Android.DownLoader.3592

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.SmsSpy.677.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.SmsSpy.677.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) wd5.mil####.com:8006
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) preload####.hishen####.com:5500
TCP(HTTP/1.1) www.hr####.com:80
TCP(HTTP/1.1) prelo####.hishen####.com:80
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) m.hr####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600

Запросы DNS:

a####.u####.com
hangzho####.oss-cn-####.aliy####.com
m.hr####.com
p####.nj####.com
prelo####.hishen####.com
preload####.hishen####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
vb####.wann####.com
wd5.mil####.com
www.hr####.com
x####.jnlia####.cn
z####.wann####.com
zxc####.wann####.com

Запросы HTTP GET:

hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
m.hr####.com/app/pkgs/2.4/wbq_18
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/png/ic_qqyywrwoy.png
p####.nj####.com.####.com:8080/res/novel/app3/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app3/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app3/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/10.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/11.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/12.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/13.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/14.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/15.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/16.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/7.jpg
p####.nj####.com.####.com:8080/res/novel/app3/icon/9.jpg
p####.nj####.com.####.com:8080/res/novel/app3/tp/1.jpg
p####.nj####.com.####.com:8080/res/novel/app3/tp/2.jpg
p####.nj####.com.####.com:8080/res/novel/app3/tp/3.jpg
p####.nj####.com.####.com:8080/res/novel/app3/tp/4.jpg
p####.nj####.com.####.com:8080/res/novel/sc/tp/jc.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2100.jar
prelo####.hishen####.com/project_preloaded/36dd4e9586a7461ab707925c0ac78...
prelo####.hishen####.com/project_preloaded/4523216e517e493ea5e9f16274fe9...
prelo####.hishen####.com/project_preloaded/4cb6e199a3c546b29bd508100c87e...
prelo####.hishen####.com/project_preloaded/960deb337af7403bb79d86fa96bdc...
prelo####.hishen####.com/project_preloaded/b0a7a2a12f4f49168816270ec4419...
prelo####.hishen####.com/project_preloaded/d02a03d1db954f63905c59d3dc1af...
qyc####.qi1####.com:8200/sdk/file?u58h54J####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
sdk.qi1####.com/vpssdk/andrcool_1.0.1.jar
www.hr####.com/2017/wbq18/tongche/

Запросы HTTP POST:

a####.u####.com/app_logs
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveDevice
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveFile
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
qyc####.qi1####.com:8200/sdk/log
wd5.mil####.com:8006/bservice/getdata.do
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/1122137938981.77
/data/data/####/1122137938981.77 (deleted)
/data/data/####/1122137939107.89
/data/data/####/1122137939107.89 (deleted)
/data/data/####/1122137939155.41
/data/data/####/1122137939155.41 (deleted)
/data/data/####/1122137939168.56
/data/data/####/1122137939168.56 (deleted)
/data/data/####/1122137939174.61
/data/data/####/1122137939174.61 (deleted)
/data/data/####/1122137939274.86
/data/data/####/1122137939274.86 (deleted)
/data/data/####/1122137939316.43
/data/data/####/1122137939316.43 (deleted)
/data/data/####/1122137939379.93
/data/data/####/1122137939379.93 (deleted)
/data/data/####/1122137939382.46
/data/data/####/1122137939382.46 (deleted)
/data/data/####/1122137939384.06
/data/data/####/1122137939384.06 (deleted)
/data/data/####/1122137939511.92
/data/data/####/1122137939511.92 (deleted)
/data/data/####/1122137939566.83
/data/data/####/1122137939566.83 (deleted)
/data/data/####/1122137939580.43
/data/data/####/1122137939580.43 (deleted)
/data/data/####/1122137939594.21
/data/data/####/1122137939594.21 (deleted)
/data/data/####/1122137939667.17
/data/data/####/1122137939667.17 (deleted)
/data/data/####/1122137939675.95
/data/data/####/1122137939675.95 (deleted)
/data/data/####/1122137939676.24
/data/data/####/1122137939676.24 (deleted)
/data/data/####/1122137939914.57
/data/data/####/1122137939914.57 (deleted)
/data/data/####/1122137939962.35
/data/data/####/1122137939962.35 (deleted)
/data/data/####/1122137940002.9
/data/data/####/1122137940002.9 (deleted)
/data/data/####/1122137940150.56
/data/data/####/1122137940150.56 (deleted)
/data/data/####/1122137940201.37
/data/data/####/1122137940201.37 (deleted)
/data/data/####/1122137940253.1
/data/data/####/1122137940253.1 (deleted)
/data/data/####/161.918512514603
/data/data/####/161.918512514603 (deleted)
/data/data/####/1766004.33430693
/data/data/####/1766004.6347615
/data/data/####/1766004.6347615 (deleted)
/data/data/####/2325823728279.41
/data/data/####/2325823728279.41 (deleted)
/data/data/####/2325823729129.82
/data/data/####/2325823729129.82 (deleted)
/data/data/####/2325823729339.21
/data/data/####/2325823729339.21 (deleted)
/data/data/####/2325823729363.85
/data/data/####/2325823729363.85 (deleted)
/data/data/####/2325823729645.02
/data/data/####/2325823729645.02 (deleted)
/data/data/####/2325823729855.84
/data/data/####/2325823729855.84 (deleted)
/data/data/####/2325823729955.32
/data/data/####/2325823729955.32 (deleted)
/data/data/####/2325823730005.67
/data/data/####/2325823730005.67 (deleted)
/data/data/####/2325823730117.33
/data/data/####/2325823730117.33 (deleted)
/data/data/####/2325823730610.26
/data/data/####/2325823730610.26 (deleted)
/data/data/####/2325823730880.41
/data/data/####/2325823730880.41 (deleted)
/data/data/####/2325823730957.8
/data/data/####/2325823730957.8 (deleted)
/data/data/####/2325823731529.35
/data/data/####/2325823731529.35 (deleted)
/data/data/####/2325823731926.8
/data/data/####/2325823731926.8 (deleted)
/data/data/####/2325823732241.24
/data/data/####/2325823732241.24 (deleted)
/data/data/####/2325823732349.97
/data/data/####/2325823732349.97 (deleted)
/data/data/####/2325823734313.74
/data/data/####/2325823734313.74 (deleted)
/data/data/####/2325823734822.82
/data/data/####/2325823734822.82 (deleted)
/data/data/####/2325823735870.58
/data/data/####/2325823735870.58 (deleted)
/data/data/####/2325823736233.21
/data/data/####/2325823736233.21 (deleted)
/data/data/####/261207194097.281
/data/data/####/261207194097.281 (deleted)
/data/data/####/261207194192.789
/data/data/####/261207194192.789 (deleted)
/data/data/####/261207194216.304
/data/data/####/261207194216.304 (deleted)
/data/data/####/261207194219.071
/data/data/####/261207194219.071 (deleted)
/data/data/####/261207194250.649
/data/data/####/261207194250.649 (deleted)
/data/data/####/261207194274.325
/data/data/####/261207194274.325 (deleted)
/data/data/####/261207194285.498
/data/data/####/261207194285.498 (deleted)
/data/data/####/261207194291.152
/data/data/####/261207194291.152 (deleted)
/data/data/####/261207194303.693
/data/data/####/261207194303.693 (deleted)
/data/data/####/261207194359.052
/data/data/####/261207194359.052 (deleted)
/data/data/####/261207194389.392
/data/data/####/261207194389.392 (deleted)
/data/data/####/261207194398.084
/data/data/####/261207194398.084 (deleted)
/data/data/####/261207194462.273
/data/data/####/261207194462.273 (deleted)
/data/data/####/261207194506.91
/data/data/####/261207194506.91 (deleted)
/data/data/####/261207194542.224
/data/data/####/261207194542.224 (deleted)
/data/data/####/261207194554.435
/data/data/####/261207194554.435 (deleted)
/data/data/####/261207194774.981
/data/data/####/261207194774.981 (deleted)
/data/data/####/261207194832.155
/data/data/####/261207194832.155 (deleted)
/data/data/####/261207194949.826
/data/data/####/261207194949.826 (deleted)
/data/data/####/261207194990.552
/data/data/####/261207194990.552 (deleted)
/data/data/####/2965425276150.11
/data/data/####/2965425276150.11 (deleted)
/data/data/####/2965425276483.4
/data/data/####/2965425276483.4 (deleted)
/data/data/####/2965425276608.98
/data/data/####/2965425276608.98 (deleted)
/data/data/####/2965425276643.73
/data/data/####/2965425276643.73 (deleted)
/data/data/####/2965425276659.71
/data/data/####/2965425276659.71 (deleted)
/data/data/####/2965425276924.63
/data/data/####/2965425276924.63 (deleted)
/data/data/####/2965425277034.5
/data/data/####/2965425277034.5 (deleted)
/data/data/####/2965425277202.3
/data/data/####/2965425277202.3 (deleted)
/data/data/####/2965425277208.99
/data/data/####/2965425277208.99 (deleted)
/data/data/####/2965425277213.23
/data/data/####/2965425277213.23 (deleted)
/data/data/####/2965425277551.1
/data/data/####/2965425277551.1 (deleted)
/data/data/####/2965425277696.2
/data/data/####/2965425277696.2 (deleted)
/data/data/####/2965425277732.16
/data/data/####/2965425277732.16 (deleted)
/data/data/####/2965425277768.57
/data/data/####/2965425277768.57 (deleted)
/data/data/####/2965425277961.38
/data/data/####/2965425277961.38 (deleted)
/data/data/####/2965425277984.59
/data/data/####/2965425277984.59 (deleted)
/data/data/####/2965425277985.35
/data/data/####/2965425277985.35 (deleted)
/data/data/####/2965425278615.17
/data/data/####/2965425278615.17 (deleted)
/data/data/####/2965425278741.43
/data/data/####/2965425278741.43 (deleted)
/data/data/####/2965425278848.6
/data/data/####/2965425278848.6 (deleted)
/data/data/####/2965425279238.8
/data/data/####/2965425279238.8 (deleted)
/data/data/####/2965425279373.07
/data/data/####/2965425279373.07 (deleted)
/data/data/####/2965425279509.78
/data/data/####/2965425279509.78 (deleted)
/data/data/####/3660380.04099951
/data/data/####/3660380.04099951 (deleted)
/data/data/####/3660380.34145408
/data/data/####/3660380.34145408 (deleted)
/data/data/####/471759138.713849
/data/data/####/471759138.713849 (deleted)
/data/data/####/471759138.80289
/data/data/####/471759138.80289 (deleted)
/data/data/####/690280926062.877
/data/data/####/690280926062.877 (deleted)
/data/data/####/690280926315.271
/data/data/####/690280926315.271 (deleted)
/data/data/####/690280926377.414
/data/data/####/690280926377.414 (deleted)
/data/data/####/690280926384.727
/data/data/####/690280926384.727 (deleted)
/data/data/####/690280926468.178
/data/data/####/690280926468.178 (deleted)
/data/data/####/690280926530.744
/data/data/####/690280926530.744 (deleted)
/data/data/####/690280926560.271
/data/data/####/690280926560.271 (deleted)
/data/data/####/690280926575.212
/data/data/####/690280926575.212 (deleted)
/data/data/####/690280926608.354
/data/data/####/690280926608.354 (deleted)
/data/data/####/690280926754.649
/data/data/####/690280926754.649 (deleted)
/data/data/####/690280926834.828
/data/data/####/690280926834.828 (deleted)
/data/data/####/690280926857.797
/data/data/####/690280926857.797 (deleted)
/data/data/####/690280927027.426
/data/data/####/690280927027.426 (deleted)
/data/data/####/690280927145.385
/data/data/####/690280927145.385 (deleted)
/data/data/####/690280927238.709
/data/data/####/690280927238.709 (deleted)
/data/data/####/690280927270.978
/data/data/####/690280927270.978 (deleted)
/data/data/####/690280927853.805
/data/data/####/690280927853.805 (deleted)
/data/data/####/690280928004.896
/data/data/####/690280928004.896 (deleted)
/data/data/####/690280928315.861
/data/data/####/690280928315.861 (deleted)
/data/data/####/690280928423.485
/data/data/####/690280928423.485 (deleted)
/data/data/####/__gather_impl.jar
/data/data/####/__gather_impl92544329442118621994.jar
/data/data/####/a.db
/data/data/####/a.db-journal
/data/data/####/andrcool.jar
/data/data/####/bdotm.qnjhy.wzuln.yodgd.jar
/data/data/####/bdotm.qnjhy.wzuln.yodgd_preference.xml
/data/data/####/cache-125730533242112626421
/data/data/####/cache139993175942112327791
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/device_info.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/getprop
/data/data/####/hreader_more_wonderful.png
/data/data/####/hreader_vip_top.png
/data/data/####/hreaer_pic_vip_book.png
/data/data/####/libgather.xml
/data/data/####/libzxsessionsafe.so
/data/data/####/maan.so
/data/data/####/pid
/data/data/####/qy_db_pay-journal
/data/data/####/qy_device_info_sdk_update.jar
/data/data/####/report.jar
/data/data/####/report_control.xml
/data/data/####/splash.jpg
/data/data/####/tmp_jar
/data/data/####/tmp_so
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/unknown.xml
/data/data/####/video_ad_sdk_update.jar
/data/data/####/video_brush_test_update.jar
/data/data/####/web_page_sdk_update.jar
/data/data/####/webview.db-journal
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/media/####/.cfg
/data/media/####/036a3c044245b33f5d3240312a36894d
/data/media/####/0c2586c0652e167cb313de5b3cd6f336
/data/media/####/0cce1514212f1a3e50516e7369da6dd2
/data/media/####/11bdf86edda902a411b3fef4de5d4de1
/data/media/####/12a5f4c5efa8731b1d7d538b82a943f1
/data/media/####/14.txt.tmp
/data/media/####/16.txt.tmp
/data/media/####/1e881ec9dc0896d9100af0236b9fdf89
/data/media/####/20f0d30b7932ed66de0b7dd38c4552b1
/data/media/####/2811e12822d424975ee387eaa02e542e
/data/media/####/28ff91a26620982f8602186208ea193d
/data/media/####/29b517950f8f2706563791b11e77726a
/data/media/####/2f84302f743f33c27fa5d88b609915bd
/data/media/####/36a04f54bb34bafe100f0f31d59876fa
/data/media/####/38b6cd60f3aad3cca1e8a75a76cd86ed
/data/media/####/3f52678818f7fa2ff93c7c765e2f7f92
/data/media/####/45cc94e3c9bc3c0b8caff7b89e18e9ec
/data/media/####/530c6635dbe192b1cf407f50a9748852
/data/media/####/54133fe0c5ca88691a04babef38096a2
/data/media/####/599c5e6b10dd7793e258d62047fa42fc
/data/media/####/5d2007cf0b7c700f5009f051c6d1d94e
/data/media/####/5d9a36de35f7b3aeda0b9575b9fee6c0
/data/media/####/658b3f402a34ef5e57b6155eda7b007d
/data/media/####/66e205ba015ac3371daf04e5b9bf4776
/data/media/####/6ad8fdc04d45449f29148cd92c377cd7
/data/media/####/6bc608740b0c757a2a825b99a28254eb
/data/media/####/71f58a199d4ae537adf22e0fe2400280
/data/media/####/7d8e027112a377fc6f039302e98aa9ab
/data/media/####/83c6f6cf81d9ca67ff65d557682281df
/data/media/####/8570a270d9cdc6a1e4a74c3c0fb49f8e
/data/media/####/8f8bfc521ab11ab3b747857b01f6584c
/data/media/####/91b3e55d11292fbdf9970a83ead8d75c
/data/media/####/9b63791f6a77c8a08bc539d7999a7b2c
/data/media/####/FrameCore.jar
/data/media/####/aacb33626ec85ec44c9e3ee6fe4def91
/data/media/####/ad537dc160ecd2c243aacc661613f676
/data/media/####/ad7fe41a9e9fa3fdfc2793f6e0d0e817
/data/media/####/b1577d82cbfbcc358bc3163592fbaed1
/data/media/####/b1a7b6bdbed01efdd65903613cb0a08a
/data/media/####/b2f7753e92d552f4ce8e64eb1b12f4ce
/data/media/####/b819879890259bbb64d350257ade6561
/data/media/####/ce2b555c4aa23fd9a1fa66bd6d87ee28
/data/media/####/com.molove.mobile.sjwwx.apk.tmp
/data/media/####/com.molove.mobile.sjwwx.png.tmp
/data/media/####/com.xajhhj.hdpheqabx.png.tmp
/data/media/####/d88f61a053611857715ef4a7b8815676
/data/media/####/db0b87e47cbde0b80f5f3ea89f0b80e4
/data/media/####/device
/data/media/####/dp.jar.tmp
/data/media/####/eb8b688327edf66baf10d9ed73b5ca18
/data/media/####/fd8acdf2548465854dd6b0975ed4ad37

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
cat /sys/class/android_usb/android0/iManufacturer
cat /sys/class/android_usb/android0/iProduct
cat /sys/class/android_usb/android0/iSerial
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Загружает динамические библиотеки:

libhelper
libsmsmanager
libzxsessionsafe
libzxvps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding

Осуществляет доступ к интерфейсу камеры.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Парсит информацию из смс сообщений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней