Android.Packed.41940

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.3887

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) 1####.50.63.227:8881
TCP(HTTP/1.1) ip.zhito####.com:88
TCP(HTTP/1.1) apk.91h####.com:80
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) tt.kyli####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) 58.2####.198.131:888
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) www.pc####.com.####.cn:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) 4####.97.20.12:80
TCP(HTTP/1.1) 2####.187.226.25:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) ope####.m.ta####.com:80
TCP(HTTP/1.1) mt.kap####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) ec####.b####.com:80
TCP(HTTP/1.1) na61-####.wagbr####.non####.####.com:80
TCP(HTTP/1.1) ip.zhito####.com:807
TCP(HTTP/1.1) 1####.75.3.32:8881
TCP(HTTP/1.1) s####.funs####.net:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) zf####.v.qin####.com:80
TCP(HTTP/1.1) v####.funs####.com:80
TCP(HTTP/1.1) hjq.91h####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) kl.kyli####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) loc.map.b####.com:443
TCP(TLS/1.0) nbsdk-b####.al####.com:443
TCP(TLS/1.0) 362b3d8####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) a####.d####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) api.t####.co:443
TCP(TLS/1.0) r.s####.cn:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP acc####.m.ta####.com:80

Запросы DNS:

362b3d8####.oss-cn-####.aliy####.com
a####.d####.com
a####.m.ta####.com
a####.man.aliy####.com
acc####.m.ta####.com
acs4bai####.m.ta####.com
ad####.m.ta####.com
ada####.m.ta####.com
adm.t####.com
ag####.m.ta####.com
api.kxcon####.com
api.map.b####.com
api.t####.co
apk.91h####.com
bn.cigo####.com
c####.mm####.com
c####.zhito####.com
c.c####.com
c.xz####.com
cdn.1####.wang
d####.wos####.com
dl.api.kyli####.com
dup.baidust####.com
ec####.b####.com
h####.c####.com
hjq.91h####.com
hm.b####.com
ip.ta####.com
ip.zhito####.com
k####.kyli####.com
kl.kyli####.com
l####.tbs.qq.com
loc.map.b####.com
log.u####.com
mi.g####.qq.com
mt.kap####.com
nbsdk-b####.al####.com
p####.x####.com.cn
p.rqco####.com
plb####.u####.com
pos.b####.com
r.s####.cn
s####.e.qq.com
s####.funs####.net
s11.c####.com
s13.c####.com
s19.c####.com
s4.c####.com
s5.c####.com
s95.c####.com
sw3.d####.com
tt.kyli####.com
u####.u####.com
u####.umengc####.com
v####.fun.tv
v####.fun.tv
wb.110.ta####.com
www.pc####.com.cn
y####.al####.com
z13.c####.com
z7.c####.com
z8.c####.com
z9.c####.com

Запросы HTTP GET:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
apk.91h####.com/apk/p_le_39.png
apk.91h####.com/apk/urlparse_66371_a.zip
c.c####.com/core.php?web_id=####&t=####
c.c####.com/stat.php?id=####
c.c####.com/stat.php?id=####&web_id=####
cdn.1####.wang/sc_156
dup.baidust####.com/js/os.js
ec####.b####.com/rs.jpg?type=####&stamp=####
gl####.w.kunl####.####.com/cnzz.html
gl####.w.kunl####.####.com/index.html
hjq.91h####.com/hjq/servers/Korean_Info.ashx?method=####&os=####&version...
ip.ta####.com/service/getIpInfo.php?ip=####
ip.zhito####.com:807/1102.html
ip.zhito####.com:807/ip1102.html
ip.zhito####.com:807/js1102/jquery.js
ip.zhito####.com:88/zong/1102.html
ip.zhito####.com:88/zong/now.html
k####.kyli####.com.####.com/1541576969414_utils.ttf
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
ope####.m.ta####.com/gw-open/mtop.taobao.tbk.sdk.config/1.0/?data=####
p.rqco####.com:8806/c/1545539953971
pos.b####.com/bfp/snippetcacher.php?dpv=####&di=####
pos.b####.com/ecsm?conwid=234&conhei=60&rtbid=3033352&rdid=13147349&dc=2...
pos.b####.com/ecsm?psi=6d41f770fdd635734bf61a5331d5b0d9&di=5897808&dri=0...
pos.b####.com/hcum?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
pos.b####.com/wcum?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
pos.b####.com/xcfm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
pos.b####.com/zcdm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
s####.funs####.net/ecom-ad/ifar_all/?oc=####
s####.funs####.net/ecom-ad/ifar_load/?rprotocol=1&fck=1545539965efc90&mi...
v####.funs####.com/vasd/pa/index?zzt=####&sid=####&ref=####&mick=####&cv...
www.pc####.com.####.cn/autox/x2.html
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zf####.v.qin####.com/market/ext/udc/c00100085.html?zzt=####
zf####.v.qin####.com/unet/static/udc.js?zzt=####

Запросы HTTP POST:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&deviceId=####&pla...
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
api.kxcon####.com:666/v1/config
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
hjq.91h####.com/hjq/ip/getmyip?sign=####&ime=####&nwtime=####&os=####&m=...
kl.kyli####.com/klv2/sdkkl/mobile
l####.tbs.qq.com/ajax?c=####&k=####
mt.kap####.com/v1/st
na61-####.wagbr####.ali####.####.com/api/update.do
na61-####.wagbr####.non####.####.com/saveWb.json
p.rqco####.com:8806/p/1545539956870
s####.e.qq.com/activate
s####.e.qq.com/launch
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
tt.kyli####.com/v2/task/mobile

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/-1147628818
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/15fdf220450474804d0eac4c5a09406d.0.tmp
/data/data/####/15fdf220450474804d0eac4c5a09406d.1.tmp
/data/data/####/2365e912bcbe870dc7a19d83a4c1af1d.0.tmp
/data/data/####/2365e912bcbe870dc7a19d83a4c1af1d.1.tmp
/data/data/####/5ae6648b20ad1b1182d08bdf8219e59f.0.tmp
/data/data/####/5ae6648b20ad1b1182d08bdf8219e59f.1.tmp
/data/data/####/66a7a04e4eb563f296d6a240fe2156b5.0
/data/data/####/66a7a04e4eb563f296d6a240fe2156b5.1
/data/data/####/7607a0041553175ca3a58ecfe40aba48.0.tmp
/data/data/####/7607a0041553175ca3a58ecfe40aba48.1.tmp
/data/data/####/76a2e27bce354473f7058eaffb518223.0.tmp
/data/data/####/76a2e27bce354473f7058eaffb518223.1.tmp
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/9081f36a8b89d2f316b89b17609ba5ef.0.tmp
/data/data/####/9081f36a8b89d2f316b89b17609ba5ef.1.tmp
/data/data/####/9c2c0f7bdf4ea76e1ad11c7513ee15aa.0.tmp
/data/data/####/9c2c0f7bdf4ea76e1ad11c7513ee15aa.1.tmp
/data/data/####/ACCS_SDK.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/AlibcLinkPartner.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/UTCommon.xml
/data/data/####/a93bd03f3b9af08ea40aa2600332584e.0.tmp
/data/data/####/a93bd03f3b9af08ea40aa2600332584e.1.tmp
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/aliTradeConfigSP.xml
/data/data/####/ap.Lock
/data/data/####/authStatus_com.leku.hmsq;remote.xml
/data/data/####/auth_sdk_device.xml
/data/data/####/com.leku.hmsq-1.apk.classes2.dex
/data/data/####/com.leku.hmsq-1.apk.classes3.dex
/data/data/####/com.leku.hmsq_preferences.xml
/data/data/####/core_info
/data/data/####/d314775b3343462f5fbbdf3c6c9040f0.0.tmp
/data/data/####/d314775b3343462f5fbbdf3c6c9040f0.1.tmp
/data/data/####/d970181369acb32beac908e693e7bee9.0.tmp
/data/data/####/d970181369acb32beac908e693e7bee9.1.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODE4ODgy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODM3MTEx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODQ1NDA2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODUwMzU3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODUyMTc5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODYzOTEy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5ODgxNDE3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ1NTM5OTA4MTMz;
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/e87c116fcc0053f536bfd3e4a7be4731.0.tmp
/data/data/####/e87c116fcc0053f536bfd3e4a7be4731.1.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f9773072bab31b09be19d89ee80af00b.0.tmp
/data/data/####/f9773072bab31b09be19d89ee80af00b.1.tmp
/data/data/####/firll.dat
/data/data/####/gdt_plugin.dex
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_suid
/data/data/####/hjtv.xml
/data/data/####/hmsq.xml
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/libsgsecuritybodyso-5.1.25.so.tmp
/data/data/####/load_MTAwMF8xMjAxXzExMDAwMjAw;.xml
/data/data/####/lock.lock
/data/data/####/multidex.version.xml
/data/data/####/p.l
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sp.lock
/data/data/####/sp_config.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/timestamp
/data/data/####/tmobi.evernote_jobs.db
/data/data/####/tmobi.evernote_jobs.db-journal
/data/data/####/tmobi.xml
/data/data/####/tmp-com.leku.hmsq-1.apk.classes-1616722407.zip
/data/data/####/tmp-com.leku.hmsq-1.apk.classes1521582845.zip
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_config.xml.bak
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/data/####/use_MTAwMF8xMjAxXzExMDAwMjAw;.xml
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.jsDex.apk
/data/media/####/.nomedia
/data/media/####/.urlparse.zip
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/urlparse.js

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
getprop ro.product.cpu.abi
grep 3269
grep 4305
ls -l /system/bin/su
ls /sys/class/thermal
mount
ps
sh

Загружает динамические библиотеки:

locSDK7b
optimize
sgmainso-5.1
sgsecuritybodyso-5.1
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
RSA-ECB-NoPadding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней