Android.Packed.38654

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.743.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) tinyq####.ove####.b0.####.com:80
TCP(HTTP/1.1) lib.su####.com.####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) ping####.qq.com:80
TCP(HTTP/1.1) ipswitc####.fmscach####.ou####.com:80
TCP(HTTP/1.1) sa.meme####.com:80
TCP(HTTP/1.1) api.meme####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) idu####.qini####.com:80
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(TLS/1.0) fund####.com:443
TCP(TLS/1.0) js.fund####.cn.####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) l####.4####.top:443

Запросы DNS:

a####.u####.com
and####.b####.qq.com
api.meme####.com
app.su####.com
fund####.com
hm.b####.com
img-a####.b0.upa####.com
img.su####.com
js.fund####.cn
l####.4####.top
lib.su####.com
loc.map.b####.com
m.2####.com
p####.ws.su####.com
pi####.qq.com
ping####.qq.com
pns.al####.com
pss.al####.com
sa.meme####.com

Запросы HTTP GET:

api.meme####.com/activity/packet_list
api.meme####.com/app/index
api.meme####.com/appload/load_page?qd=####
api.meme####.com/properties/list
api.meme####.com/public/blackword_list/0
api.meme####.com/public/blackword_list/1
api.meme####.com/public/inform?size=####&type=####
api.meme####.com/public/poster/2
api.meme####.com/public/room_list?sort=####&page=####&live=####&live_typ...
api.meme####.com/public/t_hex
api.meme####.com/show/bell_gift_list
api.meme####.com/show/cars_list
api.meme####.com/show/gift_list
api.meme####.com/show/gift_list?app_live=####
api.meme####.com/statistic/welcome_event?date=####&button=####&qd=####&i...
api.meme####.com/zone/mission_num
gl####.w.kunl####.####.com/11/3/1463043658379.jpg
gl####.w.kunl####.####.com/11/3/1485169680971.jpg
gl####.w.kunl####.####.com/11/3/1528982145355.jpg
gl####.w.kunl####.####.com/12/4/1404114730316.jpg
gl####.w.kunl####.####.com/12/4/1438840897548.jpg
gl####.w.kunl####.####.com/12/4/1495002759820.jpg
gl####.w.kunl####.####.com/13/5/1404114930829.jpg
gl####.w.kunl####.####.com/13/5/1429582714317.jpg
gl####.w.kunl####.####.com/13/5/1492522388813.jpg
gl####.w.kunl####.####.com/14/6/1493348043470.jpg
gl####.w.kunl####.####.com/15/7/1483007197391.jpg
gl####.w.kunl####.####.com/15/7/1528260134991.jpg
gl####.w.kunl####.####.com/17/1/1486433151121.jpg
gl####.w.kunl####.####.com/17/1/1494842897425.jpg
gl####.w.kunl####.####.com/18/2/1483006802130.jpg
gl####.w.kunl####.####.com/19/3/1449108603603.jpg
gl####.w.kunl####.####.com/2/2/1490841039042.jpg
gl####.w.kunl####.####.com/23/7/1504250237335.jpg
gl####.w.kunl####.####.com/24/0/1480556318040.jpg
gl####.w.kunl####.####.com/25/1/1493376825241.jpg
gl####.w.kunl####.####.com/27/3/1408010576603.jpg
gl####.w.kunl####.####.com/27/3/1492522345371.jpg
gl####.w.kunl####.####.com/28/4/1426750171036.jpg
gl####.w.kunl####.####.com/28/4/1464341461148.jpg
gl####.w.kunl####.####.com/3/3/1438841119811.jpg
gl####.w.kunl####.####.com/3/3/1483006921347.jpg
gl####.w.kunl####.####.com/30/6/1483007363166.jpg
gl####.w.kunl####.####.com/30/6/1485169565598.jpg
gl####.w.kunl####.####.com/34/2/1404113259106.jpg
gl####.w.kunl####.####.com/34/2/1457664359778.jpg
gl####.w.kunl####.####.com/35/3/1490841105507.jpg
gl####.w.kunl####.####.com/35/3/1492522643811.jpg
gl####.w.kunl####.####.com/35/3/1498551790819.jpg
gl####.w.kunl####.####.com/36/4/1435644545252.jpg
gl####.w.kunl####.####.com/36/4/1478766324580.jpg
gl####.w.kunl####.####.com/36/4/1493376841764.jpg
gl####.w.kunl####.####.com/39/7/1443163432551.jpg
gl####.w.kunl####.####.com/42/2/1404113474090.jpg
gl####.w.kunl####.####.com/43/3/1415844338219.jpg
gl####.w.kunl####.####.com/43/3/1457664322283.jpg
gl####.w.kunl####.####.com/44/4/1483006973868.jpg
gl####.w.kunl####.####.com/45/5/1418008399917.jpg
gl####.w.kunl####.####.com/45/5/1469503457837.jpg
gl####.w.kunl####.####.com/45/5/1483007327661.jpg
gl####.w.kunl####.####.com/47/7/1446715722479.jpg
gl####.w.kunl####.####.com/48/0/1442456402160.jpg
gl####.w.kunl####.####.com/51/3/1404113662771.jpg
gl####.w.kunl####.####.com/56/0/1501830032760.jpg
gl####.w.kunl####.####.com/56/0/1528250907512.jpg
gl####.w.kunl####.####.com/57/1/1523616271673.jpg
gl####.w.kunl####.####.com/58/2/1498638914490.jpg
gl####.w.kunl####.####.com/60/4/1490841324412.jpg
gl####.w.kunl####.####.com/61/5/1503651163581.jpg
gl####.w.kunl####.####.com/63/7/1483006865599.jpg
gl####.w.kunl####.####.com/63/7/1503554774655.jpg
gl####.w.kunl####.####.com/9/1/1422624662729.jpg
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?a97087b####
idu####.qini####.com/2339/m/static/base/styles/font/iconfont_f43894a.ttf...
idu####.qini####.com/2339/m/static/base/styles/public_cfa6276.css
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/banner...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/banqua...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/four_d...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/gift-1...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/gift-2...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/gift-3...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/gift-b...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/line-t...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/one_34...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/qq-btn...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/send-b...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/side-a...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/three_...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/title-...
idu####.qini####.com/2339/m/static/page/activity/2018/father/imgs/two_a7...
idu####.qini####.com/2339/m/static/page/activity/2018/father/index_0599f...
idu####.qini####.com/2339/m/static/page/activity/2018/father/index_5826f...
idu####.qini####.com/2339/m/static/pkg/base_781e4cc.js
ipswitc####.fmscach####.ou####.com/10000?ws_getip=####
lib.su####.com.####.com/base/scripts/--/jquery.js,util/oo.js,util/json2....
lib.su####.com.####.com/base/styles/--/normalize.css,level/level_h5.css
ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
s####.tc.qq.com/h5/stats.js
sa.meme####.com/api/vtrack/config/Android.conf
tinyq####.ove####.b0.####.com/20108676/1227/084cae6d7bac087540c7ffa8a394...
tinyq####.ove####.b0.####.com/38289310/0418/23b938eec097248f7a9380e39a1b...
tinyq####.ove####.b0.####.com/38692353/0516/661bc22c41ceed780febd0c17507...
tinyq####.ove####.b0.####.com/39074861/0401/ba21fcaba2565865fbfa034e46cd...
tinyq####.ove####.b0.####.com/45675829/0525/6f76923a1c1e781ce4ac118a4c37...
tinyq####.ove####.b0.####.com/48047840/1118/80c18102a4ea58d806ca4a7dd88b...
tinyq####.ove####.b0.####.com/56315596/0524/3acfaf476158e2209a30d5143f8c...
tinyq####.ove####.b0.####.com/57903241/0123/0be110239e58fddb398281554afc...
tinyq####.ove####.b0.####.com/64640926/0509/7e4ec09ef587e6977ba59b800a02...
tinyq####.ove####.b0.####.com/activity/2018/father.html

Запросы HTTP HEAD:

idu####.qini####.com/2339/m/static/pkg/base_781e4cc.js

Запросы HTTP POST:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php
pss.al####.com/iku/log/acc

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/2596546f-78ba-446a-bdd2-768cb201ebc7
/data/data/####/AllRoomList
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/BANNER
/data/data/####/BELL_GIFT_LIST
/data/data/####/CHEST_GIFT_LIST
/data/data/####/ContextData.xml
/data/data/####/GIFT_LIST
/data/data/####/KEY_WORD
/data/data/####/MISSION_COUNT
/data/data/####/MOBILE_GIFT_LIST
/data/data/####/MOUNT_MALL
/data/data/####/MixRoomList
/data/data/####/PLAZA_DATA
/data/data/####/PROPERTIES_LIST
/data/data/####/RECHARGE_AWARD
/data/data/####/RED_PACKET_LIST
/data/data/####/RTMP_BACKUP_IP
/data/data/####/SENSITIVE_WORD
/data/data/####/SUBOXLOG_
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/Zego_live_demo2.xml
/data/data/####/bugly_db_-journal
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.zhiboba.android_preferences.xml
/data/data/####/com.zhiboba.android_prefs.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e4258158-eb7a-46cc-80c5-059852bd5926.jar
/data/data/####/exchangeIdentity.json
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/firll.dat
/data/data/####/flag
/data/data/####/index
/data/data/####/last_cache_time
/data/data/####/libcuid.so
/data/data/####/libjiagu1569020037.so
/data/data/####/local_crash_lock
/data/data/####/mivmi.xml
/data/data/####/mivmi.xml.bak (deleted)
/data/data/####/mobclick_agent_cached_com.zhiboba.android2018062616
/data/data/####/multidex.version.xml
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/pcdnconfigs.xml
/data/data/####/security_info
/data/data/####/sensorsdata
/data/data/####/sensorsdata-journal
/data/data/####/sensorsdata.xml
/data/data/####/show.db-journal
/data/data/####/shuzilm.db
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/user_message_record.db-journal
/data/data/####/vmeni.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/003a63ac35a4abb2682006c425301d29.tmp
/data/media/####/03c74f856738cca9a2588caeb9b4dd44.tmp
/data/media/####/0727586962d6f893febaf3b089b5de03.tmp
/data/media/####/0ccb5114363c1aaff0eae438830d8e41.tmp
/data/media/####/0e6ec971071ad8db2fcb8a62e5e2bb96.tmp
/data/media/####/10f2da58401c491a31734f02df6c2091.tmp
/data/media/####/122d6ea5d8802acdbf8cde8c6bd0101d.tmp
/data/media/####/15872ce8e587d00dce665b6b5b4031e2.tmp
/data/media/####/16fe23ab70e74be86f27e58207a1ddd8.tmp
/data/media/####/180cd43f832265830158df87b77d7cca.tmp
/data/media/####/1912b39b47e7d784ff9e6e4401a2fbe6.tmp
/data/media/####/1aa45273480b11a2a02f94e123c60c2b.tmp
/data/media/####/20b0b26a0dd17c5064d2bf33cf383712.tmp
/data/media/####/20d0f377ffc16bdfed14257456d6ba03.tmp
/data/media/####/2140fa108c8af5c3c3bb4ed899375637.tmp
/data/media/####/320d82846c2cf1dab04df103b759f5ca.tmp
/data/media/####/3bf015aabfe0b451c30e16bba52c6f5a.tmp
/data/media/####/3c8f3f7357420728549bc4c3f02313ee.tmp
/data/media/####/413a4b15428a617bc8cf8133e2c8b55b.tmp
/data/media/####/42e1abc138d59335d449dc2b6efcb29e.tmp
/data/media/####/42e88ab413fe05003ab095510a197dc6.tmp
/data/media/####/43e23fd3b22079b6e73f28dbe19bf2cd.tmp
/data/media/####/44b4a13839bc2f8462c3a0f57557495f.tmp
/data/media/####/499f9e322cfaf69bdcc7f0f06d9517c6.tmp
/data/media/####/4bf6fec57ef1dcf7631b9b47b4470ceb.tmp
/data/media/####/5643d254841aea1ff23d34afcd2081bc.tmp
/data/media/####/59076adafe094f5e042c8770dd32667c.tmp
/data/media/####/594eb8221960f8cfa17ba64547392116.tmp
/data/media/####/5f8f25df732bc987633840d815b82069.tmp
/data/media/####/613a8465d0a66a2c7442b70c87df74f0.tmp
/data/media/####/66165ce8d3fa4a90b31d1fa94edd33fb.tmp
/data/media/####/6e4e0d52fbfad9c8d09b141c1c728b18.tmp
/data/media/####/6ef2918ea71b0ad15173eec12d6f7eae.tmp
/data/media/####/73374ce881f699a00170c6c65b55b336.tmp
/data/media/####/73a01705d50801aa355b6ec607146968.tmp
/data/media/####/7670a6b9fe7c6b592de28d37daacadb5.tmp
/data/media/####/78f8c1075332ea692601299a45d47f93.tmp
/data/media/####/7ee0bd8f0911d5964fc742be3c06d03c.tmp
/data/media/####/80079c3cd071e1605c5730a634d55432.tmp
/data/media/####/83468ba11ea69b3d294ef52d417e58b7.tmp
/data/media/####/83af6203eb2bed87f1205eb479dda66a.tmp
/data/media/####/86b20b5f83ff0ee0495abc6be925e909.tmp
/data/media/####/89b7b1d7b1359765b08f5ab93be0f5fa.tmp
/data/media/####/8bc566d199a31aec9316c275a3468ca9.tmp
/data/media/####/8d05faab7505b8dac8913fbd96b477cd.tmp
/data/media/####/8e68c566023d4a89d10da48519751319.tmp
/data/media/####/941cf35e705c472c2a1666ca2c4c864d.tmp
/data/media/####/982d6ac2fca4e25cb30750bee7a567b2.tmp
/data/media/####/9ecc2cbddd7bc092b7f86689e218e986
/data/media/####/9ecc2cbddd7bc092b7f86689e218e986.tmp.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a4aeaabb7fea7630ebfedae48b7ea053.tmp
/data/media/####/adeaebab2c8faf6e568bb2face23474d.tmp
/data/media/####/b0ab363e0851235a63059ed447633fa2.tmp
/data/media/####/b0eff06b9ce7b1e2c7b6cf8c6ec5dd27.tmp
/data/media/####/ba732d7f274e3aa3ce09ea7192f5fa66.tmp
/data/media/####/c1350429f955cfb23de752bfd63847d0.tmp
/data/media/####/c5d9bc25f1f261420a5213488061da3c.tmp
/data/media/####/cdfe164bc000b76000527e9cb04284cf.tmp
/data/media/####/config.dat
/data/media/####/conlts.dat
/data/media/####/d0692ca74b2aa95cfbb379b0d5066d4f.tmp
/data/media/####/d4435119712305fdcbfd02ea6fc15139.tmp
/data/media/####/d447e43bd49eb61fdb1f2998f3ab60d0.tmp
/data/media/####/e2ebd1a204cfd84c5e6a4a9309504e41.tmp
/data/media/####/f4417f577ebe2a57529b8c801d63706e.tmp
/data/media/####/f559256a6dfe37b5b5206bfc9f9faa34.tmp
/data/media/####/fa822078ffcb846d82781954ee47a1d5.tmp
/data/media/####/fd88953444b8c39656a537f2f9b31815.tmp
/data/media/####/ller.dat
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/lut
/data/media/####/test.0

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop androVM.vbox_dpi
/system/bin/sh -c getprop gsm.sim.state
/system/bin/sh -c getprop gsm.sim.state2
/system/bin/sh -c getprop qemu.sf.fake_camera
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.debuggable
/system/bin/sh -c getprop ro.genymotion.version
/system/bin/sh -c getprop ro.secure
/system/bin/sh -c type su
chmod 755 <Package Folder>/.jiagu/libjiagu1569020037.so
getprop androVM.vbox_dpi
getprop gsm.sim.state
getprop gsm.sim.state2
getprop qemu.sf.fake_camera
getprop ro.board.platform
getprop ro.debuggable
getprop ro.genymotion.version
getprop ro.secure
ls -l /system/bin/su
ls /dev/socket
netstat
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid

Загружает динамические библиотеки:

Bugly
du
game
libjiagu1569020037
locSDK6a
openal
pcdn_acc
zegoavkit
zegoavkit2_jni

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней