Android.RemoteCode.929

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.363.origin
Android.RemoteCode.41.origin
Android.Xiny.20

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) acti####.guav####.cn:80
TCP(HTTP/1.1) www.ye####.org:80
TCP(HTTP/1.1) cdn.danj####.com:80
TCP(HTTP/1.1) v####.6####.com:80
TCP(HTTP/1.1) acti####.danj####.com.####.com:80
TCP(HTTP/1.1) en####.tui####.com:80
TCP(HTTP/1.1) p2.ai####.com:80
TCP(HTTP/1.1) img.danj####.com:80
TCP(HTTP/1.1) z.no####.net:80
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) yun.tuis####.com:80
TCP(HTTP/1.1) do.soi####.com.####.com:80
TCP(HTTP/1.1) embe####.d####.com.cn:80
TCP(HTTP/1.1) m.e####.com:80
TCP(HTTP/1.1) ip.ch####.com:80
TCP(HTTP/1.1) yun.guav####.cn.####.com:80
TCP(HTTP/1.1) m.sdm####.com:80
TCP(HTTP/1.1) sdk.91a####.com:80
TCP(HTTP/1.1) m1.laogeda####.com:80
TCP(HTTP/1.1) cd.kw####.com:80
TCP(HTTP/1.1) w####.5####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) res.ad####.cn:443
TCP(TLS/1.0) 1####.217.17.46:443
TCP(TLS/1.0) st####.adhu####.com.####.com:443
TCP(TLS/1.0) act.ad####.cn:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) dis####.in####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) a####.b####.com:443
TCP(TLS/1.0) s####.tc.qq.com:443
TCP(TLS/1.0) i####.adhu####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) acti####.danj####.com.####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443

Запросы DNS:

a####.b####.com
act.ad####.cn
acti####.danj####.com
acti####.guav####.cn
aliyuno####.oss-cn-####.aliy####.com
aliyuns####.oss-cn-####.aliy####.com
aliyuns####.oss-cn-####.aliy####.com
c####.mm####.com
c.c####.com
cd.kw####.com
cdn.danj####.com
dis####.in####.com
do.soi####.com
ei.c####.com
embe####.d####.com.cn
en####.tui####.com
hotfix####.oss-cn-####.aliy####.com
i####.adhu####.com
i####.adhu####.com
i####.adhu####.com
img.danj####.com
ip.ch####.com
m.cuda####.com
m.e####.com
m.sdm####.com
m1.laogeda####.com
p2.ai####.com
r####.wx.qq.com
res.ad####.cn
s19.c####.com
s22.c####.com
s23.c####.com
sdk.91a####.com
ssl.gst####.com
st####.adhu####.com
v####.6####.com
w####.5####.com
w####.5####.com
www.go####.com
www.gst####.com
www.ye####.org
yun.guav####.cn
yun.tuis####.com
z####.heyc####.net
z.no####.net
z1.c####.com
z5.c####.com
z8.c####.com

Запросы HTTP GET:

acti####.danj####.com.####.com/activity/rotate?key=####
acti####.danj####.com.####.com/dist/base/css/redbox.css
acti####.danj####.com.####.com/dist/rotate/css/actBase.css
acti####.danj####.com.####.com/dist/rotate/css/alertskin.css
acti####.danj####.com.####.com/dist/rotate/css/common.css
acti####.danj####.com.####.com/dist/rotate/css/index.css
acti####.danj####.com.####.com/dist/rotate/css/prizelist.css
acti####.guav####.cn/activity/getAllSkin?timestamp=####&pageId=####
acti####.guav####.cn/activity/getReturnPage?slotId=####&id=####&login=##...
acti####.guav####.cn/activity/showLog?dpm=####&couponSource=####&orderId...
acti####.guav####.cn/mainMeet/index?id=####&slotId=####&login=####&appKe...
acti####.guav####.cn/statistics/click?dpm=####&consumer_id=####&domain4W...
cdn.danj####.com/img/bg/nh4xzvuva10.jpg
cdn.danj####.com/img/bg/tmbyrkg11i.png
do.soi####.com.####.com/201809/wli.jar
embe####.d####.com.cn/exposure/standard?dpm=####&consumer_id=####&domain...
embe####.d####.com.cn/exposure/standard?dpm=####&couponSource=####&order...
en####.tui####.com/index/activity?appKey=####&adslotId=####
img.danj####.com/img/gifts/4uu27nmhdi.png
img.danj####.com/img/gifts/6ss5q2o65t.png
img.danj####.com/img/gifts/7c44te47fr.png
img.danj####.com/img/gifts/dpk2i9q1fy.png
img.danj####.com/img/gifts/nelxdl9h2h.png
img.danj####.com/img/gifts/rkbvinsiby.png
ip.ch####.com/getip.aspx
m.e####.com/oMKzeaCU8s3O.php?o=####&i=####&s=####&ad=####
m.e####.com/shengwuyanjiu/08/31229.html
m.sdm####.com/0HSM1D7aSIAS.php?o=####&i=####&s=####&ad=####
m.sdm####.com/rengongzhinen/04/5002.html
m1.laogeda####.com/ads/admaster24.php?o=####
m1.laogeda####.com/ads/admaster240.php?o=####
m1.laogeda####.com/templets/tui/js/jquery-1.8.3.min.js
p2.ai####.com/activity/index?key=####
sdk.91a####.com/static/20180829152952mod.enc
yun.guav####.cn.####.com/babi/img/icp1duhszw.gif
yun.guav####.cn.####.com/h5-mami/common/actBase_201809262012.css
yun.guav####.cn.####.com/h5-mami/common/actBase_201809301526.js
yun.guav####.cn.####.com/h5-mami/common/common_201802011416.css
yun.guav####.cn.####.com/h5-mami/common/common_201809301526.js
yun.guav####.cn.####.com/h5-mami/common/statistics-3_201809192057.js?t=#...
yun.guav####.cn.####.com/h5-mami/h5-discern-simulator-1.0.19.min.js?t=####
yun.guav####.cn.####.com/h5-mami/intercept_201709140000.js?t=####
yun.guav####.cn.####.com/h5-mami/mainMeeting/components/base_20180124133...
yun.guav####.cn.####.com/h5-mami/mainMeeting/components/base_20180124163...
yun.guav####.cn.####.com/h5-mami/mainMeeting/components/common_201804251...
yun.guav####.cn.####.com/h5-mami/optimize/prefetch-iframe2.html?css=####...
yun.tuis####.com/h5-mami/activity/turnCircle/image/point.png
yun.tuis####.com/h5-mami/activity/turnCircle/image/rule.png
yun.tuis####.com/h5-mami/couponPrize/alipay/index_201807161748.css
yun.tuis####.com/h5-mami/couponPrize/alipay/index_201807161748.js
yun.tuis####.com/h5-mami/dist/plugin-vendors.0fd3b50c2180fbf5b46f.js
yun.tuis####.com/h5-mami/mainMeeting/car/bg.png
yun.tuis####.com/h5-mami/mainMeeting/car/car.png
yun.tuis####.com/h5-mami/mainMeeting/car/cointip.png
yun.tuis####.com/h5-mami/mainMeeting/car/countdown.png
yun.tuis####.com/h5-mami/mainMeeting/car/endgame.png
yun.tuis####.com/h5-mami/mainMeeting/car/fifty.png
yun.tuis####.com/h5-mami/mainMeeting/car/gcar.png
yun.tuis####.com/h5-mami/mainMeeting/car/glow.png
yun.tuis####.com/h5-mami/mainMeeting/car/good.png
yun.tuis####.com/h5-mami/mainMeeting/car/gtext1.png
yun.tuis####.com/h5-mami/mainMeeting/car/gtext2.png
yun.tuis####.com/h5-mami/mainMeeting/car/gtext3.png
yun.tuis####.com/h5-mami/mainMeeting/car/guidepic3.png
yun.tuis####.com/h5-mami/mainMeeting/car/hand1.png
yun.tuis####.com/h5-mami/mainMeeting/car/hand2.png
yun.tuis####.com/h5-mami/mainMeeting/car/hand3.png
yun.tuis####.com/h5-mami/mainMeeting/car/hand4.png
yun.tuis####.com/h5-mami/mainMeeting/car/hb.png
yun.tuis####.com/h5-mami/mainMeeting/car/index1_201803271532.js
yun.tuis####.com/h5-mami/mainMeeting/car/index_201803121449.css
yun.tuis####.com/h5-mami/mainMeeting/car/jinbi.png
yun.tuis####.com/h5-mami/mainMeeting/car/left.png
yun.tuis####.com/h5-mami/mainMeeting/car/lightning.png
yun.tuis####.com/h5-mami/mainMeeting/car/lihe.png
yun.tuis####.com/h5-mami/mainMeeting/car/line.png
yun.tuis####.com/h5-mami/mainMeeting/car/lines.png
yun.tuis####.com/h5-mami/mainMeeting/car/luzhang.png
yun.tuis####.com/h5-mami/mainMeeting/car/playAgain.png
yun.tuis####.com/h5-mami/mainMeeting/car/prizebg.png
yun.tuis####.com/h5-mami/mainMeeting/car/right.png
yun.tuis####.com/h5-mami/mainMeeting/car/score.png
yun.tuis####.com/h5-mami/mainMeeting/car/tree1.png
yun.tuis####.com/h5-mami/mainMeeting/car/tree2.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/ani-0.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/ani-1.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/ani-2.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/ani-3.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/ani-4.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/index_201803071047.css
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/index_201803071047.js
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/lose.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/luck-img.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/lucky-bg.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/lucky-btn.png
yun.tuis####.com/h5-mami/pluginAct/a_car_opt/score.png
yun.tuis####.com/h5-mami/recommend/index_201801111255.css
yun.tuis####.com/h5-mami/recommend/index_201801111255.js
yun.tuis####.com/h5-mami/thanksPrize/index_201801031425.css
yun.tuis####.com/h5-mami/thanksPrize/index_201803121444.js
yun.tuis####.com/mami-media/img/lx5ysx9baj.png
yun.tuis####.com/mami-media/img/x11j1n2t7d.png?x-oss-process=####

Запросы HTTP POST:

acti####.guav####.cn/pluginTools/dojoin
acti####.guav####.cn/pluginTools/embeddedIndex
acti####.guav####.cn/pluginTools/index
acti####.guav####.cn/pluginTools/result
acti####.guav####.cn/pluginTools/timingIndex
cd.kw####.com/c
sdk.91a####.com/api/DeviceReport.ashx
v####.6####.com/0/ca477c3b25914a5f821296be846eca73.html
v####.6####.com/18/a41844eff5ff4a0a96c9603142acfcf6.html
v####.6####.com/20/8c10c5184b36491eb6ed32bdbafb1eb4.html
v####.6####.com/api/CheckModule.ashx
v####.6####.com/api/GetLockAppOpenTask.ashx
v####.6####.com/api/GetModuleConfig.ashx
v####.6####.com/api/GetPkNameList.ashx
v####.6####.com/api/ReportAppLog.ashx
w####.5####.com/0/76179c31f5d04e21bcf7fee1debf1df1.html
www.ye####.org/i?requestId=####&g=####
z####.heyc####.net/getlist
z####.heyc####.net/xlogin
z.no####.net/m/a/f
z.no####.net/m/a/t

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/89PSpJClH.jar
/data/data/####/JSON.xml
/data/data/####/Mv2HHByrkJ.jar
/data/data/####/W_Key.xml
/data/data/####/WebViewSettings.xml
/data/data/####/base.js
/data/data/####/biM88SfC.jar
/data/data/####/com.SoGoyyb.stickhero_preferences.xml
/data/data/####/com.wpd.game.popstar.xml
/data/data/####/common.js
/data/data/####/countClickIP.xml
/data/data/####/cpro.baidu.com.js
/data/data/####/cxh_0.xml
/data/data/####/cxh_1.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/dpi
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/gamesetpara.xml
/data/data/####/hid.db
/data/data/####/index
/data/data/####/ju4ttU.jar
/data/data/####/lcBT1y.jar
/data/data/####/m.baidu.com.js
/data/data/####/m.chinebuy.com.js
/data/data/####/max_pref.xml
/data/data/####/mod.dec
/data/data/####/mod.dex
/data/data/####/mod.enc
/data/data/####/phan.xml
/data/data/####/st.xml
/data/data/####/start.js
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nid
/data/media/####/5.1wli.jar.u
/data/media/####/id.tmp
/data/media/####/restime.dat

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
getprop
ls -l /dev
ls -l /dev/block
ls -l /dev/block/vold
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuctl/apps
ls -l /dev/cpuctl/apps/bg_non_interactive
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/log
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ps

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней