Техническая информация
Вредоносные функции:
Отправляет SMS:
- 106901332942: rg|939|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T386gzFZ8hIkbcE2M.4RGSM,nV.a0YJdIZONNVVTOk6P7y4.wsEwW6NQDOwDllLvj5E4!
Выполняет код следующих детектируемых угроз:
- Android.Spy.373.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.55.161.68:29092
- TCP(HTTP/1.1) csk.mc####.com:9003
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
Запросы DNS:
- csk.mc####.com
- piema####.funu####.com
Запросы HTTP GET:
- ti####.c####.l####.####.com/
- ti####.c####.l####.####.com/libs/cgs/FileSaver.js
- ti####.c####.l####.####.com/libs/cgs/cgsBase.js
- ti####.c####.l####.####.com/libs/id/id.js
- ti####.c####.l####.####.com/libs/modules/dragonBones/dragonBones.min.js
- ti####.c####.l####.####.com/libs/modules/egret/egret.min.js
- ti####.c####.l####.####.com/libs/modules/egret/egret.web.min.js
- ti####.c####.l####.####.com/libs/modules/game/game.min.js
- ti####.c####.l####.####.com/libs/modules/mouse/mouse.min.js
- ti####.c####.l####.####.com/libs/modules/res/res.min.js
- ti####.c####.l####.####.com/libs/modules/tween/tween.min.js
- ti####.c####.l####.####.com/main.min.js
- ti####.c####.l####.####.com/polyfill/promise.min.js
- ti####.c####.l####.####.com/resource/assets/common_mobile.json
- ti####.c####.l####.####.com/resource/assets/common_mobile.png
- ti####.c####.l####.####.com/resource/assets/mbts_mobile.json
- ti####.c####.l####.####.com/resource/assets/mbts_mobile.png
- ti####.c####.l####.####.com/resource/assets/select_mobile.json
- ti####.c####.l####.####.com/resource/assets/select_mobile.png
- ti####.c####.l####.####.com/resource/assets/star.png
- ti####.c####.l####.####.com/resource/assets/stars_mobile.json
- ti####.c####.l####.####.com/resource/assets/stars_mobile.png
- ti####.c####.l####.####.com/resource/assets/start_mobile.json
- ti####.c####.l####.####.com/resource/assets/start_mobile.png
- ti####.c####.l####.####.com/resource/assets/tm_mobile.json
- ti####.c####.l####.####.com/resource/assets/tm_mobile.png
- ti####.c####.l####.####.com/resource/color/color_mobile.json
- ti####.c####.l####.####.com/resource/color/color_mobile.png
- ti####.c####.l####.####.com/resource/config/game.cfg.json
- ti####.c####.l####.####.com/resource/default.res.json
- ti####.c####.l####.####.com/resource/logo/elogo_mobile.json
- ti####.c####.l####.####.com/resource/logo/elogo_mobile.png
- ti####.c####.l####.####.com/resource/sounds/bgm1.mp3
- ti####.c####.l####.####.com/resource/sounds/click1.mp3
- ti####.c####.l####.####.com/resource/sounds/click3.mp3
- ti####.c####.l####.####.com/resource/sounds/eat.mp3
- ti####.c####.l####.####.com/resource/sounds/egg.mp3
- ti####.c####.l####.####.com/resource/sounds/jiao.mp3
- ti####.c####.l####.####.com/resource/sounds/sha.mp3
- ti####.c####.l####.####.com/resource/sounds/zan1.mp3
- ti####.c####.l####.####.com/resource/sounds/zan2.mp3
- ti####.c####.l####.####.com/resource/sounds/zan3.mp3
- ti####.c####.l####.####.com/resource/speak/boy/en/s1en.mp3
- ti####.c####.l####.####.com/resource/speak/boy/en/s2en.mp3
- ti####.c####.l####.####.com/resource/speak/boy/en/s3en.mp3
- ti####.c####.l####.####.com/resource/speak/boy/en/s4en.mp3
- ti####.c####.l####.####.com/resource/speak/boy/en/s5en.mp3
- ti####.c####.l####.####.com/resource/speak/boy/zh/s1zh.mp3
- ti####.c####.l####.####.com/resource/speak/boy/zh/s2zh.mp3
- ti####.c####.l####.####.com/resource/speak/boy/zh/s3zh.mp3
- ti####.c####.l####.####.com/resource/speak/boy/zh/s4zh.mp3
- ti####.c####.l####.####.com/resource/speak/boy/zh/s5zh.mp3
- ti####.c####.l####.####.com/resource/speak/girl/en/g1en.mp3
- ti####.c####.l####.####.com/resource/speak/girl/en/g2en.mp3
- ti####.c####.l####.####.com/resource/speak/girl/en/g3en.mp3
- ti####.c####.l####.####.com/resource/speak/girl/en/g4en.mp3
- ti####.c####.l####.####.com/resource/speak/girl/en/g5en.mp3
- ti####.c####.l####.####.com/resource/speak/girl/zh/g1zh.mp3
- ti####.c####.l####.####.com/resource/speak/girl/zh/g2zh.mp3
- ti####.c####.l####.####.com/resource/speak/girl/zh/g3zh.mp3
- ti####.c####.l####.####.com/resource/speak/girl/zh/g4zh.mp3
- ti####.c####.l####.####.com/resource/speak/girl/zh/g5zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/Apple_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/brown_sugar_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/butter_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/cherry_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/choose_a_pie_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/cinnamon_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/condensed_milk_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/corn_starch_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/eggs_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/flour_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/ginger_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/lemon_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/milk_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/peach_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/pumpkin_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/salt_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/sugar_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/en/vanilla_en.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/Apple_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/brown_sugar_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/butter_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/cherry_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/choose_a_pie_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/cinnamon_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/condensed_milk_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/corn_starch_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/eggs_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/flour_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/ginger_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/lemon_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/peach_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/pumpkin_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/sugar_zh.mp3
- ti####.c####.l####.####.com/resource/speak/intro/zh/vanilla_zh.mp3
Запросы HTTP POST:
- csk.mc####.com:9003/csk/c_s/g_f.json
- csk.mc####.com:9003/csk/st_c/cn_i_sec.json
- csk.mc####.com:9003/csk/st_c/cn_sk_Order.json
- csk.mc####.com:9003/csk/st_c/cn_sk_login.json
- csk.mc####.com:9003/csk/st_c/cn_sk_specialVersion.json
- csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
- csk.mc####.com:9003/csk/st_c/getst_tegy.json
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/app_test.apk
- /data/data/####/brushs.xml
- /data/data/####/bt_bkg.xml
- /data/data/####/bt_grey.xml
- /data/data/####/cds.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/diag_bg.xml
- /data/data/####/diag_cls_ig.png
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/fmoonStore.db
- /data/data/####/fmoonStore.db-journal
- /data/data/####/fpsdktempfile
- /data/data/####/fs_dia_fir_ly.xml
- /data/data/####/fs_dia_fir_ly_old.xml
- /data/data/####/fs_dia_ret_ly.xml
- /data/data/####/fs_dia_snd_ly.xml
- /data/data/####/index
- /data/data/####/order_sp.xml
- /data/data/####/pro_activi_sho.png
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/zzleanus
Другие:
Загружает динамические библиотеки:
- snjumdyx
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Получает информацию об отправленых/принятых SMS.
