Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.396.origin
- Android.DownLoader.455.origin
- Android.DownLoader.576.origin
- Android.DownLoader.675.origin
- Android.DownLoader.698.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m####.w####.com:80
- TCP(HTTP/1.1) resc####.b0.a####.com:80
- TCP(HTTP/1.1) mc.roy####.cc:80
- TCP(HTTP/1.1) hz####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) m2.a####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) l####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) a.roy####.com:80
- TCP(HTTP/1.1) hy.6####.co:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) bj####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) mc.roy####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) u####.g####.co:80
- TCP(HTTP/1.1) api.139####.com:80
- TCP(HTTP/1.1) resz####.b0.a####.com:80
- TCP(TLS/1.0) resz####.b0.a####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) m####.w####.com:443
- TCP(TLS/1.0) m2.a####.com:443
- TCP t1.jz####.com:7703
- TCP k2.yo####.com:7503
- TCP t1.jz####.com:7701
- TCP 1####.168.74.254:53475
- TCP k1.yo####.com:7501
- TCP k2.yo####.com:7803
- TCP 1####.168.74.254:50289
- TCP k2.yo####.com:7802
- TCP 1####.168.74.254:56041
- TCP 1####.168.74.254:56039
- TCP p2.jz####.com:7802
- TCP p2.jz####.com:7801
- TCP t1.jz####.com:7102
- TCP t1.jz####.com:7103
- TCP k1.yo####.com:7801
- TCP t1.jz####.com:7702
- TCP p2.jz####.com:7502
- TCP t1.jz####.com:7101
Запросы DNS:
- a####.u####.com
- a.roy####.com
- adf####.6####.com
- api.139####.com
- api.app.roy####.com
- bj####.oss-cn-####.aliy####.com
- c.c####.com
- hm.b####.com
- hy.6####.co
- hz####.oss-cn-####.aliy####.com
- k1.yo####.com
- k2.yo####.com
- k3.yo####.com
- l####.oss-cn-####.aliy####.com
- m####.w####.com
- m####.w####.com
- m2.a####.com
- mc.roy####.cc
- mc.roy####.com
- oc.u####.com
- p1.i####.com
- p1.jz####.com
- p2.i####.com
- p2.jz####.com
- p3.i####.com
- p3.jz####.com
- r####.6####.com
- r####.6####.com
- r####.6####.com
- r####.com
- s####.6####.com
- s1.u####.com
- s11.c####.com
- s2.u####.com
- s3.u####.com
- t1.jz####.com
- t2.jz####.com
- t3.jz####.com
- u####.g####.co
- www.r####.com
- z13.c####.com
Запросы HTTP GET:
- a.roy####.com/api/app/version?id=####
- a.roy####.com/app/server_line.ashx?app_code=####&app_version=####
- a.roy####.com/service/ad?position=####
- a.roy####.com/service/ad?position=####×tamp=####
- api.139####.com/api/app/cangetmoreapplist?platformid=####&client_name=##...
- bj####.oss-cn-####.aliy####.com/lhc_result.js?timestamp=####
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- hz####.oss-cn-####.aliy####.com/lhc_result.js?timestamp=####
- l####.oss-cn-####.aliy####.com/lhbd.js
- l####.oss-cn-####.aliy####.com/lhbd_tuku.js
- m####.w####.com/?utm=####
- m2.a####.com/member/getPersonalInfo?memberId=####
- mc.roy####.cc/app/server_line.ashx?app_code=####
- mc.roy####.cc/app/server_line.ashx?app_code=####&app_version=####
- mc.roy####.com/app/server_line.ashx?app_code=####
- resc####.b0.a####.com/dialog/jquery.artDialog.min.js
- resc####.b0.a####.com/dialog/skins/blue.css
- resc####.b0.a####.com/js/PrtialBottom.js
- resc####.b0.a####.com/js/PrtialFoot.js?v=####
- resc####.b0.a####.com/js/common.js
- resc####.b0.a####.com/js/feedback.js
- resc####.b0.a####.com/js/home.js?v=####
- resc####.b0.a####.com/js/jquery.min.js
- resc####.b0.a####.com/js/messenger.js
- resc####.b0.a####.com/template/default/js/fbloginframe.js?class=####
- resc####.b0.a####.com/themes/default/base.css
- resc####.b0.a####.com/themes/default/css/headAndFoot.css
- resc####.b0.a####.com/themes/default/images/ball.png
- resc####.b0.a####.com/themes/default/images/download_icon.png
- resc####.b0.a####.com/themes/default/images/hj_public_head_AIcon.jpg
- resc####.b0.a####.com/themes/default/images/hj_public_head_bg.jpg
- resc####.b0.a####.com/themes/default/images/hj_public_head_downIcon.jpg
- resc####.b0.a####.com/themes/default/images/hjwinxin.png
- resc####.b0.a####.com/themes/default/images/hjwinxin.png?v=####
- resc####.b0.a####.com/themes/default/images/hot.png
- resc####.b0.a####.com/themes/default/images/iocnDown2.gif
- resc####.b0.a####.com/themes/default/images/jia_mao4.png
- resc####.b0.a####.com/themes/default/images/logo.png
- resc####.b0.a####.com/themes/default/images/pageBg1S.png
- resc####.b0.a####.com/themes/default/images/pageS.png
- resc####.b0.a####.com/themes/default/images/penks.png
- resc####.b0.a####.com/themes/default/images/qq.png
- resc####.b0.a####.com/themes/default/images/search_paper.png
- resc####.b0.a####.com/themes/default/images/simulate_bet.gif
- resc####.b0.a####.com/themes/default/style.css?v=####
- resz####.b0.a####.com/template/default/css/mobile_v4.css?v=####
- resz####.b0.a####.com/template/default/images/loading.gif
- resz####.b0.a####.com/template/default/images/loading_3.gif
- resz####.b0.a####.com/template/default/images/m_vipC_serviceBtn.png
- resz####.b0.a####.com/template/default/images/mobile_icon.png
- resz####.b0.a####.com/template/default/images/smile.png
- resz####.b0.a####.com/template/default/js/checkinput_v4.js
- resz####.b0.a####.com/template/default/js/jquery.min.js?v=####
- resz####.b0.a####.com/template/default/js/jvalidate.js
- resz####.b0.a####.com/template/default/js/md5.js
- resz####.b0.a####.com/themes/default/images/hjwinxin.png?v=####
- resz####.b0.a####.com/urlimg/2017/10/05/145483559.gif
- resz####.b0.a####.com/urlimg/2017/10/18/18262915.gif
- resz####.b0.a####.com/urlimg/2017/11/07/172344906.gif
- resz####.b0.a####.com/urlimg/2017/12/13/145261490.jpg
- resz####.b0.a####.com/urlimg/2018/03/08/18368218.png
- u####.g####.co/pages/2017/10/24/174259053.png
- u####.g####.co/paper/2016/08/03/14502574.jpg
- u####.g####.co/paper/2016/08/03/145053528.jpg
- u####.g####.co/paper/2016/08/03/145349316.jpg
- u####.g####.co/paper/2016/08/03/15028864.jpg
- u####.g####.co/paper/2016/08/03/150346900.jpg
- u####.g####.co/paper/2016/08/03/150350354.jpg
- u####.g####.co/paper/2016/08/03/164897253.jpg
- u####.g####.co/paper/2016/08/03/172098182.jpg
- z.c####.com/stat.htm?id=1256005135&r=http://118.163.80.203:60021/sso/log...
Запросы HTTP POST:
- a####.u####.com/app_logs
- hy.6####.co/sso/v4/login
- oc.u####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/15317505549347.jar
- /data/data/####/15317505553160.jar
- /data/data/####/15317505555009.jar
- /data/data/####/15317505597875.jar
- /data/data/####/E_ID356507059351895.db-journal
- /data/data/####/MyPrefsFile.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/cn.jpush.serverconfig.xml
- /data/data/####/coni_io_356507059351895.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/db_d.db-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/fcut_appInfo_pre.xml
- /data/data/####/fcut_conf_pre.xml
- /data/data/####/fcut_info_pre.xml
- /data/data/####/fcut_trategy_pre.xml
- /data/data/####/i.xml
- /data/data/####/i_fionf_pre356507059351895.xml
- /data/data/####/iappInfo_io_356507059351895.xml
- /data/data/####/index
- /data/data/####/itrategy_io_356507059351895.xml
- /data/data/####/mobclick_agent_header_com.liuhezs.apaop.xml
- /data/data/####/mobclick_agent_online_setting_com.liuhezs.apaop.xml
- /data/data/####/mobclick_agent_state_com.liuhezs.apaop.xml
- /data/data/####/po_download.db-journal
- /data/data/####/qcut_download.db-journal
- /data/data/####/url.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/ybappInfo_pre.xml
- /data/data/####/ybconf_pre.xml
- /data/data/####/yo_fconf_pre.xml
- /data/data/####/yoappInfo_pre.xml
- /data/data/####/yoconf_pre.xml
- /data/data/####/yop_download.db-journal
- /data/data/####/yotrategy_pre.xml
- /data/media/####/1531750555687u.jar
- /data/media/####/1531750555882q.jar
- /data/media/####/1531750556033u.jar
- /data/media/####/1531750560694b.jar
Другие:
Загружает динамические библиотеки:
- jpush164
Использует следующие алгоритмы для расшифровки данных:
- DES
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
