Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.248.origin
- Android.Triada.373.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sd####.cm####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) l.ace####.com:80
- TCP(HTTP/1.1) s####.s.360.cn:80
- TCP(HTTP/1.1) 1####.75.79.16:80
- TCP(HTTP/1.1) wap.cm####.com:7758
- TCP(HTTP/1.1) api.gam####.360.cn:80
- TCP(HTTP/1.1) app####.m####.cn:8080
- TCP(HTTP/1.1) drm.cm####.com:80
- TCP(HTTP/1.1) p.s.3####.cn:80
- TCP(HTTP/1.1) 2####.111.8.140:8080
- TCP(HTTP/1.1) 1####.159.18.80:8000
- TCP(TLS/1.0) m####.m####.360.cn:443
- TCP(TLS/1.0) api.gam####.360.cn:443
Запросы DNS:
- a####.u####.com
- api.gam####.360.cn
- app####.m####.cn
- drm.cm####.com
- l.ace####.com
- m####.m####.360.cn
- p.s.3####.cn
- s####.s.360.cn
- sd####.cm####.com
- wap.cm####.com
Запросы HTTP GET:
- api.gam####.360.cn/10/system/updatecertificate?appid=####&nonce=####&rke...
- drm.cm####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
- s####.s.360.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####
Запросы HTTP POST:
- a####.u####.com/app_logs
- app####.m####.cn:8080/migusdk/tl/tcttl
- app####.m####.cn:8080/migusdk/verification/checkSdkUpdate
- drm.cm####.com/egsb/dataPlan/privateSwith
- drm.cm####.com/egsb/game/getPaymentCapability
- drm.cm####.com/egsb/message/queryPushMessages
- drm.cm####.com/egsb/otherPay/querySMSInterceptorConf
- drm.cm####.com/egsb/thirdPay/queryThirdPayInfo
- l.ace####.com/ando/v2/lv?app_id=####&r=####
- p.s.3####.cn/update/update.php?p=####
- sd####.cm####.com/behaviorLogging/eventLogging/accept?
- wap.cm####.com:7758/normandie/QueryConfigPolicy
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/2077.dex
- <Package Folder>/2234.dex
- <Package Folder>/2392.dex
- <Package Folder>/app_cache/ddLv.dex
- <Package Folder>/app_temp/SDK1205_dex.dex
- <Package Folder>/cache/####/777.txt
- <Package Folder>/cache/####/SDK1205_dex.jar
- <Package Folder>/cache/2077.dex (deleted)
- <Package Folder>/cache/2234.dex (deleted)
- <Package Folder>/cache/top.zip
- <Package Folder>/code-5119559/W1kXFf7FRh1lpo7y
- <Package Folder>/databases/W5PGCJCjMfsSjFu2_VB-zQ_rJcBO3IMDp2nm...POKw==
- <Package Folder>/databases/W5PGCJCjMfsSjFu2_VB-zQ_rJcBO3IMDp2nm...e31l8=
- <Package Folder>/databases/W5PGCJCjMfsSjFu2_VB-zQ_rJcBO3IMDp2nm...i4U4zn
- <Package Folder>/databases/W5PGCJCjMfsSjFu2_VB-zQ_rJcBO3IMDp2nm...ournal
- <Package Folder>/databases/W5PGCJCjMfsSjFu2_VB-zQ_rJcBO3IMDp2nm...oyYw==
- <Package Folder>/databases/mfgame.db
- <Package Folder>/databases/mfgame.db-journal
- <Package Folder>/files/####/-TTzXkhFIm3PMdjUQNJy-nwbUAf8X0sp.new
- <Package Folder>/files/####/2stuLPqDrMkmBm7rT_A7aFcfGmCdt4tg.new
- <Package Folder>/files/####/360sdk_1_2008.zip
- <Package Folder>/files/####/46yCn8566yUykN9HU9kdKQ==.new
- <Package Folder>/files/####/5gJ76T4adDkbW0j1_BHCQx5_hSA=.new
- <Package Folder>/files/####/9FgB-iLLi1Rj5IIfooGedA==
- <Package Folder>/files/####/EAUw4aKNLvItogUYegx06xlLM_F8QtFC.new
- <Package Folder>/files/####/FCd2mOIOTm_QTYsq.new
- <Package Folder>/files/####/FxZRrPNKISkNaGQeNPFckbLKX_f9d7J3.new
- <Package Folder>/files/####/GB2ANn-DcocgECw_TCzzEkZ59YoRUbVQ.new
- <Package Folder>/files/####/GZ7v-QrlCkNyHJWMoMnmOn2rl9o=.new
- <Package Folder>/files/####/JLrpWkz-Y2Q757Gibotr8zeuXCg=
- <Package Folder>/files/####/Jb1pOsOUHU9FHPydRv0gjEo_JlNcz07sXUDbaw==.new
- <Package Folder>/files/####/KWwcsS7qnKLXqxwDL3Oiiw7tSHYk7j1nNVg...s=.new
- <Package Folder>/files/####/KkGPyhsbzVyK8-rimCKvbLyoSmu9cEiN.new
- <Package Folder>/files/####/PuIS_19C5gI6BkLTawhdFg==.new
- <Package Folder>/files/####/QHA_JSON_PERSISTER_02522a2b2726fb0a...d9524d
- <Package Folder>/files/####/UbXm-I1geDpm8wdhnwVJ5Zx_E65EUeA9.new
- <Package Folder>/files/####/V--fi9CV-LWNOFKG4LFjHaKaBZh0_iwf.new
- <Package Folder>/files/####/XX3nmBoChtixspXcOTqNVnD7qc4=.new
- <Package Folder>/files/####/Y29tLmd1bHV6eS50YWlrb25nZGFGSi5zanho.tick.lock
- <Package Folder>/files/####/YjR1r2KQndhyKh63h2ILQg==
- <Package Folder>/files/####/YjR1r2KQndhyKh63h2ILQg==.new
- <Package Folder>/files/####/brIxXaVMq47lKAky8EMn_po4j2A=.new
- <Package Folder>/files/####/dR9c7s4WmuRIeK6PO4BxTUze_SJuJSkLTKr...Q=.new
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/fXFBF-JWUAQAuLHtZUHJakhHJmgEFQB_0D7MYw==.new
- <Package Folder>/files/####/geqpbq_f.dex
- <Package Folder>/files/####/geqpbq_f.zip
- <Package Folder>/files/####/iuLrPHE-h9uOxaG2.dex
- <Package Folder>/files/####/iuLrPHE-h9uOxaG2.zip
- <Package Folder>/files/####/kLycvPNFrkWAE9oO
- <Package Folder>/files/####/lb9N9Bz9Oo_piwWoimztjTxWSsA=.new
- <Package Folder>/files/####/libmiguED.so
- <Package Folder>/files/####/oioZm20Sbg2pJVaNPP6dAd94wuL4sPEx.new
- <Package Folder>/files/####/orY8bxMWDgRwi-xJxO4iZPUaGIM=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/tVw8NhURIu4Z3RYU-iVjTw==
- <Package Folder>/files/####/vYPSx7zun4ziQEblEFXJ1pKWUlZpUOBR27l...c=.new
- <Package Folder>/files/####/vqSLIFij2lSlFqonm3ZDsu9R0Yc=.new
- <Package Folder>/files/####/xRLE0qAM35ClRtlZKiw-iVFcP5cDJQoj7Tv...I=.new
- <Package Folder>/files/####/zcCH6QtDLBuSYFITfh6jbGH-18_S4cG9_vAUew==.new
- <Package Folder>/files/.imprint
- <Package Folder>/files/ED.ini
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003049_2b7f405527637...02.cod
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003049_2b7f405527637...02.dat
- <Package Folder>/files/ddLv
- <Package Folder>/files/ddLv.jar
- <Package Folder>/files/frameso
- <Package Folder>/files/libmgRun_05.22.09_01.so
- <Package Folder>/files/mgAS.dat
- <Package Folder>/files/mgSS.dat
- <Package Folder>/files/mgid.dat
- <Package Folder>/files/mobclick_agent_cached_<Package>122
- <Package Folder>/files/rdata_comweufkahfrw.new
- <Package Folder>/files/sdk_prefs
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Pay_config.xml
- <Package Folder>/shared_prefs/QH_DeviceSDK.xml
- <Package Folder>/shared_prefs/QH_SDK_M2.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03...4d.xml
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml
- <Package Folder>/shared_prefs/coolcloud_config.xml
- <Package Folder>/shared_prefs/miguGameBillingRequestMonitor.xml
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml
- <Package Folder>/shared_prefs/sdk_apk_info.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/360/####/02522a2b2726fb0a03bb19f2d8d9524d
- <SD-Card>/360/####/Oju
- <SD-Card>/360/####/Oju (deleted)
- <SD-Card>/360/####/Y29tLmd1bHV6eS50YWlrb25nZGFGSi5zanho
- <SD-Card>/360/####/Y29tLmd1bHV6eS50YWlrb25nZGFGSi5zanho (deleted)
- <SD-Card>/360/####/dcsdid.dat
- <SD-Card>/360/####/f64
- <SD-Card>/360/####/f64 (deleted)
- <SD-Card>/360/.deviceId
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/####/ShareData.txt
- <SD-Card>/Download/####/deviceId
- <SD-Card>/Download/####/sdk_prefs.txt
- <SD-Card>/cmgame/####/pushDB.txt
- <SD-Card>/cmgame/####/pushTime.txt
- <SD-Card>/cmgame/####/pushTotal.txt
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-5119559/W1kXFf7FRh1lpo7y -p <Package> -c com.weufk.ahfrw.entity.BilberryReceiver -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Загружает динамические библиотеки:
- cocos2dcpp
- frameso
- libmiguED
- megjb
- qhsdk
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-None-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
