Android.Packed.43119

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.3394
Android.DownLoader.635.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) w####.xinma####.net:80
TCP(HTTP/1.1) tvaw####.g####.sina####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) api.xinma####.net:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) re####.xinma####.net:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) m.d####.mob.com:80
TCP(HTTP/1.1) www.xinma####.net:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) openmo####.qq.com:80
TCP(HTTP/1.1) 1####.205.163.87:80
TCP(HTTP/1.1) appsup####.qq.com:80
TCP(HTTP/1.1) pub.idq####.com.####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) c.isds####.qq.com:80
TCP(HTTP/1.1) www.s####.net:8080
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) thi####.q####.cn:80
TCP(HTTP/1.1) tvaxw####.g####.sina####.com:80
TCP(TLS/1.0) msg.umengc####.com:443
TCP 1####.205.160.76:443
TCP openj####.m.ta####.com:80

Запросы DNS:

a####.b####.qq.com
a####.exc.mob.com
a####.u####.com
aexcep####.b####.qq.com
ag####.m.ta####.com
and####.b####.qq.com
api.xinma####.net
appsup####.qq.com
c.isds####.qq.com
cgi.con####.qq.com
com####.xinma####.net
fb.u####.com
m.d####.mob.com
msg.umengc####.com
openmo####.qq.com
pi####.qq.com
pub.idq####.com
q####.qq.com
qzones####.g####.cn
re####.xinma####.net
t####.sin####.cn
t####.sin####.cn
thi####.q####.cn
thi####.q####.cn
umengj####.m.ta####.com
w####.xinma####.net
www.s####.net
www.xinma####.net

Запросы HTTP GET:

appsup####.qq.com/cgi-bin/appstage/mstats_report?report_type=####&platfo...
c.isds####.qq.com/code.cgi?domain=####&cgi=####&type=####&code=####&time...
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
openmo####.qq.com/oauth2.0/m_authorize?status_userip=####&scope=####&red...
p####.tc.qq.com/c/=/open/mobile/login/js/login_browser_jump.js
p####.tc.qq.com/open/mobile/login/qzsjump.html?status_userip=####&scope=...
p####.tc.qq.com/open_proj/qqconnect/h5login/css/jump2.css?t=####
p####.tc.qq.com/open_proj/qqconnect/h5login/css/sprite/jump2.png?max_age...
pub.idq####.com.####.com/qconn/widget/mobile/login/images/loading.gif?ma...
thi####.q####.cn/g?b=####&k=####&s=####
thi####.q####.cn/mmopen/vi_32/rPECNq52icicwOAT2skjKjIvm13FyOGpvubVcPtsaF...
thi####.q####.cn/qqapp/1104663120/784016A258EBF51CAC99E574BAF2FE7E/100
thi####.q####.cn/qqapp/1104663120/FFE326C24BD219CA85F2CBE717C234AE/100
tvaw####.g####.sina####.com/crop.0.0.100.100.50/005SZQfzjw8ep1tsci1bjj30...
tvaw####.g####.sina####.com/crop.5.1.99.99.50/e7f76934gw1ebvx8zuv0rj2032...
tvaxw####.g####.sina####.com/crop.0.0.664.664.50/007dXaDFly8ftv4vwbglrj3...
w####.xinma####.net/246144454/res/logo_thumb.jpg?ver=####
w####.xinma####.net/279560185/res/logo_detail.jpg?ver=####
w####.xinma####.net/293043912/res/logo_thumb.jpg?ver=####
w####.xinma####.net/299669339/res/logo_detail.jpg?ver=####
w####.xinma####.net/316986593/res/logo_detail.jpg?ver=####
w####.xinma####.net/338860339/res/logo_thumb.jpg?ver=####
w####.xinma####.net/368568669/res/logo_thumb.jpeg?ver=####
w####.xinma####.net/370734244/res/logo_detail.jpeg?ver=####
w####.xinma####.net/392471801/res/logo_thumb.jpg?ver=####
w####.xinma####.net/482270979/res/logo_thumb.jpg?ver=####
w####.xinma####.net/494394807/res/logo_detail.jpg?ver=####
w####.xinma####.net/504723361/res/logo_detail.jpeg?ver=####
w####.xinma####.net/524402933/res/logo_detail.jpg?ver=####
w####.xinma####.net/529143671/res/logo_thumb.jpeg?ver=####
w####.xinma####.net/533408654/res/logo_detail.jpeg?ver=####
w####.xinma####.net/533408654/res/logo_thumb.jpeg?ver=####
w####.xinma####.net/626911702/res/logo_detail.jpeg?ver=####
w####.xinma####.net/636980941/res/logo_thumb.jpeg?ver=####
w####.xinma####.net/704626396/res/logo_detail.jpeg?ver=####
w####.xinma####.net/common/splash/xmhf572dcd7a08c3d368ef081d8c0bb631f.pn...
w####.xinma####.net/common/xmh_common_1454480961.png
w####.xinma####.net/rolling/exception/robber_map.jpg?_=####
w####.xinma####.net/uploads/worksinfo/August2018/xmh_H1Ra8IZtsRaUaXCz7lp...
w####.xinma####.net/uploads/worksinfo/August2018/xmh_sg9a962Q9B4RX4Q0SU6...
w####.xinma####.net/uploads/worksinfo/December2018/xmh_Bz3A3rAxjMkNd2FPw...
w####.xinma####.net/uploads/worksinfo/December2018/xmh_UBuGdoB2pIcuB39oq...
w####.xinma####.net/uploads/worksinfo/December2018/xmh_bqBo3SufPgswlWEMR...
w####.xinma####.net/uploads/worksinfo/December2018/xmh_wLb2Z2BNp7nzuFNcc...
w####.xinma####.net/uploads/worksinfo/January2019/xmh_G0ZerhcG2yP1It2u6u...
w####.xinma####.net/uploads/worksinfo/January2019/xmh_SiaXZaQEkQ4o7IaDRn...
w####.xinma####.net/uploads/worksinfo/January2019/xmh_m6pcqf1mmjzDHCpFlP...
w####.xinma####.net/uploads/worksinfo/July2018/xmh_OVyuAzlZ4m3pS3uPoG99....
w####.xinma####.net/uploads/worksinfo/November2018/xmh_4bJA0acBFlue4wYo3...
w####.xinma####.net/uploads/worksinfo/November2018/xmh_DQegE8ixWnRlbjggJ...
w####.xinma####.net/uploads/worksinfo/November2018/xmh_TFaHx82kAeuix6NOA...
w####.xinma####.net/uploads/worksinfo/November2018/xmh_aqDsOKf8CCrx8tMJT...
w####.xinma####.net/uploads/worksinfo/November2018/xmh_fsYbkGnvYfBu70aMV...
w####.xinma####.net/uploads/worksinfo/November2018/xmh_pKaCp2bzxOOKfzRPC...
w####.xinma####.net/uploads/worksinfo/October2018/xmh_43tO1XiI2MO74bGcra...
w####.xinma####.net/uploads/worksinfo/October2018/xmh_4fhGHfvSqz6xRYjUBO...
w####.xinma####.net/useralbum/0ffc0cd711ced879c50625717b3165e1/avatar/av...
w####.xinma####.net/useralbum/602d115d33e96f5d432dfb009d7895de/avatar/av...

Запросы HTTP POST:

a####.exc.mob.com/errconf
a####.u####.com/app_logs
aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
api.xinma####.net/v2/hotpage?devid=####&userid=####&xid=####&iver=####&n...
api.xinma####.net/v2/rolling?devid=####&userid=####&xid=####&iver=####&n...
pi####.qq.com/mstat/report
re####.xinma####.net/v2/getcomment?devid=####&userid=####&xid=####&iver=...
re####.xinma####.net/v2/getpreview?devid=####&userid=####&xid=####&iver=...
re####.xinma####.net/v2/getrecommend?devid=####&userid=####&xid=####&ive...
re####.xinma####.net/v2/latestver?devid=####&userid=####&xid=####&iver=#...
re####.xinma####.net/v2/recommend?devid=####&userid=####&xid=####&iver=#...
re####.xinma####.net/v2/splash?devid=####&userid=####&xid=####&iver=####...
re####.xinma####.net/v2/weekpage?devid=####&userid=####&xid=####&iver=##...
re####.xinma####.net/v2/worksfeature?devid=####&userid=####&xid=####&ive...
re####.xinma####.net/v2/worksinfo?devid=####&userid=####&xid=####&iver=#...
re####.xinma####.net/v2/xwreport?devid=####&userid=####&xid=####&iver=##...
www.s####.net:8080/fview/getIp.action?key=####
www.xinma####.net/api/commoncfg?devid=####&userid=####&xid=####&iver=###...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1039105015-1175825718
/data/data/####/-1078851719.tmp
/data/data/####/-1088684455.tmp
/data/data/####/-1148372614.tmp
/data/data/####/-131024232.tmp
/data/data/####/-1420139133.tmp
/data/data/####/-1432308238-157431135
/data/data/####/-1446574951.tmp
/data/data/####/-1470474800.tmp
/data/data/####/-1570424417.tmp
/data/data/####/-1582752722.tmp
/data/data/####/-1584799441800347171
/data/data/####/-1861191825.tmp
/data/data/####/-1863029307.tmp
/data/data/####/-2059619073.tmp
/data/data/####/-346472253-1139998660
/data/data/####/-445257368.tmp
/data/data/####/-463643253-2014216063
/data/data/####/-463643253-655274206
/data/data/####/-463643253-790050967
/data/data/####/-4636432532145974472
/data/data/####/-4636432532145974474
/data/data/####/-463643253223680992
/data/data/####/-463643253223680993
/data/data/####/-463643253349023114
/data/data/####/-46364325385968039
/data/data/####/-474197791709771857
/data/data/####/-577417535.tmp
/data/data/####/-812930647.tmp
/data/data/####/-83595545-350668696
/data/data/####/-835955451599631559
/data/data/####/-856644920.tmp
/data/data/####/-859522599.tmp
/data/data/####/-973883206-1303673726
/data/data/####/-973883206-1408570148
/data/data/####/.imprint
/data/data/####/.lock
/data/data/####/1071439219.tmp
/data/data/####/1096404979.tmp
/data/data/####/1213884051.tmp
/data/data/####/127094601.tmp
/data/data/####/1291033032.tmp
/data/data/####/1364862709.tmp
/data/data/####/1586352626.tmp
/data/data/####/1661107163.tmp
/data/data/####/1662653246.tmp
/data/data/####/1673074225.tmp
/data/data/####/18094281352032547234
/data/data/####/1862358722.tmp
/data/data/####/1916024063.tmp
/data/data/####/1918001702.tmp
/data/data/####/19634666412140808061
/data/data/####/1998338230-1266190100
/data/data/####/20385918451223644121
/data/data/####/20670704861147802821
/data/data/####/2126600509-1930162062
/data/data/####/233550600-1653463344
/data/data/####/352200718.tmp
/data/data/####/419455146.tmp
/data/data/####/479988766.tmp
/data/data/####/615950764.tmp
/data/data/####/715581779-641961373
/data/data/####/804224781.tmp
/data/data/####/853357305.tmp
/data/data/####/895808861.tmp
/data/data/####/939180013.tmp
/data/data/####/9600122011834539083
/data/data/####/990180211.tmp
/data/data/####/ACCS_BIND.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/SMSSDK_2.xml
/data/data/####/SMSSDK_VCODE_1.xml
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/bugly_db_legu-journal
/data/data/####/com.tencent.open.config.json.1104663120
/data/data/####/com.vseecf.pxv.xinehua.apk
/data/data/####/com.vseecf.pxv.xinehua_preferences.xml
/data/data/####/com.vseecf.pxv.xinehua_preferences.xml.bak
/data/data/####/commoncfg.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/index
/data/data/####/jsondata.xml
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.3.1.so
/data/data/####/libufix.so
/data/data/####/libwbsafeedit_x86.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mix.dex
/data/data/####/mob_commons_1.xml
/data/data/####/mob_sdk_exception_1.xml
/data/data/####/mobclick_agent_online_setting_com.vseecf.pxv.xinehua.xml
/data/data/####/native_record_lock
/data/data/####/newcomic.db
/data/data/####/newcomic.db-journal
/data/data/####/sdk_report.db
/data/data/####/sdk_report.db-journal
/data/data/####/secure_lib.xml
/data/data/####/security_info
/data/data/####/splash_1.jpg
/data/data/####/tencent_analysis.db-journal
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.dic_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/.nulplt
/data/media/####/.pkg_lock
/data/media/####/.rcTag
/data/media/####/.rc_lock
/data/media/####/.slock
/data/media/####/41d08c4d998044a2b247e8c5e2eba6dd
/data/media/####/4ac81fa82cfa452193e726d6d2ac14af
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/accs_election
/data/media/####/eb961e47d8e14fdda10c56ca89c73339

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:550059b4fd98c5f1d4000081","utdid":"XHqGZwQREAEDAGdzx1Fq7HVp","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.3.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
mount
sh

Загружает динамические библиотеки:

Bugly
MtaNativeCrash
libnfix
libshella-2.10.3.1
libufix
libwbsafeedit_x86
neh
nfix
tnet-3.1
ufix

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней