Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.728.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p.hfm####.com:6088
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) sdk.and####.com:80
- TCP(HTTP/1.1) adse####.min####.cn:80
- TCP(HTTP/1.1) zymys####.b0.upa####.com:80
- TCP(HTTP/1.1) lewu####.com:80
- TCP(HTTP/1.1) 1####.55.98.58:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) cdn.1####.wang:80
- TCP(HTTP/1.1) bs####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) 1####.23.159.36:80
- TCP(HTTP/1.1) c####.suis####.com:80
- TCP(HTTP/1.1) cdn.yucha####.com:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(Reader|com.android.gallery,Gallery|com.android.settings,Settings|com.android.vending,Play Store|com.android.dialer,Phone|com.google.android.gms,Google Settings|com.android.calendar,Calendar|com.android.browser,Browser|com.android.deskclock,Clock|com.android.contacts,People|com.android.music,Music|com.android.mms,Messaging|com.android.calculator2,Calculator|com.android.email,Email|com.android.development,Dev Tools|com.android.quicksearchbox,Search|com.android.providers.downloads.ui,Downloads|com.example.android.notepad,Notes|com.android.speechrecorder,Speech Recorder|com.android.inputmethod.latin,Android Keyboard (AOSP)|com.xsk.zy.hulu2,????| HTTP/1.1) c####.suis####.com:80
Запросы DNS:
- adse####.min####.cn
- and####.b####.qq.com
- bs####.oss-cn-####.aliy####.com
- c####.suis####.com
- cdn.1####.wang
- cdn.yucha####.com
- h####.c####.com
- int.d####.s####.####.cn
- lewu####.com
- p.hfm####.com
- sdk.and####.com
- sdk.suis####.com
- zymys####.b0.upa####.com
Запросы HTTP GET:
- adse####.min####.cn/getInfo/equipInfo?serialNo=####&mac=####&imei=####&c...
- bs####.oss-cn-####.aliy####.com/sdk_files/bh
- bs####.oss-cn-####.aliy####.com/sdk_files/bt
- bs####.oss-cn-####.aliy####.com/sdk_files/rp
- c####.suis####.com/check?channel=####
- c####.suis####.com/cnzz?channel=####
- c####.suis####.com/tongji.php?srt_liu?uid=####&osint=####&pkg=####&net=#...
- cdn.1####.wang/sc_151_2
- cdn.yucha####.com/zyad/vipk_9001_logo_hp5604_c04_1758.png
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####&ip=####
- p.hfm####.com:6088/c/1525846269230
- z.c####.com/stat.htm?id=####&cnzz_eid=####
- zymys####.b0.upa####.com/Apicture/571843a86cb19.png
- zymys####.b0.upa####.com/Apicture/571843b5b5316.png
- zymys####.b0.upa####.com/Apicture/571843e82b040.png
- zymys####.b0.upa####.com/Apicture/5718441477e24.png
- zymys####.b0.upa####.com/Apicture/57184b0f0adbd.png
- zymys####.b0.upa####.com/Apicture/57184b182bd83.png
- zymys####.b0.upa####.com/Apicture/57184b23b88d9.png
- zymys####.b0.upa####.com/Apicture/57184b2d4615f.png
- zymys####.b0.upa####.com/Apicture/57184b35c38bb.png
- zymys####.b0.upa####.com/Apicture/57184b443c9d9.png
- zymys####.b0.upa####.com/Apicture/57184b4c78248.png
- zymys####.b0.upa####.com/Apicture/57184b5d9d9df.png
- zymys####.b0.upa####.com/Apicture/57184b6636e11.png
- zymys####.b0.upa####.com/Apicture/57184b75c531c.png
- zymys####.b0.upa####.com/Apicture/5867c364c047d.png
- zymys####.b0.upa####.com/Apicture/58eb4e3e3f3d9.png
- zymys####.b0.upa####.com/Apicture/5a169e8052de8.png
- zymys####.b0.upa####.com/Apicture/5a40c37f88446.png
- zymys####.b0.upa####.com/Apicture/5a4b40ac1d228.png
- zymys####.b0.upa####.com/Apicture/5aab7a0fc6010.png
- zymys####.b0.upa####.com/Apicture/5aab7ab95745f.png
- zymys####.b0.upa####.com/Apicture/5abb0ba60bf5a.png
- zymys####.b0.upa####.com/Apicture/5ac34d83ec32c.png
- zymys####.b0.upa####.com/Apicture/5acc7ad041f3c.png
- zymys####.b0.upa####.com/Apicture/5acdb5eb62403.png
- zymys####.b0.upa####.com/Apicture/5aeab0f6a11d5.png
- zymys####.b0.upa####.com/Apicture/5aed3f45bc451.png
- zymys####.b0.upa####.com/Apicture/5aed55fc5cb8c.png
- zymys####.b0.upa####.com/Apicture/5aeffa56d8f3d.png
- zymys####.b0.upa####.com/icon/hulu/lottery_buttom_bg.png
- zymys####.b0.upa####.com/icon/hulu/lottery_buttom_normal.png
- zymys####.b0.upa####.com/icon/hulu/lottery_top_bg.png
- zymys####.b0.upa####.com/icon/hulu/lottery_up_normal.png
- zymys####.b0.upa####.com/icon/moren/lottery_back_up.png
- zymys####.b0.upa####.com/icon/moren/lottery_bg.png
- zymys####.b0.upa####.com/icon/moren/lottery_button_s.png
- zymys####.b0.upa####.com/icon/moren/lottery_center_normal.png
- zymys####.b0.upa####.com/icon/moren/lottery_gz.png
- zymys####.b0.upa####.com/icon/moren/lottery_select.png
Запросы HTTP POST:
- 1####.23.159.36//upgrade.php
- adse####.min####.cn/collectInfo/userList
- and####.b####.qq.com/rqd/async
- lewu####.com/V1/ApkManager/getApkJson
- lewu####.com/V1/ApkManager/nowactive
- lewu####.com/V1/Banner/getBannerJson
- lewu####.com/V1/Banner/getNoticeJson
- lewu####.com/V1/Game/getGameJson
- lewu####.com/V1/Gift/getGiftJson
- lewu####.com/V1/Icon/getIconJson
- lewu####.com/V1/Member/memberGetJson
- lewu####.com/V1/Upgrade/getUpgradeJson
- p.hfm####.com:6088/p/1525846269442
- p.hfm####.com:6088/s/
- sdk.and####.com/dow.php
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/0147986487077883dd6ff0884e399d23b8ebeec2b4856e7....0.tmp
- /data/data/####/01fd1018cae4ccf31d6980dbec345fb7d857e93c147516a....0.tmp
- /data/data/####/06f3369f945e16cb8f1cb82629de617d158ee2893643b73....0.tmp
- /data/data/####/08dc87cecacb7d1a5b4a294bf96d8c0eeb04c0ed92dcee1....0.tmp
- /data/data/####/13f634dbdcab1bca5e93025e64256c4f70cb896b5d6d5be....0.tmp
- /data/data/####/196E39F505E7C17558AA9AD3925E9E7C.jar
- /data/data/####/196E39F505E7C17558AA9AD3925E9E7C.tmp
- /data/data/####/2c2095082c60c148ce70ac60ab005ee01d32073dd7cdca2....0.tmp
- /data/data/####/4d2538f5bb8e576fd24235f4ca1b651bee42c9a885bdc99....0.tmp
- /data/data/####/53579b7f0179d9aa8e6586036e87871967dec1e3e476fd8....0.tmp
- /data/data/####/56e6a410ae88c253c8952ed782317c6b09e222c63c69623....0.tmp
- /data/data/####/598ab74e6dda6a03e1066312d266b6f2064e7737c34a5a9....0.tmp
- /data/data/####/6347aeb2d06333207d3f0035f2157af3c79f1609af43953....0.tmp
- /data/data/####/64b00b23c88009078d74c6032c9ff5e9925bd4a9c9903f1....0.tmp
- /data/data/####/67a3d2a5c9c4d4a6f49dc69b00b3953798d87979a67fbac....0.tmp
- /data/data/####/6d7ebc98a349ef6f7123b4345493d223833c0c6d8bb85f0....0.tmp
- /data/data/####/76951468e46d36dd15820935af837d4fca1b88126e5dee4....0.tmp
- /data/data/####/76b0ddc1769d7e85a790348a1170da71c96793e5667b613....0.tmp
- /data/data/####/77486b29cd5bebcb91af5fce4757aeb91294994749de719....0.tmp
- /data/data/####/7fbca7b29fa6ae4d633c2f5397e45807bd4c29211129672....0.tmp
- /data/data/####/96351cd4b41d2d1e9c3a20d92934ce73678eb934e046e76....0.tmp
- /data/data/####/ReService.xml
- /data/data/####/a1afd81c7f825e479679cfedb03c88d1c8daa1f6d86dc32....0.tmp
- /data/data/####/a76cfc10a40d93dd6e687d151a5ef27c8f52dff4c5047b5....0.tmp
- /data/data/####/adccbd829ad7fdac8b3bf97f6304f6ed5749f6f9dbca45d....0.tmp
- /data/data/####/b.gif
- /data/data/####/bbb5abe51886521c7ac3829b6c151bde8de661a37982a23....0.tmp
- /data/data/####/bh.apk
- /data/data/####/bt.apk
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c071630212a7f957aefc0109833172931d9bfa3024551c1....0.tmp
- /data/data/####/c1bc2ae391aa3afc0d143ab896cb5efa9ea90c00cce5d87....0.tmp
- /data/data/####/c39176a9264530ccafde124908ceb0e5c5f56ef3cba06b9....0.tmp
- /data/data/####/c4edacc168360636cbd6a615a3969355b0213fd06365843....0.tmp
- /data/data/####/ca9cb17299dcbdc4821a94563e55be64f5bbfbcda105eb2....0.tmp
- /data/data/####/cfe066eaf27dab630c7417d74f62d869c8a3d3cb99042cf....0.tmp
- /data/data/####/cnzz.xml
- /data/data/####/counts.xml
- /data/data/####/d110ca40abc008e7ee6b78f06df6c78910dfecd188dcfad....0.tmp
- /data/data/####/d637e52d879e0ed8bfba29078bf30032208de165f76f606....0.tmp
- /data/data/####/d64b1d0de3c90909397ec3186550f2b0befaa3561c4c9a7....0.tmp
- /data/data/####/db8ed2b5c00145dcfd6e87a50fedfe9c01cb83881c33ce9....0.tmp
- /data/data/####/e0f0249677387cd7ee076d926a4fe386615ccca2200551e....0.tmp
- /data/data/####/e888717ff11a56ec24c65542e85bb49151b051631d2fa72....0.tmp
- /data/data/####/ef03ebbe19363e429b5440a0ac68bb3297a5e8a3fb3745c....0.tmp
- /data/data/####/f679f41a1ffc4ce4b67373bbd9b83aefec26e6a2f0676fb....0.tmp
- /data/data/####/f770d1849f0b1805ed5ea841028c91711a3dda7efc86ca1....0.tmp
- /data/data/####/fcb2a16a6c54d057df37eaa50079590c3e768123c5e564d....0.tmp
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/lotuseed_android_a9001cfg_qq_stat.xml
- /data/data/####/lotuseed_android_a9001mta_cfg_db-journal
- /data/data/####/lotuseed_android_a9001mta_qq_a.jar
- /data/data/####/lotuseed_android_a9001mta_qq_u_world.dat
- /data/data/####/mix.dex
- /data/data/####/native_record_lock
- /data/data/####/nextTime.xml
- /data/data/####/rfmoxb
- /data/data/####/rp.apk
- /data/data/####/s_class.txt
- /data/data/####/s_finger.txt
- /data/data/####/sdkconfig.xml
- /data/data/####/security_info
- /data/data/####/webview.db-journal
- /data/media/####/adv
- /data/media/####/config
- /data/media/####/deviceId
- /data/media/####/master
- /data/media/####/master.lock
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
Загружает динамические библиотеки:
- Bugly
- libnfix
- libshella-2.8
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-GCM-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
