Adware.Waps.818

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Waps.5.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) img.a8####.com:80
TCP(HTTP/1.1) p####.a8####.com:80
TCP(HTTP/1.1) 1####.40.181.218:3553
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) u####.a8####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) d.sin####.cn.####.net:80
TCP(HTTP/1.1) lia####.500.com:80
TCP(HTTP/1.1) cdn.a8.tv####.####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) g3.l####.cn:80
TCP(HTTP/1.1) a8.tv####.com:80
TCP(HTTP/1.1) u####.tv####.com:80
TCP(HTTP/1.1) n####.tv####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) 1####.124.119.149:3553
TCP(HTTP/1.1) 1####.40.182.164:3553
TCP(TLS/1.0) cdn.datas####.com.cn:443
TCP(TLS/1.0) to####.datas####.com.cn:443
TCP(TLS/1.0) st####.v.xingy####.com:443
TCP(TLS/1.0) g####.api.a8s####.com:443
TCP(TLS/1.0) h5.a8s####.com:443
TCP(TLS/1.0) 2####.58.212.142:443
TCP 1####.11.61.13:80

Запросы DNS:

a####.m.ta####.com
a####.u####.com
a.appj####.com
a8.tv####.com
ag####.m.ta####.com
api.m.ta####.com
app.w####.cn
c####.fun####.com
cdn.a8.tv####.com
cdn.datas####.com.cn
chan####.s####.com
feed####.u####.com
g####.api.a8s####.com
g3.l####.cn
h5.a8s####.com
img.a8####.com
lia####.500.com
log.u####.com
msg.umengc####.com
n####.tv####.com
oc.u####.com
p####.a8####.com
pi####.qq.com
st####.v.xingy####.com
to####.datas####.com.cn
u####.a8####.com
u####.tv####.com
www.sin####.cn

Запросы HTTP GET:

a8.tv####.com/right/game_ads_switch?platform=####&version=####&os_ver=##...
a8.tv####.com/right/game_progress_info?platform=####&leagueId=####&versi...
a8.tv####.com/right/get_live_literal?order=####&count=####&platform=####...
a8.tv####.com/right/news/news_list?platform=####&version=####&uid=####&o...
a8.tv####.com/v2/app_conf?platform=####&version=####&key=####&os_ver=###...
a8.tv####.com/v2/duiba/login?userId=####&platform=####&version=####&os_v...
a8.tv####.com/v2/integral/get?platform=####&version=####&os_ver=####&sig...
a8.tv####.com/v3/game/list?platform=####&status=####&version=####&os_ver...
api.m.ta####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&a...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=#...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
cdn.a8.tv####.####.com/a8_sport/guess/guess_marquee/css/style.css
cdn.a8.tv####.####.com/a8_sport/guess/guess_marquee/index.html
cdn.a8.tv####.####.com/a8_sport/guess/guess_marquee/js/jquery.js
cdn.a8.tv####.####.com/a8_sport/guess/guess_marquee/js/jquery.md5.js
cdn.a8.tv####.####.com/a8_sport/guess/guess_marquee/js/marquee.js
cdn.a8.tv####.####.com/right/get_show_leagues?platform=####&version=####
cdn.a8.tv####.####.com/right/news/news_list?platform=####&version=####&p...
cdn.a8.tv####.####.com/right/news/video_news_list
cdn.a8.tv####.####.com/v3/hot/main?gameType=####&page=####&pageSize=####
cdn.a8.tv####.####.com/v3/team/list?platform=####&version=####&os_ver=##...
d.sin####.cn.####.net/lf/sports/cba_85/2014/14.png
d.sin####.cn.####.net/lf/sports/cba_85/2014/3.png
et2-na6####.wagbr####.ali####.####.com/bar/get/53e9d1f2fd98c5b21600025b/...
g3.l####.cn/recommend?format=####
gdv.a.s####.com/api/2/topic/load?page_size=####&style=####&hot_size=####...
gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
img.a8####.com/nba/cavaliers.png
img.a8####.com/nba/clippers.png
img.a8####.com/nba/lakers.png
img.a8####.com/nba/rockets.png
img.a8####.com/nba/spurs.png
img.a8####.com/nba/thunder.png
img.a8####.com/nba/warriors.png
img.a8####.com/nba/凯尔特人.png
img.a8####.com/nba/国王.png
img.a8####.com/nba/开拓者.png
img.a8####.com/nba/快船.png
img.a8####.com/nba/步行者.png
img.a8####.com/nba/活塞.png
img.a8####.com/nba/湖人.png
img.a8####.com/nba/爵士.png
img.a8####.com/nba/独行侠.png
img.a8####.com/nba/雄鹿.png
img.a8####.com/nba/马刺.png
img.a8####.com/nba/鹈鹕.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_1072.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_1075.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_1560.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_554.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_653.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_664.png
lia####.500.com/static/soccerdata/images/TeamPic/teamsignnew_883.png
n####.tv####.com/front_page_conf.php?nwtime=####&key=####&sign=####
n####.tv####.com/list_plugin_meta.php?app_name_version=####
p####.a8####.com/heart?platform=####&version=####&uid=####&did=####&appK...
u####.a8####.com/v2/jc/list?userId=####&platform=####&version=####&date=...
u####.a8####.com/v2/user/init_account?platform=####&version=####&flag=##...
u####.a8####.com/v3/team/follow_list?userId=####&platform=####&version=#...
u####.tv####.com/app_conf?version=####&nwtime=####&app=####&keys=####&si...

Запросы HTTP POST:

a####.u####.com/app_logs
a.appj####.com/ad-service/ad/mark
app.w####.cn/action/user_info
msg.umengc####.com/v2/launch
msg.umengc####.com/v2/register
oc.u####.com/check_config_update
pi####.qq.com/mstat/report/?index=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.mta-wxop.xml
/data/data/####/A8Sport.db-journal
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppSettings.xml
/data/data/####/AppStore.xml
/data/data/####/AppStore.xml (deleted)
/data/data/####/CacheTime.dat
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MsgLogStore.db-journal
/data/data/####/PhoneUtil.xml
/data/data/####/ShowAdFlag.xml
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/agoo.pid
/data/data/####/config.xml
/data/data/####/daemonserver.pid
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/hack.apk
/data/data/####/index
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_org.fungo.a8sport2070
/data/data/####/mobclick_agent_online_setting_org.fungo.a8sport.xml
/data/data/####/multidex.version.xml
/data/data/####/org.fungo.a8sport.xml
/data/data/####/org.fungo.a8sport_preferences.xml
/data/data/####/pri_wxop_tencent_analysis.db-journal
/data/data/####/register.xml
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_socialize_qq.xml
/data/data/####/uuid.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wxop_tencent_analysis.db-journal
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/10jbicso0opph1c7qwlfz24p5.0.tmp
/data/media/####/13ihqhzmws2c150crjavlhitp.0.tmp
/data/media/####/13va6qaxmuilwrgwdeovejtpm.0.tmp
/data/media/####/1d7bu2lk9685b1t6t1didlk4c.0.tmp
/data/media/####/1psschj3p8xdh7dp63vo9vrlq.0.tmp
/data/media/####/1r0cyffyzpnaydivwc16zy06e.0.tmp
/data/media/####/1tbu1o622nw703995q21zs14r.0.tmp
/data/media/####/1vicq6tnidt0tk1qlad47nff9.0.tmp
/data/media/####/213xenjk0ixyczh1imznoy7ye.0.tmp
/data/media/####/2bkx76uwcllk7twy6wioxhmwg.0.tmp
/data/media/####/2n114j2ngevlm07zm205vtwsy.0.tmp
/data/media/####/2nxnxy46id6zb61psygdejgp3.0.tmp
/data/media/####/2rqexy3k3xxvwg9awaaj57g08.0.tmp
/data/media/####/312j7viz57evbi0zvaxfzlg1u.0.tmp
/data/media/####/31piwqijn1ccxvh7210gqno3z.0.tmp
/data/media/####/3557njhe7xxph1ljyo03fpshh.0.tmp
/data/media/####/35wy1s8ka4w4tj4plt1trlhbl.0.tmp
/data/media/####/3ha0fng81f50t4f8lsic4j7v7.0.tmp
/data/media/####/3hlj50c7e60w3h3sk8798h7da.0.tmp
/data/media/####/3qasdu4cp7jhmisv9i19jcpse.0.tmp
/data/media/####/3qec7rffji2prxhstxfywne1x.0.tmp
/data/media/####/3rnossijq2ntgfaqvlm9o5dam.0.tmp
/data/media/####/3u8329vee1cun62s54gawz06l.0.tmp
/data/media/####/41sas2jsg3ahvpamgu22s0axk.0.tmp
/data/media/####/4du3acu2j91ls6tsf76u0dh68.0.tmp
/data/media/####/4f3z9bo9jgphr0f6484ttunc.0.tmp
/data/media/####/4luylrvzgq0atx62cimvmui27.0.tmp
/data/media/####/4r8lvp0qcs5oo96ur4e8d47n5.0.tmp
/data/media/####/4y2fbw7hcbn6217h6cbp326m2.0.tmp
/data/media/####/596h4vy0gobafeazdoa91dgxi.0.tmp
/data/media/####/5dq9e14lc77pyt79jzheorf57.0.tmp
/data/media/####/5nlbsifmd6lwoo7fi73lhky2t.0.tmp
/data/media/####/64bywp1bt2xx3d35dpsas1el2.0.tmp
/data/media/####/6pst1sbb4watt1g7es8r3sp14.0.tmp
/data/media/####/7fb4wqotwjryij4oi0d89kfk6.0.tmp
/data/media/####/Alvin2.xml
/data/media/####/AppPackage.dat
/data/media/####/CacheTime.dat
/data/media/####/ContextData.xml
/data/media/####/UnPackage.dat
/data/media/####/android
/data/media/####/ff0d6s9v4z8nsbq3ubgtgixq.0.tmp
/data/media/####/fqfil82uuip4frqzv7q17d50.0.tmp
/data/media/####/journal.tmp
/data/media/####/ucpjd8pptskwa96x23pjcrf8.0.tmp

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_android_daemon_1.1.0 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:53e9d1f2fd98c5b21600025b","utdid":"XHeh3gNsyR4DAGdzx1HVq0tW","sdkVersion":"20160215"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
sh

Загружает динамические библиотеки:

fungo_ffmpeg
libjiagu
tnet-2.1.20

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней