Android.Packed.43320

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.540.origin

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) zhusho####.gam####.cn:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) ipv6-as####.m.ta####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) mobads-####.b####.com:80
TCP(HTTP/1.1) i####.gam####.cn.####.com:80
TCP(HTTP/1.1) li.zi.al####.com:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) mf####.gam####.cn.####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(TLS/1.0) h####.b####.com:443
TCP 1####.205.203.77:80

Запросы DNS:

a####.91.com
a####.m.ta####.com
ag####.m.ta####.com
api.m.ta####.com
chan####.s####.com
feed####.u####.com
h####.b####.com
hm.b####.com
i####.gam####.cn
li.zi.al####.com
m####.gam####.cn
mf####.gam####.cn
mo####.b####.com
mobads-####.b####.com
msg.umengc####.com
pi####.qq.com
pl####.y####.com
zhusho####.gam####.cn

Запросы HTTP GET:

api.m.ta####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&a...
api.m.ta####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=#...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
gdv.a.s####.com/api/2/topic/load?page_size=####&style=####&hot_size=####...
gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
hm.b####.com/hm.gif?hca=####&cc=####&ck=####&cl=####&ds=####&vl=####&et=...
hm.b####.com/hm.js?a6dafb1####
i####.gam####.cn.####.com/2015/05/07/106-15050G214350-L.jpg
i####.gam####.cn.####.com/2015/05/08/106-15050QA3220-L.jpg
i####.gam####.cn.####.com/2015/05/08/106-15050QF2000-L.jpg
i####.gam####.cn.####.com/2015/05/09/106-1505091553370-L.jpg
i####.gam####.cn.####.com/2015/05/09/106-1505091604070-L.jpg
i####.gam####.cn.####.com/2015/05/09/106-1505091614020-L.jpg
i####.gam####.cn.####.com/2015/05/09/106-1505091623270-L.jpg
i####.gam####.cn.####.com/2015/05/11/106-1505111522080-L.jpg
i####.gam####.cn.####.com/2015/05/11/106-1505111534220-L.jpg
i####.gam####.cn.####.com/2015/05/11/106-150511154H00-L.jpg
i####.gam####.cn.####.com/2015/05/14/106-1505141629200-L.jpg
i####.gam####.cn.####.com/2015/05/14/106-1505141633030-L.jpg
i####.gam####.cn.####.com/2015/05/27/106-15052G633470-L.jpg
i####.gam####.cn.####.com/2015/07/19/269-150G91335240-L.jpg
i####.gam####.cn.####.com/2015/07/19/269-150G91356390-L.jpg
i####.gam####.cn.####.com/2015/07/19/269-150G91406300-L.jpg
i####.gam####.cn.####.com/2015/07/20/269-150H00922470-L.jpg
i####.gam####.cn.####.com/2015/07/20/269-150H00Z9400-L.jpg
i####.gam####.cn.####.com/2015/07/23/269-150H31009190-L.jpg
i####.gam####.cn.####.com/2015/07/23/269-150H3102F20-L.jpg
i####.gam####.cn.####.com/2015/07/23/269-150H31034150-L.jpg
i####.gam####.cn.####.com/2015/07/23/269-150H31053320-L.jpg
i####.gam####.cn.####.com/2015/08/19/269-150Q91101300-L.jpg
i####.gam####.cn.####.com/2015/08/19/269-150Q9110J70-L.jpg
i####.gam####.cn.####.com/2015/08/19/269-150Q91119390-L.jpg
i####.gam####.cn.####.com/2015/08/19/269-150Q91140570-L.jpg
i####.gam####.cn.####.com/2015/08/22/269-150R20950240-L.jpg
i####.gam####.cn.####.com/2015/08/22/269-150R21024250-L.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111J3590.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111J6060.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111JP90.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111KI10.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111P1250.jpg
i####.gam####.cn.####.com/2015/09/11/269-1509111P4330.jpg
i####.gam####.cn.####.com/2015/09/15/269-150915094H40-L.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221053580-L.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221640210.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221642050.jpg
i####.gam####.cn.####.com/2015/09/22/269-150922164P10.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221A5010.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H0180.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H2070.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H3320.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H5110.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H6240.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221H9270.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221I0360.jpg
i####.gam####.cn.####.com/2015/09/22/269-1509221I2000.jpg
i####.gam####.cn.####.com/2015/09/23/269-1509231113340-L.jpg
i####.gam####.cn.####.com/2015/09/23/269-1509231125010-L.jpg
i####.gam####.cn.####.com/2015/09/23/269-150923115J00-L.jpg
i####.gam####.cn.####.com/2015/09/25/269-150925092P70-L.jpg
i####.gam####.cn.####.com/2015/09/25/269-150925095Q80-L.jpg
i####.gam####.cn.####.com/2015/09/25/269-1509251034320-L.jpg
i####.gam####.cn.####.com/2015/09/30/269-1509301014460-L.jpg
i####.gam####.cn.####.com/2015/09/30/269-1509301110100.jpg
i####.gam####.cn.####.com/2015/09/30/269-1509301110210-L.jpg
i####.gam####.cn.####.com/2015/10/08/269-15100PS3390-L.jpg
i####.gam####.cn.####.com/2015/10/12/269-151012102F20-L.jpg
i####.gam####.cn.####.com/2015/10/12/269-1510121031440-L.jpg
i####.gam####.cn.####.com/2015/10/16/269-1510161030490-L.jpg
i####.gam####.cn.####.com/2016/01/26/269-1601261Q2520.jpg
i####.gam####.cn.####.com/2016/01/26/269-1601261Q4310.jpg
i####.gam####.cn.####.com/2016/01/26/269-1601261Q5420.jpg
i####.gam####.cn.####.com/2016/10/10/1162591-1610101643100-L.jpg
i####.gam####.cn.####.com/2016/12/14/106-1612141S9170.jpg
i####.gam####.cn.####.com/2018/05/04/2270112-1P5041125430.jpg
i####.gam####.cn.####.com/2018/05/04/2804218-1P504101H70-L.jpg
i####.gam####.cn.####.com/2018/05/04/2804218-1P5041039320-L.jpg
i####.gam####.cn.####.com/2018/05/04/2804218-1P5041103150-L.jpg
ipv6-as####.m.ta####.com/jsapi
ipv6-as####.m.ta####.com/unifull/css/unifull.min.css?v=####
mf####.gam####.cn.####.com/2015/09/30/269-1509301110100.jpg
mf####.gam####.cn.####.com/2015/10/20/269-1510201133270.jpg
mf####.gam####.cn.####.com/js/jquery.min.js
zhusho####.gam####.cn/index.php?m=####&a=####&aid=####
zhusho####.gam####.cn/index.php?m=####&a=####&id=####&umengchannel=####
zhusho####.gam####.cn/index.php?m=####&a=####&page=####&typeid=####&flag...
zhusho####.gam####.cn/index.php?m=####&a=####&pageSize=####&page=####&ty...

Запросы HTTP POST:

li.zi.al####.com/71c5/gd7
mobads-####.b####.com/brwhis.log
msg.umengc####.com/v2/launch
msg.umengc####.com/v2/register
pi####.qq.com/mstat/report/?index=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-10813310522058397680
/data/data/####/-10813310522058397682
/data/data/####/-10813310522058397684
/data/data/####/-10813310522058432220
/data/data/####/.mta-wxop.xml
/data/data/####/1003943842-1641187573
/data/data/####/13766565442043072538
/data/data/####/1824952415-2004233749
/data/data/####/25510160.xml
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/AppStore.xml.bak
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MsgLogStore.db-journal
/data/data/####/PhoneUtil.xml
/data/data/####/TrineaAndroidCommon.xml
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1552360572785
/data/data/####/__send_data_1552360573986
/data/data/####/__x_adsdk_agent_header__.xml
/data/data/####/__xadsdk__remote__final__builtin__.jar
/data/data/####/agoo.pid
/data/data/####/bdp_pref.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.gamedog.terrariacomposbox_preferences.xml
/data/data/####/cn.gamedog.terrariacomposboxc.jar
/data/data/####/com.baidu.mobads.loader.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/index
/data/data/####/libcuid.so
/data/data/####/mobclick_agent_cached_cn.gamedog.terrariacomposbox115
/data/data/####/pri_wxop_tencent_analysis.db-journal
/data/data/####/push__local_stat_cache.json
/data/data/####/register.xml
/data/data/####/terrariacomposbox.db-journal
/data/data/####/terrariacomposbox.xml
/data/data/####/trinea_android_common.db-journal
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize_qq.xml
/data/data/####/uuid.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/wxop_tencent_analysis.db-journal
/data/media/####/-1476766188-317244184
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.mid.txt
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/DB11FEB6F80B125A8DA0231024A86004
/data/media/####/http___img1_gamedog_cn_2015_05_07_106_15050G214350_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_08_106_15050QA3220_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_08_106_15050QF2000_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091553370_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091604070_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091614020_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_09_106_1505091623270_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_11_106_1505111522080_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_11_106_1505111534220_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_11_106_150511154H00_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_14_106_1505141629200_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_14_106_1505141633030_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_05_27_106_15052G633470_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91335240_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91356390_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_19_269_150G91406300_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_20_269_150H00922470_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_20_269_150H00Z9400_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31009190_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H3102F20_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31034150_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_269_150H31053320_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91101300_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q9110J70_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91119390_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_19_269_150Q91140570_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_22_269_150R20950240_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_22_269_150R21024250_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111J3590_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111J6060_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111JP90_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111KI10_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111P1250_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_11_269_1509111P4330_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_15_269_150915094H40_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221053580_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221640210_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221642050_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_150922164P10_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221A5010_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H0180_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H2070_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H3320_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H5110_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H6240_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221H9270_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221I0360_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_22_269_1509221I2000_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_23_269_1509231113340_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_23_269_1509231125010_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_23_269_150923115J00_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_25_269_150925092P70_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_25_269_150925095Q80_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_25_269_1509251034320_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_30_269_1509301014460_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_30_269_1509301110210_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_10_08_269_15100PS3390_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_10_12_269_151012102F20_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_10_12_269_1510121031440_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_10_16_269_1510161030490_L_jpg
/data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q2520_jpg
/data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q4310_jpg
/data/media/####/http___img1_gamedog_cn_2016_01_26_269_1601261Q5420_jpg
/data/media/####/http___img1_gamedog_cn_2016_10_10_1162591_1610..._L_jpg
/data/media/####/http___img1_gamedog_cn_2016_12_14_106_1612141S9170_jpg
/data/media/####/http___img1_gamedog_cn_2018_05_04_2270112_1P50...30_jpg
/data/media/####/http___img1_gamedog_cn_2018_05_04_2804218_1P50..._L_jpg
/data/media/####/http___mimg1_gamedog_cn_2015_10_20_269_1510201133270_jpg

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_android_daemon_1.1.0 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5596003f67e58ec956003b88","utdid":"XIckc39i4r0DAGdzx1FVMtDg","sdkVersion":"20160215"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
sh

Загружает динамические библиотеки:

crash_analysis
tnet-2.1.20

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES
DESede-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
DES

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней