Android.Spy.2628

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Spy.2442

Осуществляет доступ к приватному интерфейсу ITelephony.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
TCP(HTTP/1.1) gs.g####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) l####.cc:80
TCP(HTTP/1.1) c####.g####.com:80
TCP(HTTP/1.1) cn-hang####.oss####.aliyun####.com:80
TCP(HTTP/1.1) wlcc####.b0.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) b####.g####.com:80
TCP(HTTP/1.1) ope####.m.ta####.com:80
TCP(HTTP/1.1) 5####.cn:80
TCP(TLS/1.0) lbs.net####.im:443
TCP(TLS/1.0) ma####.m.ta####.com:443
TCP(TLS/1.0) hd.mm####.com:443
TCP(TLS/1.0) wa####.127.net:443
TCP(TLS/1.0) nbsdk-b####.al####.com:443
TCP(TLS/1.0) s.c####.ta####.com:443
TCP(TLS/1.0) guide-w####.m.ta####.com:443
TCP(TLS/1.0) log.mm####.com:443
TCP(TLS/1.0) wea####.weilito####.net.####.com:443
TCP(TLS/1.0) h5.m.ta####.com:443
TCP(TLS/1.0) na61-####.wagbr####.adverti####.####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) log####.wei####.cn:443
TCP(TLS/1.0) g.al####.com:443
TCP(TLS/1.0) w####.wei####.cn:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

5####.cn
a####.u####.com
acs4bai####.m.ta####.com
ad####.m.ta####.com
ada####.m.ta####.com
b####.g####.com
c####.g####.com
c####.g####.com
c####.g####.ig####.com
c-h####.g####.com
cn-hang####.oss####.aliyun####.com
g.al####.com
gs.g####.com
gw.al####.com
h####.m.ta####.com
h5.m.ta####.com
hd.mm####.com
img.al####.com
l####.cc
lbs.net####.im
log####.wei####.cn
log.mm####.com
ma####.m.ta####.com
nbsdk-b####.al####.com
res####.a####.com
s.c####.t####.com
s.c####.ta####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.weilito####.net
up####.weilito####.net
w####.wei####.cn
wa####.127.net
wb.110.ta####.com
wea####.weilito####.net
wlcc####.wel####.cn
y####.al####.com

Запросы HTTP GET:

5####.cn/cpRRBoB
ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
cn-hang####.oss####.aliyun####.com/amap-api/comm/upload/CoordinateSoEnhe...
l####.cc/i/sdk/is_gal?imei_md5=####&os=####&p_chklst_version=####&retry_...
ope####.m.ta####.com/gw-open/mtop.taobao.tbk.sdk.config/1.0/?data=####
ti####.c####.l####.####.com/config/hz-hzv3.conf
wlcc####.b0.a####.com/2019/02/27/upload_1xymu3723y5qsujwht9dvfkxqaq0mh3r...
wlcc####.b0.a####.com/2019/02/27/upload_3ez1474adekrsz9oti2d8tqxlfnr45c2...
wlcc####.b0.a####.com/2019/02/27/upload_3uet46cl8ochkyms7dnz307y6y116i9r...
wlcc####.b0.a####.com/2019/02/27/upload_644dh1lj0awnwt5qw1i2c6a0cg0p77b2...
wlcc####.b0.a####.com/2019/02/27/upload_p1tq9bg0d1qfc84k4u2brb4c6cjwen1u...
wlcc####.b0.a####.com/2019/02/27/upload_pnn7k8c64syvm4t0lpeo48wnb0d98mfi...
wlcc####.b0.a####.com/2019/02/27/upload_zthvwdf1wh41tm97w4bujee6flw7occ7...
wlcc####.b0.a####.com/2019/02/28/upload_bm46n96kpsfevylcf0d7dl9h4rl85kgp...
wlcc####.b0.a####.com/2019/02/28/upload_oq9fpkc0m58kky3to41mmk1xtelxpg04...
wlcc####.b0.a####.com/2019/03/15/upload_blpdaelurfnrz3h3mrbfa41fzz4w245k...
wlcc####.b0.a####.com/2019/03/15/upload_bnioe795okkac5w11qnoxeocen5u777n...
wlcc####.b0.a####.com/2019/03/15/upload_ma3hohwyec3c4b838p4de6yq5znhdsyr...
wlcc####.b0.a####.com/2019/03/15/upload_wb5vb1egfzocaqg2unro3e61b58mvvrx...
wlcc####.b0.a####.com/category/20181129/4g3wh88d5kazlqg1ol8ibaoev161fcxy...
wlcc####.b0.a####.com/category/20181129/8ukwwfrs3e94knxyph6vtirff7cemma9...
wlcc####.b0.a####.com/category/20181129/b1blihmcpomfzoa015l8ih4awx1p5txu...
wlcc####.b0.a####.com/category/20181129/d4wcmbnlkirhqc6eh9g51d6gruzqokim...
wlcc####.b0.a####.com/category/20181129/ix2h0rclmt7zwo1pvee0x7254eeraym8...
wlcc####.b0.a####.com/category/20181129/l6hpuk0rd1egj7cbjvwnb2l53r9vswnq...
wlcc####.b0.a####.com/category/20181129/n4als1h4zkka4e4x49c7fcss89r8sf80...
wlcc####.b0.a####.com/category/20181129/n52hndhs1ixowlqufimk7ydsunlzfpmc...
wlcc####.b0.a####.com/category/20181129/nxrmmj4j0yip0cn6q8nsxlgnn922at2c...
wlcc####.b0.a####.com/category/20181129/p9e88i9aoe8ds4dv21vyna01h64bkdf0...
wlcc####.b0.a####.com/category/20181129/tyjiza3ehiosgurbec1anmih0b7d2f04...
wlcc####.b0.a####.com/category/20181129/yi3ko1wsj58jwjjeaa1n22o9akwoncx9...
wlcc####.b0.a####.com/category/20181129/zvits8cqqqt4al69j73b1q9qdx6ccska...

Запросы HTTP POST:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
b####.g####.com/api.php?format=####&t=####
c####.g####.com/api.php?format=####&t=####
gs.g####.com/encryption/key/fetch
gs.g####.com/geshu/sdkStatistics/bd
gs.g####.com/geshu/sdkStatistics/ubi
hk.wagbr####.non####.####.com/saveWb.json
l####.cc/i/sdk/install
na61-####.wagbr####.ali####.####.com/api/update.do
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/020b0f31fa0a327eefe34fb1f20ec4b842e80b6e791c4f6....0.tmp
/data/data/####/02bfd5d02a8928210706973a5e0cf55160f8d475fe5a3d6....0.tmp
/data/data/####/054deb0a5c2d3c29f9db12080589af5411cf43ab41d296b....0.tmp
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/0ce9a96009882ddac615e82b81d1d0b41c1e7eca60f3c60....0.tmp
/data/data/####/10016abc104d35056da3d2c62e6af1aeffe24125bc6e93d....0.tmp
/data/data/####/1abf09544279cef7534bcc25fbb6ff78a75457b4a8cba87....0.tmp
/data/data/####/1c69f9ac2f0a4d2995c784442bd918ee1888529b4a19280....0.tmp
/data/data/####/1d125c846bdbe9551ec2338889e5f8f4032649ee924c0d5....0.tmp
/data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/21cc5e486857d72ce0be39a3484911319d9ff953cb38dae....0.tmp
/data/data/####/22ae78a0e42de5fb54c541ce5b7dc0e24b6ee23c4ad1558....0.tmp
/data/data/####/2c94bd8b9ac2a7156b590982618b3f98080fa5dce109bd3....0.tmp
/data/data/####/2fd7ef28f39ed30b5d87503684a20a010017b139588baa0....0.tmp
/data/data/####/36f5637e297b83733014ff95c96da5f778b04082132e994....0.tmp
/data/data/####/3f579ab8814d12241f04b63eaaa2806f7d935606f6d4166....0.tmp
/data/data/####/3facbdcd08ed10d9a1e61eb9718d1a55ca2de15b5b1cb99....0.tmp
/data/data/####/4dd29c850e239fe4366f3548b6d15edd452018468e57ae4....0.tmp
/data/data/####/5215cb7f524f175deb54f5c0f46739804cd48b3cce91b5c....0.tmp
/data/data/####/570cc86ad6cdae9a2335ae561128ea1ff85eefb9bf2ecdb....0.tmp
/data/data/####/7c76296f19fa0e6a2f9657d089b79c8aa4476ea4948a711....0.tmp
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/8fe94ecad72f25631d052b7c2543483fcc01122f21e95a9....0.tmp
/data/data/####/9215c0bdd0ff811407f60af7bff67829801f8808c4a1471....0.tmp
/data/data/####/930a31b34bd52c08.lock
/data/data/####/961f8b6cd3893d4d01cb10d9e79a029b0ee56a90c060a13....0.tmp
/data/data/####/AlibcLinkPartner.xml
/data/data/####/Alvin2.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/ContextData.xml
/data/data/####/LKME_Server_Request_Queue.xml
/data/data/####/MultiDex.lock
/data/data/####/NIMSDK_Config_219554c62485fd9458690447473edbce.xml
/data/data/####/ReadAward.xml
/data/data/####/SGMANAGER_DATA2
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/WlkkSharedPreferences.xml
/data/data/####/a41fdc38357b36941572831bf401b8c83217062e25cb460....0.tmp
/data/data/####/ae29103e1ede395aed3cda4fd357afe58f367a6e434d643....0.tmp
/data/data/####/aliTradeConfigSP.xml
/data/data/####/analyticsdata.xml
/data/data/####/ap.Lock
/data/data/####/auth_sdk_device.xml
/data/data/####/b0038a97aeb50c7cf6a4418c367c060f5ac5bc61ca3c983....0.tmp
/data/data/####/bb101b7cec6f40f7e6604f97e580599f00a8e6282f69aad....0.tmp
/data/data/####/beee0e9c2ed2d09b76eb40d2bd3f42d4e2ac04c3549a699....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cn.weli.analytics.AnalyticsDataAPI.xml
/data/data/####/cn.weli.coupon-journal
/data/data/####/cn.weli.coupon_preferences.xml
/data/data/####/d70bf3e162f6d95f463ade6c2f4bc88670d1cbf751f640d....0.tmp
/data/data/####/d96f1c09225bbfda915688af845fd7d22c2990479f965b8....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dc8365f5011f28637d9af8f33578c5cba99a37e50d051ca....0.tmp
/data/data/####/e5af798e9b5bcd58acbb4c35183beb9874dd41446e84d87....0.tmp
/data/data/####/e8f61792e67019b759e7b216e868450ab484ce7750b97ff....0.tmp
/data/data/####/ef6c59f7a4b7ea712bf669cfe3f94e030e50d2b6a2a778f....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/fa5ddd1fd702ce2504dbad4bcd7da42c24cbd52e97e3cc1....0.tmp
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gtc.db-journal
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/ias.db-journal
/data/data/####/ias_sp.xml
/data/data/####/imei_mac.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/k.store
/data/data/####/libjiagu1490445148.so
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/libwgs2gcj.so
/data/data/####/linkedme_referral_shared_pref.xml
/data/data/####/lock.lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/multidex.version.xml
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sp.lock
/data/data/####/timestamp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/wlsq.db-journal
/data/media/####/.lm_device_id
/data/media/####/.nomedia
/data/media/####/1552768097924.db
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/alsn20170807.db
/data/media/####/alsn20170807.db-journal
/data/media/####/app.db
/data/media/####/cn.weli.coupon.bin
/data/media/####/cn.weli.coupon.db
/data/media/####/cn.weli.coupon_.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/dd7893586a493dc3
/data/media/####/dev_info
/data/media/####/hid.dat
/data/media/####/nim_sdk.log
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GetuiPushService 24394 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.GetuiPushService 24394 300 0

Загружает динамические библиотеки:

WeliLib
getuiext3
libjiagu1490445148
sgmainso-5.1
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DESede
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней