Android.Spy.2195

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

106901332942: rg|229|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T385qvw3up93KB88qMLcLKZpJE.geitH8uEVQI4lNG1tgMUaTOOSwALoAqaavh8hz1cI!

Загружает на исполнение код следующих детектируемых угроз:

Android.Spy.373.origin
Android.Triada.236.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) sdk.qipa####.cn:8088
TCP(HTTP/1.1) csk.mc####.com:9003
TCP(HTTP/1.1) 1####.55.161.68:29092
TCP(HTTP/1.1) q####.a####.com:80
TCP(HTTP/1.1) dev.pu####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.com:443

Запросы DNS:

adser####.go####.com
csk.mc####.com
dev.pu####.com
keng####.funu####.com
sdk.qipa####.cn
ssl.gst####.com
www.go####.com
www.go####.nl
www.gst####.com

Запросы HTTP GET:

dev.pu####.com/mvc/lgn
q####.a####.com/
q####.a####.com/game.min.js
q####.a####.com/project.json
q####.a####.com/res/GameOver/failure_bg.png
q####.a####.com/res/GameOver/spriteFrames.plist
q####.a####.com/res/GameOver/spriteFrames.png
q####.a####.com/res/GameScene100Dollars/icon_GameScene100Dollars.png
q####.a####.com/res/GameScene100Dollars/spriteFrames.plist
q####.a####.com/res/GameScene100Dollars/spriteFrames.png
q####.a####.com/res/GameSceneBasketBall/icon_GameSceneBasketBall.png
q####.a####.com/res/GameSceneBasketBall/k_kdlq_bg.png
q####.a####.com/res/GameSceneBasketBall/spriteFrames.plist
q####.a####.com/res/GameSceneBasketBall/spriteFrames.png
q####.a####.com/res/GameSceneBeatenBoss/icon_GameSceneBeatenBoss.png
q####.a####.com/res/GameSceneBeatenBoss/k_bdlb_dazhao_guang01.png
q####.a####.com/res/GameSceneBeatenBoss/k_bdlb_dazhao_guang02.png
q####.a####.com/res/GameSceneBeatenBoss/spriteFrames.plist
q####.a####.com/res/GameSceneBeatenBoss/spriteFrames.png
q####.a####.com/res/GameSceneBeginEat/icon_GameSceneBeginEat.png
q####.a####.com/res/GameSceneBeginEat/k_kfl_bg.png
q####.a####.com/res/GameSceneBeginEat/spriteFrames.plist
q####.a####.com/res/GameSceneBeginEat/spriteFrames.png
q####.a####.com/res/GameSceneBlowGod/icon_GameSceneBlowGod.png
q####.a####.com/res/GameSceneBlowGod/spriteFrames.plist
q####.a####.com/res/GameSceneBlowGod/spriteFrames.png
q####.a####.com/res/GameSceneDwarf/icon_GameSceneDwarf.png
q####.a####.com/res/GameSceneDwarf/k_xar_bg.png
q####.a####.com/res/GameSceneDwarf/spriteFrames.plist
q####.a####.com/res/GameSceneDwarf/spriteFrames.png
q####.a####.com/res/GameSceneElevator/icon_GameSceneElevator.png
q####.a####.com/res/GameSceneElevator/k_dt_line.png
q####.a####.com/res/GameSceneElevator/spriteFrames.plist
q####.a####.com/res/GameSceneElevator/spriteFrames.png
q####.a####.com/res/GameSceneFightChick/icon_GameSceneFightChick.png
q####.a####.com/res/GameSceneFightChick/spriteFrames.plist
q####.a####.com/res/GameSceneFightChick/spriteFrames.png
q####.a####.com/res/GameSceneFunnyMonk/icon_GameSceneFunnyMonk.png
q####.a####.com/res/GameSceneFunnyMonk/k_lhs_bg.png
q####.a####.com/res/GameSceneFunnyMonk/spriteFrames.plist
q####.a####.com/res/GameSceneFunnyMonk/spriteFrames.png
q####.a####.com/res/GameSceneHitButt/icon_GameSceneHitButt.png
q####.a####.com/res/GameSceneHitButt/k_pg_bg_1.png
q####.a####.com/res/GameSceneHitButt/spriteFrames.plist
q####.a####.com/res/GameSceneHitButt/spriteFrames.png
q####.a####.com/res/GameSceneKDBusStation/icon_GameSceneKDBusStation.png
q####.a####.com/res/GameSceneKDBusStation/k_kdgjz_bg.png
q####.a####.com/res/GameSceneKDBusStation/spriteFrames.plist
q####.a####.com/res/GameSceneKDBusStation/spriteFrames.png
q####.a####.com/res/GameSceneKengGym/icon_GameSceneKengGym.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man2_ju04.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man2_ju07.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big01.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big02.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big03.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big04.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big05.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big06.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_big07.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju01.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju02.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju03.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju04.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju05.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju06.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju07.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju08.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju09.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju10.png
q####.a####.com/res/GameSceneKengGym/k_kdjsf_man_ju11.png
q####.a####.com/res/GameSceneKengGym/spriteFrames.plist
q####.a####.com/res/GameSceneKengGym/spriteFrames.png
q####.a####.com/res/GameSceneKengLock/icon_GameSceneKengLock.png
q####.a####.com/res/GameSceneKengLock/spriteFrames.plist
q####.a####.com/res/GameSceneKengLock/spriteFrames.png
q####.a####.com/res/GameSceneKengTest/icon_GameSceneKengTest.png
q####.a####.com/res/GameSceneKengTest/spriteFrames.plist
q####.a####.com/res/GameSceneKengTest/spriteFrames.png
q####.a####.com/res/GameSceneKengdieSong/icon_GameSceneKengdieSong.png
q####.a####.com/res/GameSceneKengdieSong/k_wechat_bg.png
q####.a####.com/res/GameSceneKengdieSong/spriteFrames.plist
q####.a####.com/res/GameSceneKengdieSong/spriteFrames.png
q####.a####.com/res/GameSceneMagicGloves/icon_GameSceneMagicGloves.png
q####.a####.com/res/GameSceneMagicGloves/k_qz_bg.png
q####.a####.com/res/GameSceneMagicGloves/spriteFrames.plist
q####.a####.com/res/GameSceneMagicGloves/spriteFrames.png
q####.a####.com/res/GameSceneMakeMeHappy/icon_GameSceneMakeMeHappy.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_frame.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_1.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_2.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_3.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_4.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_5.png
q####.a####.com/res/GameSceneMakeMeHappy/k_dwkx_pic_6.png
q####.a####.com/res/GameSceneMakeMeHappy/spriteFrames.plist
q####.a####.com/res/GameSceneMakeMeHappy/spriteFrames.png
q####.a####.com/res/GameSceneMischief/icon_GameSceneMischief.png
q####.a####.com/res/GameSceneMischief/spriteFrames.plist
q####.a####.com/res/GameSceneMischief/spriteFrames.png
q####.a####.com/res/GameSceneOpenDoorTricky/icon_GameSceneOpenDoorTricky...
q####.a####.com/res/GameSceneOpenDoorTricky/k_kmzr_bg.png
q####.a####.com/res/GameSceneOpenDoorTricky/spriteFrames.plist
q####.a####.com/res/GameSceneOpenDoorTricky/spriteFrames.png
q####.a####.com/res/GameScenePlayingTricks/icon_GameScenePlayingTricks.png
q####.a####.com/res/GameScenePlayingTricks/k_bxhg_bg.png
q####.a####.com/res/GameScenePlayingTricks/spriteFrames.plist
q####.a####.com/res/GameScenePlayingTricks/spriteFrames.png
q####.a####.com/res/GameSceneRollBallWar/icon_GameSceneRollBallWar.png
q####.a####.com/res/GameSceneRollBallWar/k_gqdz_land.png
q####.a####.com/res/GameSceneRollBallWar/spriteFrames.plist
q####.a####.com/res/GameSceneRollBallWar/spriteFrames.png
q####.a####.com/res/GameSceneShootPigHead/icon_GameSceneShootPigHead.png
q####.a####.com/res/GameSceneShootPigHead/k_szt_bg.png
q####.a####.com/res/GameSceneShootPigHead/spriteFrames.plist
q####.a####.com/res/GameSceneShootPigHead/spriteFrames.png
q####.a####.com/res/GameSceneSkullCry/icon_GameSceneSkullCry.png
q####.a####.com/res/GameSceneSkullCry/spriteFrames.plist
q####.a####.com/res/GameSceneSkullCry/spriteFrames.png
q####.a####.com/res/GameSceneThreeAnxious/icon_GameSceneThreeAnxious.png
q####.a####.com/res/GameSceneThreeAnxious/k_rysj_bg.png
q####.a####.com/res/GameSceneThreeAnxious/spriteFrames.plist
q####.a####.com/res/GameSceneThreeAnxious/spriteFrames.png
q####.a####.com/res/Loading/spriteFrames.plist
q####.a####.com/res/Loading/spriteFrames.png
q####.a####.com/res/MainScene/home_bg_2.png
q####.a####.com/res/MainScene/k_sy_bg.png
q####.a####.com/res/MainScene/spriteFrames.plist
q####.a####.com/res/MainScene/spriteFrames.png
q####.a####.com/res/Panel/spriteFrames.plist
q####.a####.com/res/Panel/spriteFrames.png
q####.a####.com/res/Register/login_btn_else.png
q####.a####.com/res/Register/login_btn_start.png
q####.a####.com/res/Register/login_clown_01.png
q####.a####.com/res/Register/login_clown_02.png
q####.a####.com/res/Register/login_frame.png
q####.a####.com/res/Register/login_name_box.png
q####.a####.com/res/common/com_bg_01.png
q####.a####.com/res/common/com_bg_02.png
q####.a####.com/res/common/com_frame_bg.png
q####.a####.com/res/common/common_interface.png
q####.a####.com/res/common/proload_frame.png
q####.a####.com/res/common/spriteFrames.plist
q####.a####.com/res/common/spriteFrames.png
q####.a####.com/res/icon.png
q####.a####.com/res/jieshao.png
q####.a####.com/res/levelCommon/bg1.png
q####.a####.com/res/levelCommon/bg2.png
q####.a####.com/res/levelCommon/k_dxj_hill.png
q####.a####.com/res/levelCommon/spriteFrames.plist
q####.a####.com/res/levelCommon/spriteFrames.png
q####.a####.com/res/levelCommon/spriteFrames2.plist
q####.a####.com/res/levelCommon/spriteFrames2.png
q####.a####.com/res/levelConfig.csv
q####.a####.com/res/levelSelect/spriteFrames.plist
q####.a####.com/res/levelSelect/spriteFrames.png
q####.a####.com/res/storeLayer/spriteFrames.plist
q####.a####.com/res/storeLayer/spriteFrames.png
q####.a####.com/res/video/com_btn_font_tv.png
q####.a####.com/res/video/com_btn_frame_1.png
q####.a####.com/res/video/com_btn_frame_2.png
q####.a####.com/res/video/com_tv.png
q####.a####.com/res/video/com_tv2.png
q####.a####.com/res/webCommon/web_game_btn_completion.png
q####.a####.com/res/webCommon/web_game_btn_level.png
q####.a####.com/res/webCommon/web_game_btn_skill.png
q####.a####.com/res/webCommon/web_game_btn_skill_01.png
q####.a####.com/res/webCommon/web_game_btn_skill_02.png
q####.a####.com/res/webCommon/web_game_btn_skill_03.png
q####.a####.com/res/webCommon/web_game_more.png

Запросы HTTP POST:

csk.mc####.com:9003/csk/c_s/g_f.json
csk.mc####.com:9003/csk/st_c/cn_i_sec.json
csk.mc####.com:9003/csk/st_c/cn_sk_login.json
csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
csk.mc####.com:9003/csk/st_c/getst_tegy.json
dev.pu####.com/mvc/network/get_info.do
sdk.qipa####.cn:8088/a.do

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/ApplicationCache.db-journal
/data/data/####/aa
/data/data/####/abc.xml
/data/data/####/app_test.apk
/data/data/####/brushs.xml
/data/data/####/cds.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/donmafar.jar
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/f_000055
/data/data/####/f_000056
/data/data/####/f_000057
/data/data/####/f_000058
/data/data/####/f_000059
/data/data/####/f_00005a
/data/data/####/f_00005b
/data/data/####/f_00005c
/data/data/####/fmoonStore.db
/data/data/####/fmoonStore.db-journal
/data/data/####/index
/data/data/####/kvuebdjd
/data/data/####/md.tmp
/data/data/####/qipa.apk
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Другие:

Запускает следующие shell-скрипты:

getprop
service list

Загружает динамические библиотеки:

zpenguin

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
DES

Использует следующие алгоритмы для расшифровки данных:

AES
DES
DES-CBC-PKCS5Padding
DESede

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Осуществляет доступ к информации об отправленых/принятых смс.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней