Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
- Android.DownLoader.675.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) i1.hun####.com:80
- TCP(HTTP/1.1) 1####.h####.i####.tv:80
- TCP(HTTP/1.1) 4####.h####.i####.tv:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) statson####.pu####.b####.com:80
- TCP(HTTP/1.1) geo.gridsum####.com:80
- TCP(HTTP/1.1) av####.h####.com:80
- TCP(HTTP/1.1) com####.hun####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) 3####.h####.i####.tv:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) api.tui####.b####.com:80
- TCP(HTTP/1.1) rc.mpp.hun####.com:80
- TCP p2.jz####.com:7803
- TCP t1.jz####.com:7103
- TCP p2.jz####.com:7802
- TCP p1.jz####.com:7801
- TCP t1.jz####.com:7101
- TCP t1.jz####.com:7102
- TCP 2####.108.23.105:5287
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- a####.tui####.b####.com
- a####.u####.com
- api####.a####.com
- api.tui####.b####.com
- au.u####.co
- au.u####.com
- av####.h####.com
- b.scoreca####.com
- com####.hun####.com
- geo.gridsum####.com
- i1.hun####.com
- i2.hun####.com
- i5.hun####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- oc.u####.com
- p1.jz####.com
- p2.jz####.com
- p3.jz####.com
- rc.mpp.hun####.com
- sa6.tui####.b####.com
- statson####.pu####.b####.com
- t1.jz####.com
- t2.jz####.com
- t3.jz####.com
- x.da.hun####.com
Запросы HTTP GET:
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180620154155942.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180622191324511.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180622203808810.jpg
- 1####.h####.i####.tv/preview/cms_icon/2018/06/20180622211826861.jpg
- 1####.h####.i####.tv/preview/sp_images/2017/dianying/316670/4220005/2017...
- 1####.h####.i####.tv/preview/sp_images/2018/dianying/323411/4437148/2018...
- 1####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440122/201806...
- 3####.h####.i####.tv/preview/cms_icon/2018/06/20180613092056924.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/06/20180621234226606.gif
- 3####.h####.i####.tv/preview/cms_icon/2018/06/20180622121712534.jpg
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440120/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440129/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440151/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440197/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/322865/4440201/201806...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/323564/4439865/201806...
- 3####.h####.i####.tv/s1/2016/yuanxiao/icon/dubo.png
- 3####.h####.i####.tv/s1/2016/yuanxiao/icon/mianfeibo.png
- 3####.h####.i####.tv/s1/2016/yuanxiao/icon/vipmian.png
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110101862.jpg
- 4####.h####.i####.tv/preview/cms_icon/2018/06/20180604110125168.jpg
- av####.h####.com/0/8c5a31e7/b6tpo1n6jlt7t174jptg?x-oss-process=####
- av####.h####.com/5/51b17cdf/WOTd3ZzZyWKek8Tw?x-oss-process=####
- av####.h####.com/5/f9b1e3fb/b625qe5mugg6td8l5mc0?x-oss-process=####
- av####.h####.com/6/2fd4c566/b4sfq75mugg8r6kq1cgg?x-oss-process=####
- av####.h####.com/6/3b2166be/b7gn0ddmugg6k8kn0hkg?x-oss-process=####
- av####.h####.com/6/a0245944/b4aqiddmugg8nvtkd8ig?x-oss-process=####
- av####.h####.com/6/daa7d65f/b41vfitmugg8pblaib5g?x-oss-process=####
- av####.h####.com/7/4304ac9d/bbk300en9l25e9mq3vm0?x-oss-process=####
- b.scoreca####.com.####.net/p2?c1=####&c2=####&ns_ap_an=####&ns_ap_pn=###...
- com####.hun####.com/mobile_comment/top?userId=####&osVersion=####&subjec...
- geo.gridsum####.com/v2/g.aspx
- i1.hun####.com/p1/20161111/161659711C.png
- i1.hun####.com/p1/20161216/1508155487C.png
- mo####.api.hun####.com/channel/getDetail?userId=####&osVersion=####&devi...
- mo####.api.hun####.com/channel/getList?userId=####&osVersion=####&device...
- mo####.api.hun####.com/comment/read?userId=####&osVersion=####&device=##...
- mo####.api.hun####.com/mobile/getCategorys?userId=####&osVersion=####&de...
- mo####.api.hun####.com/mobile/getRsaKey
- mo####.api.hun####.com/mobile/iconLink?userId=####&osVersion=####&device...
- mo####.api.hun####.com/mobile/p2pSwitch?userId=####&osVersion=####&devic...
- mo####.api.hun####.com/search/hotWords
- mo####.api.hun####.com/user/getActivity?userId=####&osVersion=####&devic...
- mo####.api.hun####.com/user/payConfig
- mo####.api.hun####.com/v2/video/getMultiplyList?userId=####&osVersion=##...
- mo####.api.hun####.com/v2/video/getShortList?userId=####&osVersion=####&...
- mo####.api.hun####.com/v2/video/getSource?userId=####&osVersion=####&dev...
- mo####.api.hun####.com/v2/video/getVideoInfo?userId=####&osVersion=####&...
- mo####.api.hun####.com/video/getSupport?userId=####&osVersion=####&devic...
- rc.mpp.hun####.com/mobile/v1/cms?userId=####&collectionid=####&osVersion...
Запросы HTTP POST:
- a####.u####.com/app_logs
- api.tui####.b####.com/rest/2.0/channel/3957223345759155026
- api.tui####.b####.com/rest/2.0/channel/channel
- apilo####.a####.com/v3/log/init
- mo####.log.hun####.com/data.cgi
- oc.u####.com/check_config_update
- statson####.pu####.b####.com/pushlog
- x.da.hun####.com/json/app/boot
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/15297256029740.jar
- /data/data/####/15297256031889.jar
- /data/data/####/E_ID356507059351895.db-journal
- /data/data/####/GridsumCommon.xml
- /data/data/####/ImgoPad-journal
- /data/data/####/MGTVCommon.xml
- /data/data/####/MV3Plugin.ini
- /data/data/####/cSPrefs.xml
- /data/data/####/coni_io_356507059351895.xml
- /data/data/####/dbVersion.xml
- /data/data/####/db_d.db-journal
- /data/data/####/i.xml
- /data/data/####/i_fionf_pre356507059351895.xml
- /data/data/####/iappInfo_io_356507059351895.xml
- /data/data/####/itrategy_io_356507059351895.xml
- /data/data/####/last_know_location.xml
- /data/data/####/mobclick_agent_online_setting_tuoshi.free.film....qh.xml
- /data/data/####/plugin-deploy.jar
- /data/data/####/plugin-deploy.key
- /data/data/####/pst.xml
- /data/data/####/tuoshi.free.film.player.qh.push_sync.xml
- /data/data/####/tuoshi.free.film.player.qh.xml
- /data/data/####/tuoshi.free.film.player.qh_preferences.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/1ezr7shk60o6pzqx9p0gt6ade.tmp
- /data/media/####/1vj5jqqucytqd43knogj8mhh1.tmp
- /data/media/####/1wug29mjtr26g1zj37mx0eg6a.tmp
- /data/media/####/21bpigidgohn4udet7ckgvmso.tmp
- /data/media/####/231aouysromcsru1qj8a1e4mp.tmp
- /data/media/####/2xoj6z2r2plmvx30ju2l98kda.tmp
- /data/media/####/39k28ac30k8qzj563qeuzeudf.tmp
- /data/media/####/3d2xmwknnxsnjvlnldo4lw8l8.tmp
- /data/media/####/3en20whhg22s8ts9vbgniaecz.tmp
- /data/media/####/3fwqwsdl20zgble6g3zcmc56t.tmp
- /data/media/####/3tv4tcffho2o5nfca143y3ykb.tmp
- /data/media/####/4dwxk9m8qvp2c2irp4jjv05m0.tmp
- /data/media/####/4fn1z8gf3v2nwyyznngvungmj.tmp
- /data/media/####/4lvyi3f0uuixmrbs1q6wi0vzg.tmp
- /data/media/####/54eye1hcb6c9ofedj5p6pfy6q.tmp
- /data/media/####/5alwpjitwk10pll5jjjkx5dot.tmp
- /data/media/####/5ct6jbcwkvf8qcv2dwyb8rrxz.tmp
- /data/media/####/5mbgj0i2ra387b9ipa836nyjo.tmp
- /data/media/####/5tttqye8j8vuxf597dbenulxp.tmp
- /data/media/####/5v9v7tr014zuiqu59q5jlwnmt.tmp
- /data/media/####/5y7hr4nihri58j6xuv0xfmg32.tmp
- /data/media/####/6215roechei49f9tyx1vdk8e8.tmp
- /data/media/####/6ef949xg5q6y5n2bmrvbez18r.tmp
- /data/media/####/6g1iqpzqwqgy9iddjvikoeex9.tmp
- /data/media/####/6qo1s42jbrh2wnyevbbzywd8r.tmp
- /data/media/####/75uhxh1lzbgmuw44ce13lt7kd.tmp
- /data/media/####/apps
- /data/media/####/journal.tmp
- /data/media/####/l7gfxt6hxxpky61nv6l7gn0u.tmp
- /data/media/####/lightapp_V4.db
- /data/media/####/lightapp_V4.db-journal
- /data/media/####/pushlappv2.db
- /data/media/####/pushlappv2.db-journal
- /data/media/####/pushstat_4.4.db
- /data/media/####/pushstat_4.4.db-journal
- /data/media/####/re6lp3k16kbcnlr76txy461u.tmp
- /data/media/####/tcbexj0akfwbr5buhtv18u96.tmp
- /data/media/####/uj0z5i7gw99xksg15arisnml.tmp
- /data/media/####/umuh4pdjv133w39rq89oz2ml.tmp
Другие:
Загружает динамические библиотеки:
- bdpush_V2_2
- bspatch
- libmv3_common
- libmv3_jni
- libmv3_jni_4.0
- libmv3_mpplat
- libmv3_platform
- libmv3_playerbase
- yfnet_mongotv
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1PADDING
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
