Android.RemoteCode.2946

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.RemoteCode.127.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) api.won####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.map.b####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) api.s####.com:443
TCP(TLS/1.0) o####.map.b####.com:443
TCP(TLS/1.0) loc.map.b####.com:443

Запросы DNS:

a####.b####.qq.com
a####.exc.mob.com
aexcep####.b####.qq.com
and####.b####.qq.com
api.map.b####.com
api.s####.com
api.won####.com
img.won####.com
loc.map.b####.com
o####.map.b####.com
plb####.u####.com
u####.u####.com

Запросы HTTP GET:

api.map.b####.com/sdkproxy/v2/lbs_androidsdk/place/v2/search?query=####&...
ti####.c####.l####.####.com/userfiles/heads/2019011414122292628e4P.jpg
ti####.c####.l####.####.com/userfiles/image/20180519/19160556b122357a438...
ti####.c####.l####.####.com/userfiles/image/20180628/281711435e0ff815bb5...
ti####.c####.l####.####.com/userfiles/image/20180804/0415170446fb01b7b25...
ti####.c####.l####.####.com/userfiles/image/20180804/041522085f1053a6307...
ti####.c####.l####.####.com/userfiles/image/20180814/14154927e63c4044b96...
ti####.c####.l####.####.com/userfiles/image/20180814/14161927d6cd7189fd8...
ti####.c####.l####.####.com/userfiles/image/20180815/15180341a1ef7e3a9d8...
ti####.c####.l####.####.com/userfiles/image/20180905/05180751ccbb061f133...
ti####.c####.l####.####.com/userfiles/image/20180919/1916451496665b981e7...
ti####.c####.l####.####.com/userfiles/image/20180929/29164928bf7f7632937...
ti####.c####.l####.####.com/userfiles/image/20180930/30161045106a008c942...
ti####.c####.l####.####.com/userfiles/image/20180930/30175525ff378630af4...
ti####.c####.l####.####.com/userfiles/image/20180930/301756193bb5f484a69...
ti####.c####.l####.####.com/userfiles/image/20181001/0115312902fb558ec12...
ti####.c####.l####.####.com/userfiles/image/20181013/131538518efa50280f9...
ti####.c####.l####.####.com/userfiles/image/20181014/14093322816d5096798...
ti####.c####.l####.####.com/userfiles/image/20181128/28141204853dbb75eb2...
ti####.c####.l####.####.com/userfiles/image/20181203/0313485626e3d572494...
ti####.c####.l####.####.com/userfiles/image/20181218/1816545941459c21684...
ti####.c####.l####.####.com/userfiles/image/20181219/190938539d52cb97c66...
ti####.c####.l####.####.com/userfiles/image/20181220/20103707c8a963180e2...
ti####.c####.l####.####.com/userfiles/image/20181220/20104658a55b9883429...
ti####.c####.l####.####.com/userfiles/image/20181220/20110044000a73149a8...
ti####.c####.l####.####.com/userfiles/image/20181220/2016425147205823590...
ti####.c####.l####.####.com/userfiles/image/20190102/02144525237cfe0a000...
ti####.c####.l####.####.com/userfiles/image/20190107/07175349571b96fdb09...
ti####.c####.l####.####.com/userfiles/image/20190107/0717594602f654b7b43...
ti####.c####.l####.####.com/userfiles/image/20190111/11140443c7d04b5f755...
ti####.c####.l####.####.com/userfiles/image/20190111/11182115cc0ee2d3e33...
ti####.c####.l####.####.com/userfiles/image/20190111/111826586908820d749...
ti####.c####.l####.####.com/userfiles/image/20190111/11183011ec2288071d9...
ti####.c####.l####.####.com/userfiles/image/20190112/121121000d808681e80...
ti####.c####.l####.####.com/userfiles/image/20190114/141426142e173e2eee6...
ti####.c####.l####.####.com/userfiles/image/20190115/15162521e2fb6ef2107...
ti####.c####.l####.####.com/userfiles/image/20190115/15182817a59d16e8b01...
ti####.c####.l####.####.com/userfiles/images/03tnftnlhim03tnftnlhim.jpg
ti####.c####.l####.####.com/userfiles/images/180823145817yeay14sch4q.jpg...
ti####.c####.l####.####.com/userfiles/images/180824104312x4knfk1wjkv.png...
ti####.c####.l####.####.com/userfiles/images/180824121929bv35n5kpwoz.jpg...
ti####.c####.l####.####.com/userfiles/images/180824122849huntkmehntk.jpg...
ti####.c####.l####.####.com/userfiles/images/180829184305kullgx10qt0.jpg...
ti####.c####.l####.####.com/userfiles/images/180829185630iycfcqhukhq.jpg...
ti####.c####.l####.####.com/userfiles/images/1808291925174ioj0eisv20.jpg...
ti####.c####.l####.####.com/userfiles/images/180831190958tvjgsb43zkj.jpg...
ti####.c####.l####.####.com/userfiles/images/1808311959012oun2ynpg4o.jpg...
ti####.c####.l####.####.com/userfiles/images/180904233205bqqe1p3biy1.jpg...
ti####.c####.l####.####.com/userfiles/images/1809050055451zoiw3zn1d1.png...
ti####.c####.l####.####.com/userfiles/images/180905200151hbpcotiwim0.jpg...
ti####.c####.l####.####.com/userfiles/images/180912205816kbvkma2fevm.jpg...
ti####.c####.l####.####.com/userfiles/images/180912214910pbs1k3kzg3q.jpg...
ti####.c####.l####.####.com/userfiles/images/2h3f4xy4od12h3f4xy4od1.jpg-...
ti####.c####.l####.####.com/userfiles/images/a5mbp0odr35a5mbp0odr35.jpg-...
ti####.c####.l####.####.com/userfiles/images/b3ytllcrm5f.jpg-m.houses.list
ti####.c####.l####.####.com/userfiles/images/cozy235g3m1cozy235g3m1.jpg-...
ti####.c####.l####.####.com/userfiles/images/d0vq5jjqzeod0vq5jjqzeo.jpg-...
ti####.c####.l####.####.com/userfiles/images/lzaozhnvisblzaozhnvisb.jpg-...
ti####.c####.l####.####.com/userfiles/images/vnaapfhmazbvnaapfhmazb.jpg-...
ti####.c####.l####.####.com/userfiles/images/x100cb44uujx100cb44uuj.jpg-...
ti####.c####.l####.####.com/userfiles/images/xv3kfukbev2xv3kfukbev2.jpg-...

Запросы HTTP POST:

a####.exc.mob.com/errconf
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
api.won####.com/api/v1/developer/brands
api.won####.com/api/v1/developer/brands/detail?developer_id=####
api.won####.com/api/v1/houses/detail?houses_id=####&api_token=####
api.won####.com/api/v1/houses/search?area_id=####&page=####
api.won####.com/api/v1/houses/similar?houses_id=####
api.won####.com/api/v1/planner?page=####&area_id=####&api_token=####
api.won####.com/api/v1/public/acreage/list
api.won####.com/api/v1/public/app/version?type=####
api.won####.com/api/v1/public/areas
api.won####.com/api/v1/public/areas/business?area_id=####
api.won####.com/api/v1/public/broadcast
api.won####.com/api/v1/public/feature/list?area_id=####
api.won####.com/api/v1/public/house/price/list?area_id=####
api.won####.com/api/v1/public/house/types
api.won####.com/api/v1/public/sale/status/list
api.won####.com/api/v1/public/slide?area_id=####
api.won####.com/api/v1/public/type/list
api.won####.com/api/v1?area_id=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1106445582
/data/data/####/-1115058732
/data/data/####/-1421164408
/data/data/####/-1821612606
/data/data/####/-569690973
/data/data/####/-889919583
/data/data/####/-890492684
/data/data/####/.duid
/data/data/####/.imprint
/data/data/####/.lock
/data/data/####/.vpl_lock
/data/data/####/04d74b1b506a7da7eeb4d62cd15e8e63551de34cde8a15a....0.tmp
/data/data/####/08ff28255f6d6843dda1cedf20411baf08448251742aa28....0.tmp
/data/data/####/0e5aca7d0a560d7e1abc3c802c0623b1c644a120718dec8....0.tmp
/data/data/####/1004
/data/data/####/109526449
/data/data/####/1112798511
/data/data/####/1374173782
/data/data/####/1990137437
/data/data/####/1c0c681d69275dc2ce2c569ef05e51175ca8a0d3c31536e....0.tmp
/data/data/####/1d1ce1dfeb0ad83f7f487a6a264ec571ec86ed2596c9a0e....0.tmp
/data/data/####/1e7742abdd74ae9961156e74579765943a0bbd8835c9396....0.tmp
/data/data/####/202710deab858c58986597cfb25a08a01f9b219a11c4484....0.tmp
/data/data/####/236e0cfdc225b6737238d163dcc8108b6fcfc74bc16fa95....0.tmp
/data/data/####/23a2ca48519491dbf92a5737be0f8b60b43a86c1962c85d....0.tmp
/data/data/####/2854706727592899b5928d546be2dc6d7f6ed65276c2f61....0.tmp
/data/data/####/2af0d23f3be7e90fe14a1b94456c389f064fb49f69d2ab5....0.tmp
/data/data/####/2b890d2ff5b931441fa17b5cfb7b88ba108d329e41250a6....0.tmp
/data/data/####/30ad81b7ab999c61869116c405e983c7fec12d0ecc52017....0.tmp
/data/data/####/3315bea6b28e2ed37e3c2a8077ef59e78856dd2749347ae....0.tmp
/data/data/####/345e50466f26c2b595ecd519b50dbafbc1ac6d9ced00e3e....0.tmp
/data/data/####/3a6f0edc1a0f95957e7df29870e0fbcd0de7def553fec4f....0.tmp
/data/data/####/3c90326f06cf36b7b14d282f7280789deda00cbc04a1896....0.tmp
/data/data/####/403a92b2823f197d3f39921cc1cd9c8a3d577ecf09f0c8d....0.tmp
/data/data/####/4153c302b6045f5816dc9559d401ec78898cc5a9042acfe....0.tmp
/data/data/####/4732e94ab957ac00b0ac589d7f2f35358aeeebaaf52d71a....0.tmp
/data/data/####/4c1ee4def93ee7aa300a49b9fc3b44584cd7532f30b823f....0.tmp
/data/data/####/4c72f3fd977ff312cf7ad33594cf5e13d345e1a79eb7bde....0.tmp
/data/data/####/50a3029effc0a73d7a5958463e2a49fce1fa520a1ce87d3....0.tmp
/data/data/####/5229bb075eb9a407b568d5b1ba8d26319c50446e00c1770....0.tmp
/data/data/####/52faa38e71534b7de3cfce23bbfd3af4d76a493a67908e6....0.tmp
/data/data/####/530cfa9ad99020d74007b62ee64dc857e866d6a959f2158....0.tmp
/data/data/####/64ebb501b25520f8142419cb3fe2757a953862868f0465b....0.tmp
/data/data/####/669066272
/data/data/####/697024654dec09b824ffc4c2f3508146202cc9a1a958576....0.tmp
/data/data/####/6a2d970d3883c90fb677a5d9d951449e861581b8d38a7fa....0.tmp
/data/data/####/7759476a43467fcf0c1b698c2f2b2affe6245f8a4fe4cc3....0.tmp
/data/data/####/7d80c59a1596905437779fb6d9f72b52663f54f12bcabeb....0.tmp
/data/data/####/7d9bfbcc89e7f5553690f8cc1e5833c565a0a67a147fe54....0.tmp
/data/data/####/80a01a88b37093932a86cf340ad9af855aa382e280c48ac....0.tmp
/data/data/####/82890498f7bba116d02c7856da3d223e75ce747595f64c0....0.tmp
/data/data/####/8293463e7234ec43eb67d7a597344591b1f3373998ef376....0.tmp
/data/data/####/8a4deaff43a0b8b68de90adc48251c34fffc4be9beca96b....0.tmp
/data/data/####/8b433d0d5b36c4b7d850d294210de90cea4ac125d74ad30....0.tmp
/data/data/####/8d8d7bd3599171344345605a89a892e52ca30268209ef02....0.tmp
/data/data/####/8dc99be60f67fb11471d59c1174bdb0b1b4cb8a42e74148....0.tmp
/data/data/####/8eb0909a811b1b5a3364e9fb83ba48db91d9af970289862....0.tmp
/data/data/####/904c28d686a968acfa307a226a46effbb45bf73975a4dfd....0.tmp
/data/data/####/905248af806afd8bcf21627e218a1a1091050088799da5f....0.tmp
/data/data/####/960cae8680fc2d6fbb40fbfe51090f6e09d462cb75fc65e....0.tmp
/data/data/####/9a44357bd4fe17024ac2f4331d74a4f8d20f861ba4f5c91....0.tmp
/data/data/####/9a889879ca8a3d3ec888bac9e62c808a64fcf08cd4f1f11....0.tmp
/data/data/####/9ad1b649f2c2b82fe74b349f273b8c95629bbdab68be00a....0.tmp
/data/data/####/9c64e26337f2dfe8b11bc982f26f6020ef5d7751aa22855....0.tmp
/data/data/####/CustomIndex
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVIndoor.cfg
/data/data/####/DVSDirectory.cfg
/data/data/####/DVVersion.cfg
/data/data/####/ResPackIndoorMap.rs
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/a1611a47cba624c9f951820d4aa2824e01a8e615051b189....0.tmp
/data/data/####/a5f3ba3188096107dd9cfe4869c63b2817dbd3aead06165....0.tmp
/data/data/####/a632917759343d0879424e1c039d26c588f1847020b1df0....0.tmp
/data/data/####/a==7.5.4&&1.0.5_1548605112816_envelope.log
/data/data/####/aa0e16881ea2c06137155d63e18ef0375bcf807aa9755c0....0.tmp
/data/data/####/ada05774f5f83d482d0294391efb099056e5fb50eecda26....0.tmp
/data/data/####/afdd29856b245da740b0d82d85e8b4dc34c6c2d4f9cf87c....0.tmp
/data/data/####/authStatus_com.mgmt.woniuge.xml
/data/data/####/authStatus_com.mgmt.woniuge;remote.xml
/data/data/####/b4376699fa4827f9047b233092a4f89d440838f7fc82bcd....0.tmp
/data/data/####/b489b5edb0e42e8ea5b32d7dfdf706bbda56ce74e850c3e....0.tmp
/data/data/####/b7d3ce0b39e6e7b42f7b63af774e41c12de2a9b92a99110....0.tmp
/data/data/####/baseindoormap.sty
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/c209cc755567a91bdee5d10c1a0b2ddc5bce4a43ad225b8....0.tmp
/data/data/####/c2c21a7e129c2e813bba9e6e1c506dc6e0d2f770c81036b....0.tmp
/data/data/####/c85fb948679666c527be8b940bc884123d968651de51c92....0.tmp
/data/data/####/c8da6d75b39e31ac7fdc8f5dca230099828913217ca661c....0.tmp
/data/data/####/ccbc231047231b23dbf42abad9f61ca80ff9036f73044a9....0.tmp
/data/data/####/cff9968a5c3b87b24dbff1be87869b13044bd02bb2b2a27....0.tmp
/data/data/####/crashrecord.xml
/data/data/####/d1bc733f328c8f61a0ef99a4605d4a6a8946cbaa88d6a7d....0.tmp
/data/data/####/d450772d809c8f28a9443333dc457db5c6c9fa39db321fc....0.tmp
/data/data/####/d690537e3165b79233097770271c394f8c42a322038482b....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4NjA1MTExOTg4;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ4NjA1MTQ4MzUz;
/data/data/####/dab336bcb5cd2dd4b544c7e5209b0ae5efbb58530b84535....0.tmp
/data/data/####/dd3ee57a4839659ea5b69ef7216778bb64f40543db1395e....0.tmp
/data/data/####/domain_1
/data/data/####/e0aa17413679c763aeefe63d4393492073cdb011e38a856....0.tmp
/data/data/####/e5ab9d744bbe364a2730e4785e19b965d01cf666525920f....0.tmp
/data/data/####/e7b25fefd5ce20d21868d38357a034d8395485beae71def....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f698b2411482ce1cca6fe08ecf8b6cca992978948750a48....0.tmp
/data/data/####/f69fec78682d30a8bce2a52e47aeedf4d2c2c6a8d7808d4....0.tmp
/data/data/####/f91bdbb495e541f18c891951e7fedd0ae1b9c07eddb74f2....0.tmp
/data/data/####/f962875b5fc8bbbc2d01b9fd19c1eb9a616263506a772d4....0.tmp
/data/data/####/firll.dat
/data/data/####/gal.db
/data/data/####/gal.db-journal
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/i==1.2.0&&1.0.5_1548605112012_envelope.log
/data/data/####/i==1.2.0&&1.0.5_1548605148745_envelope.log
/data/data/####/info.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libcuid.so
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.5.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/map.rs
/data/data/####/map.sty
/data/data/####/map_pref.xml
/data/data/####/mix.dex
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/native_record_lock
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/reduct.rs
/data/data/####/reduct.sty
/data/data/####/security_info
/data/data/####/sobot_chat_20190127_log.txt
/data/data/####/sobot_config.xml
/data/data/####/traffic.rs
/data/data/####/traffic.sty
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ver.dat
/data/data/####/wng_sp.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.artc_lock
/data/media/####/.cca.dat
/data/media/####/.cuid2
/data/media/####/.di
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.im_lock
/data/media/####/.lesd_lock
/data/media/####/.mn_-1464060969
/data/media/####/.nomedia
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.rc_lock
/data/media/####/.slw
/data/media/####/.ss_lock
/data/media/####/.umm.dat
/data/media/####/DTTempdat.dat
/data/media/####/DTTempdat.idx
/data/media/####/DVUserdat.cfg
/data/media/####/conlts.dat
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/sysid.dat
/data/media/####/test.0
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.5.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal

Загружает динамические библиотеки:

BaiduMapSDK_base_v5_2_1
BaiduMapSDK_map_v5_2_1
Bugly
libnfix
libshella-2.9.0.5
libufix
locSDK7b
nfix
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней