Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.RemoteCode.32
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) a####.wagbr####.t####.####.com:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) g.al####.com:80
- TCP(HTTP/1.1) www.ta####.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) wild####.al####.com.####.net:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) a####.al####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) log.mm####.com:80
- TCP(HTTP/1.1) h5####.p####.cn:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) a.c####.com:80
- TCP(HTTP/1.1) gxb.mm####.com:80
- TCP(HTTP/1.1) at.al####.com:80
- TCP(HTTP/1.1) m.ta####.com:80
- TCP(TLS/1.0) huhu-12####.f####.myqc####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) re####.al####.com:443
- TCP(TLS/1.0) hm2.c####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) sh.wagbr####.ali####.com:443
- TCP(TLS/1.0) like####.cc:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) sh.wagbr####.ta####.com:443
- TCP(TLS/1.0) m.ta####.com:443
- TCP(TLS/1.0) a.c####.com:443
- TCP(TLS/1.0) www.ta####.com:443
- TCP(TLS/1.0) log.mm####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
Запросы DNS:
- a####.al####.com
- a.c####.com
- af####.ali####.com
- af####.ali####.com
- afp.al####.com
- afpt####.ali####.com
- app.jjl-####.com
- at.al####.com
- c####.mm####.com
- c.c####.com
- fee.feiyunh####.com
- fou####.ali####.com
- g.al####.com
- gm.mm####.com
- gxb.mm####.com
- h5####.p####.cn
- h5.m.ta####.com
- hm2.c####.com
- huhu-12####.f####.myqc####.com
- i####.51.la
- i####.u####.com
- img.al####.com
- int.d####.s####.####.cn
- ip.ta####.com
- js.u####.51.la
- like####.cc
- log.mm####.com
- m.ta####.com
- mo####.u####.com
- new.c####.com
- pass####.u####.com
- re####.al####.com
- s.c####.com
- s.u####.com
- s22.c####.com
- s5.c####.com
- tce.ta####.com
- w.c####.com
- www.c####.com
- www.ta####.com
- www.u####.com
- z1.c####.com
- z13.c####.com
Запросы HTTP GET:
- a####.al####.com/acookie.html
- a####.al####.com/afp-creative/creative/u46686923/e7452824c6e75973bc96512...
- a####.al####.com/g/mm/afp-cdn/JS/k.js
- a####.al####.com/g/mm/afp-cdn/JS/r.js
- a####.wagbr####.t####.####.com/acookie.html
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_55850014&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56000332&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322240&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322262&sp=1&c...
- a####.wagbr####.t####.####.com/imp?bid=####&pid=####&cid=####&mid=####&o...
- a####.wagbr####.t####.####.com/opt?bid=####&pid=####&cid=####&mid=####&o...
- a.c####.com/dplusTrack/?data=ey####&img=####&ip=####&dataver=####&_=####
- at.al####.com/t/font_472294_c6ig36jyg3rw9udi.ttf
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/dplus.php?id=####
- c.c####.com/stat.php?id=####&web_id=####&show=####
- g.al####.com/??kissy/####
- g.al####.com/ali-mod/??umsite-####
- g.al####.com/alilog/??s/8.4.6/plugin/aplus_client.js,aplus_cplugin/0.4.3...
- g.al####.com/alilog/mlog/aplus_v2.js
- g.al####.com/code/npm/@ali/??straw/1####
- g.al####.com/code/npm/@ali/init-kissy-pc/0.0.11/index.js
- g.al####.com/dt/tracker/3.4.10/tracker.Tracker.js
- g.al####.com/dt/tracker/3.4.11/tracker.performanceTrackerPlugin.js
- g.al####.com/kissy/k/6.2.4/??base-mi####
- g.al####.com/kissy/k/6.2.4/??promise####
- g.al####.com/sd/sufei/0.2.4/app/common/sufei-kissy.js
- g.al####.com/secdev/entry/index.js?t=####
- g.al####.com/secdev/sufei_data/3.5.0/index.js
- g.al####.com/tbc/global/0.0.8/index-min.css
- g.al####.com/um-f2e/alicare/0.0.40/umeng_message.js
- g.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.css
- g.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.js
- g.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.css?r=####
- g.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.js
- gm.mm####.com//fsp.1.3?appcacheTime=####&connectTime=####&delay=####&dom...
- gxb.mm####.com/gxb.gif?si=####&ref=####&lang=####&bw=####&bh=####&pu=###...
- h5####.p####.cn/Play/H6Home
- h5####.p####.cn/Play/Live
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####
- ip.ta####.com/service/getIpInfo2.php?ip=####
- js.u####.51.la/19422581.js
- log.mm####.com/eg.js
- log.mm####.com/v.gif?logtype=####&title=####&pre=####&cache=####&scr=###...
- m.ta####.com/?sprefer=####
- sh.wagbr####.alibaba####.com/
- sh.wagbr####.alibaba####.com/api/user/publicHeader?callback=####
- sh.wagbr####.alibaba####.com/stat/website.php?web_id=####
- sh.wagbr####.alibaba####.com/tms/html/www/script/alicare
- sh.wagbr####.alibaba####.com/tms/jsonp/www/data/products?callback=####&r...
- sh.wagbr####.alibaba####.com/tms/jsonp/www/data/solutions?callback=####&...
- sh.wagbr####.alibaba####.com/v1/images/an_download.gif
- sh.wagbr####.alibaba####.com/v1/images/ios_download.gif
- sh.wagbr####.alibaba####.com/v1/images/login/bqline.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button01.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button02.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button03.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button04.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button05.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button06.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button07.gif
- sh.wagbr####.alibaba####.com/v1/images/login/check.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/leftback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/logo.gif
- sh.wagbr####.alibaba####.com/v1/images/login/titleback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/toolback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/topback.jpg
- sh.wagbr####.alibaba####.com/v1/images/qr/qr.php?siteid=####
- sh.wagbr####.alibaba####.com/v1/images/validate.php
- sh.wagbr####.alibaba####.com/v1/login.php?siteid=####
- wild####.al####.com.####.net/tfs/TB1HXRmXuuSBuNjy1XcXXcYjFXa-190-190.gif
- wild####.al####.com.####.net/tfs/TB1Sz5kwuuSBuNjy1XcXXcYjFXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1T4DKa4GYBuNjy0FnXXX5lpXa-176-176.png
- wild####.al####.com.####.net/tfs/TB1YroqmQyWBuNjy0FpXXassXXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1jLIdwDtYBeNjy1XdXXXXyVXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1kqLVv1uSBuNjy1XcXXcYjFXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1nl3daYGYBuNjy0FoXXciBFXa-228-80.jpg
- wild####.al####.com.####.net/tfs/TB1qVD7dXOWBuNjy0FiXXXFxVXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1tOqDq_tYBeNjy1XdXXXXyVXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1wPbsaYGYBuNjy0FoXXciBFXa-176-176.png
- wild####.al####.com.####.net/tfs/TB1zcTJv7yWBuNjy0FpXXassXXa-2880-800.jpg
- www.ta####.com/
- www.ta####.com/markets/umplus/block/assets/iconfont
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/EOZTzhVG.jar
- /data/data/####/ccidgtc.hpmfvpvx.ezt.kgp_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/device_id.xml.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/index
- /data/data/####/libus.so
- /data/data/####/libvia_pay.so
- /data/data/####/multidex.version.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/journal.tmp
Другие:
Загружает динамические библиотеки:
- suvyk
- us
- via_pay
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- RSA
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
