Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) cdnp####.f####.mma####.####.com:8080
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) p####.mma####.com:8080
- TCP(HTTP/1.1) p####.mma####.com:8081
- TCP(HTTP/1.1) p####.mma####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(TLS/1.0) www.cmpass####.com:443
- TCP(TLS/1.0) wap.cmpass####.com:8443
- TCP c####.g####.ig####.com:5226
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- c####.g####.ig####.com
- c-h####.g####.com
- cdnp####.f####.mma####.com
- p####.mma####.com
- p####.mma####.com
- p####.mma####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- wap.cmpass####.com
- www.cmpass####.com
Запросы HTTP GET:
- cdnp####.f####.mma####.####.com:8080//MMPIC/13/300011857013/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/15/330000001315/2.png
- cdnp####.f####.mma####.####.com:8080//MMPIC/16/300009954216/logo140x1400...
- cdnp####.f####.mma####.####.com:8080//MMPIC/18/300011858318/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/19/300011007619/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/2/300009732202/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/20/300009954220/logo4140x140...
- cdnp####.f####.mma####.####.com:8080//MMPIC/21/300008247221/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/21/300011006621/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/22/300009642222/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/23/300011853723/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/24/300001565424/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/25/300011869725/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/30/300002797930/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/30/300009240030/logo140x1400...
- cdnp####.f####.mma####.####.com:8080//MMPIC/31/300011853831/logo140x1407...
- cdnp####.f####.mma####.####.com:8080//MMPIC/35/300000863435/logo140x1407...
- cdnp####.f####.mma####.####.com:8080//MMPIC/35/300011860335/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/37/300008402837/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/37/300010936337/logo140x1407...
- cdnp####.f####.mma####.####.com:8080//MMPIC/38/300010148338/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/38/300011859338/logo140x1403...
- cdnp####.f####.mma####.####.com:8080//MMPIC/39/300002437539/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/39/300011859339/logo140x1403...
- cdnp####.f####.mma####.####.com:8080//MMPIC/4/300009968304/logo140x14098...
- cdnp####.f####.mma####.####.com:8080//MMPIC/40/300011853240/logo140x1406...
- cdnp####.f####.mma####.####.com:8080//MMPIC/40/300011859340/logo140x1403...
- cdnp####.f####.mma####.####.com:8080//MMPIC/44/300010244344/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/47/300002584247/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/47/300009970247/logo140x1405...
- cdnp####.f####.mma####.####.com:8080//MMPIC/5/300009670205/logo140x14055...
- cdnp####.f####.mma####.####.com:8080//MMPIC/50/300008926150/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/51/300002577051/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/53/300011852553/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/54/300000415654/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/54/300008222254/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/55/300000034255/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/57/300010060457/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/59/300000013959/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/6/300001141606/logo140x14044...
- cdnp####.f####.mma####.####.com:8080//MMPIC/6/300011847206/logo140x14088...
- cdnp####.f####.mma####.####.com:8080//MMPIC/63/300000050663/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/63/300011857763/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/64/300009986364/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/65/300011853065/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/65/300011857765/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/69/300001502369/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/7/300009486307/logo140x14092...
- cdnp####.f####.mma####.####.com:8080//MMPIC/72/300010176372/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/75/300009212575/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/75/300011864275/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/77/300011007277/logo140x1400...
- cdnp####.f####.mma####.####.com:8080//MMPIC/79/300001786279/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/8/300002575008/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/81/300011858881/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/83/300011859083/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/85/300009598185/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/85/300011010385/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/86/300009362186/logo140x1408...
- cdnp####.f####.mma####.####.com:8080//MMPIC/88/300009986288/logo120x1209...
- cdnp####.f####.mma####.####.com:8080//MMPIC/88/300010994488/logo140x1404...
- cdnp####.f####.mma####.####.com:8080//MMPIC/89/300002742389/logo140x1401...
- cdnp####.f####.mma####.####.com:8080//MMPIC/90/300011857990/logo140x1406...
- cdnp####.f####.mma####.####.com:8080//MMPIC/92/300011524392/logo140x1403...
- cdnp####.f####.mma####.####.com:8080//MMPIC/93/300011318393/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/94/300011852494/logo140x1404...
- cdnp####.f####.mma####.####.com:8080//MMPIC/95/300009508195/logo140x1409...
- cdnp####.f####.mma####.####.com:8080//MMPIC/96/300002457496/logo5_src.jpg
- cdnp####.f####.mma####.####.com:8080//MMPIC/96/300009630196/logo140x1402...
- cdnp####.f####.mma####.####.com:8080//MMPIC/96/300011494396/logo140x1407...
- cdnp####.f####.mma####.####.com:8080//MMPIC/98/300011869498/logo140x1407...
- cdnp####.f####.mma####.####.com:8080//MMPIC/99/300011853099/logo140x1402...
- p####.mma####.com/AssPage/common/common.js?v=####
- p####.mma####.com/AssPage/resources/jquery/jquery-3.3.1.min.js
- p####.mma####.com/AssPage/resources/js/base64.js
- p####.mma####.com/AssPage/scanindex/css/base.css
- p####.mma####.com/AssPage/scanindex/css/index.css
- p####.mma####.com/AssPage/scanindex/css/mescroll.min.css
- p####.mma####.com/AssPage/scanindex/images/bg_lan.png
- p####.mma####.com/AssPage/scanindex/images/bg_lv.png
- p####.mma####.com/AssPage/scanindex/images/bg_zi.png
- p####.mma####.com/AssPage/scanindex/images/l_d.jpg
- p####.mma####.com/AssPage/scanindex/images/lan_s.jpg
- p####.mma####.com/AssPage/scanindex/images/t_op.png
- p####.mma####.com/AssPage/scanindex/images/xz_img.png
- p####.mma####.com/AssPage/scanindex/images/yj_ll.png
- p####.mma####.com/AssPage/scanindex/images/yu_j.png
- p####.mma####.com/AssPage/scanindex/js/banner.js?v=####
- p####.mma####.com/AssPage/scanindex/js/index.js?v=####
- p####.mma####.com/AssPage/scanindex/js/mescroll.min.js?v=####
- p####.mma####.com/AssPage/scanindex/js/resize.js?v=####
- p####.mma####.com/AssPage/scanindex/js/scanner.js?v=####
- p####.mma####.com/AssPage/scanner/index.html?ma=####
- p####.mma####.com/MobileAss/resources/upload/adpic/52038869-720d-4a9b-ab...
- p####.mma####.com/download/android/32360b0d-a578-41ad-b5eb-4c794a412788....
- p####.mma####.com/download/android/3e134a7e-c4e2-4d3d-95d5-636f81d63138....
- p####.mma####.com/download/android/80b56f23-938c-441d-81c4-3223456084f1....
- p####.mma####.com/download/android/a411240b-aff5-4296-9cd8-0e310c0995b5....
- p####.mma####.com/download/android/ace4ac0d-d8e1-4890-b9ac-ca1c7fa035ce....
- p####.mma####.com/download/android/bd731554-3659-4785-bc17-e1f559802aa8....
- p####.mma####.com/download/android/c13fecc4-2a14-40ea-b624-93178adbcf75....
- p####.mma####.com/download/android/c5c1b975-b070-447d-aff6-b4341755bba1....
- p####.mma####.com:8080/MMPIC/10/300011857910/logo140x1409327791292_src.jpg
- p####.mma####.com:8080/MMPIC/35/300000863435/logo140x1407346963582_src.jpg
- t####.c####.q####.####.com/config/hz-hzv3.conf
Запросы HTTP POST:
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- p####.mma####.com/AssPage/commonjson.html
- p####.mma####.com/MobileAss/getTime.html
- p####.mma####.com/Webservice/httpjson
- p####.mma####.com/Webservice/interfaces
- p####.mma####.com/si/keepalive.do
- p####.mma####.com:8081/currentTime.do
- p####.mma####.com:8081/fusionUpPhone.do
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1d0af94e45e41b67f0d38bb2ab08987a2bdd26f0aeb3cda....0.tmp
- /data/data/####/1d96c710bc08cc344d7db95c09489f70f63bd28b7f21123....0.tmp
- /data/data/####/2b24dac39644a678775d09c2e1dce51fa2c109db63f931f....0.tmp
- /data/data/####/33e2ca2daa89a37cd9824b822d44aed62b80e33e7df236c....0.tmp
- /data/data/####/5c771cd13652bc66957efa5a816f90967879afc177c7e86....0.tmp
- /data/data/####/78bef7e6061c82997f3bab3fda9475d575ce5fdabeee5b8....0.tmp
- /data/data/####/8f52d0dde4deef2b6abdbdd8173a189a0e032aef8ce9fa6....0.tmp
- /data/data/####/92189b7d308966e3e58fb9a8270d63086a1fbe55ff982a3....0.tmp
- /data/data/####/AUTO_MAIL_SDK.xml
- /data/data/####/b1321f6717b0b8d29d86080f9770658c8c1f7342badc572....0.tmp
- /data/data/####/b8b26b06af5500dde6432212006d6c3c2c081c8336539aa....0.tmp
- /data/data/####/b8d8bce9d8b5e4e193ec1d0addc5cb532aaa5c75b7313ed....0.tmp
- /data/data/####/bc04afb4c6f90b2eba99ee593783097b595d1466577106b....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/ca67a3b22552eac141ba3fbdcdbd90a7a88aa211205f1e9....0.tmp
- /data/data/####/com.cmic.mmassistant.xml
- /data/data/####/d85f5e37a562e8c12aa25479ea3b3ca1f32c4abecfc8879....0.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/getui_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libkh_x86_5.4.2.3.soo
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.9.0.2.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mm_db-journal
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/quick_login_android_5.4.2.3.180707.jar
- /data/data/####/run.pid
- /data/data/####/scan_assist-journal
- /data/data/####/sdk.db-journal
- /data/data/####/security_info
- /data/data/####/ssoconfigs.xml
- /data/data/####/triffi_stat3-journal
- /data/data/####/updateconfig.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/app.db
- /data/media/####/applog
- /data/media/####/com.cmic.mmassistant.bin
- /data/media/####/com.cmic.mmassistant.db
- /data/media/####/com.igexin.sdk.deviceId.db
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- chmod 777 <Package Folder>/chkproc
- dd if=<Package Folder>/lib/libchkproc.so of=<Package Folder>/chkproc
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- ps
- sh
Загружает динамические библиотеки:
- Bugly
- FieldAssistant
- MMKey
- getuiext2
- libkh_x86_5.4.2.3
- libnfix
- libshella-2.9.0.2
- libufix
- mmtraffic
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
- AES-GCM-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
