Android.Packed.36454

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.570.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) v####.c####.q####.####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) c####.6####.cn:8086
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) st####.dc####.net.cn:80
TCP v.m####.com:7701
TCP v.m####.com:7702
TCP v.m####.com:7703

Запросы DNS:

a####.u####.com
and####.b####.qq.com
c####.6####.cn
st####.dc####.net.cn
st####.mobih####.com
v####.6####.cn
v.m####.com

Запросы HTTP GET:

c####.6####.cn:8086/klerge/category/querySubCat.do?undef####&catid=####&...
c####.6####.cn:8086/klerge/device/userDeviceLogin.do?appname=####&channe...
c####.6####.cn:8086/klerge/video/videoList.do?undef####&catid=####&short...
st####.dc####.net.cn/resource/icon?appid=####&width=####&__am=####&imei=...
v####.c####.q####.####.com/a/b/c/e02d4e187ad6f0f56f0b6edf7a51e615.jpg
v####.c####.q####.####.com/a/e/b/d8148a262331f6320ebeb790045ef602.jpg
v####.c####.q####.####.com/b/d/a/d28bfc0c4f338e4330080f13e8747c49.jpg
v####.c####.q####.####.com/b/d/e/277f3e5464baf1a084ac24d3ebf70388.jpg
v####.c####.q####.####.com/b/f/c/aaa08e4ee4f25fdf0fac5ad03cc69bd6.jpg
v####.c####.q####.####.com/b/f/e/1bd104d0f87b6ad481dc4b24429fc541.jpg
v####.c####.q####.####.com/c/d/d/e96be64dd38504c2eb97c2647c4cce82.jpg
v####.c####.q####.####.com/e/a/b/4a5a32808cea2c2161870156f56b0379.jpg
v####.c####.q####.####.com/e/d/a/49e47fa950ced91e476bb11ec2e67d55.jpg

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/index
<Package Folder>/databases/111.db-journal
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/files/####/CNAME
<Package Folder>/files/####/CONTRIBUTING.md
<Package Folder>/files/####/Ccontent.html
<Package Folder>/files/####/FontAwesome.otf
<Package Folder>/files/####/Gemfile
<Package Folder>/files/####/Gemfile.lock
<Package Folder>/files/####/HELP-US-OUT.txt
<Package Folder>/files/####/Makefile
<Package Folder>/files/####/README.md
<Package Folder>/files/####/TV.png
<Package Folder>/files/####/TingSongLinst.html
<Package Folder>/files/####/Wordpad.png
<Package Folder>/files/####/ZeroClipboard-1.1.7.min.js
<Package Folder>/files/####/ZeroClipboard-1.1.7.swf
<Package Folder>/files/####/_animated.scss
<Package Folder>/files/####/_bootstrap.scss
<Package Folder>/files/####/_bordered-pulled.scss
<Package Folder>/files/####/_config.yml
<Package Folder>/files/####/_core.scss
<Package Folder>/files/####/_extras.scss
<Package Folder>/files/####/_fixed-width.scss
<Package Folder>/files/####/_icons.scss
<Package Folder>/files/####/_larger.scss
<Package Folder>/files/####/_list.scss
<Package Folder>/files/####/_mixins.scss
<Package Folder>/files/####/_path.scss
<Package Folder>/files/####/_rotated-flipped.scss
<Package Folder>/files/####/_screen-reader.scss
<Package Folder>/files/####/_stacked.scss
<Package Folder>/files/####/_variables.scss
<Package Folder>/files/####/accordion.less
<Package Folder>/files/####/alerts.less
<Package Folder>/files/####/animated.less
<Package Folder>/files/####/as.html
<Package Folder>/files/####/backbone.min.js
<Package Folder>/files/####/base.js
<Package Folder>/files/####/bootstrap-2.3.1.min.js
<Package Folder>/files/####/bootstrap-222.min.js
<Package Folder>/files/####/bootstrap.less
<Package Folder>/files/####/bordered-pulled.less
<Package Folder>/files/####/breadcrumbs.less
<Package Folder>/files/####/btnList.html
<Package Folder>/files/####/button-groups.less
<Package Folder>/files/####/buttons.less
<Package Folder>/files/####/carousel.less
<Package Folder>/files/####/cat.html
<Package Folder>/files/####/catTing.html
<Package Folder>/files/####/catXue.html
<Package Folder>/files/####/catting.js
<Package Folder>/files/####/catxue.js
<Package Folder>/files/####/cheatsheet.html
<Package Folder>/files/####/close.less
<Package Folder>/files/####/code.less
<Package Folder>/files/####/collection (2).png
<Package Folder>/files/####/comm.css
<Package Folder>/files/####/common.css
<Package Folder>/files/####/common.js
<Package Folder>/files/####/community.html
<Package Folder>/files/####/component-animations.less
<Package Folder>/files/####/composer.json
<Package Folder>/files/####/contribution-sample.png
<Package Folder>/files/####/core.js
<Package Folder>/files/####/core.less
<Package Folder>/files/####/css-loader.css
<Package Folder>/files/####/design.html
<Package Folder>/files/####/di.png
<Package Folder>/files/####/dl.png
<Package Folder>/files/####/downloaddhp.html
<Package Folder>/files/####/downloadeg.html
<Package Folder>/files/####/downloadgs.html
<Package Folder>/files/####/downloadsp.html
<Package Folder>/files/####/dropdowns.less
<Package Folder>/files/####/examples.html
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/extras.less
<Package Folder>/files/####/favicon.ico
<Package Folder>/files/####/file__0.localstorage-journal
<Package Folder>/files/####/fixed-width.less
<Package Folder>/files/####/font-awesome-animation.min.css
<Package Folder>/files/####/font-awesome-ie7.css
<Package Folder>/files/####/font-awesome-ie7.less
<Package Folder>/files/####/font-awesome-ie7.min.css
<Package Folder>/files/####/font-awesome-ie7.scss
<Package Folder>/files/####/font-awesome.css
<Package Folder>/files/####/font-awesome.less
<Package Folder>/files/####/font-awesome.min.css
<Package Folder>/files/####/font-awesome.scss
<Package Folder>/files/####/fontawesome-webfont.eot
<Package Folder>/files/####/fontawesome-webfont.svg
<Package Folder>/files/####/fontawesome-webfont.ttf
<Package Folder>/files/####/fontawesome-webfont.woff
<Package Folder>/files/####/fontawesome-webfont.woff2
<Package Folder>/files/####/forms.less
<Package Folder>/files/####/fort_awesome.jpg
<Package Folder>/files/####/get-started.html
<Package Folder>/files/####/glyphicons-halflings-white.png
<Package Folder>/files/####/glyphicons-halflings.png
<Package Folder>/files/####/grid.less
<Package Folder>/files/####/header.html
<Package Folder>/files/####/header.png
<Package Folder>/files/####/hero-unit.less
<Package Folder>/files/####/icon-flag.pdf
<Package Folder>/files/####/icon.png
<Package Folder>/files/####/icon_st.png
<Package Folder>/files/####/icons.html
<Package Folder>/files/####/icons.less
<Package Folder>/files/####/icons.yml
<Package Folder>/files/####/index.css
<Package Folder>/files/####/index.html
<Package Folder>/files/####/index.js
<Package Folder>/files/####/iscroll-probe.js
<Package Folder>/files/####/jquery-1.7.1.min.js
<Package Folder>/files/####/jquery.js
<Package Folder>/files/####/jquery.min.js
<Package Folder>/files/####/jquery.min.map
<Package Folder>/files/####/jquery.slim.js
<Package Folder>/files/####/jquery.slim.min.js
<Package Folder>/files/####/jquery.slim.min.map
<Package Folder>/files/####/k.png
<Package Folder>/files/####/kanCartoonList.html
<Package Folder>/files/####/kanFooter.html
<Package Folder>/files/####/kanSongList.html
<Package Folder>/files/####/labels-badges.less
<Package Folder>/files/####/larger.less
<Package Folder>/files/####/layouts.less
<Package Folder>/files/####/lazy.less
<Package Folder>/files/####/license.html
<Package Folder>/files/####/list.css
<Package Folder>/files/####/list.less
<Package Folder>/files/####/listHeader.html
<Package Folder>/files/####/listcomm.js
<Package Folder>/files/####/loading.png
<Package Folder>/files/####/logo.png
<Package Folder>/files/####/manifest.json
<Package Folder>/files/####/media.less
<Package Folder>/files/####/meu01.png
<Package Folder>/files/####/mixins.less
<Package Folder>/files/####/modals.less
<Package Folder>/files/####/mui.css
<Package Folder>/files/####/mui.js
<Package Folder>/files/####/mui.min.css
<Package Folder>/files/####/mui.min.js
<Package Folder>/files/####/mui.ttf
<Package Folder>/files/####/navbar.less
<Package Folder>/files/####/navs.less
<Package Folder>/files/####/next.png
<Package Folder>/files/####/notepad.png
<Package Folder>/files/####/on.png
<Package Folder>/files/####/package.json
<Package Folder>/files/####/pager.less
<Package Folder>/files/####/pagination.less
<Package Folder>/files/####/path.less
<Package Folder>/files/####/pause.png
<Package Folder>/files/####/pifu.png
<Package Folder>/files/####/play.png
<Package Folder>/files/####/popovers.less
<Package Folder>/files/####/prettify.css
<Package Folder>/files/####/prettify.min.js
<Package Folder>/files/####/prev.png
<Package Folder>/files/####/progress-bars.less
<Package Folder>/files/####/pygments.css
<Package Folder>/files/####/qz.png
<Package Folder>/files/####/reset.less
<Package Folder>/files/####/responsive-1200px-min.less
<Package Folder>/files/####/responsive-767px-max.less
<Package Folder>/files/####/responsive-768px-979px.less
<Package Folder>/files/####/responsive-navbar.less
<Package Folder>/files/####/responsive-utilities.less
<Package Folder>/files/####/responsive.less
<Package Folder>/files/####/rotated-flipped.less
<Package Folder>/files/####/scaffolding.less
<Package Folder>/files/####/screen-reader.less
<Package Folder>/files/####/seaech.js
<Package Folder>/files/####/search.css
<Package Folder>/files/####/search.html
<Package Folder>/files/####/site.js
<Package Folder>/files/####/site.less
<Package Folder>/files/####/song.png
<Package Folder>/files/####/sprites.less
<Package Folder>/files/####/stacked.less
<Package Folder>/files/####/sticky-footer.less
<Package Folder>/files/####/story.png
<Package Folder>/files/####/t.png
<Package Folder>/files/####/tables.less
<Package Folder>/files/####/test.html
<Package Folder>/files/####/thumbnails.less
<Package Folder>/files/####/tingFooter.html
<Package Folder>/files/####/tooltip.less
<Package Folder>/files/####/type.less
<Package Folder>/files/####/underscore.min.js
<Package Folder>/files/####/utilities.less
<Package Folder>/files/####/variables.less
<Package Folder>/files/####/video.css
<Package Folder>/files/####/video.html
<Package Folder>/files/####/video.js
<Package Folder>/files/####/vip(1).png
<Package Folder>/files/####/vip.html
<Package Folder>/files/####/vip.png
<Package Folder>/files/####/w.png
<Package Folder>/files/####/weixin.png
<Package Folder>/files/####/wells.less
<Package Folder>/files/####/whats-new.html
<Package Folder>/files/####/woFooter.html
<Package Folder>/files/####/x.png
<Package Folder>/files/####/xueFooter.html
<Package Folder>/files/####/xueList.html
<Package Folder>/files/####/xunhuan.png
<Package Folder>/files/####/zepto.min.js
<Package Folder>/files/####/zhifubao.png
<Package Folder>/files/.imei.txt
<Package Folder>/files/.imprint
<Package Folder>/files/34.jar
<Package Folder>/files/exid.dat
<Package Folder>/files/local_crash_lock
<Package Folder>/files/native_record_lock
<Package Folder>/files/security_info
<Package Folder>/files/umeng_it.cache
<Package Folder>/mix.dex
<Package Folder>/shared_prefs/87b3308ca455e154dc3bb3c75e8bfc2c.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/H53C3339C.xml
<Package Folder>/shared_prefs/a33.xml
<Package Folder>/shared_prefs/a33<IMEI>.xml
<Package Folder>/shared_prefs/a34<IMEI>.xml
<Package Folder>/shared_prefs/a35<IMEI>.xml
<Package Folder>/shared_prefs/pdr.xml
<Package Folder>/shared_prefs/stream_permission.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/tx_shell/libshella-2.10.7.1.so
<Package Folder>/tx_shell/libufix.so
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.imei.txt
<SD-Card>/Android/####/temp.arm

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime

Загружает динамические библиотеки:

Bugly
app_2017
libnfix
libshella-2.10.7.1
libufix
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней