Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.RemoteCode.32
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) a####.wagbr####.t####.####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) g.al####.com:80
- TCP(HTTP/1.1) www.ta####.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) wild####.al####.com.####.net:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) h5####.p####.cn:80
- TCP(HTTP/1.1) a####.al####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) log.mm####.com:80
- TCP(HTTP/1.1) pco####.c####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) a.c####.com:80
- TCP(HTTP/1.1) pco####.ali####.com:80
- TCP(HTTP/1.1) gxb.mm####.com:80
- TCP(HTTP/1.1) afp.al####.com:80
- TCP(TLS/1.0) huhu-12####.f####.myqc####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) t####.renyan####.com:443
- TCP(TLS/1.0) gw.al####.com:443
- TCP(TLS/1.0) re####.al####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) us-aebr####.ali####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
Запросы DNS:
- a####.al####.com
- a.c####.com
- af####.ali####.com
- af####.ali####.com
- afp.al####.com
- afpt####.ali####.com
- app.jjl-####.com
- at.al####.com
- c.c####.com
- fee.feiyunh####.com
- fou####.ali####.com
- g.al####.com
- gm.mm####.com
- gw.al####.com
- gxb.mm####.com
- h5####.p####.cn
- huhu-12####.f####.myqc####.com
- i####.51.la
- img.al####.com
- int.d####.s####.####.cn
- ip.ta####.com
- js.u####.51.la
- log.mm####.com
- mt####.go####.com
- new.c####.com
- pass####.u####.com
- pco####.ali####.com
- pco####.c####.com
- re####.al####.com
- s.c####.com
- s22.c####.com
- s5.c####.com
- t####.renyan####.com
- tce.ta####.com
- w.c####.com
- www.c####.com
- www.ta####.com
- www.u####.com
- z1.c####.com
- z13.c####.com
Запросы HTTP GET:
- a####.al####.com/acookie.html
- a####.al####.com/afp-creative/creative/u46686923/a33c97c31b5e8aef10ebbaa...
- a####.al####.com/afp-creative/creative/u46686923/ca4c3bf3d5851a60ce9a55a...
- a####.al####.com/afp-creative/creative/u46686923/cb538b6141cb0feb4c1ab63...
- a####.al####.com/afp-creative/creative/u46686923/e7452824c6e75973bc96512...
- a####.al####.com/afp-creative/creative/u46686923/fe3fcd5538d95ae880bd15f...
- a####.al####.com/g/mm/afp-cdn/JS/k.js
- a####.al####.com/g/mm/afp-cdn/JS/r.js
- a####.wagbr####.t####.####.com/acookie.html
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_55850014&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56000332&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322240&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322262&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56344564&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56350295&sp=1&c...
- a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56350300&sp=1&c...
- a####.wagbr####.t####.####.com/imp?bid=####&pid=####&cid=####&mid=####&o...
- a####.wagbr####.t####.####.com/opt?bid=####&pid=####&cid=####&mid=####&o...
- a.c####.com/dplusTrack/?data=ey####&img=####&ip=####&dataver=####&_=####
- afp.al####.com/t/font_472294_6z2llm7grb7.ttf
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/dplus.php?id=####
- c.c####.com/stat.php?id=####&web_id=####&show=####
- g.al####.com/??kissy/####
- g.al####.com/ali-mod/??umsite-####
- g.al####.com/alilog/??s/8.5.8/aplus_std.js?v=####
- g.al####.com/alilog/aplus_cplugin/0.4.4/monitor.js
- g.al####.com/alilog/aplus_cplugin/0.4.4/toolkit.js
- g.al####.com/alilog/mlog/aplus_v2.js
- g.al####.com/alilog/oneplus/entry.js?t=####
- g.al####.com/alilog/s/8.5.8/plugin/aplus_client.js
- g.al####.com/alilog/s/8.5.8/plugin/aplus_spmact.js
- g.al####.com/code/npm/@ali/??straw/1####
- g.al####.com/code/npm/@ali/init-kissy-pc/0.0.11/index.js
- g.al####.com/dt/tracker/3.4.10/tracker.Tracker.js
- g.al####.com/dt/tracker/3.4.11/tracker.performanceTrackerPlugin.js
- g.al####.com/kissy/k/6.2.4/??base-mi####
- g.al####.com/kissy/k/6.2.4/??promise####
- g.al####.com/sd/sufei/0.2.4/app/common/sufei-kissy.js
- g.al####.com/secdev/entry/index.js?t=####
- g.al####.com/secdev/sufei_data/3.6.2/index.js
- g.al####.com/tbc/global/0.0.8/index-min.css
- g.al####.com/um-f2e/alicare/0.0.40/umeng_message.js
- g.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.css
- g.al####.com/um-f2e/assets/1.0.8/umsite-footer/index.js
- g.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.css?r=####
- g.al####.com/um-f2e/assets/1.1.1/umsite-nav/index.js
- gm.mm####.com/mm.req.load?page=####&info=####&stack=####&filename=####&m...
- gxb.mm####.com/gxb.gif?si=####&ref=####&lang=####&bw=####&bh=####&pu=###...
- h5####.p####.cn/Play/H6Category?t=####
- h5####.p####.cn/Play/H6Home
- h5####.p####.cn/Play/H6v1vip
- h5####.p####.cn/Play/Live
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- ip.ta####.com/service/getIpInfo2.php?ip=####
- js.u####.51.la/19560175.js
- log.mm####.com/eg.js
- log.mm####.com/v.gif?logtype=####&title=####&pre=####&scr=####&cna=####&...
- log.mm####.com/w.gif?logtype=1&pre=http://new.cnzz.com/v1/login.php?site...
- pco####.ali####.com/app.gif?&cna=####
- pco####.c####.com/app.gif?&cna=####
- sh.wagbr####.alibaba####.com/
- sh.wagbr####.alibaba####.com/api/user/publicHeader?_ksTS=####&callback=#...
- sh.wagbr####.alibaba####.com/api/user/publicHeader?callback=####
- sh.wagbr####.alibaba####.com/stat/website.php?web_id=####
- sh.wagbr####.alibaba####.com/tms/html/www/script/alicare
- sh.wagbr####.alibaba####.com/tms/jsonp/www/data/products?callback=####&r...
- sh.wagbr####.alibaba####.com/tms/jsonp/www/data/solutions?callback=####&...
- sh.wagbr####.alibaba####.com/v1/images/an_download.gif
- sh.wagbr####.alibaba####.com/v1/images/ios_download.gif
- sh.wagbr####.alibaba####.com/v1/images/login/bqline.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button01.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button02.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button03.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button04.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button05.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button06.gif
- sh.wagbr####.alibaba####.com/v1/images/login/button07.gif
- sh.wagbr####.alibaba####.com/v1/images/login/check.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/leftback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/logo.gif
- sh.wagbr####.alibaba####.com/v1/images/login/titleback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/toolback.jpg
- sh.wagbr####.alibaba####.com/v1/images/login/topback.jpg
- sh.wagbr####.alibaba####.com/v1/images/qr/qr.php?siteid=####
- sh.wagbr####.alibaba####.com/v1/images/validate.php
- sh.wagbr####.alibaba####.com/v1/login.php?siteid=####
- wild####.al####.com.####.net/tfs/TB11XTwa9CWBuNjy0FhXXb6EVXa-631-154.png
- wild####.al####.com.####.net/tfs/TB15zpnXuuSBuNjy1XcXXcYjFXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB16jHBaVOWBuNjy0FiXXXFxVXa-839-86.png
- wild####.al####.com.####.net/tfs/TB1FY2uaYGYBuNjy0FoXXciBFXa-181-181.png
- wild####.al####.com.####.net/tfs/TB1HXRmXuuSBuNjy1XcXXcYjFXa-190-190.gif
- wild####.al####.com.####.net/tfs/TB1M9B7qTtYBeNjy1XdXXXXyVXa-58-58.jpg
- wild####.al####.com.####.net/tfs/TB1T4DKa4GYBuNjy0FnXXX5lpXa-176-176.png
- wild####.al####.com.####.net/tfs/TB1YVTwa9CWBuNjy0FhXXb6EVXa-623-167.png
- wild####.al####.com.####.net/tfs/TB1YYLMa4GYBuNjy0FnXXX5lpXa-982-105.png
- wild####.al####.com.####.net/tfs/TB1YroqmQyWBuNjy0FpXXassXXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1ZYLMa4GYBuNjy0FnXXX5lpXa-218-218.png
- wild####.al####.com.####.net/tfs/TB1hb2uaYGYBuNjy0FoXXciBFXa-4-58.png
- wild####.al####.com.####.net/tfs/TB1nl3daYGYBuNjy0FoXXciBFXa-228-80.jpg
- wild####.al####.com.####.net/tfs/TB1p4eiFTtYBeNjy1XdXXXXyVXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1qVD7dXOWBuNjy0FiXXXFxVXa-2880-800.jpg
- wild####.al####.com.####.net/tfs/TB1wPbsaYGYBuNjy0FoXXciBFXa-176-176.png
- wild####.al####.com.####.net/tfs/TB1wpfOFuuSBuNjy1XcXXcYjFXa-2880-800.png
- wild####.al####.com.####.net/tfs/TB1wtHJaY9YBuNjy0FgXXcxcXXa-133-133.png
- www.ta####.com/markets/umplus/block/assets/iconfont
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/EOZTzhVG.jar
- /data/data/####/cimhv.bdsht.vryuxkq.ijy_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/device_id.xml.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000c (deleted)
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/index
- /data/data/####/libus.so
- /data/data/####/libvia_pay.so
- /data/data/####/multidex.version.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/journal.tmp
Другие:
Загружает динамические библиотеки:
- gdahc
- us
- via_pay
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- RSA
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
