Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.RemoteCode.41.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) hd.a####.com:80
- TCP(HTTP/1.1) adv.jpi####.com:80
- TCP(HTTP/1.1) en####.tui####.com:80
- TCP(HTTP/1.1) yun.russi####.cn.####.com:80
- TCP(HTTP/1.1) acti####.russi####.cn:80
- TCP(HTTP/1.1) fp-st####.b0.a####.com:80
- TCP(HTTP/1.1) c.no####.net:80
- TCP(HTTP/1.1) adv.99y####.com:80
- TCP(HTTP/1.1) api.51aiz####.cn:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(SSL/3.0) ip.goq####.com:443
- TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) t####.i####.com:443
- TCP(TLS/1.0) st####.adhu####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) st####.hd####.com.####.com:443
- TCP(TLS/1.0) dis####.eq####.com:443
- TCP(TLS/1.0) fp-st####.b0.a####.com:443
- TCP(TLS/1.0) common####.ia####.m####.com:443
- TCP(TLS/1.0) yun.russi####.cn.####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) api.iad####.com:443
- TCP(TLS/1.0) ip.goq####.com:443
- TCP(TLS/1.0) s####.yy.com:443
- TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) ei.c####.com:443
- TCP(TLS/1.0) ia####.m####.com:443
Запросы DNS:
- acti####.russi####.cn
- adv-u####.t####.u####.net
- adv.99y####.com
- adv.jpi####.com
- aliyuno####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- api.51aiz####.cn
- api.iad####.com
- c####.mm####.com
- c.c####.com
- c.no####.net
- cdn.boo####.com
- common####.ia####.m####.com
- dis####.eq####.com
- ei.c####.com
- en####.tui####.com
- hotfix####.oss-cn-####.aliy####.com
- i####.adhu####.com
- i####.adhu####.com
- i####.adhu####.com
- i####.adhu####.com
- ia####.m####.com
- ip.goq####.com
- m.b####.com
- s####.yy.com
- s19.c####.com
- st####.adhu####.com
- st####.hd####.com
- st####.ton####.net
- t####.i####.com
- yun.russi####.cn
- yun.tuis####.com
- yun.tuit####.com
- z8.c####.com
Запросы HTTP GET:
- acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
- acti####.russi####.cn/domainWhite/getAll
- acti####.russi####.cn/index/activity?appKey=####&adslotId=####
- en####.tui####.com/index/activity?appKey=####&adslotId=####
- fp-st####.b0.a####.com/tdu/tdu_js_file.js?partner=####&appName=####&even...
- hd.a####.com/android/adv/qsz/advsdk/release/advsdk-release.enc
- hd.a####.com/android/adv/qsz/resource/ljsdk.dex
- wap.n.sh####.com/mobads.php?K000000####
- yun.russi####.cn.####.com/h5-mami/activity/smashg/2.0.5/index_2018101210...
- yun.russi####.cn.####.com/h5-mami/activity/smashg/2.0.5/index_2018101214...
- yun.russi####.cn.####.com/h5-mami/activity/turnCircle/5.0/actBase_201809...
- yun.russi####.cn.####.com/mami-media/img/04xb7fqlss.jpg?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/1cekxz8mtc.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/32bdhbrzpm.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/91dnlp25dq.png
- yun.russi####.cn.####.com/mami-media/img/91dnlp25dq.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/al50fvij7i.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/dneqp85qf6.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/e419216wtv.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/e84fkx40c6.png
- yun.russi####.cn.####.com/mami-media/img/e84fkx40c6.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/g5tl3kvvcy.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/hwo6ssohy9.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/jw4iz90q7t.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/lm97zkakoi.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/m4xsgb9xdr.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/o2o0i2b19z.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/p05ksvqluj.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/pk4t7chxyd.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/putzba5sgn.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/q61ta3t9jv.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/sp0zp5fpdl.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/z9sn3afdkg.png?x-oss-process=####
- yun.russi####.cn.####.com/newactivity/assets/actBase.4e31f162.js
- yun.russi####.cn.####.com/newactivity/assets/actBase.e3ec4c0b.css
- yun.russi####.cn.####.com/newactivity/assets/gyroscope.90b7461a.js
- yun.russi####.cn.####.com/newactivity/assets/touchs.3bae3309.js
- yun.russi####.cn.####.com/newactivity/assets/turnCard-fs.3.0.f010f63c.css
- yun.russi####.cn.####.com/newactivity/assets/turnCard-fs.3.0.f03e95a5.js...
Запросы HTTP POST:
- acti####.russi####.cn/activity/ajaxOptions
- acti####.russi####.cn/statistics/activityPagePerf?type=####&skinName=###...
- adv.99y####.com/adv/dayActive
- adv.99y####.com/adv/getTask
- adv.99y####.com/adv/pluginFeedback
- adv.99y####.com/adv/pluginReq
- adv.99y####.com/adv/taskFedback
- adv.jpi####.com/adv/pluginReq
- api.51aiz####.cn/api/cmcc/check?sdk=####&app=####
- c.no####.net/e/a/t
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/61561a876896a2a77dd8fe35b4403c0b.db
- /data/data/####/99fa89db37b9859fdb387aa6b1199ad2.db
- /data/data/####/JSON.xml
- /data/data/####/PDvjrzYq.jar
- /data/data/####/W_Key.xml
- /data/data/####/b19288e.dex
- /data/data/####/cmcc.xml
- /data/data/####/com.lk.fc_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/i5Hy6MFo.jar
- /data/data/####/iQbPKox.jar
- /data/data/####/index
- /data/data/####/texigPnbqX.jar
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Использует следующие алгоритмы для шифрования данных:
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
- ARCFOUR
- DES
- DES-CBC-PKCS5Padding
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
