Android.Packed.41294

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.3887

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) a.bjsd####.com:80
TCP(HTTP/1.1) nb.i36####.com:9000
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) dn.tc####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) 4####.97.20.12:80
TCP(HTTP/1.1) api.ila####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) www.d####.xyz:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.con####.kyli####.com:666
TCP(HTTP/1.1) 2####.98.33.230:8888
TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
TCP(HTTP/1.1) rcv.ila####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) 1####.75.3.32:8881
TCP(HTTP/1.1) d####.dd7####.com:80
TCP(HTTP/1.1) ny.bul####.cn:666
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) d.bjsd####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) php.sho####.com:80
TCP(HTTP/1.1) hjq.91h####.com:80
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) d.sho####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP(TLS/1.0) m.n####.com:443

Запросы DNS:

a####.b####.qq.com
a####.man.aliy####.com
a.bjsd####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
aexcep####.b####.qq.com
and####.b####.qq.com
api.con####.kyli####.com
api.ila####.com
beacon####.aliy####.com
c.xz####.com
cdn.1####.wang
d####.dd7####.com
d####.wos####.com
d.bjsd####.com
d.sho####.com
dl.api.kyli####.com
dn.tc####.com
hjq.91h####.com
ip.ta####.com
k####.kyli####.com
log.u####.com
m.n####.com
nb.i36####.com
ny.bul####.cn
oc.u####.com
p.rqco####.com
php.sho####.com
plb####.u####.com
pv.s####.com
rcv.ila####.com
s####.u####.com
se.n####.com
u####.u####.com
w####.pcon####.com.cn
www.d####.xyz
wx2.sin####.cn
wx3.sin####.cn
wx4.sin####.cn
z####.heyc####.net
z1.c####.com
z9.c####.com

Запросы HTTP GET:

api.ila####.com/c/_ii_?_=####
api.ila####.com/c/strawberry_sdk
api.ila####.com/e/i.html
api.ila####.com/e/i.js
api.ila####.com/update_ch/cherry/core.jar
api.ila####.com/update_ch/common/coreconfig.jar
cdn.1####.wang/sc_156
d####.dd7####.com//upload/sdk1/six66.jar
d####.dd7####.com/upload/sdk1/n38dex201811091.jar
d####.dd7####.com/upload/sdk2/bsho.jar
d####.dd7####.com/upload/sdk2/ykseeding03.jar
dn.tc####.com/dnfile/wmp/WG3N20181022LD1030NEW8.jar
et2-na6####.wagbr####.ali####.####.com/bar/get/58d32a2bc895767f53000d33/...
ip.ta####.com/service/getIpInfo.php?ip=####
k####.kyli####.com.####.com/1542712806203_utils.ttf
nb.i36####.com:9000/jsonServer/LanMei004
nb.i36####.com:9000/jsonServer/LanMei01
nb.i36####.com:9000/jsonServer/lanmei9behavior
nb.i36####.com:9000/jsonServer/xinyi03
p.rqco####.com:8806/c/1543729708158
rcv.ila####.com/report2?t=####&h1=####&c=####&v=####&op1=####&op2=####&n...
weiboi####.g####.sina####.com/mw690/006zfkKAgy1fn3denarx6j30a30a33z0.jpg
weiboi####.g####.sina####.com/mw690/006zfkKAgy1fn3dpulbdtj30a30a3wez.jpg
weiboi####.g####.sina####.com/mw690/006zfkKAgy1fn5jd1gyyuj30a30a3wi3.jpg
weiboi####.g####.sina####.com/mw690/006zfkKAgy1fn5jh674zmj30a30a3n1f.jpg
weiboi####.g####.sina####.com/mw690/00751FDsgy1fqoorxuu58j30a30a3t92.jpg
weiboi####.g####.sina####.com/mw690/00751FDsgy1fqoos046qaj30a30a3aaj.jpg
z.c####.com/stat.htm?id=####&cnzz_eid=####

Запросы HTTP POST:

a.bjsd####.com/index.php?r=####
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
api.con####.kyli####.com:666/v1/config
beacon####.aliy####.com/beacon/fetch/config/byappkey
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/longheartbeat.jsp
d.bjsd####.com/index.php?r=####
d.sho####.com/index.php?r=####
dl.api.kyli####.com/v2/load/mobile
gdv.a.s####.com/cityjson
hjq.91h####.com/hjq/ip/getmyip?s=####&nt=####&n=####&o=####&v=####&c=###...
nb.i36####.com:9000/api/getAdInfoByDevice.do
nb.i36####.com:9000/api/getAdInfoById.do
nb.i36####.com:9000/api/jad.do
nb.i36####.com:9000/api/vsp/getVspCore.do
ny.bul####.cn:666/api_yi.aspx
ny.bul####.cn:666/slsdk/getdata.aspx
ny.bul####.cn:666/slsdk/settings.aspx
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
p.rqco####.com:8806/p/1543729708822
php.sho####.com/index.php?r=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
w####.pcon####.com.cn/ip.jsp
www.d####.xyz/Orders/getlive?channel=####
z####.heyc####.net/getlist
z####.heyc####.net/xlogin

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/01f7133a6030eb35ea8ef27f77d6bfe5.0.tmp
/data/data/####/01f7133a6030eb35ea8ef27f77d6bfe5.1.tmp
/data/data/####/04C6522B7AA56FD8827878EF4F34CDB0.jar
/data/data/####/04C6522B7AA56FD8827878EF4F34CDB0.tmp
/data/data/####/1002
/data/data/####/1004
/data/data/####/1543729660452.log
/data/data/####/16115c341f911819d1cd970be886ac0a665f57aad6db2b5....0.tmp
/data/data/####/2018_12_02read.xml
/data/data/####/6e2e2de2f387dff8bfe202d761af31b22c0338a48b720ee....0.tmp
/data/data/####/8fd87696c117daf27fcfec1cc9942e4a.0.tmp
/data/data/####/8fd87696c117daf27fcfec1cc9942e4a.1.tmp
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2NjI4Mjk=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2NjQwMjQ=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2NjUzOTE=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2Njk2NzI=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2NzQxMzM=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2Nzc1NTM=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2Nzg2MzI=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2Nzk2Nzc=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2ODMzODM=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2ODQ1NTA=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2ODU1MjU=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2ODY4OTQ=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2ODg2MTk=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2OTAyNTM=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2OTE0OTU=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk2OTI5NDE=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk3MDQ3MTI=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk3MTc0MTE=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk3MTk2NjU=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk3MjEwNzU=;
/data/data/####/L3VtcHhfZXJyb3JzXzE1NDM3Mjk3MzUyOTg=;
/data/data/####/UTCommon.xml
/data/data/####/a==7.4.0&&2.3.4_1543729675980_envelope.log
/data/data/####/android-util.zip
/data/data/####/ap.Lock
/data/data/####/b_project_show.data-journal
/data/data/####/b_project_show.xml
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu
/data/data/####/bugly_db_legu-journal
/data/data/####/c598ed81a70fa95c0660a7312cd126c07ee76b940907567....0.tmp
/data/data/####/c7559b0a8f32c94bb15caeda7d70b7668c22d336c4b5a19....0.tmp
/data/data/####/com.leku.tjtv.BETA_VALUES.xml
/data/data/####/com.leku.tjtv_preferences.xml
/data/data/####/com_alibaba_aliyun_crash_defend_sdk_info
/data/data/####/core.jar.tm
/data/data/####/coreconfig.jar.tm
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjU5Njky;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjY0MTM1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjY1NTQ3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjY5NzYz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjYyOTcx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njc0OTk1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njc3NjU5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njc4NzQx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njc5NzY3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njg0NjUy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njg1NjEx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njg3MDA5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5Njg4NzUx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjgzNTIx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjkwNDQ2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjkxNTg1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NjkzMTU4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NzA1MDMy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NzE3NTc0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NzE5OTUx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NzIxMTkw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQzNzI5NzM1NDAw;
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dd49684d104c717444b38f39ac027e1e190b428428a13d7....0.tmp
/data/data/####/defaultpref1.xml
/data/data/####/dpi
/data/data/####/engc.jar
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0c61b5e74a80fc96be041a3e7eb02b2.0.tmp
/data/data/####/f0c61b5e74a80fc96be041a3e7eb02b2.1.tmp
/data/data/####/f518c1ba50d740df1148378aaa4432f4
/data/data/####/f_000001
/data/data/####/fcd7fae826dc79e60792d0d5d1515a9e5cabf0b71328dcb....0.tmp
/data/data/####/fdhjhkgj.data-journal
/data/data/####/fdhjhkgj.xml
/data/data/####/hid.db
/data/data/####/http_api.ilabtap.com_0.localstorage-journal
/data/data/####/i==1.2.0&&2.3.4_1543729659791_envelope.log
/data/data/####/i==1.2.0&&2.3.4_1543729663148_envelope.log
/data/data/####/i==1.2.0&&2.3.4_1543729675062_envelope.log
/data/data/####/i==1.2.0&&2.3.4_1543729707247_envelope.log
/data/data/####/i==1.2.0&&2.3.4_1543729718413_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/kobox.0.sp.xml
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.2.so
/data/data/####/libufix.so
/data/data/####/lnkumv
/data/data/####/load_MTAwMF8xMjAxXzExMDAwMTAw;.xml
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/mix.so
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/onlineconfig_agent_online_setting_com.leku.tjtv.xml
/data/data/####/p.l
/data/data/####/pl_o_sp.xml
/data/data/####/prdopt.xml
/data/data/####/rdata_@apkloader-unique.pkgname@.new
/data/data/####/read.xml
/data/data/####/security_info
/data/data/####/six666.data-journal
/data/data/####/six666.xml
/data/data/####/six666.xml.bak
/data/data/####/six666.xml.bak (deleted)
/data/data/####/sp_config.xml
/data/data/####/sys_log_1543729683968422.txt
/data/data/####/tdargs.xml
/data/data/####/tjtv.xml
/data/data/####/tmp7.xml
/data/data/####/tmpbl.jar
/data/data/####/tools8977.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_socialize.xml.bak
/data/data/####/umeng_socialize.xml.bak (deleted)
/data/data/####/umexecption.json
/data/data/####/use_MTAwMF8xMjAxXzExMDAwMTAw;.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webengine.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/xconfig.xml
/data/data/####/xsdk_preference.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.nid
/data/media/####/.umm.dat
/data/media/####/2018_12_02
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/LanMei004
/data/media/####/adv
/data/media/####/bsho.jar
/data/media/####/config
/data/media/####/deviceId
/data/media/####/isread
/data/media/####/master
/data/media/####/master.lock
/data/media/####/n38dex201811091.jar
/data/media/####/six66.jar
/data/media/####/sysid.dat
/data/media/####/tag2.datdb0315ae-083f-4201-af6b-f153609ad9a7.tmp
/data/media/####/ykseeding03.jar

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
chmod 700 /data/user/0/<Package>/tx_shell/libnfix.so
chmod 700 /data/user/0/<Package>/tx_shell/libshella-2.9.0.2.so
chmod 700 /data/user/0/<Package>/tx_shell/libufix.so
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.2.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls -l /dev
ls -l /dev/block
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuctl/apps
ls -l /dev/cpuctl/apps/bg_non_interactive
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/log
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ls -l /system/bin/su
ls /sys/class/thermal
ps

Загружает динамические библиотеки:

Bugly
libnfix
libshella-2.9.0.2
libufix
nfix
ufix
umeng_error_catch
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней