Android.RemoteCode.682

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.RemoteCode.32

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) m.t####.ch####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) a####.wagbr####.t####.####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) q.c####.com:80
TCP(HTTP/1.1) log.mm####.com:80
TCP(HTTP/1.1) s####.ch####.com:80
TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
TCP(HTTP/1.1) css.t####.ch####.####.com:80
TCP(HTTP/1.1) hm1.c####.com:80
TCP(HTTP/1.1) a2.zhanz####.net:80
TCP(HTTP/1.1) l####.ch####.com:80
TCP(HTTP/1.1) h5####.p####.cn:80
TCP(HTTP/1.1) a####.al####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) pco####.c####.com:80
TCP(HTTP/1.1) i####.51.la:80
TCP(HTTP/1.1) www.ta####.com:80
TCP(HTTP/1.1) js.u####.51.la:80
TCP(HTTP/1.1) pco####.ali####.com:80
TCP(HTTP/1.1) a1.zhanz####.net:80
TCP(HTTP/1.1) gxb.mm####.com:80
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) m.ta####.com:80
TCP(HTTP/1.1) em.b####.com:80
TCP(TLS/1.0) huhu-12####.f####.myqc####.com:443
TCP(TLS/1.0) b.mj####.com:443
TCP(TLS/1.0) t####.renyan####.com:443
TCP(TLS/1.0) gw.al####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) re####.al####.com:443
TCP(TLS/1.0) a.mj####.com.####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) m.ta####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443

Запросы DNS:

a####.al####.com
a.mj####.com
a1.zhanz####.net
a2.zhanz####.net
af####.ali####.com
af####.ali####.com
afp.al####.com
afpt####.ali####.com
app.jjl-####.com
b.mj####.com
c####.baidust####.com
c####.baidust####.com
c####.mm####.com
c.c####.com
css.t####.ch####.com
em.b####.com
fee.feiyunh####.com
gw.al####.com
gxb.mm####.com
h####.c####.com
h####.c####.com
h####.c####.com
h5####.p####.cn
h5.m.ta####.com
hm1.c####.com
huhu-12####.f####.myqc####.com
i####.51.la
i####.c####.com
img.al####.com
int.d####.s####.####.cn
ip.ta####.com
js.u####.51.la
l####.ch####.com
log.mm####.com
m.t####.ch####.com
m.ta####.com
my.ch####.com
new.c####.com
pco####.ali####.com
pco####.c####.com
pos.b####.com
q3.c####.com
re####.al####.com
s####.ch####.com
s.c####.com
s11.c####.com
s13.c####.com
s19.c####.com
s22.c####.com
s5.c####.com
t####.renyan####.com
w.c####.com
www.c####.com
www.ta####.com
z1.c####.com
z7.c####.com

Запросы HTTP GET:

a####.al####.com/acookie.html
a####.al####.com/afp-creative/creative/u46686923/527c168cffa4245269c1b1a...
a####.al####.com/afp-creative/creative/u46686923/a33c97c31b5e8aef10ebbaa...
a####.al####.com/afp-creative/creative/u46686923/ca4c3bf3d5851a60ce9a55a...
a####.al####.com/afp-creative/creative/u46686923/cb538b6141cb0feb4c1ab63...
a####.al####.com/afp-creative/creative/u46686923/df96851c838335e43c5bec7...
a####.al####.com/afp-creative/creative/u46686923/e7452824c6e75973bc96512...
a####.al####.com/afp-creative/creative/u46686923/fe3fcd5538d95ae880bd15f...
a####.al####.com/g/mm/afp-cdn/JS/k.js
a####.al####.com/g/mm/afp-cdn/JS/r.js
a####.wagbr####.t####.####.com/acookie.html
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_55850014&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56000332&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322240&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56322262&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56332536&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56338420&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56344564&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56350295&sp=1&c...
a####.wagbr####.t####.####.com/ex?a=mm_46686923_14002394_56350300&sp=1&c...
a####.wagbr####.t####.####.com/imp?bid=####&pid=####&cid=####&mid=####&o...
a####.wagbr####.t####.####.com/opt?bid=####&pid=####&cid=####&mid=####&o...
a1.zhanz####.net/rlptepi.js
a1.zhanz####.net/site/vr8s7.js?tod=####
a2.zhanz####.net/dbgcvnmn?olp=####&dpk=####&kp=####&sab=####&kat=####&wz...
a2.zhanz####.net/m.html?baidu_error=####&timestamp=####
a2.zhanz####.net/qpfn/i?c=####
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/cpro/ui/pr.js
c.c####.com/c.php?id=####
c.c####.com/c.php?id=####&l=####
c.c####.com/core.php?web_id=####&l=####&t=####
c.c####.com/core.php?web_id=####&show=####&t=####
c.c####.com/core.php?web_id=####&t=####
c.c####.com/img/2.gif
c.c####.com/img/pic.gif
c.c####.com/stat.php?id=####&web_id=####
c.c####.com/stat.php?id=####&web_id=####&show=####
css.t####.ch####.####.com/common/js/jq-public.js?v=####
css.t####.ch####.####.com/common/js/jquery-1.11.3.min.js
css.t####.ch####.####.com/common/js/mobilepage.js?v=####
css.t####.ch####.####.com/common/styles/all-base.css?v=####
css.t####.ch####.####.com/common/styles/publicstyle.css?v=####
css.t####.ch####.####.com/tools/styles/linkstyle.css
em.b####.com/pixel?media_sign=####&media_site=####
gm.mm####.com/9.gif?abc=####&rnd=####
gxb.mm####.com/gxb.gif?si=####&ref=####&lang=####&bw=####&bh=####&pu=###...
h5####.p####.cn/Play/H6Home
h5####.p####.cn/Play/H6v1vip
hm1.c####.com/heatmap.gif?id=30001831&x=385&y=880&w=980&s=600x800&b=safa...
i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
ip.ta####.com/service/getIpInfo2.php?ip=####
js.u####.51.la/19560175.js
l####.ch####.com/
l####.ch####.com/js/links.js
log.mm####.com/w.gif?logtype=1&pre=http://new.cnzz.com/v1/login.php?site...
m.t####.ch####.com/links
m.t####.ch####.com/template/default/images/acarat-d-black.png
m.t####.ch####.com/template/default/images/acarat-r-black.png
m.t####.ch####.com/template/default/images/tico-fanhui32.png
m.t####.ch####.com/template/default/images/tico-menu32.png
m.t####.ch####.com/template/default/images/toolbanner.png
m.t####.ch####.com/template/default/js/globals.js
m.t####.ch####.com/template/default/js/jquery-1.11.1.min.js
m.t####.ch####.com/template/default/js/jquery.mobile-1.4.5.min.js
m.t####.ch####.com/template/default/js/jquery.my-custom-theme.js
m.t####.ch####.com/template/default/style/images/ajax-loader.gif
m.t####.ch####.com/template/default/style/jquery.mobile-1.4.5.min.css
m.t####.ch####.com/template/default/style/my-custom-theme.min.css
m.ta####.com/?sprefer=####
pco####.ali####.com/app.gif?&cna=####
pco####.c####.com/app.gif?&cna=####
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cja=####&exps=####&ps...
q.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
s####.ch####.com/gj_g/seo_468.js
s####.ch####.com/gj_g/seo_a.js
s####.ch####.com/gj_g/todqwquqn.js
sh.wagbr####.alibaba####.com/stat/website.php?web_id=####
sh.wagbr####.alibaba####.com/v1/images/an_download.gif
sh.wagbr####.alibaba####.com/v1/images/ios_download.gif
sh.wagbr####.alibaba####.com/v1/images/login/bqline.gif
sh.wagbr####.alibaba####.com/v1/images/login/button01.gif
sh.wagbr####.alibaba####.com/v1/images/login/button02.gif
sh.wagbr####.alibaba####.com/v1/images/login/button03.gif
sh.wagbr####.alibaba####.com/v1/images/login/button04.gif
sh.wagbr####.alibaba####.com/v1/images/login/button05.gif
sh.wagbr####.alibaba####.com/v1/images/login/button06.gif
sh.wagbr####.alibaba####.com/v1/images/login/button07.gif
sh.wagbr####.alibaba####.com/v1/images/login/check.jpg
sh.wagbr####.alibaba####.com/v1/images/login/leftback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/logo.gif
sh.wagbr####.alibaba####.com/v1/images/login/titleback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/toolback.jpg
sh.wagbr####.alibaba####.com/v1/images/login/topback.jpg
sh.wagbr####.alibaba####.com/v1/images/qr/qr.php?siteid=####
sh.wagbr####.alibaba####.com/v1/images/validate.php
sh.wagbr####.alibaba####.com/v1/login.php?siteid=####
www.ta####.com/
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/EOZTzhVG.jar
/data/data/####/cdxnpmzl.reuuxsdp.zarihmpb.qehtuf_preferences.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/device_id.xml.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000d (deleted)
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_00000f (deleted)
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/index
/data/data/####/libus.so
/data/data/####/libvia_pay.so
/data/data/####/multidex.version.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/journal.tmp

Другие:

Загружает динамические библиотеки:

jsahv
us
via_pay

Использует следующие алгоритмы для шифрования данных:

AES-ECB-PKCS5Padding
RSA

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней