Android.Packed.42561

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.758.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.g####.com:80
TCP(HTTP/1.1) st####.shu####.cn:80
TCP(HTTP/1.1) tls.d####.com:80
TCP(HTTP/1.1) ma####.img.a####.####.com:80
TCP(HTTP/1.1) a####.g####.com:80
TCP(HTTP/1.1) p.cdn.a####.####.com:80
TCP(TLS/1.0) daa.shu####.cn:443
TCP(TLS/1.0) dcc.shu####.cn:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) p.a####.com:443

Запросы DNS:

a####.g####.com
api.g####.com
api.shu####.cn
daa.shu####.cn
dai.shu####.cn
dcc.shu####.cn
gp.hz####.com
h####.b####.com
i####.a####.com
p####.dianx####.com
p.a####.com
p.cdn.a####.com
st####.shu####.cn
tls.d####.com

Запросы HTTP GET:

api.g####.com/info.php?mt=####&pid=####&sdk=####&chl=####&imei=####&sign...
ma####.img.a####.####.com/data1/icon/201802/07/com.ss.android.article.li...
ma####.img.a####.####.com/data1/icon/201803/22/com.tencent.mobileqq_5445...
ma####.img.a####.####.com/data3/icon/201404/09/com.tencent.news_88829100...
ma####.img.a####.####.com/data3/icon/201412/10/4676a7368814a037ac7a18f88...
ma####.img.a####.####.com/data3/icon/201708/07/com.snda.wifilocating_825...
ma####.img.a####.####.com/data4/icon/201806/24/com.yy.kaitian.phonelocat...
ma####.img.a####.####.com/data5/icon/201811/23/com.newscat.cn_39130000_1...
ma####.img.a####.####.com/data5/icon/201811/26/com.ledo.kof97ol.anzhi_52...
ma####.img.a####.####.com/data5/icon/201812/24/bubei.tingshu_90219700_16...
ma####.img.a####.####.com/data5/icon/201901/09/com.sina.weibo_23387500_1...
ma####.img.a####.####.com/data5/icon/201901/15/com.tencent.tmgp.pubgmhd_...
ma####.img.a####.####.com/data5/icon/201901/22/com.tencent.mtt_22429100_...
ma####.img.a####.####.com/img/201809/25/1537864031_4988.jpg
ma####.img.a####.####.com/img/201810/26/83209200.png
ma####.img.a####.####.com/img/201811/02/78728100.png
ma####.img.a####.####.com/img/201811/09/45201600.png
ma####.img.a####.####.com/img/201811/22/76241800.png
ma####.img.a####.####.com/img/201811/22/84113000.png
ma####.img.a####.####.com/img/201811/23/14808300.png
ma####.img.a####.####.com/img/201812/17/58207000.png
ma####.img.a####.####.com/img/201812/27/1545886854_3440.png
ma####.img.a####.####.com/img/201812/27/1545886854_4254.png
ma####.img.a####.####.com/img/201812/27/1545886854_7289.png
ma####.img.a####.####.com/img/201901/11/14181300.png
ma####.img.a####.####.com/img/201901/11/1547193313_1836.jpg
ma####.img.a####.####.com/img/201901/11/1547193313_8329.jpg
ma####.img.a####.####.com/img/201901/11/1547193313_9068.jpg
p.cdn.a####.####.com/data1/icon/201309/22/com.lectek.android.ecp_4652230...
p.cdn.a####.####.com/data1/icon/201711/24/551fd6423e926e3a731fed86e20ab9...
p.cdn.a####.####.com/data1/img/201804/09/pic0_84693300.jpg
p.cdn.a####.####.com/data1/img/201805/11/pic0_87372700.jpg
p.cdn.a####.####.com/data2/icon/201608/24/com.alibaba.mobileim_79329700_...
p.cdn.a####.####.com/data3/icon/201407/11/com.yy.huanju_62796800_160.png
p.cdn.a####.####.com/data3/icon/201412/29/f0fd875148e5b134bcb93fbd23d200...
p.cdn.a####.####.com/data3/icon/201501/15/com.tencent.pb_12975000_160.png
p.cdn.a####.####.com/data3/icon/201708/25/com.xtc.watch_14294600_160.png
p.cdn.a####.####.com/data3/thumb/201809/11/1536647632_5300.png
p.cdn.a####.####.com/data4/icon/201810/25/f088f1af687c117331a575bc2be496...
p.cdn.a####.####.com/data4/icon/201811/09/com.dfjj.paiyou_37239800_160.png
p.cdn.a####.####.com/data5/icon/201812/28/com.azhi.happyfish_18604900_16...
p.cdn.a####.####.com/data5/icon/201901/02/79802538638738262fffcf3fc59b94...
p.cdn.a####.####.com/data5/icon/201901/07/com.aly.topgun.anzhi_83051000_...
p.cdn.a####.####.com/data5/thumb/201812/24/7b621ec3e1cebe0fbb025b19d3bdd...
p.cdn.a####.####.com/data5/thumb/201812/24/99349615b34d5dfa0c68933befe3d...
p.cdn.a####.####.com/data5/thumb/201812/24/cc2c17a947753b9c531049929fba4...
p.cdn.a####.####.com/data5/thumb/201812/24/f39c37b5c0428ac1cc6932bc9450e...
p.cdn.a####.####.com/img/201811/19/73019000_o.jpg
p.cdn.a####.####.com/img/201812/26/1545791915_5997.png
p.cdn.a####.####.com/pcdn/config_0.json
tls.d####.com/1.0/config/query?auth_ver=####&appkey=####&nonce=####&mode...

Запросы HTTP POST:

a####.g####.com/api.php
api.g####.com/api.php
st####.shu####.cn/report?v=####&c=####&e=####&t=####
tls.d####.com/api/data?token=####&tk=PmkK####&sv=####
tls.d####.com/api/tokens?tk=PmkK####&sv=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/1.dex
/data/data/####/1401095385.db
/data/data/####/1401095385.db-journal
/data/data/####/DianxinDXB.xml
/data/data/####/DianxinDXB.xml.bak (deleted)
/data/data/####/MESSAGE_LIST_INFO_V3
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1548306336394
/data/data/####/al_events.db-journal
/data/data/####/anzhi_assist.db-journal
/data/data/####/anzhi_new.db-journal
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/behavior_new.db-journal
/data/data/####/cache.xml
/data/data/####/cache.xml.bak
/data/data/####/cache_branch.xml
/data/data/####/cn.goapk.market_preferences.xml
/data/data/####/cn.goapk.market_prefs.xml
/data/data/####/com.anzhi.plugin.design.apk
/data/data/####/com.anzhi.plugin.design.apk.raw
/data/data/####/com.anzhi.plugin.h5web.apk
/data/data/####/com.anzhi.plugin.h5web.apk.raw
/data/data/####/com.anzhi.plugin.push.apk
/data/data/####/com.anzhi.plugin.push.apk.raw
/data/data/####/com.anzhi.plugin.snareden.apk
/data/data/####/com.anzhi.plugin.snareden.apk.raw
/data/data/####/d
/data/data/####/d-journal
/data/data/####/d.xml
/data/data/####/h.xml
/data/data/####/i
/data/data/####/i-journal
/data/data/####/i.xml
/data/data/####/libcuid.so
/data/data/####/libdesign_az2.so
/data/data/####/netstate.xml
/data/data/####/push.db-journal
/data/data/####/rt.xml
/data/data/####/sk
/data/data/####/sk-journal
/data/data/####/t
/data/data/####/utils.xml
/data/data/####/z
/data/data/####/z-journal
/data/media/####/-10992230151548306349900
/data/media/####/-11422890731548306326985
/data/media/####/-11806283331548306325684
/data/media/####/-13411892061548306326342
/data/media/####/-13413154141548306326970
/data/media/####/-13905523161548306348013
/data/media/####/-14775894041548306328274
/data/media/####/-15703658911548306328004
/data/media/####/-16819304951548306325684
/data/media/####/-17731178161548306350423
/data/media/####/-1799832191548306327109
/data/media/####/-18352946451548306327906
/data/media/####/-19924301941548306324421
/data/media/####/-1992782301548306350371
/data/media/####/-3172204391548306326036
/data/media/####/-4758017621548306349900
/data/media/####/-556049391548306350418
/data/media/####/-5599439371548306324421
/data/media/####/-5661958131548306328293
/data/media/####/-692352581548306325686
/data/media/####/-692802591548306348648
/data/media/####/-823612461548306350766
/data/media/####/-9764905021548306343450
/data/media/####/..ccvid
/data/media/####/..cvtid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.acc.dat
/data/media/####/.aio.dat
/data/media/####/.ccvid
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.cvtid
/data/media/####/.timestamp
/data/media/####/.userReturn
/data/media/####/10742818631548306348012
/data/media/####/12494064591548306324421
/data/media/####/13916626441548306324421
/data/media/####/14797636461548306327098
/data/media/####/16332018171548306348014
/data/media/####/180514491548306325684
/data/media/####/18751820341548306348071
/data/media/####/19373114461548306350213
/data/media/####/19635145101548306348072
/data/media/####/20601168271548306324424
/data/media/####/2094605131548306351227
/data/media/####/2293906551548306325683
/data/media/####/2436293481548306328004
/data/media/####/2798009961548306327774
/data/media/####/3530507961548306350941
/data/media/####/4810746591548306350576
/data/media/####/4942424821548306349866
/data/media/####/5520936231548306349882
/data/media/####/5654466521548306348461
/data/media/####/6261244061548306327088
/data/media/####/6677783221548306327586
/data/media/####/7456117581548306327584
/data/media/####/7632608121548306327936
/data/media/####/9334606741548306320792
/data/media/####/9597024351548306349900
/data/media/####/DEFAULT_KEYWORDS_v1
/data/media/####/GET_CONFIGURED_IMG
/data/media/####/HOME_RECOMMEND_APP_LIST_V3_DOUBLE
/data/media/####/HOME_SOARGING_BATCH_v24_COUNT_60
/data/media/####/MAYBE_LIKE_com.tencent.mobileqq
/data/media/####/SEARCH_HOT_KEYWORDS_v6
/data/media/####/SOFT_DETAIL_3089952
/data/media/####/SOFT_UPDATE_PAGE_v13
/data/media/####/TIPS
/data/media/####/TOP_KEYWORDS_v1
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/acc.dat
/data/media/####/aio.dat
/data/media/####/anzhi_push
/data/media/####/anzhi_push-journal
/data/media/####/ucenter
/data/media/####/ucenter-journal

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/meminfo
/system/bin/cat /sys/block/mmcblk0/device/cid
/system/bin/cat /sys/block/mmcblk1/device/cid
/system/bin/cat /sys/block/mmcblk2/device/cid
/system/bin/cat /sys/block/mmcblk3/device/cid
app_process /system/bin com.android.commands.pm.Pm list package
date
df
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /proc/meminfo
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c echo MjRDNjhCRjJGRTcwRDZBMjdBMzM2RjUwMjIwRjNFRTRjOGZ2NXhDVjUrMllMaEtrSGRjWjQ2NGp3aGlwbGFNMTV4R3gydjFBVUIxUXMzVUNHMGN5OC9qNFJUK3E5N0xkbGYxdkF6WE5udSsxTDV0MnF6dSt5QnphWHRvODdJUmNxTjAvenE2bDBMeWpza3Zva0Z1UnFxMTdOMW9iWWFSZlArVkZJOE5oS0MvUmcvaWVtYkFyVG1jQlRJZWlJSGlJb3NNaDhZNFNRdFlVUGhBM2pFb3V4TEpJeHozSDdPN25wdEhrRTNqYXVMS1NndFlWY3Y4NXljSzE4YU5IaS9zSHBvWnF4S2FEMWgxVXRjd01wSmlFWlZRaHcvcnM5bmp4SUQvNEpCekE2SHJPS0syK2ljQXBpejJwUWc5Y09Pd3ovWWk2YXFoY3Q4NnJwb0g3Tk4vbTZqYjQzcTZvZ3pzK1lPQ2JRY1ZQRkd4NG1EdGZTKzJVbDYwTzRURl
sh -c echo MkJGNEY0MjYwQjMwQ0YwNzkwM0NBQzc2MTJGRTBFMzZEQ0FBMjA6RjU4ODI0OjM4MTI5Mw== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo MkJGNEY0MjYwQjMwQ0YwNzkwM0NBQzc2MTJGRTBFMzZEQ0FBMjA6RjU4ODI0OjM4MTI5Mw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c echo NkRGMTFDMTFGMTFBODA1M0MwMjQ1QTZCQTVDNkU4MzIyMDE4MDIwOTAwMDM= > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c echo Q0EyNkEyQkY2RDNDNjE4NTQ2N0Q4OEVCNEU5NzJDNzQxNTQ4MzA2MzM5 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo Q0EyNkEyQkY2RDNDNjE4NTQ2N0Q4OEVCNEU5NzJDNzQxNTQ4MzA2MzM5 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RUJENUQ5ODk2NDQ4MkUxRUUwNDU1NDJCREJGNkVFMDgxNTQ4MzA2MzQ1 > <SD-Card>/../../../../../..<SD-Card>/..cvtid
sh -c echo RUJENUQ5ODk2NDQ4MkUxRUUwNDU1NDJCREJGNkVFMDgxNTQ4MzA2MzQ1 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.cvtid
sh -c echo RjFFODY0Q0E3OEZDOTQ0QTdBQzZFM0EyMzRERTZFOTI4NjlDNjA6Mzc1NzBCOkEzQzM2OQ== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo RjFFODY0Q0E3OEZDOTQ0QTdBQzZFM0EyMzRERTZFOTI4NjlDNjA6Mzc1NzBCOkEzQzM2OQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo RkMwRTc1RTBCNkM3RTdCNTc5RUYwQzI3NjZGQkM2OTExNTQ4MzA2MzQ0 > <SD-Card>/../../../../../..<SD-Card>/.acc.dat
sh -c echo RkMwRTc1RTBCNkM3RTdCNTc5RUYwQzI3NjZGQkM2OTExNTQ4MzA2MzQ0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/acc.dat

Загружает динамические библиотеки:

bspatch_az
design_az2
du

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DESede
RSA
RSA-ECB-PKCS1Padding
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

DES
DESede
desede-CBC-NoPadding

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Получает информацию об отправленых/принятых SMS.

Управляет Wi-Fi-подключением.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней