132427_thumb_1521188594.jpg
- <SD-Card>/meiyin/####/132429_thumb_1521189009.jpg
- <SD-Card>/meiyin/####/132431_thumb_1521189264.jpg
- <SD-Card>/meiyin/####/132436_thumb_1521189904.jpg
- <SD-Card>/meiyin/####/132440_thumb_1521191194.jpg
- <SD-Card>/meiyin/####/132466_thumb_1521439769.jpg
- <SD-Card>/meiyin/####/132467_thumb_1521439871.jpg
- <SD-Card>/meiyin/####/132468_thumb_1521439946.jpg
- <SD-Card>/meiyin/####/132469_thumb_1521440039.jpg
- <SD-Card>/meiyin/####/132470_thumb_1521440106.jpg
- <SD-Card>/meiyin/####/132471_thumb_1521440203.jpg
- <SD-Card>/meiyin/####/132473_thumb_1521442664.jpg
- <SD-Card>/meiyin/####/132474_thumb_1521443062.jpg
- <SD-Card>/meiyin/####/seller_3332_thumb.jpg
- <SD-Card>/system/####/tdata_JmZ606
- <SD-Card>/system/####/tdata_TSb400
- <SD-Card>/system/####/tdata_dro841
- <SD-Card>/system/####/tdata_sYw275
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.DemoPushService 25247 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
Загружает динамические библиотеки:
- getuiext2
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES-ECB-NoPadding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES-ECB-NoPadding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
