Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1768.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) a.rua####.com:80
- TCP(HTTP/1.1) v3.jia####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) twi####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) st####.an####.org:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) i####.rua####.com.####.com:80
- TCP(TLS/1.0) cs2-wa####.8####.e####.net:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) syndica####.twi####.com:443
- TCP(TLS/1.0) twi####.com:443
- TCP(TLS/1.0) mo####.twi####.com:443
- TCP(TLS/1.0) ma.t####.com:443
Запросы DNS:
- a####.u####.com
- a.rua####.com
- c.c####.com
- h####.b####.com
- hm.b####.com
- i####.c####.com
- i####.rua####.com
- ma.t####.com
- mo####.twi####.com
- pbs.t####.com
- s13.c####.com
- st####.an####.org
- syndica####.twi####.com
- twi####.com
- v3.jia####.com
- www.go####.com
- z7.c####.com
Запросы HTTP GET:
- a.rua####.com/
- a.rua####.com/api/ajax_get/updateClick?id=####
- a.rua####.com/game/1/
- a.rua####.com/html/game/comment_list?p=####&gameId=####&sort=####
- a.rua####.com/jingpin/
- a.rua####.com/list/
- a.rua####.com/live_weixin.png
- a.rua####.com/static/css/comment.css
- a.rua####.com/static/css/index.css
- a.rua####.com/static/css/list.css
- a.rua####.com/static/css/public.css
- a.rua####.com/static/css/view.css
- a.rua####.com/static/images/dian.png
- a.rua####.com/static/images/home.png
- a.rua####.com/static/images/line.gif
- a.rua####.com/static/images/logo.png
- a.rua####.com/static/images/more.gif
- a.rua####.com/static/images/pullUp.png
- a.rua####.com/static/images/search.png
- a.rua####.com/static/images/sprite.png
- a.rua####.com/static/images/wuxing.png
- a.rua####.com/static/js/comment.js
- a.rua####.com/static/js/jquery.1.7.2.js
- a.rua####.com/static/js/jquery.min.js
- a.rua####.com/static/js/public.js
- a.rua####.com/static/js/skins/icons/loading.gif
- a.rua####.com/static/js/view.js
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/z_stat.php?id=####&show=####
- hm.b####.com/h.js?77630c5####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- i####.rua####.com.####.com/data/images/user/nomal_100.png
- i####.rua####.com.####.com/static/images/gametype/1.jpg
- i####.rua####.com.####.com/static/images/gametype/10.jpg
- i####.rua####.com.####.com/static/images/gametype/11.jpg
- i####.rua####.com.####.com/static/images/gametype/12.jpg
- i####.rua####.com.####.com/static/images/gametype/13.jpg
- i####.rua####.com.####.com/static/images/gametype/14.jpg
- i####.rua####.com.####.com/static/images/gametype/15.jpg
- i####.rua####.com.####.com/static/images/gametype/16.jpg
- i####.rua####.com.####.com/static/images/gametype/17.jpg
- i####.rua####.com.####.com/static/images/gametype/2.jpg
- i####.rua####.com.####.com/static/images/gametype/3.jpg
- i####.rua####.com.####.com/static/images/gametype/4.jpg
- i####.rua####.com.####.com/static/images/gametype/5.jpg
- i####.rua####.com.####.com/static/images/gametype/6.jpg
- i####.rua####.com.####.com/static/images/gametype/7.jpg
- i####.rua####.com.####.com/static/images/gametype/8.jpg
- i####.rua####.com.####.com/static/images/gametype/9.jpg
- i####.rua####.com.####.com/uface/2018/05/23/avatar_20180523233351_307139...
- i####.rua####.com.####.com/uface/2018/07/20/avatar_20180720073857_278608...
- i####.rua####.com.####.com/uploads/game_logo/201409/gLogo_54096474c99d56...
- i####.rua####.com.####.com/uploads/game_logo/201411/gLogo_5460b724972c57...
- i####.rua####.com.####.com/uploads/game_logo/201603/gLogo_56f38ca91bc4d5...
- i####.rua####.com.####.com/uploads/game_logo/201605/gLogo_574975919741f0...
- i####.rua####.com.####.com/uploads/game_logo/201611/gLogo_581ec86b278847...
- i####.rua####.com.####.com/uploads/game_logo/201612/gLogo_5842b15b72c4a2...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_586e175fb9d8a1...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_5884b99815f596...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_5884baa1892157...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_5884c0f51edf03...
- i####.rua####.com.####.com/uploads/game_logo/201701/gLogo_58860230536847...
- i####.rua####.com.####.com/uploads/game_logo/201709/gLogo_59ad1b8bbbd079...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b5030c76e1169...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b513c3ccbc947...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b513dc731c498...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b513e762042c5...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b51406337d6a7...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b51423bc930a8...
- i####.rua####.com.####.com/uploads/game_logo/201807/gLogo_5b51439e4568a7...
- st####.an####.org/static/outer/image/aqkx_83x30.png?id=a.ruansky.com?t=#...
- st####.an####.org/static/outer/js/aq_auth.js
- twi####.com/
- v3.jia####.com/code/jia.js?uid=####
- www.go####.com/complete/search?hl=####&client=####&q=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- a####.u####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/libsecexe.x86.so
- /data/data/####/libsecmain.x86.so
- /data/data/####/mobclick_agent_cached_org.Hex.ghostHunter
- /data/data/####/mobclick_agent_header_org.Hex.ghostHunter.xml
- /data/data/####/mobclick_agent_state_org.Hex.ghostHunter.xml
- /data/data/####/org.Hex.ghostHunter
- /data/data/####/org.Hex.ghostHunter.art
- /data/data/####/qy_db_pay
- /data/data/####/qy_db_pay-journal
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh
- <Package> <Package> -1828913992 0 /data/app/<Package>-1.apk 39 <Package> 50 51
- <Package> <Package> -1829978952 0 /data/app/<Package>-1.apk 39 <Package> 50 51
- <Package> <Package> -1829978952 0 /data/app/<Package>-1.apk 40 <Package> 48 49
- chmod 755 <Package Folder>/.cache/<Package>
- chmod 755 <Package Folder>/.cache/<Package>.art
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- cocos2dcpp
- libsecexe.x86
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
