Android.Spy.2419

Техническая информация

Вредоносные функции:

Отправляет SMS:

106901332942: rg|408|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T3847JBEM61kgQ0WgAFAcYuBgeq5unO7DFf,gUp2lKfdR4AWreVsMhHhbEt67JN7f2Kc!

Выполняет код следующих детектируемых угроз:

Android.DownLoader.691.origin
Android.Spy.373.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) d####.top:985
TCP(HTTP/1.1) csk.mc####.com:9003
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) 1####.55.161.68:29092
TCP(HTTP/1.1) 39.1####.156.168:1616
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) sv.bdst####.com.####.com:443
TCP(TLS/1.0) sslbdst####.jom####.com:443
TCP(TLS/1.0) opencdn####.jom####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) ssls####.jom####.com:443
TCP(TLS/1.0) ch####.jom####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) box.jom####.com:443
TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443
TCP(TLS/1.0) sslb####.jom####.com:443

Запросы DNS:

c####.b####.com
cambria####.cdn.bc####.com
cdn.static####.org
csk.mc####.com
d####.top
g####.bdst####.com
g0.b####.com
m.b####.com
piema####.funu####.com
s.bdst####.com
sp0.b####.com
sp1.b####.com
ss0.b####.com
ss0.bdst####.com
ss1.b####.com
ss2.b####.com
sv.bdst####.com
t7.b####.com
t8.b####.com

Запросы HTTP GET:

gl####.w.kunl####.####.com/jquery/1.7/jquery.min.js?cclt1=####
ti####.c####.l####.####.com/
ti####.c####.l####.####.com/libs/cgs/FileSaver.js
ti####.c####.l####.####.com/libs/cgs/FileSaver.js?cclt1=####
ti####.c####.l####.####.com/libs/cgs/cgsBase.js
ti####.c####.l####.####.com/libs/id/id.js
ti####.c####.l####.####.com/libs/modules/dragonBones/dragonBones.min.js
ti####.c####.l####.####.com/libs/modules/egret/egret.min.js
ti####.c####.l####.####.com/libs/modules/egret/egret.web.min.js
ti####.c####.l####.####.com/libs/modules/game/game.min.js
ti####.c####.l####.####.com/libs/modules/mouse/mouse.min.js
ti####.c####.l####.####.com/libs/modules/res/res.min.js
ti####.c####.l####.####.com/libs/modules/tween/tween.min.js
ti####.c####.l####.####.com/main.min.js
ti####.c####.l####.####.com/polyfill/promise.min.js
ti####.c####.l####.####.com/resource/assets/apple_mobile.json
ti####.c####.l####.####.com/resource/assets/apple_mobile.png
ti####.c####.l####.####.com/resource/assets/bake_mobile.json
ti####.c####.l####.####.com/resource/assets/bake_mobile.png
ti####.c####.l####.####.com/resource/assets/cherry_mobile.json
ti####.c####.l####.####.com/resource/assets/cherry_mobile.png
ti####.c####.l####.####.com/resource/assets/common_mobile.json
ti####.c####.l####.####.com/resource/assets/common_mobile.png
ti####.c####.l####.####.com/resource/assets/cutlight.png
ti####.c####.l####.####.com/resource/assets/dough_mobile.json
ti####.c####.l####.####.com/resource/assets/dough_mobile.png
ti####.c####.l####.####.com/resource/assets/game1_mobile.json
ti####.c####.l####.####.com/resource/assets/game1_mobile.png
ti####.c####.l####.####.com/resource/assets/mbts_mobile.json
ti####.c####.l####.####.com/resource/assets/mbts_mobile.png
ti####.c####.l####.####.com/resource/assets/peach_mobile.json
ti####.c####.l####.####.com/resource/assets/peach_mobile.png
ti####.c####.l####.####.com/resource/assets/pumpkin_mobile.json
ti####.c####.l####.####.com/resource/assets/pumpkin_mobile.png
ti####.c####.l####.####.com/resource/assets/select_mobile.json
ti####.c####.l####.####.com/resource/assets/select_mobile.png
ti####.c####.l####.####.com/resource/assets/star.png
ti####.c####.l####.####.com/resource/assets/stars_mobile.json
ti####.c####.l####.####.com/resource/assets/stars_mobile.png
ti####.c####.l####.####.com/resource/assets/start_mobile.json
ti####.c####.l####.####.com/resource/assets/start_mobile.png
ti####.c####.l####.####.com/resource/assets/tm_mobile.json
ti####.c####.l####.####.com/resource/assets/tm_mobile.png
ti####.c####.l####.####.com/resource/color/color_mobile.json
ti####.c####.l####.####.com/resource/color/color_mobile.png
ti####.c####.l####.####.com/resource/config/game.cfg.json
ti####.c####.l####.####.com/resource/default.res.json
ti####.c####.l####.####.com/resource/logo/elogo_mobile.json
ti####.c####.l####.####.com/resource/logo/elogo_mobile.png
ti####.c####.l####.####.com/resource/sounds/bgm1.mp3
ti####.c####.l####.####.com/resource/sounds/click1.mp3
ti####.c####.l####.####.com/resource/sounds/click3.mp3
ti####.c####.l####.####.com/resource/sounds/da.mp3
ti####.c####.l####.####.com/resource/sounds/done4.mp3
ti####.c####.l####.####.com/resource/sounds/eat.mp3
ti####.c####.l####.####.com/resource/sounds/egg.mp3
ti####.c####.l####.####.com/resource/sounds/jiao.mp3
ti####.c####.l####.####.com/resource/sounds/sha.mp3
ti####.c####.l####.####.com/resource/sounds/timeover.mp3
ti####.c####.l####.####.com/resource/sounds/zan1.mp3
ti####.c####.l####.####.com/resource/sounds/zan2.mp3
ti####.c####.l####.####.com/resource/sounds/zan3.mp3
ti####.c####.l####.####.com/resource/speak/boy/en/s1en.mp3
ti####.c####.l####.####.com/resource/speak/boy/en/s2en.mp3
ti####.c####.l####.####.com/resource/speak/boy/en/s3en.mp3
ti####.c####.l####.####.com/resource/speak/boy/en/s4en.mp3
ti####.c####.l####.####.com/resource/speak/boy/en/s5en.mp3
ti####.c####.l####.####.com/resource/speak/boy/zh/s1zh.mp3
ti####.c####.l####.####.com/resource/speak/boy/zh/s2zh.mp3
ti####.c####.l####.####.com/resource/speak/boy/zh/s3zh.mp3
ti####.c####.l####.####.com/resource/speak/boy/zh/s4zh.mp3
ti####.c####.l####.####.com/resource/speak/boy/zh/s5zh.mp3
ti####.c####.l####.####.com/resource/speak/girl/en/g1en.mp3
ti####.c####.l####.####.com/resource/speak/girl/en/g2en.mp3
ti####.c####.l####.####.com/resource/speak/girl/en/g3en.mp3
ti####.c####.l####.####.com/resource/speak/girl/en/g4en.mp3
ti####.c####.l####.####.com/resource/speak/girl/en/g5en.mp3
ti####.c####.l####.####.com/resource/speak/girl/zh/g1zh.mp3
ti####.c####.l####.####.com/resource/speak/girl/zh/g2zh.mp3
ti####.c####.l####.####.com/resource/speak/girl/zh/g3zh.mp3
ti####.c####.l####.####.com/resource/speak/girl/zh/g4zh.mp3
ti####.c####.l####.####.com/resource/speak/girl/zh/g5zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/Apple_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/brown_sugar_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/butter_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/cherry_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/choose_a_pie_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/cinnamon_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/condensed_milk_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/corn_starch_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/eggs_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/flour_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/ginger_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/lemon_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/milk_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/peach_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/pumpkin_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/salt_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/sugar_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/en/vanilla_en.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/Apple_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/brown_sugar_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/butter_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/cherry_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/choose_a_pie_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/cinnamon_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/condensed_milk_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/corn_starch_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/eggs_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/flour_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/ginger_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/lemon_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/peach_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/pumpkin_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/sugar_zh.mp3
ti####.c####.l####.####.com/resource/speak/intro/zh/vanilla_zh.mp3

Запросы HTTP POST:

csk.mc####.com:9003/csk/c_s/g_f.json
csk.mc####.com:9003/csk/st_c/cn_i_sec.json
csk.mc####.com:9003/csk/st_c/cn_sk_Order.json
csk.mc####.com:9003/csk/st_c/cn_sk_login.json
csk.mc####.com:9003/csk/st_c/cn_sk_specialVersion.json
csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
csk.mc####.com:9003/csk/st_c/getst_tegy.json
d####.top:985/d48/4b1
d####.top:985/ob6e538/4803372
d####.top:985/s7a7b/101bb

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jar
/data/data/####/ApplicationCache.db-journal
/data/data/####/app_test.apk
/data/data/####/brushs.xml
/data/data/####/bt_bkg.xml
/data/data/####/bt_grey.xml
/data/data/####/cds.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/diag_bg.xml
/data/data/####/diag_cls_ig.png
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/fmoonStore.db
/data/data/####/fmoonStore.db-journal
/data/data/####/fpsdktempfile
/data/data/####/fs_dia_fir_ly.xml
/data/data/####/fs_dia_fir_ly_old.xml
/data/data/####/fs_dia_ret_ly.xml
/data/data/####/fs_dia_snd_ly.xml
/data/data/####/index
/data/data/####/order_sp.xml
/data/data/####/pro_activi_sho.png
/data/data/####/qwifehnp
/data/data/####/twsdk.db-journal
/data/data/####/userData.xml
/data/data/####/userDatas.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Другие:

Загружает динамические библиотеки:

jxuowenx

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Получает информацию об отправленых/принятых SMS.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней