Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.RemoteCode.127.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) rp-na####.ron####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(TLS/1.0) api.s####.com:443
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) res####.a####.com:443
- TCP(TLS/1.0) yp.api.m####.cn:443
- TCP(TLS/1.0) s####.cn.ron####.com:443
- TCP 1####.92.22.227:8631
Запросы DNS:
- aexcep####.b####.qq.com
- amap####.cn-hang####.oss####.####.com
- and####.b####.qq.com
- api.s####.com
- cdn.m####.cn
- log.u####.com
- mt####.go####.com
- nav.cn.ron####.com
- plb####.u####.com
- res####.a####.com
- s####.cn.ron####.com
- u####.u####.com
- yp.api.m####.cn
Запросы HTTP GET:
- m####.oss-cn-####.aliy####.com/avatar/201711/06/5a007806ecc220.jpg?x-oss...
- m####.oss-cn-####.aliy####.com/avatar/201711/26/5a1a9427a00bb0.jpg?x-oss...
- m####.oss-cn-####.aliy####.com/avatar/201806/19/5b28c648209940.jpeg?x-os...
- m####.oss-cn-####.aliy####.com/avatar/201808/06/5b681dfea0e870.jpeg?x-os...
- m####.oss-cn-####.aliy####.com/avatar/201809/04/5b8de4f467dfe0.jpeg?x-os...
- m####.oss-cn-####.aliy####.com/avatar/201810/03/5bb4df99309a10.jpeg?x-os...
- m####.oss-cn-####.aliy####.com/avatar/201901/19/evy93q5xbtzv47iedr62.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201902/14/w5ywto78c1lze4cq9mhi.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201902/17/hlaud9jsrgx394xufboh.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201902/17/tbzzqhl61hcayfalga9q.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201902/28/lcdxghhzmlsia0mlp8vg.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201903/06/f8vzl10vrippvcyktkf7.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201903/07/1551934761TVPc4HBg.jpg?x...
- m####.oss-cn-####.aliy####.com/avatar/201903/14/1552560952wtonn3n3.jpg?x...
- m####.oss-cn-####.aliy####.com/avatar/201903/19/pxzn6vi9exmor249ngfn.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201903/27/1553670093UMHFF5xG.jpg?x...
- m####.oss-cn-####.aliy####.com/avatar/201903/28/7tv1qnspgtme91kbf81k.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201903/29/3gfqc1v0121x54u9ctrv.jpg...
- m####.oss-cn-####.aliy####.com/avatar/201904/03/1554279246afORpvwc.jpg?x...
- m####.oss-cn-####.aliy####.com/avatar/201904/04/1554339957806ar2jn.jpg?x...
- m####.oss-cn-####.aliy####.com/photo/201901/16/fiefxsef55kwhfabhuqe.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201901/25/b847p9k9e0ixb9mm9c8t.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201901/30/1548825446y8mThuRA.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201902/16/2n6ko751htdtcj25lx2q.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201902/24/z6vfry7t41qnc1xogjzx.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201902/28/qp07pt90ejwatcjjf7lj.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201903/07/1551911244spuxh6Mz.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201903/07/1551934128wqhi4rIB.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201903/08/1552018323f107YU0z.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201903/08/sc2dsny4fihvhxu314xc.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201903/14/amvncsehez5q2qoboawy.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201903/15/11btva1cl1z5yz2d2qb7.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201903/26/1553614158IM2zSqvA.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201903/27/1553671682uf4ochia.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201903/27/ce4ht9p3q5sxnirbwoy6.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201903/28/80qrf5aoofiqfv3pcwnp.jpg
- m####.oss-cn-####.aliy####.com/photo/201903/28/8wyd8ppmbp9puvi5s4lv.jpg
- m####.oss-cn-####.aliy####.com/photo/201903/28/dh05nmjjnpdplql5x30n.jpg
- m####.oss-cn-####.aliy####.com/photo/201903/28/fkridnqt94fngiac7odw.jpg
- m####.oss-cn-####.aliy####.com/photo/201904/02/ar8uvv4thq8b6smj2fqe.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201904/02/aukvsmo2jav5di1zdh28.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201904/02/vtfz123hf9nwhoe2aawg.jpg?...
- m####.oss-cn-####.aliy####.com/photo/201904/03/1554279340YLDqtYuk.jpg?x-...
- m####.oss-cn-####.aliy####.com/photo/201904/03/cvvxrjxqp74b1kjm842m.jpg
- m####.oss-cn-####.aliy####.com/photo/201904/03/ehisn60tejkdqmq9w4mj.jpg
- m####.oss-cn-####.aliy####.com/photo/201904/04/1554339639itcbXpce.jpg?x-...
- m####.oss-cn-####.aliy####.com/tmp/201812/26/20181227114826.png
Запросы HTTP POST:
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- rp-na####.ron####.com/navipush.json
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/004d40b7da426f74784a8115bb72aa5196e2a4b4b3c1507....0.tmp
- /data/data/####/0af74c55a3f47d44462d49c5c15118bbe5ff2d8cf0b16be....0.tmp
- /data/data/####/16f299df47f9412eb6e90549bb5471337ac51df6a2c134c....0.tmp
- /data/data/####/1a86008181df14214a2092e851de58aedbe9cfc79172271....0.tmp
- /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
- /data/data/####/1f851c024e34bc3a873baa5490e68330ce4c0afd6f11e2b....0.tmp
- /data/data/####/23bb934f471ab796b0d5e0099c01c2d9f61721a8012d5a8....0.tmp
- /data/data/####/2998adb9079c651ca3de894ba855e8526de7940616087fa....0.tmp
- /data/data/####/2a38300c30ab9d22a5ff2837e0809273e91c4741c99bf4e....0.tmp
- /data/data/####/33b0ce47130455d03a3f2e99fd66fd1cfb0eeefbc14ef27....0.tmp
- /data/data/####/35f2d25c69439f59ae6243c6eabaeac5aa143be33960baf....0.tmp
- /data/data/####/39c43af1a08ffd34f9d97489b636af6bc89cb0aa0ce6e0e....0.tmp
- /data/data/####/402f34ff830bb57c79507eb3fe8e547d62d3d78612cf493....0.tmp
- /data/data/####/486aab2184b9a65d3a373c29fe6a371556a66e37d115647....0.tmp
- /data/data/####/4a0683f2ddc142f899c41d1ce7609111f26a54575ed6980....0.tmp
- /data/data/####/57d6e15a7a8f1c61450d7081370cf73fad7728ffaeca907....0.tmp
- /data/data/####/6074c16faf41b6b3204a8e4315316bf277c9f53ef4e3710....0.tmp
- /data/data/####/63d278a6f5eae55f27c462aaabc01cd56ffd1820f7b0e64....0.tmp
- /data/data/####/65185658d4f72b65524861ea71948ece43955a05e4fd1b5....0.tmp
- /data/data/####/673ff5b805ccfbd8f44dab0d20bcc7762ca5730fffbdd32....0.tmp
- /data/data/####/6ed7fa51b39635692df865eba871598136f8539d2970d13....0.tmp
- /data/data/####/73b05e67ceb77880b587f6aac3c728db243ecc4935102c7....0.tmp
- /data/data/####/75a16b9276ff3ad388e1952f29a6462ee629bd872f61713....0.tmp
- /data/data/####/80193ed65ea42fee62cd22bf4899f263fc8c343b9abf83b....0.tmp
- /data/data/####/9bc93d1abb41eeeb525de3815b57e85b0c6b8bb581daf0f....0.tmp
- /data/data/####/9daaa32252a03de5631138cac01404b075050ed9bddb7d3....0.tmp
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/FwLog.xml
- /data/data/####/RongPush.xml
- /data/data/####/RongPushAppConfig.xml
- /data/data/####/Statistics.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/a==7.5.4&&4.2.0_1554484102101_envelope.log
- /data/data/####/aab5806a1f9ea2df6c61d9efefdc42a893c101e22ae1aa6....0.tmp
- /data/data/####/area.db
- /data/data/####/b5f3af8181b5761ed63a059ce6a690acf10362ef0355bd8....0.tmp
- /data/data/####/b6678912573e1ea5d822367023d9f87f89db1808963d8c8....0.tmp
- /data/data/####/bb24929fc4ae15027d39e695d0fcb684b6904a31bf01ecc....0.tmp
- /data/data/####/bcf4a4300677d64974c7b5e71d1584721a8453ab2fda5ef....0.tmp
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c026c37af43d5fb7a4db8a251462e1d4240f535609c0367....0.tmp
- /data/data/####/c2d4c1126b47c9d00656a0f13205e22f426a7f54564a69b....0.tmp
- /data/data/####/c67e58cce836db944aa3ccccdcb3a262dc199f639011884....0.tmp
- /data/data/####/c8eea95700ee576c7e5a0ff60c221536c3b75bd8b4384c3....0.tmp
- /data/data/####/class cn.mmote.yuepai.util.AssetsDatabaseManager.xml
- /data/data/####/d489343f111e56bdd7f51febe9306599b03a2c512bbed99....0.tmp
- /data/data/####/d5178bac9e24adcaf0cd2724810df783a9d85059c84f3fe....0.tmp
- /data/data/####/d5b58d08591fa26ee922ad1ba6ec95eb843f16146aee29b....0.tmp
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTU0NDg0MTAwOTQ3;
- /data/data/####/dW1weF9zaGFyZV8xNTU0NDg0MTAyNzgy;
- /data/data/####/dW1weF9zaGFyZV8xNTU0NDg0MTAyOTgw;
- /data/data/####/df334dcf82140a338ea101acf37e61cd7293818df42e8de....0.tmp
- /data/data/####/df7773057483dfa1df51d99c3b291d00eb11977436c0020....0.tmp
- /data/data/####/e0c866cb9ca9bacb70b9b70cb89b5281ee036e443a96fa9....0.tmp
- /data/data/####/ea605ba70d4b105e49862681dd81c2e81593fe912a4ae47....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f48dd2f80552004b9db1271377e70383fe3072f1a552aa9....0.tmp
- /data/data/####/f4ccc499d99e7bd5646622129cc0e9e5a56ecfa7cec2f87....0.tmp
- /data/data/####/f663a9679639bfa7e95657bbe6bd003c330de34a70973e7....0.tmp
- /data/data/####/fb39aa07f5d0c29fa1fd8dee1a8ebf8c2a0ff7055666708....0.tmp
- /data/data/####/fc20548dc2bed0134d7540ea466f59865891bcd834910cb....0.tmp
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/i==1.2.0&&4.2.0_1554484101030_envelope.log
- /data/data/####/info.xml
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-3.0.0.0.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/locale.config.xml
- /data/data/####/logdb.db
- /data/data/####/logdb.db-journal
- /data/data/####/mix.dex
- /data/data/####/native_record_lock
- /data/data/####/pref.xml
- /data/data/####/security_info
- /data/data/####/share.db-journal
- /data/data/####/sobot_chat_20190405_log.txt
- /data/data/####/sobot_config.xml
- /data/data/####/tempfile
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.nomedia
- /data/media/####/.umm.dat
- /data/media/####/1554484103124.db
- /data/media/####/alsn.db
- /data/media/####/alsn.db-journal
- /data/media/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-3.0.0.0.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- ls /
- ls /sys/class/thermal
Загружает динамические библиотеки:
- Bugly
- RongIMLib
- libnfix
- libshella-3.0.0.0
- libufix
- nfix
- ufix
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
