Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) c####.l.qq.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) m.gzu####.com:80
- TCP(HTTP/1.1) wc.find####.cc.####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) cm.pos.b####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) cm.g.doublec####.net:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) m.zu####.org.cn:80
- TCP(HTTP/1.1) s.un####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.c####.b####.com:80
- TCP(HTTP/1.1) c####.jd.com:80
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) 1####.217.17.110:443
Запросы DNS:
- a####.u####.com
- c####.baidust####.com
- c####.baidust####.com
- c####.jd.com
- c####.l.qq.com
- cm.g.doublec####.net
- cm.pos.b####.com
- dup.baidust####.com
- ec####.b####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- hm.b####.com
- i####.51.la
- js.u####.51.la
- m.gzu####.com
- m.zu####.org.cn
- mo####.b####.com
- mobads-####.b####.com
- pos.b####.com
- s.c####.b####.com
- s.un####.com
- t10.b####.com
- t11.b####.com
- t12.b####.com
- wc.find####.cc
- wn.pos.b####.com
- www.zu####.org.cn
Запросы HTTP GET:
- c####.baidust####.com/cpro/ui/cm.js
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- c####.baidust####.com/sync.htm?cproid=####
- c####.jd.com/du?&baidu_error=####×tamp=####
- c####.jd.com/du?&baidu_user_id=####&cookie_version=####×tamp=####&e...
- c####.l.qq.com/?dspid=####&dspuid=####&gettuid=####
- cm.g.doublec####.net/pixel?google_nid=####&googl####
- cm.g.doublec####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- cm.pos.b####.com/gpixel?google_error=####
- cm.pos.b####.com/pixel?dspid=####
- cm.pos.b####.com/tencent?tuid=####&ver=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?0653032####
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- js.u####.51.la/18738872.js
- m.gzu####.com/
- m.gzu####.com/ernianjidhg/
- m.gzu####.com/ernianjikantu/
- m.gzu####.com/liunianjizuowen/
- m.gzu####.com/pic/151101/20180428/214-1P42Q40246234.jpg
- m.gzu####.com/pic/20180428/214-1P42Q40234321.jpg
- m.gzu####.com/sitemap.html
- m.gzu####.com/www/css/art.css
- m.gzu####.com/www/css/list.css
- m.gzu####.com/www/imgs/z-ico1.png
- m.gzu####.com/www/js/jquery.min.js
- m.gzu####.com/zuowensucai/
- m.gzu####.com/zuowensucai/kcsc/201712/1512546660145367.html
- m.gzu####.com/zuowensucai/myjj/
- m.gzu####.com/zuowensucai/myjj/201708/1502347077141474.html
- m.zu####.org.cn/
- m.zu####.org.cn/liunianjikantu/
- m.zu####.org.cn/liunianjixushi/201804/1524894998146696.html
- m.zu####.org.cn/sitemap.html
- m.zu####.org.cn/sitemaps.html
- m.zu####.org.cn/www/css/app.css
- m.zu####.org.cn/www/css/common.css
- m.zu####.org.cn/www/imgs/z-ico5.png
- m.zu####.org.cn/www/js/jquery.min.js
- m.zu####.org.cn/www/js/jquery.min1.js
- m.zu####.org.cn/www/js/mad.js
- m.zu####.org.cn/zuowensucai/kcsc/
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7043.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525573914457=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525573944808=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525573975511=####
- pos.b####.com/dcom?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/fcfm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/jccm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/lcem?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/lcem?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/ockm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/ocxm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/scqm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/scqm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/sync_pos.htm?cproid=####
- pos.b####.com/sync_pos.htm?cproid=####&t=####
- pos.b####.com/vcim?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/vcrm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- s.c####.b####.com/s.htm?cproid=####&t=####
- si####.jom####.com/it/u=1087360078,1289494679&fm=76
- si####.jom####.com/it/u=131956562,3710592328&fm=76
- si####.jom####.com/it/u=1344957095,12611258&fm=76
- si####.jom####.com/it/u=1429613319,1101029029&fm=76
- si####.jom####.com/it/u=1443182046,1764944214&fm=76
- si####.jom####.com/it/u=145486076,4125360639&fm=76
- si####.jom####.com/it/u=1653535506,2186566601&fm=76
- si####.jom####.com/it/u=1731106803,2507023088&fm=76
- si####.jom####.com/it/u=1769850444,2362331158&fm=76
- si####.jom####.com/it/u=1787728580,2258219358&fm=76
- si####.jom####.com/it/u=1789163323,2444522036&fm=76
- si####.jom####.com/it/u=1960329663,2800370018&fm=76
- si####.jom####.com/it/u=1966745382,2549263790&fm=76
- si####.jom####.com/it/u=2631261196,702456809&fm=76
- si####.jom####.com/it/u=280594571,4079205611&fm=76
- si####.jom####.com/it/u=301680318,1959343959&fm=76
- si####.jom####.com/it/u=3213136439,2853405121&fm=76
- si####.jom####.com/it/u=345718401,2192130554&fm=76
- si####.jom####.com/it/u=3478601,25168237&fm=76
- si####.jom####.com/it/u=3552469471,3601155057&fm=76
- si####.jom####.com/it/u=3576295060,3753622027&fm=76
- si####.jom####.com/it/u=364370451,4232451809&fm=76
- si####.jom####.com/it/u=3681889901,3781005453&fm=76
- si####.jom####.com/it/u=3698601844,1066823458&fm=76
- si####.jom####.com/it/u=3712825453,692518663&fm=76
- si####.jom####.com/it/u=3797857230,3826776786&fm=76
- si####.jom####.com/it/u=3817059961,3893042431&fm=76
- si####.jom####.com/it/u=3877495676,3817121351&fm=76
- si####.jom####.com/it/u=4039932086,4200631450&fm=76
- si####.jom####.com/it/u=4107558832,4218656584&fm=76
- si####.jom####.com/it/u=416178739,3115995123&fm=76
- si####.jom####.com/it/u=438366879,4212003888&fm=76
- si####.jom####.com/it/u=442432073,3925154657&fm=76
- si####.jom####.com/it/u=466588169,2174393445&fm=76
- si####.jom####.com/it/u=490464409,1327782939&fm=76
- si####.jom####.com/it/u=509827831,3061346639&fm=76
- si####.jom####.com/it/u=511476840,4285100113&fm=76
- si####.jom####.com/it/u=638085556,2285136908&fm=76
- si####.jom####.com/it/u=764670814,4141827284&fm=76
- si####.jom####.com/it/u=93537016,1581991582&fm=76
- si####.jom####.com/it/u=939766961,3848750762&fm=76
- si####.jom####.com/it/u=970984917,1502991659&fm=76
- wc.find####.cc.####.com/2011/rio.jar
- wn.pos.b####.com/adx.php?c=####
Запросы HTTP POST:
- a####.u####.com/app_logs
- s.un####.com/cw/cp.action?requestId=####&g=####
- s.un####.com/cw/interface!u2.action?protocol=####&version=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/W_Key.xml
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__895f3ceb-ebc5-4900-96c...93.jar
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/exchangeIdentity.json
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/index
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/3.6_rio.jar.tmp
- /data/media/####/assetstime.dat
Другие:
Загружает динамические библиотеки:
- ke
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
