Android.Backdoor.955

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Backdoor.657.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) i####.uc.cn:80
TCP(HTTP/1.1) www.qchann####.cn:80
TCP(HTTP/1.1) z.di####.com:80
TCP(HTTP/1.1) g.al####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) log.mm####.com:80
TCP(HTTP/1.1) n####.uc.cn:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) wild####.al####.com.####.net:80
TCP(HTTP/1.1) huic####.sm.cn:80
TCP(HTTP/1.1) tj.ff####.com:80
TCP(HTTP/1.1) o####.u####.cn:80
TCP(HTTP/1.1) cmsst####.dat####.com:80
TCP(HTTP/1.1) i####.u####.cn:80
TCP(HTTP/1.1) t####.uc.cn:80
TCP(HTTP/1.1) 1####.196.123.24:80
TCP(TLS/1.0) tj.ff####.com:443
TCP(TLS/1.0) utp.u####.com:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) t####.uc.cn:443
TCP(TLS/1.0) gd4.al####.com:443
TCP(TLS/1.0) share####.uc.cn:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP 1####.11.61.106:443
TCP umengj####.m.ta####.com:80

Запросы DNS:

ag####.m.ta####.com
amdc####.m.ta####.com
and####.b####.qq.com
cmsst####.dat####.com
g.al####.com
gd4.al####.com
huic####.sm.cn
i####.u####.cn
i####.uc.cn
img.al####.com
l####.tbs.qq.com
log.mm####.com
lsd####.d-####.com
m.u####.cn
msg.umengc####.com
n####.uc.cn
o####.u####.cn
plb####.u####.com
share####.uc.cn
t####.uc.cn
tj.ff####.com
tj.qua####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
utp.u####.com
www.qchann####.cn
z.di####.com

Запросы HTTP GET:

cmsst####.dat####.com//web/css/cms_skin/purple.css?v=####
cmsst####.dat####.com//web/css/swiper-3.4.2.min.css?v=####
cmsst####.dat####.com//web/css/wap-video.css?v=####
cmsst####.dat####.com//web/css/wap_common.css?v=####
cmsst####.dat####.com//web/css/wap_search.css?v=####
cmsst####.dat####.com//web/css/wapindex.css?v=####
cmsst####.dat####.com//web/images/cms-img.png?s=2?v=####
cmsst####.dat####.com//web/images/cms-img.png?s=3?v=####
cmsst####.dat####.com//web/images/cms-img.png?t=20180119?v=####
cmsst####.dat####.com//web/images/cms-img.png?v=####
cmsst####.dat####.com//web/images/cms-img.png?v=10001?v=####
cmsst####.dat####.com//web/images/ddq.gif?v=####
cmsst####.dat####.com//web/images/rolling.gif?v=####
cmsst####.dat####.com//web/js/cms_common.js?v=####
cmsst####.dat####.com//web/js/cms_ggw_wap.js?v=####
cmsst####.dat####.com//web/js/cms_wap_index.js?v=####
cmsst####.dat####.com//web/js/jquery.2.0.min.js?v=####
cmsst####.dat####.com//web/js/jsized.snow.min.js?v=####
cmsst####.dat####.com//web/js/lazyload.js?v=####
cmsst####.dat####.com//web/js/swiper-3.4.2.jquery.min.js?v=####
cmsst####.dat####.com/other/Swiper/3.3.1/css/swiper.min.css
cmsst####.dat####.com/other/Swiper/3.3.1/js/swiper.jquery.min.js
g.al####.com/alilog/??s/8.3.10/plugin/aplus_client.js,aplus_cplugin/0.3....
g.al####.com/alilog/mlog/aplus_wap.js
g.al####.com/secdev/sufei_data/3.0.9/index.js
huic####.sm.cn/jsad?fhver=dist&&title=网红“见光死”, 冯提莫素颜直播引得粉丝直呼: 多丑都爱&page_...
i####.u####.cn/12814435189008510331.jpg?id=####&from=####
i####.uc.cn/14045922270050756892.jpg?id=####&width=####&height=####
i####.uc.cn/14724909685178797652.jpg?id=####&from=####&width=####
i####.uc.cn/16318196674021981586.jpg?id=####&width=####&height=####
i####.uc.cn/16836532799263389551.jpg?id=####
i####.uc.cn/2082913938943039681.jpg?id=####&from=####&width=####
i####.uc.cn/4872546374057474631.jpg?id=####&width=####&height=####
i####.uc.cn/7159187285326235125.jpg?id=####
i####.uc.cn/8360226832955445998.jpg?id=####&width=####&height=####
i####.uc.cn/9029097114638332985.jpg?id=####&from=####
i####.uc.cn/e/uaeext/m;1y/libs/;utp-jssdk-1.6.20.js;jssdk_cn-2.8.7.js;uc...
i####.uc.cn/s/uae/g/0s/fh/dist/fhloader.js?ts=####
i####.uc.cn/s/uae/g/0s/fh/dist/fhpullor.js?ts=####
i####.uc.cn/s/uae/g/1y/article.relate/assets/article.relate.index.6c5f8e...
i####.uc.cn/s/uae/g/1y/libs/loader.ls.1.0.1.js
i####.uc.cn/s/uae/g/1y/libs/sdklibs.shim.1.0.8.js
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/1.0.1/2ce1daac.js
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/1.0.1/70b8d550.js
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/1.0.1/7468a430.js
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/1.0.1/a14af071.js
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/png/html5Loading.bdfcf9b8...
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/png/img_bg_logo_new.d73c2...
i####.uc.cn/s/uae/g/1y/old-xiss-article/assets/png/sofa.3afe18bf.png?for...
i####.uc.cn/s/uae/g/1y/sdk-mod-config/prod/others-xiss-article.json?t=####
i####.uc.cn/s/uae/g/1y/tag-sdk/assets/tag-sdk.index.e78fdd70f3.js
i####.uc.cn/s/uae/g/1y/tool-bar-sdk/assets/svg/like_.982435bb19.svg?forc...
i####.uc.cn/s/uae/g/1y/tool-bar-sdk/assets/svg/report.82a0d1be05.svg?for...
i####.uc.cn/s/uae/g/1y/tool-bar-sdk/assets/tool-bar-sdk.index.949fe8955e...
i####.uc.cn/s/uae/g/1y/xiss.webapp/article.c6b1f1c579.js
i####.uc.cn/s/uae/g/36/per/1.1/m/c/performance.min.js
i####.uc.cn/s/uccircle/s/utp/images/d68026318f101602819ef7a552b33a46x128...
log.mm####.com/eg.js
log.mm####.com/m.gif?logtype=####&title=####&pre=####&cache=####&scr=###...
n####.uc.cn/3/classes/old-xiss-article/lists/article.master?_app_id=####...
n####.uc.cn/3/classes/sdk_loader_maps/lists/article.relate.index.master?...
n####.uc.cn/3/classes/sdk_loader_maps/lists/tag-sdk.master?_app_id=####&...
n####.uc.cn/3/classes/sdk_loader_maps/lists/tool-bar-sdk.master?_app_id=...
n####.uc.cn/3/classes/share_shield_aid/objects/fbaf69e1b3824289b1463b005...
o####.u####.cn/iflow/api/v1/article/5738434224226862234/related?count=##...
o####.u####.cn/iflow/api/v2/cmt/article/5738434224226862234/comments/byh...
o####.u####.cn/log/api/v1/client/info?source=####&os_name=####&aid=####&...
o####.u####.cn/log/api/v1/client/info?title=####&item_type=####&ch_id=##...
o####.u####.cn/log/api/v1/client/info?uc_param_str=####&app=####&sn=####...
o####.u####.cn/log/api/v1/element/click-log?uc_param_str=####&app=####&s...
o####.u####.cn/log/api/v1/element/page?uc_param_str=####&app=####&sn=###...
o####.u####.cn/openiflow/openapi/v2/channel/100?access_token=####&app=##...
o####.u####.cn/openiflow/openapi/v2/channel/1105405272?access_token=####...
o####.u####.cn/openiflow/openapi/v2/channel/179223212?access_token=####&...
o####.u####.cn/openiflow/openapi/v2/channel/51830095?access_token=####&a...
o####.u####.cn/openiflow/openapi/v2/channel/923258246?access_token=####&...
o####.u####.cn/openiflow/openapi/v2/channels?access_token=####&app=####&...
o####.u####.cn/webview/news?app=####&aid=####&cid=####&zzd_from=####&uc_...
t####.uc.cn/collect?lt=####&type=####&e_c=####&e_a=####&appid=####&uc_pa...
tj.ff####.com/_utm.gif?z=1522485886523&tid=xc-dtk-cms-766381&at=pageview...
wild####.al####.com.####.net/bao/uploaded/i4/2259557633/TB2f5w7XXdYMKJjS...
wild####.al####.com.####.net/imgextra/i2/2619659252/TB1u2uofkSWBuNjSszdX...
www.qchann####.cn/1.gif?domain=m.uczzd.cn&url=http://m.uczzd.cn/webview/...
www.qchann####.cn/m2.js
z.di####.com/
z.di####.com/index.php?r=####

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
l####.tbs.qq.com/ajax?c=####&k=####
z.di####.com/index.php?r=####&type=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/1004
/data/data/####/ACCS_BINDumeng;5a5f112ab27b0a1fd1000022.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DL.db-journal
/data/data/####/DaemonServer
/data/data/####/JiaoDian-journal
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewSettings.xml
/data/data/####/a==7.4.1&&4.1_1522485877194_envelope.log
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/debug.conf
/data/data/####/dphoneappstore.com_preferences.xml
/data/data/####/dphoneshared.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/i==1.2.0&&4.1_1522485873572_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.7.1.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/lotuseed_df.apps
/data/data/####/lotuseed_df.s
/data/data/####/lotuseed_df.task
/data/data/####/lotuseed_global_df.xml
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/security_info
/data/data/####/spUtils.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/11ced60323b2494fba46d03fecb12ef0
/data/media/####/2eaa6f0403eb4e1c85e367769d6c4a5e
/data/media/####/351463e4eadb46449a9177fbe108c93a
/data/media/####/72970d22bef24fb4a5d2e36a6cc1e022
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/DPhonelog.txt
/data/media/####/deviceToken
/data/media/####/lotuseed.devid

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a5f112ab27b0a1fd1000022","utdid":"Wr9KceXsfnUDAGdzx1H9LX6m","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
app_process /system/bin com.android.commands.am.Am start --user 0 -n com.android.sdxo/.LogoActivity
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
ps
sh

Загружает динамические библиотеки:

Bugly
libnfix
libshella-2.10.7.1
libufix
nfix
tnet-3.1
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней