Android.Backdoor.1870

Техническая информация

Вредоносные функции:

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.114.206.188:8888
TCP(HTTP/1.1) w####.sosta####.com:7077
TCP(HTTP/1.1) api.s####.mob.com:80
TCP(HTTP/1.1) en####.tui####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) acti####.russi####.cn:80
TCP(HTTP/1.1) fp-st####.b0.a####.com:80
TCP(HTTP/1.1) yun.pop####.cn.####.com:80
TCP(HTTP/1.1) w####.sosta####.com:80
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) yun.d####.com.cn:80
TCP(HTTP/1.1) ip.ws.1####.net:80
TCP(HTTP/1.1) w####.sosta####.com:7017
TCP(HTTP/1.1) yun.russi####.cn.####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) yun.lveha####.com:80
TCP(SSL/3.0) wq####.jd.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) d####.iap####.com:443
TCP(TLS/1.0) wq####.jd.com:443
TCP(TLS/1.0) fp.ton####.net:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) union-c####.jd.com:443
TCP(TLS/1.0) fp.fraudme####.cn:443
TCP(TLS/1.0) i####.yy.com:443

Запросы DNS:

a####.exc.mob.com
a####.u####.com
acti####.russi####.cn
api.s####.mob.com
c####.mm####.com
c.c####.com
d####.iap####.com
en####.pop####.com
en####.tui####.com
fp.fraudme####.cn
fp.ton####.net
i####.yy.com
int.d####.s####.####.cn
ip.ws.1####.net
m.d####.mob.com
m.sosta####.com
re####.wow####.com
s13.c####.com
st####.fraudme####.cn
union-c####.jd.com
w####.sosta####.com
wq####.jd.com
yun.d####.com.cn
yun.lveha####.com
yun.pop####.com
yun.russi####.cn
yun.tuis####.com
yun.tuit####.com
z7.c####.com

Запросы HTTP GET:

acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
acti####.russi####.cn/api/v1/activity/get4web?request_id=####&app_key=##...
acti####.russi####.cn/api/v1/activity/spm4web?slotId=4290&app_key=461zSX...
acti####.russi####.cn/statistics/activityPagePerf?group_type=####&platfo...
en####.tui####.com/index/activity?appKey=####&adslotId=####
fp-st####.b0.a####.com/v2/fm.js?ver=####&t=####
ip.ws.1####.net/ipquery?ip=####
m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
w####.sosta####.com/admin/upload/app/05ihJNA3gCOVtwjFQXlasHL9I2FR2TwaZLG...
w####.sosta####.com/admin/upload/app/DDxQjVobVKMaO6DJ71apD6ZvX58hZtRFrLE...
w####.sosta####.com/admin/upload/app/FqRDkJp7ysu8fCZO1l7oFxCtkWzDp9LyC5T...
w####.sosta####.com/admin/upload/app/KzY7GL9Kr7KJd3KQ7QiSim9LGHihp4VSlux...
w####.sosta####.com/admin/upload/app/eR0edSnZjEzd1UMcGmxM3SSJLEFDuKfH51h...
w####.sosta####.com/admin/upload/app/fVQ18RdG8lZEOBQWBX04nSHAfoFWg1fQMSG...
w####.sosta####.com/admin/upload/app/pU1xuViXKGUfWlDOeUogfq8i7ny59Qc2gaX...
w####.sosta####.com/admin/upload/app/xnmgeJxN5F8wod2exQk4JjDK18ztNRU0UAj...
w####.sosta####.com/admin/upload/app/yYLN3ZTd3wjIJFoGoHBJhc8dK8cTaP56hSy...
w####.sosta####.com/admin/upload/hpic/head_13.webp
w####.sosta####.com/admin/upload/hpic/head_14.webp
w####.sosta####.com/admin/upload/image/20170927/1506517067787.webp
w####.sosta####.com/admin/upload/image/20170927/1506517319915.webp
w####.sosta####.com/admin/upload/image/20170927/1506517410082.webp
w####.sosta####.com/admin/upload/image/20170927/1506519271000.webp
w####.sosta####.com/admin/upload/image/20170927/1506519700839.webp
w####.sosta####.com/admin/upload/image/20170927/1506519775107.webp
w####.sosta####.com/admin/upload/image/20170927/1506519902333.webp
w####.sosta####.com/admin/upload/image/20170927/1506521377085.webp
w####.sosta####.com/admin/upload/image/20171105/1509884744765.webp
w####.sosta####.com/admin/upload/image/20171105/1509884837675.webp
w####.sosta####.com/admin/upload/image/20171105/1509884900322.webp
w####.sosta####.com/admin/upload/image/20171222/1513926226332.webp
w####.sosta####.com/admin/upload/image/20171222/1513926524102.webp
w####.sosta####.com/admin/upload/image/20171222/1513926891043.webp
w####.sosta####.com/admin/upload/image/20171222/1513927285898.webp
w####.sosta####.com/admin/upload/image/20171222/1513927617783.webp
w####.sosta####.com/admin/upload/image/20171222/1513932726670.webp
w####.sosta####.com/admin/upload/image/20171225/1514171810794.webp
w####.sosta####.com/admin/upload/image/20171225/1514171835838.webp
w####.sosta####.com/admin/upload/image/20171225/1514171855445.webp
w####.sosta####.com/admin/upload/image/20171225/1514171877523.webp
w####.sosta####.com/admin/upload/image/20171225/1514171896260.webp
w####.sosta####.com/admin/upload/image/20171225/1514171920830.webp
w####.sosta####.com/appserver/classes/Ad?where=####&limit=####&order=###...
w####.sosta####.com/appserver/classes/Album?where=####&limit=####&skip=#...
w####.sosta####.com/appserver/classes/Feed?limit=####&where=####&skip=##...
w####.sosta####.com/appserver/classes/Version?where=####&limit=####
w####.sosta####.com/olconfig.php?channel=####&h=####&imei=####&imsi=####...
w####.sosta####.com/wap/
w####.sosta####.com/wap/css/list.css?v=####
w####.sosta####.com/wap/imgs/loading.gif
w####.sosta####.com/wap/js/base-loading.js
w####.sosta####.com/wap/js/jquery-3.2.1.min.js
w####.sosta####.com:7017/getip?package=####&channel=####&ver=####
yun.d####.com.cn/h5-tuia/couponPrize/lucky.png?nnn=####
yun.lveha####.com/h5/media/media-3.2.1.min.js
yun.pop####.cn.####.com/mami-media/img/nqpm022m9a.jpg
yun.russi####.cn.####.com/h5-mami/activity/rollDice/2.0/index_2018092118...
yun.russi####.cn.####.com/h5-mami/activity/rollDick/2.0/index_2018022816...
yun.russi####.cn.####.com/h5-mami/activity/turnCircle/5.0/actBase_201809...
yun.russi####.cn.####.com/h5-mami/common/actBase_201811011651.css
yun.russi####.cn.####.com/h5-mami/common/actBase_201811051552.js
yun.russi####.cn.####.com/h5-mami/h5-discern-simulator-1.0.19.min.js?t=#...
yun.russi####.cn.####.com/mami-media/img/8hobgdioxx.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/k3rnftrwu8.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/m41lht8e84.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/opvqb1v68c.jpg?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/psdr2sc18a.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/rjruupvc3q.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/u9kwec8jrb.png?x-oss-process=####
yun.russi####.cn.####.com/mami-media/img/vptr7v0s09.png?x-oss-process=####

Запросы HTTP POST:

a####.exc.mob.com/errconf
a####.u####.com/app_logs
acti####.russi####.cn/activity/ajaxOptions
api.s####.mob.com/conf5
api.s####.mob.com/conn
api.s####.mob.com/snsconf
w####.sosta####.com/appserver/batch/save
w####.sosta####.com/report/do
w####.sosta####.com:7077/uahelper/collectdevice

Запросы HTTP PUT:

w####.sosta####.com/appserver/always_collect

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.app_sharepreference.xml
/data/data/####/.imprint
/data/data/####/.lock
/data/data/####/.mrecord
/data/data/####/.mrlock
/data/data/####/.statistics
/data/data/####/.task_sharepreference.xml
/data/data/####/0428d17f1e095e9c20511872dfc5817a
/data/data/####/0e00b09d3220d8789ff5c358fe851043fe6cce8dd2ee7d5....0.tmp
/data/data/####/163a4d8f42201e8766577d83428ce81e4cc7efe04d6b2bb....0.tmp
/data/data/####/1ff186e2167c8a815f613cab8fa853db159685b2400d81e....0.tmp
/data/data/####/234e740a2e9faa3675357f376805630a418be65f2e842e8....0.tmp
/data/data/####/2c105c314ead29a68979b7b9831b82d57e7beeabb6d9ddb....0.tmp
/data/data/####/322f2aec7f30e526932e4e979e370157
/data/data/####/3636904ad2f9743a11efe1fce66e60e0b9fddc35fa594a7....0.tmp
/data/data/####/4a199f91436658022e2ae50acd87c4b6
/data/data/####/4b3bcb290541db6c918e6cccce6ec966
/data/data/####/4ea77b1722161e81778a5e8a76e81ddaee7789c9a3f8c86....0.tmp
/data/data/####/4f506f4b1d391dae7636b65273194c094b20694399c8f24....0.tmp
/data/data/####/59c968352d7d9ae716d4b27cfb5b0c4db8bdd4a2157f7b3....0.tmp
/data/data/####/6486644581d7633973dbfa6699a7d780ac817d97ced7e40....0.tmp
/data/data/####/658738a04196e0a041cf55e12df02a1ffb185ef04e9c1bf....0.tmp
/data/data/####/691d4ab5a7e5ce2ec02cb221f6be129a1669912ab5e744d....0.tmp
/data/data/####/69f4fd69795e31040384af9f830b5a93766ade5fa521d1d....0.tmp
/data/data/####/6fb5eb891de929c3897f725b8f11dc7c396788e41ef1fbf....0.tmp
/data/data/####/7b4b355d8596bb3e166ee2c59395839a5b2faca6df48591....0.tmp
/data/data/####/8a2a0b5e7ca0d4a652eae6bf0eef18e669dfecc50af4113....0.tmp
/data/data/####/9271cffb7371999040e4c8ce52c791ff79b363477e4c5a0....0.tmp
/data/data/####/94165132ee577eee0320503ac9cb7178b542b9459eb5d0c....0.tmp
/data/data/####/959e13ca3027f49a2801e169f3931573c12f0feb32af3d5....0.tmp
/data/data/####/979b71b57f4f68142bd033f9cdc7575403faf627d785e55....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Databases.db-journal
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/a0363cea295381b3fcb7c50de34d0a446d27d6ac372e7cd....0.tmp
/data/data/####/a04bce2ea2e485fcece0d24df9292fefda00f5b8be9232e....0.tmp
/data/data/####/a1e242096de1c302c872c35144951bf491fbce7b4f3902b....0.tmp
/data/data/####/ad13622c12484e50f4229e4a92660ed5e8ce8459806fc2a....0.tmp
/data/data/####/b876b009f15c87392bcc8c2b2ec4751e9ea06c551c83c48....0.tmp
/data/data/####/ba84c9940ce2715b1931c706202d235879cea70baa97ab0....0.tmp
/data/data/####/c418b9973e7f5489a9917950939ea1fc1f2100409eb7988....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ceb15b38c2cb121dbdf9d960dfb43235dbc93d9f4917e2d....0.tmp
/data/data/####/cf13c1a1f9f2bbe0699795be2e1f8c656bdadfacf3f195a....0.tmp
/data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
/data/data/####/com.avos.avoscloud.analysis.xml
/data/data/####/com.avos.avoscloud.approuter.EkOej4AwDQcg7TSMoi...sz.xml
/data/data/####/d04d25c36892c8ff298b0f904297cbae52ebf976e470c45....0.tmp
/data/data/####/d37e7dbddbea16cd865e730398d7fa89eb93d4fc9801812....0.tmp
/data/data/####/d7acd72da8096484a687daa4e905ab31c2a38b091238040....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/e1fef3ad7566e8f9c520219467055071f7db9d45c351f18....0.tmp
/data/data/####/e831a98e559730aa3262f3bfe0968dcd12d2b7d1577c598....0.tmp
/data/data/####/ed035ddbffe3c1d48ddd889fecb8d758bc808975978f834....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/http_activity.russiango.cn_0.localstorage-journal
/data/data/####/http_wubi.sostation.com_0.localstorage-journal
/data/data/####/iapppay_config.xml
/data/data/####/index
/data/data/####/installation
/data/data/####/journal.tmp
/data/data/####/mb_device_id.xml.xml
/data/data/####/mob_commons_1.xml
/data/data/####/mob_sdk_exception_1.xml
/data/data/####/olconfig
/data/data/####/pdi.apk
/data/data/####/pdi.arg
/data/data/####/pdi.ver
/data/data/####/pp.apk
/data/data/####/pp.arg
/data/data/####/pp.ver
/data/data/####/share_sdk_1.xml
/data/data/####/sharesdk.db-journal
/data/data/####/statistics_preference.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.nulplt
/data/media/####/.pkg_lock
/data/media/####/.rcTag
/data/media/####/.rc_lock
/data/media/####/1541770864003.log
/data/media/####/1541770864003.log (deleted)
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml

Другие:

Запускает следующие shell-скрипты:

Загружает динамические библиотеки:

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-NoPadding

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней