Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) vc.m####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) st.bz.m####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) com####.m####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) x.da.m####.com:80
- TCP(HTTP/1.1) o####.ar####.api.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) log.rc.hun####.com:80
- TCP(HTTP/1.1) c####.d####.v2.####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) mob.bz.m####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) cou####.pe####.m####.com:80
- TCP(HTTP/1.1) 3####.h####.com:80
- TCP(HTTP/1.1) o####.ac####.api.####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(HTTP/1.1) s5.hun####.com:80
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) qq.i####.com:443
- TCP 43.2####.145.64:5226
- TCP sdk.o####.t####.####.com:5224
- TCP t####.nz4.ig####.com:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.cli####.go####.com
- ap####.v0.m####.com
- api####.a####.com
- c####.d####.v2.####.com
- c-h####.g####.com
- com####.m####.com
- cou####.pe####.m####.com
- d####.t####.m####.com
- g####.hun####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.rc.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mob.bz.m####.com
- o####.ac####.api.####.com
- o####.ar####.api.####.com
- o####.con####.api.####.com
- o####.dy.api.####.com
- pl####.log.hun####.com
- rc.m####.com
- s5.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st.bz.m####.com
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- vc.m####.com
- www.qchann####.cn
- x.da.hun####.com
- x.da.m####.com
- y.da.hun####.com
Запросы HTTP GET:
- 0####.h####.com/preview/cms_icon/2019/3/22/03/20190322202246947.jpg_130x...
- 0####.h####.com/preview/cms_icon/2019/3/23/03/20190323152253395.png_750x...
- 0####.h####.com/preview/sp_images/2018/dianshiju/322675/4341800/20180404...
- 0####.h####.com/preview/sp_images/2019/1/31/dianshiju/327996/5089189/201...
- 0####.h####.com/preview/sp_images/2019/3/10/dianshiju/324653/5285886/201...
- 0####.h####.com/preview/sp_images/2019/3/15/dianshiju/328268/5313053/201...
- 3####.h####.com/preview/cms_icon/2019/3/23/03/20190323233657612.jpg_366x...
- 3####.h####.com/preview/cms_icon/2019/3/24/03/20190324001634042.jpg_750x...
- 3####.h####.com/preview/cms_icon/2019/3/24/03/20190324190914485.jpg_750x...
- 3####.h####.com/preview/cms_icon/auto_gif/2019/03/24/846919332022977283....
- 3####.h####.com/preview/sp_images/2018/dianshiju/290856/4457878/20180711...
- 3####.h####.com/preview/sp_images/2019/3/23/zongyi/328606/5355922/201903...
- 3####.h####.com/preview/sp_images/2019/3/24/dianshiju/324653/5360690/201...
- 3####.h####.com/preview/sp_images/2019/3/24/dianshiju/324653/5360831/201...
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
- ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
- com####.m####.com/video_comment/getcount?type=####&subject_id=####
- cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&svrip=####&ver=#...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&ver=####&chk=####
- g####.hun####.com/mobile/distribute.do?deviceid=####
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15506498742532.png
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.rc.hun####.com/rpt?region=####&mod=####&did=####&ver=####&net=####&c...
- mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
- o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
- o####.ar####.api.####.com/artist/getArtistListByIds?artistIds=####&type=...
- o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
- pl####.log.hun####.com/playerQuality.gif?first_frame_time=####&seeking_t...
- s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
- s5.hun####.com/mobile/like?did=####&uid=####&vid=####&c=####
- s5.hun####.com/mobile/rank?c=####
- s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
- s5.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&appVersion...
- s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
- s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
- s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
- s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
- s5.hun####.com/v7/playlist/list?clipId=####&abroad=####
- s5.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=####&osTyp...
- s5.hun####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=###...
- s5.hun####.com/v8/video/list?uid=####&appVersion=####&ticket=####&fstlvl...
- s5.hun####.com/v8/video/relative?uid=####&appVersion=####&ticket=####&fs...
- st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- t####.c####.q####.####.com/tdata_AXX896
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_Fus136
- ti####.c####.l####.####.com/config/bj-bjv6.conf
- ti####.c####.l####.####.com/config/hz-bjv6.conf
- use####.api.max.####.com/person57fb6062d84a5.png
- use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5c22237087396.jpg
- use####.api.max.####.com/person5c788bd844d9e.jpg
- use####.api.max.####.com/preview/channel_images/20190110115242539.jpg_73...
- use####.api.max.####.com/preview/cms_icon/2019/3/15/03/20190315181422588...
- use####.api.max.####.com/preview/cms_icon/2019/3/19/03/20190319100733607...
- use####.api.max.####.com/preview/cms_icon/2019/3/21/03/20190321121152252...
- use####.api.max.####.com/preview/cms_icon/2019/3/22/03/20190322200317631...
- use####.api.max.####.com/preview/cms_icon/2019/3/22/03/20190322202238819...
- use####.api.max.####.com/preview/cms_icon/2019/3/23/03/20190323115431361...
- use####.api.max.####.com/preview/cms_icon/2019/3/23/03/20190323231918869...
- use####.api.max.####.com/preview/cms_icon/2019/3/24/03/20190324001129701...
- use####.api.max.####.com/preview/cms_icon/2019/3/24/03/20190324191142607...
- use####.api.max.####.com/preview/cms_icon/2019/3/24/03/20190324215858089...
- use####.api.max.####.com/preview/cms_icon/2019/3/24/03/20190324215902255...
- use####.api.max.####.com/preview/cms_icon/auto_gif/2019/03/20/1258088904...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2017/dianshiju...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2019/3/20/dian...
- use####.api.max.####.com/preview/sp_images/2016/dianshiju/295303/3337673...
- use####.api.max.####.com/preview/sp_images/2017/zongyi/308811/3871207/20...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/290856/4454496...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/299437/4270021...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/318353/4383900...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/320547/4683042...
- use####.api.max.####.com/preview/sp_images/2018/dianshiju/323665/4438686...
- use####.api.max.####.com/preview/sp_images/2019/3/13/dianshiju/324653/53...
- use####.api.max.####.com/preview/sp_images/2019/3/23/dianshiju/324653/53...
- use####.api.max.####.com/preview/sp_images/2019/3/23/zongyi/328606/53556...
- use####.api.max.####.com/preview/sp_images/2019/3/24/dianshiju/324653/53...
- v2.log.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- vc.m####.com/v2/dynamicinfo?uid=####&osVersion=####&mac=####&pid=####&os...
- y.da.hun####.com/app/impression?_serverip=####&adid=####&adtotal=####&ap...
Запросы HTTP POST:
- a####.u####.com/app_logs
- c####.d####.v2.####.com/dispatcher.do
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- mo####.log.hun####.com/data.cgi
- o####.ac####.api.####.com/global/config
- o####.ar####.api.####.com/artist/getArtistListByIds
- res####.a####.com/v3/log/init
- sdk-ope####.g####.com/api.php?format=####&t=####
- vc.m####.com/v2/watch
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/m/page
- x.da.hun####.com/video/player
- x.da.m####.com/m/page
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-613446739
- /data/data/####/-613448754
- /data/data/####/.imprint
- /data/data/####/00ebc08dcc9679401289285a011bc89663dc13562d9106c....0.tmp
- /data/data/####/1176bfd6eb1682950b6be04d35b0d34d1a481c5acfc9964....0.tmp
- /data/data/####/124babf84a281ac615999f63f2764fcf7a57fb28473622b....0.tmp
- /data/data/####/15e4c9e11457450dea09c51934556ea21535acf8111ef36....0.tmp
- /data/data/####/1703720991
- /data/data/####/1b9682ecd39c88c84d939cc43d967a8c
- /data/data/####/1cba257273de35f830ccf903aa6f326f95ba149b954d0ef....0.tmp
- /data/data/####/1f5bcdb12d6ea0faf01631344d17b20c669c3624f6260a0....0.tmp
- /data/data/####/257306020
- /data/data/####/257306028
- /data/data/####/28186c1859089f6e6af24303f3855de06dc0770ed89b7a2....0.tmp
- /data/data/####/2f247767a0a8fb8bdbcc5819ea3aaa8f32e7bc8c772c5f4....0.tmp
- /data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
- /data/data/####/43c123b0fd59385e109a0f749862f504414b48520583298....0.tmp
- /data/data/####/47591b91f9b94fd1930d2212492df409bed3b4ce90e816a....0.tmp
- /data/data/####/47c821f0ad093eef0a4e555476d2ed34fe1df716281a4a7....0.tmp
- /data/data/####/4d3dca89e6cbbe15fafd853339fc3b6cd385c48a12100cd....0.tmp
- /data/data/####/5a5b277776b3e731fbb7d727c492cd1be7476baf241c6ac....0.tmp
- /data/data/####/5d3447d2f3f87d4bd49d5cf4e3444b5bad0ba20021deb1d....0.tmp
- /data/data/####/614108960
- /data/data/####/6164488808ecdfe1bb669cf1488d6e4f
- /data/data/####/61fe4053300fcd978803de9233739d4587be282de2fcafd....0.tmp
- /data/data/####/61fe4053300fcd978803de9233739d4587be282de2fcafd...4910.0
- /data/data/####/6ba9aa834cb38cbf4c38cf8eb5e503861ec723c2e3b14d7....0.tmp
- /data/data/####/6bfd51611deb9d17528381f384e4a037aeff3a6e96c781b....0.tmp
- /data/data/####/72358e89097ebe5d72f8bf6e84c82b519d9762e357a11e3....0.tmp
- /data/data/####/750f14ad41a593ad8287c3e17d1e5e785acd7f3b80e28fc....0.tmp
- /data/data/####/7a19c61c0e1fecd9c049eaed76f3caff811305a4a0a9dd9....0.tmp
- /data/data/####/83362044decc3e09e86cbfb27f292c3d57aa4c014e51ef0....0.tmp
- /data/data/####/8855d789c7a58356284a33c25b00c8ed
- /data/data/####/8cfc572d147f3df3014ba62f111a0467980e583f73341b3....0.tmp
- /data/data/####/933978904
- /data/data/####/9628cafe9294c2ac719f7353d2096e98
- /data/data/####/988a4482fea878459f1522a4709edacac6f495cccc26fff....0.tmp
- /data/data/####/9f457bb56895a3a43a18ad99c86fe072b55c2d6f313512b....0.tmp
- /data/data/####/ERROR.xml
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MGTVCommon.xml.bak (deleted)
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/a198350dcc366982b9d604b03fc1f0fec1ca6ec0cefbddc....0.tmp
- /data/data/####/a21f9839e52938d9e87563fcb2194a6447ebddf5185129e....0.tmp
- /data/data/####/a46e7e35bd9bedb4cbc220fc5394d59e28cdb42c4eca61a....0.tmp
- /data/data/####/a918c9c02c578a4afc894a6e53bcb8f5
- /data/data/####/arch.xml
- /data/data/####/bd35083a5a398d01839ed4812b25e91fc2246e7e3448b48....0.tmp
- /data/data/####/c4d76ba530404a4c7b244cc8c3e940c150a53380d0590e7....0.tmp
- /data/data/####/c8649a8cca726f3e4693a0a71e7e0c3e
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/com.hunantv.mglive.FILE_KEY_HINT_DATA.xml
- /data/data/####/d47f74cbfa4378964c9b5d8331de94ed
- /data/data/####/d4a61dedf35199386d1dce4fb0aa03ae
- /data/data/####/d92230bc172bd03fd8ee26319c49d847761a8f3f08fcaaf....0.tmp
- /data/data/####/dbad6ce0d3124746450c94f35bfbfc90
- /data/data/####/e9a77f5edf1580d46262cfc4554d0427
- /data/data/####/ed4017c9ccc641e99eb9320c9532e1a408fdbbfdc6ef575....0.tmp
- /data/data/####/ee4b2f56a425eb994bb2f95fafb962bae058d51228390e5....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/fcd3b0cb64ebe2d99be7120cf2af7c9771b0c01afc8ddff....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/hmt_agent_commonutill_com.helong.movie.chaoQing.xml
- /data/data/####/hmt_agent_commonutill_device_id.xml
- /data/data/####/hmt_agent_online_setting_com.helong.movie.chaoQing.xml
- /data/data/####/hmt_analytics
- /data/data/####/hmt_analytics-journal
- /data/data/####/hmt_init_savetime.xml
- /data/data/####/hmt_irsuid.xml
- /data/data/####/hmt_session_id.xml
- /data/data/####/hmt_session_id_savetime.xml
- /data/data/####/hmt_session_id_savetime.xml.bak
- /data/data/####/hmt_session_id_savetime.xml.bak (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu1277710486.so
- /data/data/####/mobclick_agent_cached_com.helong.movie.chaoQing610
- /data/data/####/multidex.version.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/root.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_AXX896
- /data/data/####/tdata_AXX896.jar
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_Fus136
- /data/data/####/tdata_Fus136.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/1_log.txt
- /data/media/####/1a5adfbed6018d896d618c7f69860580
- /data/media/####/6c0f39dfcc4b7c9a168a91c577bac5cd
- /data/media/####/85e1235247dea8ed9f99f86caa05a8f2
- /data/media/####/AN.csv-20190324184025
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1553452826218
- /data/media/####/UA.csv-20190324184026
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/apge.csv-20190324184040
- /data/media/####/apge.csv-20190324184044
- /data/media/####/apge.csv-20190324184121
- /data/media/####/app.db
- /data/media/####/b4d55cad2e339fccc7e309b530553048
- /data/media/####/befd88b6731adea07780d3d02398dc71
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.helong.movie.chaoQing.bin
- /data/media/####/com.helong.movie.chaoQing.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/ed564792a6ba70d0b9fa8e93d34ad244
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1553452824205.txt
- /data/media/####/tdata_AXX896
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_Fus136
- /data/media/####/test.log
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25448 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25448 300 0
Загружает динамические библиотеки:
- CdnAuth
- ImgoFfmpeg
- ImgoHelp
- ImgoMediaPlayer_V3.0.3
- getuiext2
- libjiagu1277710486
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
