Android.DownLoader.3588

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.728.origin
Android.RemoteCode.153.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.RemoteCode.153.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) y####.s####.com:80
TCP(HTTP/1.1) p####.cy####.cn:80
TCP(HTTP/1.1) tm.as####.cn:6088
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) cdn.bpa####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) cdn-sta####.020####.com:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) reso####.msg.xi####.net:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) p####.s####.com:80
TCP(HTTP/1.1) i####.sogo####.com.####.com:80
TCP(TLS/1.0) p####.s####.com:443
TCP(TLS/1.0) regi####.xm####.xi####.com:443
TCP 4####.62.94.2:443
TCP 1####.205.203.75:80
TCP 47.74.1####.156:5222

Запросы DNS:

a####.m.ta####.com
a####.u####.com
ag####.m.ta####.com
api.apt.k.####.com
api.m.ta####.com
cdn-sta####.020####.com
cdn.bpa####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
imgc####.qq.com
k.s####.com
mi.g####.qq.com
msg.umengc####.com
o####.ad####.cn
p####.cy####.cn
p####.s####.com
p####.ugd####.com
pb.s####.com
pv.s####.com
regi####.xm####.xi####.com
reso####.msg.xi####.net
s####.e.qq.com
tm.as####.cn
y####.s####.com

Запросы HTTP GET:

api.m.ta####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&a...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=#...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
cdn-sta####.020####.com/group1/M00/25/9D/rBI6SVr9IROAdqseAAAsX_y6YqM522....
cdn.bpa####.com/sc_151
gdv.a.s####.com/cityjson?ie=####
i####.sogo####.com.####.com/app/a/10070003/560D2932C682A3E250E5ECB98D280...
i####.sogo####.com.####.com/app/a/10070003/96E741298F1B13EA2039BAD674FD4...
i####.sogo####.com.####.com/app/a/10070003/ADDAFCBA9285A6408CF474BB9A43C...
i####.sogo####.com.####.com/app/a/10190001/031479973320043
i####.sogo####.com.####.com/app/a/10190001/1F1486536867096
i####.sogo####.com.####.com/app/a/10190001/2A1487140358938
i####.sogo####.com.####.com/app/a/10190001/2B1478759222497
i####.sogo####.com.####.com/app/a/10190001/301478759250685
i####.sogo####.com.####.com/app/a/10190001/391478759271875
i####.sogo####.com.####.com/app/a/10190001/3C1478759266766
i####.sogo####.com.####.com/app/a/10190001/491486539527875
i####.sogo####.com.####.com/app/a/10190001/521478759215830
i####.sogo####.com.####.com/app/a/10190001/5E1487140358954
i####.sogo####.com.####.com/app/a/10190001/641527060112811
i####.sogo####.com.####.com/app/a/10190001/651478508093951
i####.sogo####.com.####.com/app/a/10190001/661487140358953
i####.sogo####.com.####.com/app/a/10190001/681518324348799
i####.sogo####.com.####.com/app/a/10190001/6D1486536297941
i####.sogo####.com.####.com/app/a/10190001/721486536847340
i####.sogo####.com.####.com/app/a/10190001/981486536881467
i####.sogo####.com.####.com/app/a/10190001/991478508069963
i####.sogo####.com.####.com/app/a/10190001/A61478759260709
i####.sogo####.com.####.com/app/a/10190001/AD1489577087010
i####.sogo####.com.####.com/app/a/10190001/CE1486537621317
i####.sogo####.com.####.com/app/a/10190001/D31527060320296
i####.sogo####.com.####.com/app/a/10190001/D41487140358950
i####.sogo####.com.####.com/app/a/10190001/DA1478759238720
i####.sogo####.com.####.com/app/a/10190001/EC1487140358951
i####.sogo####.com.####.com/v2/thumb/resize/w/120/h/160?appid=####&name=...
i####.sogo####.com.####.com/v2/thumb/resize/w/160/h/216?appid=####&name=...
i####.sogo####.com.####.com/v2/thumb/resize/w/190/h/258?appid=####&name=...
i####.sogo####.com.####.com/v2/thumb/resize/w/210/h/286?appid=####&name=...
mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
p####.s####.com/abs/ad/android?bkey=####&location=####&network=####&fake...
p####.s####.com/abs/ad/android?orientation=####&model=####&dvh=####&cuui...
p####.s####.com/abs/android/config?uid=####&sdkandroid=####&cuuid=####&p...
p####.s####.com/abs/android/v3/activity/sharebook/ajax/activate?uid=####...
p####.s####.com/abs/android/v3/activity/sharebook/ajax/reward?uid=####&s...
p####.s####.com/abs/android/v3/activity/sharebook/ajax/status?uid=####&s...
p####.s####.com/abs/android/v3/ajax/ranking?rank=####&currentGender=####...
p####.s####.com/abs/android/v3/css/app/publication.css?v=####
p####.s####.com/abs/android/v3/css/app/style.css?v=####
p####.s####.com/abs/android/v3/css/swiper.css?v=####
p####.s####.com/abs/android/v3/detail?cuuid=####&ppid=####&imei=####&cpu...
p####.s####.com/abs/android/v3/font/FZNewShuSong.ttf?v=####
p####.s####.com/abs/android/v3/girl?cuuid=####&ppid=####&token=####&eid=...
p####.s####.com/abs/android/v3/images/app/bg-detail.png?v=####
p####.s####.com/abs/android/v3/images/app/bg-night.png?v=####
p####.s####.com/abs/android/v3/images/app/bg-noon.png?v=####
p####.s####.com/abs/android/v3/images/app/competitive.png?v=####
p####.s####.com/abs/android/v3/images/common/sogou_read.png?v=####
p####.s####.com/abs/android/v3/images/sprite/sprite_app.png?v=####
p####.s####.com/abs/android/v3/images/sprite/sprite_common.png?v=####
p####.s####.com/abs/android/v3/ranking?cuuid=####&ppid=####&imei=####&cu...
p####.s####.com/abs/checkupdate?uid=####&sdkandroid=####&cuuid=####&ppid...
p####.s####.com/abs/images/bg190x258.png
p####.s####.com/abs/images/bg210x286.png
p####.s####.com/abs/images/tj.gif?t=####&type=####&page=####&cuuid=####&...
p####.s####.com/abs/images/tj.gif?t=####&type=####&page=####&id=####&cuu...
p####.s####.com/abs/images/tj.gif?t=####&type=####&page=####&id=####&key...
p####.s####.com/abs/js/echo.js?v=####
p####.s####.com/abs/js/index_animation.js?v=####
p####.s####.com/abs/js/pb.js?v=####
p####.s####.com/abs/js/swipe.min.js?v=####
p####.s####.com/abs/js/swiper.min.js?v=####
p####.s####.com/abs/js/zepto.min.v1.0rc1.js?v=####
p####.s####.com/apt/app/readingTime/get?uid=####&sdkandroid=####&cuuid=#...
p####.s####.com/pv.gif?t=1526453985307&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453987639&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453988773&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453989164&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453994783&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453994789&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526453995202&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454000143&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454000144&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454000756&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454000768&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454001649&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454002407&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454006084&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1526454010646&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/s/api/android/bb/recharged?uid=####&sdkandroid=####&cuui...
p####.s####.com/s/api/android/refactor/b?uid=####&sdkandroid=####&cuuid=...
p####.s####.com/s/api/android/refactor/identify/userid2sgid?uid=####&sdk...
p####.s####.com/s/api/android/refactor/u/buy/bcs?uid=####&sdkandroid=###...
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
reso####.msg.xi####.net/gslb/?ver=####&type=####&conpt=####&uuid=####&li...
s####.tc.qq.com/gdt/0/DAAeX5tAKAAPAAArBbDrdDCsPzweY2.jpg/0?ck=####
tm.as####.cn:6088/c/1526453980168
y####.s####.com/app/identify/register/visitor?uuid=####&sign=####

Запросы HTTP POST:

a####.u####.com/app_logs
msg.umengc####.com/v2/register
msg.umengc####.com/v2/tag/add
p####.cy####.cn/athene/do
p####.cy####.cn/hello/where
p####.s####.com/pv.gif?uigs_productid=####&send=####&filename=####
p####.s####.com/pv.gif?uigs_productid=####&send=####&filename=####&conte...
p####.s####.com/pv.gif?uigs_productid=####&send=####&log=####
p####.s####.com/s/api/android/refactor/b/m?uid=####&sdkandroid=####&cuui...
s####.e.qq.com/activate
s####.e.qq.com/msg
tm.as####.cn:6088/p/1526453980403
tm.as####.cn:6088/s/

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/356507059351895
/data/data/####/3E11B3001FEC13B19B92C61F781AF6DD.jar
/data/data/####/3E11B3001FEC13B19B92C61F781AF6DD.tmp
/data/data/####/4.7.20.xml
/data/data/####/441323c2-46de-48c6-9e00-afb114fbfb89_1
/data/data/####/446d6c426c74786e634f4f5079705a674a636c6d52773d3d.xml
/data/data/####/918021dd0e1729d9242cad6f6d849ccb.temp
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PhoneUtil.xml
/data/data/####/PhoneUtil.xml.bak
/data/data/####/SOGOUPLUS_CONFIG.xml
/data/data/####/SOGOUPLUS_CONFIG.xml.bak
/data/data/####/SOGOUPLUS_CONFIG.xml.bak (deleted)
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/XMPushServiceConfig.xml
/data/data/####/activate_356507059351895
/data/data/####/agoo.pid
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn_feng_skin_pref.xml
/data/data/####/com.sogou.novel-1.apk.classes1457259345.zip
/data/data/####/com.sogou.novel.push_service_setting.xml
/data/data/####/com.sogou.novel;pushservice
/data/data/####/d92483e86308758f188f2bc4ce268703.0
/data/data/####/d92483e86308758f188f2bc4ce268703.apk
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/file_log.txt
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/geofencing.db
/data/data/####/geofencing.db-journal
/data/data/####/immediate_active
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/mipush.xml
/data/data/####/mipush_account.xml
/data/data/####/mipush_extra.xml
/data/data/####/mkoyhl
/data/data/####/multidex.version.xml
/data/data/####/push_state_356507059351895
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/share_storage_name.xml
/data/data/####/sn_ad_sp.xml
/data/data/####/sogou.xml
/data/data/####/sogou.xml.bak
/data/data/####/sogou.xml.bak (deleted)
/data/data/####/sogounovel.db-journal
/data/data/####/sp_app_config.xml
/data/data/####/sp_app_config.xml.bak
/data/data/####/sp_app_config_reddot.xml
/data/data/####/sp_app_content.xml
/data/data/####/sp_app_content.xml.bak
/data/data/####/sp_app_font_settings.xml
/data/data/####/sp_push_status.xml
/data/data/####/sp_sogou_novel.xml
/data/data/####/sp_sogou_novel.xml.bak
/data/data/####/sp_sogou_novel.xml.bak (deleted)
/data/data/####/sp_sogou_push.xml
/data/data/####/sp_sogou_time.xml
/data/data/####/sp_user.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/media/####/.nomedia
/data/media/####/.vistor.sgnt
/data/media/####/00208034754585040d0612fbe9a3badf.sgni.tmp
/data/media/####/059f1d2f901facb35fc9282c70353426.sgni.tmp
/data/media/####/1ade2f52222bf639eb488a82f8498088.sgni.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/adv
/data/media/####/config
/data/media/####/deviceId
/data/media/####/master
/data/media/####/master.lock

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_android_daemon_1.1.0 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5704d46567e58ef95e0020d2","utdid":"WvvWzKsfuvADAGdzx1Hfb2Vb","sdkVersion":"20160215"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
sh

Загружает динамические библиотеки:

sogouupdcore
tnet-2.1.20

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней