Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.337.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a.rua####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) v3-jiat####.b0.a####.com:80
- TCP(HTTP/1.1) st####.an####.org:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) i####.rua####.com.####.com:80
- TCP(HTTP/1.1) i####.c####.com:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) poli####.go####.com:443
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.gst####.com:443
Запросы DNS:
- a.rua####.com
- adser####.go####.com
- c.c####.com
- f####.gst####.com
- gg.wap####.com
- h####.b####.com
- hm.b####.com
- i####.c####.com
- i####.rua####.com
- p####.go####.com
- poli####.go####.com
- s13.c####.com
- ssl.gst####.com
- st####.an####.org
- v3.jia####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.gst####.com
- z7.c####.com
Запросы HTTP GET:
- a.rua####.com/
- a.rua####.com/api/ajax_get/updateClick?id=####
- a.rua####.com/favicon.ico
- a.rua####.com/game/35948/
- a.rua####.com/html/game/comment_list?p=####&gameId=####&sort=####
- a.rua####.com/live_weixin.png
- a.rua####.com/static/css/comment.css
- a.rua####.com/static/css/index.css
- a.rua####.com/static/css/list.css
- a.rua####.com/static/css/public.css
- a.rua####.com/static/css/view.css
- a.rua####.com/static/images/dian.png
- a.rua####.com/static/images/home.png
- a.rua####.com/static/images/line.gif
- a.rua####.com/static/images/logo.png
- a.rua####.com/static/images/more.gif
- a.rua####.com/static/images/pullUp.png
- a.rua####.com/static/images/search.png
- a.rua####.com/static/images/sprite.png
- a.rua####.com/static/images/wuxing.png
- a.rua####.com/static/js/comment.js
- a.rua####.com/static/js/jquery.1.7.2.js
- a.rua####.com/static/js/jquery.min.js
- a.rua####.com/static/js/public.js
- a.rua####.com/static/js/skins/icons/loading.gif
- a.rua####.com/static/js/view.js
- a.rua####.com/update/
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/z_stat.php?id=####&show=####
- hm.b####.com/h.js?77630c5####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- i####.c####.com/img/pic1.gif
- i####.rua####.com.####.com/uploads/game_logo/201409/gLogo_54096474c99d56...
- i####.rua####.com.####.com/uploads/game_logo/201411/gLogo_5460b724972c57...
- i####.rua####.com.####.com/uploads/game_logo/201603/gLogo_56f38ca91bc4d5...
- i####.rua####.com.####.com/uploads/game_logo/201605/gLogo_574975919741f0...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_5881d865944984...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_588493b6940668...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_588494564994a7...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_5885ed48b22a25...
- i####.rua####.com.####.com/uploads/game_logo/201703/gLogo_58d52366b982e8...
- i####.rua####.com.####.com/uploads/game_logo/201709/gLogo_59c0c7747ec5e0...
- i####.rua####.com.####.com/uploads/game_logo/201801/gLogo_5a5c864fb83dd0...
- i####.rua####.com.####.com/uploads/game_logo/201802/gLogo_5a8adbe5871634...
- i####.rua####.com.####.com/uploads/game_logo/201803/gLogo_5aaa3fc5c71708...
- i####.rua####.com.####.com/uploads/game_logo/201803/gLogo_5abc3a3b04c150...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ac2da4a239ea7...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5acb026c470204...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5509f73dba5...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad55451205265...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad578c2893a33...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad592f6dd2096...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad599cf012ae4...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5b44be2c7d3...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5b8bbda2294...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5c7feb6a815...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5cc36eaa774...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d19d18eda4...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d25450ed69...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d2c1daa402...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d2e1268235...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d3b79c4057...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d410978e78...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d48ba79532...
- i####.rua####.com.####.com/uploads/game_logo/201804/gLogo_5ad5d51e8f84c5...
- st####.an####.org/static/outer/image/aqkx_83x30.png?id=a.ruansky.com?t=#...
- st####.an####.org/static/outer/js/aq_auth.js
- v3-jiat####.b0.a####.com/code/css/jiathis_share.css
- v3-jiat####.b0.a####.com/code/images/jiathis_ico.png
- v3-jiat####.b0.a####.com/code/jia.js?uid=####
- v3-jiat####.b0.a####.com/code/jiathis_utility.html
- v3-jiat####.b0.a####.com/code/plugin.client.js
- www.go####.com/complete/search?hl=####&client=####&q=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/SafFramework.db
- /data/data/####/SafFramework.db-journal
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/com.fd.wap
- /data/data/####/com.fd.wap.art
- /data/data/####/container.dex
- /data/data/####/container.pre_global_config
- /data/data/####/device_id.xml.xml
- /data/data/####/iapSplash.dat
- /data/data/####/libsecexe.x86.so
- /data/data/####/libsecmain.x86.so
- /data/data/####/license_data.db
- /data/data/####/license_data.db-journal
- /data/data/####/save_ad.xml
- /data/media/####/log
Другие:
Запускает следующие shell-скрипты:
- <Package> <Package> -1829454664 0 /data/app/<Package>-1.apk 39 <Package> 50 51
- <Package> <Package> -1830454088 0 /data/app/<Package>-1.apk 39 <Package> 50 51
- <Package> <Package> -1830454088 0 /data/app/<Package>-1.apk 39 <Package> 51 52
- <Package> <Package> -1830454088 0 /data/app/<Package>-1.apk 40 <Package> 48 49
- chmod 755 <Package Folder>/.cache/<Package>
- chmod 755 <Package Folder>/.cache/<Package>.art
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- casdkjni
- cocos2dcpp
- identifyapp
- libsecexe.x86
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
