Android.Xiny.2270

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.BackDoor.985
Android.DownLoader.750.origin
Android.DownLoader.751.origin
Android.Xiny.166.origin
Android.Xiny.202.origin
Android.Xiny.2086
Android.Xiny.263.origin
Android.Xiny.73.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) trac####.ad####.com:80
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) 13.2####.16.115:8081
TCP(HTTP/1.1) 45.33.1####.188:80
TCP(HTTP/1.1) api.cloud####.net:80
TCP(HTTP/1.1) api.ap####.com:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) p####.admobc####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) trk.iskywo####.com:80
TCP(HTTP/1.1) net.ray####.com:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) trac####.le####.com:80
TCP(HTTP/1.1) api.migh####.com:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) t####.click####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) 45.79.2####.163:80
TCP(HTTP/1.1) 5####.general####.com:80
TCP(HTTP/1.1) hy####.ray####.com:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) analy####.ray####.com:80
TCP(HTTP/1.1) pic.a####.com:80
TCP(HTTP/1.1) bg1.hatch####.com:8080
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) clk.apxadtr####.net:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) x####.g####.com:8808
TCP(HTTP/1.1) c####.aztrac####.net:80
TCP(HTTP/1.1) e####.uc####.swifts####.com:80
TCP(HTTP/1.1) ssp.nan####.com:80
TCP(HTTP/1.1) d####.ray####.com:80
TCP(HTTP/1.1) ggg.koapk####.com:80
TCP(HTTP/1.1) s####.adin####.com:80
TCP(HTTP/1.1) set####.ray####.com:80
TCP(HTTP/1.1) idv####.qini####.com:80
TCP(SSL/3.0) a####.app####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) im####.quick####.top:443
TCP(TLS/1.0) mm####.go2af####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) at.al####.com:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) cl####.mob####.net:443
TCP(TLS/1.0) app.ad####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) t.api.y####.net:443
TCP(TLS/1.0) encrypt####.gst####.com:443
TCP(TLS/1.0) im####.google####.com:443
TCP(TLS/1.0) con####.koc####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) r####.quick####.top:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) lp.cooktra####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) a####.app####.com:443

Запросы DNS:

5####.general####.com
a####.app####.com
adser####.go####.com
adser####.go####.nl
analy####.ray####.com
api.ap####.com
api.cloud####.net
api.migh####.com
app.ad####.com
at.al####.com
bg1.hatch####.com
c####.aztrac####.net
c.s####.co
cdn####.ray####.com
cl####.mob####.net
clinkad####.com
clk.apxadtr####.net
clk.tap####.com
con####.koc####.com
d####.ray####.com
duc####.b####.com
encrypt####.gst####.com
f####.google####.com
f####.gst####.com
ggg.koapk####.com
googl####.g.doublec####.net
h####.b####.com
hy####.ray####.com
im####.google####.com
im####.quick####.top
l.a####.com
lp.cooktra####.com
net.ray####.com
offers####.adflush####.com
p####.admobc####.com
p####.quick####.top
p7b3l####.s####.gdi####.com
pag####.googles####.com
pi####.qq.com
pic.a####.com
r####.quick####.top
s####.adin####.com
s####.g.doublec####.net
set####.ray####.com
ssp.nan####.com
t####.click####.com
t.api.y####.net
t.m####.agency
t.mob####.net
tpc.googles####.com
trac####.ad####.com
trac####.le####.com
trk.iskywo####.com
www.go####.com
www.go####.nl
www.google-####.com
www.koapk####.com
www.okyes####.com
x####.g####.com
x####.g####.com

Запросы HTTP GET:

5####.general####.com/api/click?c=####&key=####&u=####&clickid=####&goog...
api.ap####.com/link/buy/android/com.booster.master.cleaner.cooler/e1?cli...
api.cloud####.net/api/v3/template/get?slot_id=####&update_time=####&user...
api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
bg1.hatch####.com:8080/ads/getJarVersion/haoxing/23/cn
c####.aztrac####.net/tracking/cparedirect.php?ids=7MTUyNzF-Mjk5NTY4fjEyN...
c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
clinkad####.com/tracking?camp=####&pubid=####&&subpubid=####&sid=####&ga...
clk.apxadtr####.net/iclk/redirect.php?id=####&trafficsourceid=####&devic...
d####.ray####.com/click?k=####&z=MTIwM####&q=####&r=####&al=####&csp=i+M...
d####.ray####.com/impression?k=####&z=MTIwM####&q=####&x=####&r=####&al=...
d####.ray####.com/onlyImpression?k=####&p=MTI2N####&csp=####&c=####
duc####.b####.com/click/affClick?aff_sub=####&aff_sub19=####&aff_sub2=##...
e####.uc####.swifts####.com/cdn-adn/dmp/17/12/23/15/10/5a3e01615c90a.png
e####.uc####.swifts####.com/cdn-adn/dmp/18/06/24/14/48/5b2f3eb663cfe.jpg
hy####.ray####.com/offerwall/img/interstitalbg.jpg
hy####.ray####.com/offerwall/img/star.png
hy####.ray####.com/offerwall/img/star_w.png
hy####.ray####.com/offerwall/js/common.min.js?v=####
hy####.ray####.com/offerwall/js/interstital.js?v=####
hy####.ray####.com/offerwall/tpl/interstital.html?unit_id=####&sdk_versi...
idv####.qini####.com/path_hx_hw_update2.dat
net.ray####.com/openapi/ad/v3?app_id=####&unit_id=####&sign=####&categor...
p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
pic.a####.com/img/dy2_uni263_80421.png
s####.adin####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=#...
set####.ray####.com/setting?app_id=####&sign=####&jm_a=####&jm_n=####&la...
set####.ray####.com/setting?unit_ids=####&app_id=####&sign=####&channel=...
ssp.nan####.com/aff/ssp/click?channel=####&uuid=####&id=####&aoid=####&c...
t####.click####.com/v1/ad/click?campid=####&h=####&pubid=####&geo=####&s...
trac####.ad####.com/click/10910/11972826/?tid=692####&gaid=####&aid=####...
trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&clickid=#...
trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_creati...
trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_packag...
trk.iskywo####.com/click?id=####&aff=####&ost=####&aff_sub=####&click_id...
x####.g####.com:8808/a/e?a=####

Запросы HTTP POST:

13.2####.16.115:8081/sm/sr/sdl/in
analy####.ray####.com/
ggg.koapk####.com/pgm/sr/gm/gy
l.a####.com/l.php
l.a####.com/sal.php
pi####.qq.com/mstat/report/?index=####
s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/run/hy
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...
x####.g####.com:8808/a/f

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.atmp9.jar
/data/data/####/.atmp_8.log
/data/data/####/.do.jar
/data/data/####/.m2.so
/data/data/####/09695690.apk
/data/data/####/09695690.dex
/data/data/####/20160121.xml
/data/data/####/201804101550.apk
/data/data/####/3323003.jar
/data/data/####/3323003.ttf
/data/data/####/53778828.apk
/data/data/####/53778828.dex
/data/data/####/60752129.apk
/data/data/####/60752129.dex
/data/data/####/66935714.apk
/data/data/####/66935714.dex
/data/data/####/74277037.apk
/data/data/####/74277037.dex
/data/data/####/B201807101750.apk
/data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
/data/data/####/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
/data/data/####/VirtualAPK_Settings.xml
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1531277085921
/data/data/####/ag.xml
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/bdownloaders.db-journal
/data/data/####/c0fbe5e9065b05574d1e8180bb06bb8c.d
/data/data/####/c201804101550.apk
/data/data/####/com.youba.flashlight-1.apk.classes-874747203.zip
/data/data/####/com.youba.flashlight-1.apk.classes783724923.zip
/data/data/####/com.youba.flashlight.mid.world.ro.xml
/data/data/####/com.youba.flashlight_ct_default.xml
/data/data/####/com.youba.flashlight_preferences.xml
/data/data/####/com.youba.flashlight_preferences.xml.bak
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dc1
/data/data/####/dc2
/data/data/####/dcz
/data/data/####/debuggerd_hulu
/data/data/####/dk691.data
/data/data/####/dk909.data
/data/data/####/dk910.data
/data/data/####/dk951.data
/data/data/####/dnsmasq_nujb_radish
/data/data/####/elfm
/data/data/####/elfm1531277095629.zip
/data/data/####/env201807101750.data
/data/data/####/f8fc32221f30daaf3974f670d8db38e6.d
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/forever.sh
/data/data/####/gvegwv
/data/data/####/index
/data/data/####/install-recovery.sh
/data/data/####/iw_bnju_hd
/data/data/####/kcol_ysy
/data/data/####/krcfg.txt
/data/data/####/krmain
/data/data/####/krmain1531277096836.zip
/data/data/####/krmain1531277114057.zip
/data/data/####/krmain1531277135950.zip
/data/data/####/krmain1531277145268.zip
/data/data/####/krsdk.cert
/data/data/####/libcuid.so
/data/data/####/libjp.oaoz.cm.wom.wa.so
/data/data/####/ljtq.xml
/data/data/####/loa.xml
/data/data/####/loa.xml.bak
/data/data/####/m2018062610.apk
/data/data/####/mc_cache.db-journal
/data/data/####/mintegral.msdk.db-journal
/data/data/####/mintegral.xml
/data/data/####/multidex.version.xml
/data/data/####/path_hx_hw_update2.temp (deleted)
/data/data/####/pl_config.xml
/data/data/####/pri_tencent_analysis.db_com.youba.flashlight-journal
/data/data/####/qdoomg
/data/data/####/rtr.db
/data/data/####/rtr.db-journal
/data/data/####/s2018062610.apk
/data/data/####/settingsLog.xml
/data/data/####/share_date.xml
/data/data/####/supolicy
/data/data/####/swith1014.db-journal
/data/data/####/temp.zip (deleted)
/data/data/####/tencent_analysis.db_com.youba.flashlight-journal
/data/data/####/toolbox
/data/data/####/toolbox1531277095731.zip
/data/data/####/v71.xml
/data/data/####/ver.ini.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.m2.so
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/759153601.jpg.tmp
/data/media/####/B201807101750.apk
/data/media/####/test1531277095476
/data/media/####/test1531277095642

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
c201804101550.apk -p <Package>
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod -R 777 <Package Folder>/com.init.env/app_abz /storage/emulated/0/abz
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk691/files/forever.sh
chmod 0777 <Package Folder>/p.dk691/files/krmain
chmod 0777 <Package Folder>/p.dk909/files/forever.sh
chmod 0777 <Package Folder>/p.dk909/files/krmain
chmod 0777 <Package Folder>/p.dk909/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk910/files/forever.sh
chmod 0777 <Package Folder>/p.dk910/files/krmain
chmod 0777 <Package Folder>/p.dk951/files/forever.sh
chmod 0777 <Package Folder>/p.dk951/files/krmain
chmod 6777 <Package Folder>/files/c201804101550.apk
chmod 777 <Package Folder>/p.dk691/files/krcfg.txt
chmod 777 <Package Folder>/p.dk909/files/krcfg.txt
chmod 777 <Package Folder>/p.dk910/files/krcfg.txt
chmod 777 <Package Folder>/p.dk951/files/krcfg.txt
dcz <Package Folder>/com.init.env/app_abz/dc1 <Package Folder>/com.init.env/app_abz/dc2
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
iw_bnju_hd
iw_bnju_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
sh
sh /system/bin/iw_bnju_hd
sh /system/bin/iw_bnju_hd -c id
sh <Package Folder>/com.init.env/app_abz/dcz <Package Folder>/com.init.env/app_abz/dc1 <Package Folder>/com.init.env/app_abz/dc2
su
su -c id

Загружает динамические библиотеки:

MtaNativeCrash_v2
jp.oaoz.cm.wom
qdoomg

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding

Использует повышенные привилегии.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней