Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Spy.2442
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) pin####.qq.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) l####.cc:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) im####.i####.com.####.com:80
- TCP(HTTP/1.1) ad.i####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) www.i####.com:80
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.b####.qq.com
- a####.u####.com
- ad.i####.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- api.yuanshe####.com
- c####.g####.ig####.com
- c-h####.g####.com
- far####.pl####.com
- im####.i####.com
- l####.cc
- oc.u####.com
- pi####.qq.com
- pin####.qq.com
- sdk.c####.ig####.com
- sdk.o####.i####.####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- www.i####.com
Запросы HTTP GET:
- ad.i####.com/api/advertising/ireader?platform=####&appver=####
- im####.i####.com.####.com/favicon.ico
- im####.i####.com.####.com/medias/2016/1216/110018.jpeg
- im####.i####.com.####.com/medias/2016/1229/110821.jpeg@312x208
- im####.i####.com.####.com/medias/2017/0714/118652.jpeg@312x208
- im####.i####.com.####.com/medias/2017/0824/120471.jpeg@312x208
- im####.i####.com.####.com/medias/2017/0912/121524.jpeg@312x208
- im####.i####.com.####.com/medias/2017/0925/122227.png@312x208
- im####.i####.com.####.com/medias/2017/0928/122428.jpeg@312x208
- im####.i####.com.####.com/medias/2017/0930/122591.jpeg@312x208
- im####.i####.com.####.com/medias/2017/1016/123061.jpeg@312x208
- im####.i####.com.####.com/medias/2017/1221/126476.jpeg@312x208
- im####.i####.com.####.com/medias/2017/1221/126480.jpeg@312x208
- im####.i####.com.####.com/medias/2017/1221/126481.jpeg@312x208
- im####.i####.com.####.com/medias/2017/1221/126482.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0412/131203.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0426/131792.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0524/133001.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0611/133615.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0612/133713.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0628/134334.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0707/134737.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0802/135892.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0830/137365.jpeg@250x167
- im####.i####.com.####.com/medias/2018/0830/137418.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0904/137667.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0907/137946.jpeg@250x167
- im####.i####.com.####.com/medias/2018/0914/138491.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0915/138579.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/138919.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/138921.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/138926.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/138930.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/138933.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/139003.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0920/139006.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0921/139152.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0921/139153.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0921/139155.jpeg@312x208
- im####.i####.com.####.com/medias/2018/0925/139325.jpeg@312x208
- im####.i####.com.####.com/medias/2018/1108/142670.jpeg@312x208
- im####.i####.com.####.com/medias/2019/0124/149900.jpeg@312x208
- im####.i####.com.####.com/mobile/infzm.6.3.2.apk
- im####.i####.com.####.com/mobile/infzmreader_release_v6.0.6.apk
- l####.cc/i/sdk/is_gal?sign=####&android_id=####&retry_times=####&linkedm...
- t####.c####.q####.####.com/tdata_DHU970
- t####.c####.q####.####.com/tdata_aRs116
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- www.i####.com/mobile/get_app_config?platform=####&version=####&machine_i...
- www.i####.com/mobile/get_categories_list?format=####&version=####
- www.i####.com/mobile/get_contents?platform=####&id[]=####&token=####&ver...
- www.i####.com/mobile/get_list_by_cat_ids?count=####&platform=####&versio...
- www.i####.com/mobile/get_public_salt?platform=####&version=####&machine_...
- www.i####.com/mobile/get_rewards?link_id=####&count=####&machine_id=####...
- www.i####.com/mobile/get_source_list?platform=####&version=####&machine_...
- www.i####.com/mobilesource/goal/app.config.php
Запросы HTTP POST:
- a####.u####.com/app_logs
- aexcep####.b####.qq.com:8011/rqd/async
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- c-h####.g####.com/api.php?format=####&t=####
- l####.cc/i/sdk/close
- l####.cc/i/sdk/install
- l####.cc/i/sdk/open
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- pi####.qq.com/mstat/report/?index=####
- pin####.qq.com/request
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.mta-wxop.xml
- /data/data/####/LKME_Server_Request_Queue.xml
- /data/data/####/bugly_db_legu-journal
- /data/data/####/com.infzm.ireader.mid.world.ro.xml
- /data/data/####/com.infzm.ireader_preferences.xml
- /data/data/####/com.nfzm.reader.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/increment.db-journal
- /data/data/####/infzmReader.db-journal
- /data/data/####/init.pid
- /data/data/####/ireader.xml
- /data/data/####/legu_tencent_analysis.db_com.infzm.ireader-journal
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/linkedme_referral_shared_pref.xml
- /data/data/####/linkedme_referral_shared_pref.xml.bak
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mobclick_agent_cached_com.infzm.ireader69
- /data/data/####/mobclick_agent_online_setting_com.infzm.ireader.xml
- /data/data/####/native_record_lock
- /data/data/####/pri_legu_tencent_analysis.db_com.infzm.ireader-journal
- /data/data/####/pri_wxop_tencent_analysis.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/tdata_DHU970.jar
- /data/data/####/tdata_DHU970.tmp
- /data/data/####/tdata_aRs116.jar
- /data/data/####/tdata_aRs116.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize_qq.xml
- /data/data/####/webview.db-journal
- /data/data/####/wxop_tencent_analysis.db-journal
- /data/media/####/.lm_device_id
- /data/media/####/.lm_device_info
- /data/media/####/.mid.txt
- /data/media/####/.mid.txt1000001
- /data/media/####/.nomedia
- /data/media/####/1562szgfzuq1lg4jao90f1fl1.0.tmp
- /data/media/####/1dn06043ttahmktz63psu4x1l.0.tmp
- /data/media/####/1ghv7n6n5xragth2fv6ste3v1.0.tmp
- /data/media/####/1rlt93wasfc8zv24c9jg9p62k.0.tmp
- /data/media/####/21exotqkj23lrqsoky0jyes6b.0.tmp
- /data/media/####/29nyr838oovyzbzrlb1ok55et.0.tmp
- /data/media/####/2di32z6sdcn6qopo0993wo6s6.0.tmp
- /data/media/####/2q3u5qio8eu3l23psdegix9tk.0.tmp
- /data/media/####/2wrlzq8pcc0da09pq9trk2qag.0.tmp
- /data/media/####/3B6717ED9ACDE2D72E1CEB60D7F0CAA1
- /data/media/####/3f9i754amhch8o3s4g1cpzf03.0.tmp
- /data/media/####/3jjt0f4r9l473sl2ltty9wg5k.0.tmp
- /data/media/####/3jxbbq3gtjfm8kvi5tbvrfdz2.0.tmp
- /data/media/####/3kdcmsaoq7w4tiv0s6lom8459.0.tmp
- /data/media/####/3pru5u6zjzgbek2qint15m05s.0.tmp
- /data/media/####/3qe78qmelv315xg58122t7gtv.0.tmp
- /data/media/####/40605l1p7leiqsqyxd00svw6y.0.tmp
- /data/media/####/42r16z3wbf2waq86z3mrf843j.0.tmp
- /data/media/####/43t8oa149ou4w2u2ayhq1z90d.0.tmp
- /data/media/####/4awsxxkqce8iuqzoktgnm3idp.0.tmp
- /data/media/####/4cycw3r7onz700fnyzyjkvruq.0.tmp
- /data/media/####/4g0f2jxgt9vbo9hhnr3hibsxh.0.tmp
- /data/media/####/4lq9hm1l9ypr7jluge11mmrcq.0.tmp
- /data/media/####/50mgaoexzza3nmf71v1tlpqlp.0.tmp
- /data/media/####/5E1EAEFA8D20F71BF8E8B954746938AA
- /data/media/####/5myr7ijdbhoqoth99ff66c3ru.0.tmp
- /data/media/####/5qdmb0gxp3o5c2ga93amjgq60.0.tmp
- /data/media/####/5qko39t3pq6xfy1le168ocxcp.0.tmp
- /data/media/####/5ryhod074sbajq1tog7s945lo.0.tmp
- /data/media/####/5tihybkf80zzpybwwrcz79uxd.0.tmp
- /data/media/####/64pvvx3fmedag1jrobc3g62hm.0.tmp
- /data/media/####/69ocn2o8sckem7rlx5wtilnqx.0.tmp
- /data/media/####/6a7d5v72negyuin4hj49bf84s.0.tmp
- /data/media/####/6dp4o3kgpsa7ry45q2mecmq0t.0.tmp
- /data/media/####/6emyq5z087tz7gyh4i41j6hkq.0.tmp
- /data/media/####/6hi8tnb9c26u3tyzvgnjxr3v.0.tmp
- /data/media/####/6je1793869gm104dp2ety18wi.0.tmp
- /data/media/####/70nen2s3b4v2tof16kwxaqtov.0.tmp
- /data/media/####/7hssqrushrm703b6q61cmssni.0.tmp
- /data/media/####/8i6jnxfr10y39kk1ruwuqmrn.0.tmp
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.infzm.ireader.db
- /data/media/####/infzmReader_v6.3.2.apk
- /data/media/####/journal.tmp
- /data/media/####/rsj5eyv5tb4cxvgy1p2cjvno.0.tmp
- /data/media/####/tdata_DHU970
- /data/media/####/tdata_aRs116
- /data/media/####/test.log
- /data/media/####/vw8havze83f2d41se0c6fv8m.0.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24691 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24691 300 0
Загружает динамические библиотеки:
- Bugly
- MtaNativeCrash
- libnfix
- libshella-2.8
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-NONE-PKCS1PADDING
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB-NoPadding
- AES-GCM-NoPadding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
