Android.DownLoader.3723

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.728.origin
Android.RemoteCode.153.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.RemoteCode.153.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) m.lu.s####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) y####.s####.com:80
TCP(HTTP/1.1) p####.cy####.cn:80
TCP(HTTP/1.1) cdn.bpa####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) cdn-sta####.020####.com:80
TCP(HTTP/1.1) p####.s####.com:80
TCP(HTTP/1.1) tm.as####.cn:6088
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) i####.sogo####.com.####.com:80
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) p####.s####.com:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP umengj####.m.ta####.com:80
TCP ope####.m.ta####.com:443

Запросы DNS:

a####.man.aliy####.com
a####.u####.com
ag####.m.ta####.com
amdc####.m.ta####.com
api.apt.k.####.com
cdn-sta####.020####.com
cdn.bpa####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
i####.sogo####.com
j####.gol####.s####.com
k.s####.com
m.lu.s####.com
msg.umengc####.com
mt####.go####.com
p####.cy####.cn
p####.s####.com
pb.s####.com
plb####.u####.com
pv.s####.com
tm.as####.cn
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
y####.s####.com

Запросы HTTP GET:

cdn-sta####.020####.com/group1/M00/25/9D/rBI6SVr9IROAdqseAAAsX_y6YqM522....
cdn.bpa####.com/sc_151
gdv.a.s####.com/cityjson?ie=####
i####.sogo####.com.####.com/app/a/10190001/0D1531738536961
i####.sogo####.com.####.com/app/a/10190001/101488446887305
i####.sogo####.com.####.com/app/a/10190001/191529478175774
i####.sogo####.com.####.com/app/a/10190001/2B1478759222497
i####.sogo####.com.####.com/app/a/10190001/301478759250685
i####.sogo####.com.####.com/app/a/10190001/3A1521097408462
i####.sogo####.com.####.com/app/a/10190001/401531206064814
i####.sogo####.com.####.com/app/a/10190001/6E1488446887280
i####.sogo####.com.####.com/app/a/10190001/871529131714477
i####.sogo####.com.####.com/app/a/10190001/8B1505276767731
i####.sogo####.com.####.com/app/a/10190001/A11488446887296
i####.sogo####.com.####.com/app/a/10190001/A21488446887289
i####.sogo####.com.####.com/app/a/10190001/A61478759260709
i####.sogo####.com.####.com/app/a/10190001/B01488446887292
i####.sogo####.com.####.com/app/a/10190001/DA1478759238720
i####.sogo####.com.####.com/app/a/10190001/DB1488446887608
i####.sogo####.com.####.com/app/a/10190001/E21516789576011
i####.sogo####.com.####.com/app/a/10190001/F01521097395033
i####.sogo####.com.####.com/app/a/10190001/FF1505276767728
i####.sogo####.com.####.com/app/a/200630/auto_plg_bgback
i####.sogo####.com.####.com/app/a/200630/auto_plg_bodybg
i####.sogo####.com.####.com/app/a/200630/auto_plg_btn
i####.sogo####.com.####.com/app/a/200630/auto_plg_coupon
i####.sogo####.com.####.com/app/a/200630/auto_plg_light
i####.sogo####.com.####.com/app/a/200630/auto_plg_redpacks
i####.sogo####.com.####.com/app/a/200630/autoplg_close
i####.sogo####.com.####.com/app/a/200630/close
i####.sogo####.com.####.com/app/a/200630/lucky_chick_100
i####.sogo####.com.####.com/app/a/200630/lucky_chick_1000
i####.sogo####.com.####.com/app/a/200630/lucky_chick_1g
i####.sogo####.com.####.com/app/a/200630/lucky_chick_500
i####.sogo####.com.####.com/app/a/200630/lucky_chick_eggs
i####.sogo####.com.####.com/app/a/200630/lucky_chick_lucky
i####.sogo####.com.####.com/app/a/200630/lucky_chick_prizebg
i####.sogo####.com.####.com/app/a/200630/lucky_w1_background
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball1
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball2
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball3
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball4
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball5
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball6
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball7
i####.sogo####.com.####.com/app/a/200630/lucky_w1_ball_shadow
i####.sogo####.com.####.com/app/a/200630/lucky_w1_title
i####.sogo####.com.####.com/app/a/200630/yhq_error
i####.sogo####.com.####.com/app/a/200688/2f1ee88e-e849-4875-8415-6dda9d0...
i####.sogo####.com.####.com/v2/thumb/resize/w/190/h/258?appid=####&name=...
m.lu.s####.com/apt/app/readingTime/get?uid=####&sdkandroid=####&cuuid=##...
m.lu.s####.com/yhq_ask?ppid=####&eid=####&uid=####&count=####&info=####&...
m.lu.s####.com/yhq_c?ppid=####&eid=####&uid=####&count=####&info=####&tp...
p####.s####.com/abs/android/config?uid=####&sdkandroid=####&cuuid=####&p...
p####.s####.com/abs/android/v3/css/app/publication.css?v=####
p####.s####.com/abs/android/v3/css/swiper.css?v=####
p####.s####.com/abs/android/v3/font/FZNewShuSong.ttf?v=####
p####.s####.com/abs/android/v3/images/common/sogou_read.png?v=####
p####.s####.com/abs/android/v3/images/sprite/sprite_app.png?v=####
p####.s####.com/abs/android/v3/images/sprite/sprite_common.png?v=####
p####.s####.com/abs/android/v3/publication?cuuid=####&ppid=####&token=##...
p####.s####.com/abs/checkupdate?uid=####&sdkandroid=####&cuuid=####&cli=...
p####.s####.com/abs/checkupdate?uid=####&sdkandroid=####&cuuid=####&ppid...
p####.s####.com/abs/images/bg190x258.png
p####.s####.com/abs/images/tj.gif?t=####&type=####&page=####&cuuid=####&...
p####.s####.com/abs/images/tj.gif?t=####&type=####&page=####&id=####&cuu...
p####.s####.com/abs/js/echo.js?v=####
p####.s####.com/abs/js/pb.js?v=####
p####.s####.com/abs/js/swiper.min.js?v=####
p####.s####.com/abs/js/zepto.min.v1.0rc1.js?v=####
p####.s####.com/pv.gif?t=1532175533421&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1532175534002&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1532175534078&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/pv.gif?t=1532175534079&uigs_productid=yuedu&host=k.sogou...
p####.s####.com/s/api/android/bb/recharged?uid=####&sdkandroid=####&cuui...
p####.s####.com/s/api/android/refactor/b?uid=####&sdkandroid=####&cuuid=...
p####.s####.com/s/api/android/refactor/identify/userid2sgid?uid=####&sdk...
p####.s####.com/yhq?p=####
p####.s####.com/yhq_fst?cuuid=####&s=####&ppid=####&token=####&imei=####...
tm.as####.cn:6088/c/1532175490132
y####.s####.com/app/identify/register/visitor?uuid=####&sign=####

Запросы HTTP POST:

a####.u####.com/app_logs
amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
m.lu.s####.com/pv.gif?uigs_productid=####&send=####&filename=####&conten...
m.lu.s####.com/pv.gif?uigs_productid=####&send=####&log=####
m.lu.s####.com/pv.gif?uigs_productid=####&send=####&log=####&action_type...
m.lu.s####.com/pv.gif?uigs_productid=yuedu_app_android_pb&send=android&f...
p####.cy####.cn/athene/do
p####.cy####.cn/hello/where
p####.s####.com/pv.gif?uigs_productid=####&send=####&filename=####
p####.s####.com/pv.gif?uigs_productid=####&send=####&filename=####&conte...
p####.s####.com/pv.gif?uigs_productid=####&send=####&log=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
tm.as####.cn:6088/p/1532175490409
tm.as####.cn:6088/s/
y####.s####.com/pv.gif?uigs_productid=####&send=####&filename=####&conte...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/356507059351895
/data/data/####/3E11B3001FEC13B19B92C61F781AF6DD.jar
/data/data/####/3E11B3001FEC13B19B92C61F781AF6DD.tmp
/data/data/####/4.8.30.xml
/data/data/####/77416b4f33774639557a582f496e394954504c5946513d3d.xml
/data/data/####/77416b4f33774639557a582f496e394954504c5946513d3d.xml.bak
/data/data/####/ACCS_BINDumeng;5704d46567e58ef95e0020d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak (deleted)
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/Alvin2.xml.bak (deleted)
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/SOGOUPLUS_CONFIG.xml
/data/data/####/SOGOUPLUS_CONFIG.xml.bak
/data/data/####/SOGOUPLUS_CONFIG.xml.bak (deleted)
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/accs.db-journal
/data/data/####/activate_356507059351895
/data/data/####/af385e14-b1c8-46a4-8fed-f8efbb32971e_0
/data/data/####/af385e14-b1c8-46a4-8fed-f8efbb32971e_1
/data/data/####/af385e14-b1c8-46a4-8fed-f8efbb32971e_2
/data/data/####/agoo.pid
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn_feng_skin_pref.xml
/data/data/####/com.sogou.novel-1.apk.classes-807688691.zip
/data/data/####/com.sogou.novel.push_service_setting.xml
/data/data/####/d92483e86308758f188f2bc4ce268703.0
/data/data/####/d92483e86308758f188f2bc4ce268703.apk
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/file_log.txt
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&4.8.30_1532175478879_envelope.log
/data/data/####/immediate_active
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mkoyhl
/data/data/####/multidex.version.xml
/data/data/####/push_state_356507059351895
/data/data/####/share_storage_name.xml
/data/data/####/sn_ad_sp.xml
/data/data/####/sogou.xml
/data/data/####/sogou.xml.bak
/data/data/####/sogou.xml.bak (deleted)
/data/data/####/sogounovel.db-journal
/data/data/####/sp_app_config.xml
/data/data/####/sp_app_config.xml.bak
/data/data/####/sp_app_config_reddot.xml
/data/data/####/sp_app_content.xml
/data/data/####/sp_app_font_settings.xml
/data/data/####/sp_push_status.xml
/data/data/####/sp_sogou_novel.xml
/data/data/####/sp_sogou_push.xml
/data/data/####/sp_sogou_time.xml
/data/data/####/sp_user.xml
/data/data/####/sp_user.xml.bak (deleted)
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml (deleted)
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/.vistor.sgnt
/data/media/####/07f3a2a575794170b1501209dbf81561
/data/media/####/28574a500c53488da1ff49efdb23b05f
/data/media/####/55654c24ad9e4aa895024a6f42694ad4
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/adv
/data/media/####/config
/data/media/####/deviceId
/data/media/####/deviceToken
/data/media/####/e00bbe43acfa48d78de3f617e44acc40
/data/media/####/master
/data/media/####/master.lock

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5704d46567e58ef95e0020d2","utdid":"W1MkdoOmcpMDAGdzx1HOUNeL","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
ls /
ls /sys/class/thermal
sh

Загружает динамические библиотеки:

sogouupdcore
tnet-3.1

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней