Adware.Waps.1018

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Waps.5.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1111031####.dns.wa####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) s####.m.img####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) cdn.43####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) who.wa####.com:80
TCP(HTTP/1.1) p####.43####.com:80
TCP(HTTP/1.1) cloud####.fengkon####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) f1.img####.com:80
TCP(HTTP/1.1) f####.fengkon####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) fs.img####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) m####.439####.net:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) l####.tbs.qq.com:443
TCP pus####.43####.com:4800
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

1111028####.dns.wa####.com
1111031####.dns.wa####.com
7j####.c####.z0.####.com
a.img####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.43####.com
cloud####.fengkon####.com
f####.fengkon####.com
f1.img####.com
fs.img####.com
l####.tbs.qq.com
m####.439####.net
p####.43####.com
p.img####.com
pub-####.qin####.com
pus####.43####.com
s####.m.img####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sj2.img####.com
ssl.gst####.com
who.wa####.com
www.go####.com
www.gst####.com

Запросы HTTP GET:

1111031####.dns.wa####.com/result?key=####&form=####&
cdn.43####.com/android/box/player/v3.1.1/miniGame-entryConfig-mareacode-...
cdn.43####.com/app/android/v3.0/config-dailySign-mareacode-999998.html
cdn.43####.com/app/android/v3.1/software-cover-mareacode-999998-coverSiz...
cdn.43####.com/app/android/v3.4/config-common-mareacode-999998.html
cdn.43####.com/app/android/v4.3.1/game-index-mareacode-999998.html
cdn.43####.com/app/forums/android/v2.1/chat-faces-mareacode-999998.html
cdn.43####.com/app/forums/android/v3.3/chat-faces-mareacode-999998.html
f1.img####.com/1630963330/middle?155394####
f1.img####.com/2338809807/middle
f1.img####.com/249397179~480x280
f1.img####.com/2917847877/middle?155097####
f1.img####.com/box~cp/2902019/03/05/20_WKPXQw.912x261.png
f1.img####.com/box~cp/7402019/04/08/16_na2Fay.320x200.gif
f1.img####.com/downloader/tpl/game/template401.zip
f1.img####.com/downloader/tpl/thread/template562.zip
f1.img####.com/ma~106139_logo2_6a5e.jpg~124x124
f1.img####.com/ma~107215_logo2_5048.jpg~124x124
f1.img####.com/ma~111201_logo2_7c8b.jpg~124x124
f1.img####.com/ma~114512_logo2_09b6.jpg~124x124
f1.img####.com/ma~116858_logo2_09f8.jpg~124x124
f1.img####.com/ma~119083_logo2_73cf.jpg~124x124
f1.img####.com/ma~124040_logo2_adea.jpg~124x124
f1.img####.com/ma~124519_logo2_48a4.jpg~124x124
f1.img####.com/ma~125674_logo2_0c0a.jpg~124x124
f1.img####.com/ma~129247_logo2_2fe0.jpg~124x124
f1.img####.com/ma~129827_logo2_7310.jpg~124x124
f1.img####.com/ma~132609_logo2_05f2.jpg~124x124
f1.img####.com/ma~136248_logo2_df1f.jpg~124x124
f1.img####.com/ma~167_20181116112906_5bee398202941.jpeg
f1.img####.com/ma~167_20190228174840_5c77ae78badec.gif
f1.img####.com/ma~27_20170706154005_595de955018bc.png
f1.img####.com/ma~27_20181113164916_5bea900cebd42.png
f1.img####.com/ma~27_20190213161034_5c63d0fac2233.png
f1.img####.com/ma~30_20180423163038_5add99aec4cca.png
f1.img####.com/ma~30_20180423163148_5add99f421bdf.png
f1.img####.com/ma~425_20181112161400_5be9364878917.png
f1.img####.com/ma~425_20181112161609_5be936c995d7c.png
f1.img####.com/ma~425_20181112161649_5be936f16ff2e.png
f1.img####.com/ma~425_20181112161726_5be93716dae95.png
f1.img####.com/ma~425_20181112161828_5be93754808c9.png
f1.img####.com/ma~425_20181112161901_5be9377528945.png
f1.img####.com/ma~92170_logo2_9439.jpg
f1.img####.com/ma~wap_s2_1551751574
f1.img####.com/ma~wap_s2_1554714484
f1.img####.com/sj~rniij0Gu2Ns7G.png
f1.img####.com/v/4.8.0.24/4399Game_4.8.0.24.upgrade.8762.apk
f1.img####.com/yxh~u/16309633302019/04/08/21_9x5Mo6.1386x1040.jpg~480x480
f1.img####.com/yxh~u/29178478772019/04/08/20_jk4qDn.1280x720.jpg
p####.43####.com/cloud.php?act=####&rectime=####&appid=####&uid=####&fla...
p####.43####.com/cloud.php?act=####&rectime=####&flag=####&data=####
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_Cta775
t####.c####.q####.####.com/tdata_RyW085
t####.c####.q####.####.com/tdata_YYn966
t####.c####.q####.####.com/tdata_lOE499
ti####.c####.l####.####.com/config/hz-hzv3.conf
who.wa####.com/?key=####&form=####

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
cloud####.fengkon####.com/v2/device/conf
f####.fengkon####.com/v2/device/profile
s####.m.img####.com/trace/<Package>/1.0/360/1100ggC8KQYlptfweLjOCde21
s####.m.img####.com/trace/<Package>/1.0/360/1100ggC8KQYlptfweLjOCde21.co...
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/._index.css
/data/data/####/._index.html
/data/data/####/._index.js
/data/data/####/._js
/data/data/####/.jg.ic
/data/data/####/.policy
/data/data/####/02bfc27ffb58b9a3796a629dbcb3ab08721b757150a1c08....0.tmp
/data/data/####/033e7066c811ebfb0885ce6273425bcfaab0a2214d7ba64....0.tmp
/data/data/####/0707eabb262cd5237bb766f557d5f84b056862214c4f5ad....0.tmp
/data/data/####/07ac1eaa8b92368d2a02a79502a99a454e5fa4cd9063662....0.tmp
/data/data/####/0aa2cc1b0853dc8798a114dee20b58418e91097894c1bea....0.tmp
/data/data/####/0bf80b62087e10cfb7660c155184c0e5212dd2554835187...7ab2.0
/data/data/####/0c97826feeedbad178468c8c36c4e2d6aa1c415f0abd7b8....0.tmp
/data/data/####/0f5f9537031ef817c8e7ef63fc02829722876a67ce03105....0.tmp
/data/data/####/193931ad476a18998c5ff76121ce1d8ea4943e33ce99e53....0.tmp
/data/data/####/1b2ec9b469fad1ae2a35a5b591c38f309ffdf09356fff00....0.tmp
/data/data/####/1d49664e376057c8627eac860e29905575b1decfbbcf023....0.tmp
/data/data/####/1f01b0aa828100487d87e6645326731478c3c0aee6cf809....0.tmp
/data/data/####/2088a0d868bc
/data/data/####/20d4ce2405975c753510d967cd483c1b91b145e309f3421....0.tmp
/data/data/####/21c39c6e42bf0d1458bf243a7e0dd9fdb95e7cd5567f470....0.tmp
/data/data/####/21e98e91467c0f738e667f891c788dcbad67c95a7ad2040....0.tmp
/data/data/####/265420c4351a041a687879ad3d984804e5fed0bd2919c55....0.tmp
/data/data/####/2c144957ccaa52f69cbebd60022893db27b2844155be4b1....0.tmp
/data/data/####/34a51d37afba3bca3f1582f0765cf9a2389d01a0f828881....0.tmp
/data/data/####/35bbea759ec6fd903b474c7cc6b29c0966a1c246e18dc85....0.tmp
/data/data/####/389821d61049ee00bb4812ed3d2f9222ce412e4d6444bbf....0.tmp
/data/data/####/3bfc210fa04baa6305a0ac6187bbc78bfb8a4b2d9ddb05e....0.tmp
/data/data/####/3d1998aca0287bd8a53729a2c580b00be8b55a848ad9562....0.tmp
/data/data/####/3d1998aca0287bd8a53729a2c580b00be8b55a848ad9562...3b04.0
/data/data/####/47970169658b06369accfa04d613719506619b93c5118da....0.tmp
/data/data/####/4f7a1966243507e126aee0d9ac4d4d25f9f465461ed3e0d....0.tmp
/data/data/####/549434ad87fac66f59395b5d15244f633fd3cc6a885d0fb....0.tmp
/data/data/####/579bfe36e527566b04de381f03868cc5e2dbeed772b43a5....0.tmp
/data/data/####/5991a85aac763701dcd451f56b7fb41d81ff11df5b93edf....0.tmp
/data/data/####/5a1d87a6c2010409a15beaa70d8c897d8c76a9708775ed6....0.tmp
/data/data/####/5adc1f2fae95dec46020d8684bc0cfb9ed8c8c953c29a6b....0.tmp
/data/data/####/5d818e178b7ec64700cb6ca3400813f8852a5e7041397fe....0.tmp
/data/data/####/5df6551b4e46f318e93091d3a5b9083909e38295977035c....0.tmp
/data/data/####/5fe255ae0510ce91f90d42a97d41d7f87b27a85ab3d0fb3....0.tmp
/data/data/####/65ee2774aadcf23a423485bb7c954c3f0e1f635843ffd29....0.tmp
/data/data/####/65f6f7763bdb0ef38b115d605d0f50f60267abcaa1be15c....0.tmp
/data/data/####/69861d9da1a1ea1546c98f28c9e89b672d40f4bba90eb26....0.tmp
/data/data/####/6fb7de4c13ae311adf50a0c7c831203b4d113878ac14bab....0.tmp
/data/data/####/7b7e4257212d9def9f7e07f1d88a532f159a10d6a1829ee....0.tmp
/data/data/####/7d11ed8aa05a92b56fdd3497e203e48d198b0954ff09f7e....0.tmp
/data/data/####/7da579e4e43d7abfe71ef3d1135610cbb93a36ab7be6a74....0.tmp
/data/data/####/7f2ab67cfabcdca28eb1f8ec22a23565a35a216aa2452a8....0.tmp
/data/data/####/80ad60a719f347d0c59e8854a2eb04a842dab2f6ae9ee21....0.tmp
/data/data/####/832fb049d85f2d6d8da0d7adec66f928f16aa821eceeadb....0.tmp
/data/data/####/857ee214a564ec0f940870d02372cc7277dc29428810010....0.tmp
/data/data/####/89b62b30965a0bfa29ffe066e82d275c2e6857b16eff560....0.tmp
/data/data/####/89c67041ae708040f0ea8a2f55f74790424430aba0e79ab....0.tmp
/data/data/####/8a38c46d7e5f6d8817ce1cc914f9248f0a3733ca57bea1e....0.tmp
/data/data/####/915b0e3b61ff006b76b593969288f16fd2fe8d1c3028d19....0.tmp
/data/data/####/98169561561365ad0a4a0725a7b8fde18dc8dd292e35ec9....0.tmp
/data/data/####/9ec7438d65a4f5ba0b4ec76d49a7f0725df2338d3fa3f26....0.tmp
/data/data/####/MultiDex.lock
/data/data/####/MyAnalytics_VERSION_INFO.xml
/data/data/####/MyAnalytics_device_id.xml
/data/data/####/MyAnalytics_general_config.xml
/data/data/####/MyAnalytics_send_config.xml
/data/data/####/UserInfo.xml
/data/data/####/a239c5d4c96127cba6ff6cd9d9c0d5a867b5764ec36dcc9....0.tmp
/data/data/####/a62f7323a4f9055b1f8d8a146c9e432dd773623dc977ae0....0.tmp
/data/data/####/a6e58464fd8cb6cd6d9f3b3da4b6f580825513f672a66a9....0.tmp
/data/data/####/ac68829b9e339467a140d26d89aaad9d0f09468872b0808....0.tmp
/data/data/####/asset-manifest.json
/data/data/####/b48f17723e32d6f4759b8d60c10f64b7fd4e7812128f9f8....0.tmp
/data/data/####/b51bff8df0392ad333c064bac31c8c615c127c68ba7322c....0.tmp
/data/data/####/b96927bf9fb506d0ae4ef9a69a1523a2c14e7ac1481274d....0.tmp
/data/data/####/ba81f53de64ca236f56503c9083e6616ff17136a7dc4032....0.tmp
/data/data/####/bb29a0a9c5f265bf018cf54611bf4e1e97b14abc263e523....0.tmp
/data/data/####/bd005fa02328ef85462a8b552822d28b8c1eef897ca25ad....0.tmp
/data/data/####/bdf18d2623689ba24d0fd59220dcb14ac05a129c136ade2....0.tmp
/data/data/####/c1c52946803e60bffb67b91093ea842194856a203c156e1...a6a8.0
/data/data/####/c5dfca1bd3ab09eb9892e7e0c01e851c33a264de86bcefd....0.tmp
/data/data/####/c64526bd974d419b861ce0f6cf74621b35be66200f7d43e....0.tmp
/data/data/####/c74dd28e15384ac0fd2642e9a15836bb15eb57696ca401b....0.tmp
/data/data/####/c8791ab05c46e44cae9d0db785a2d3199ac2c588183803d....0.tmp
/data/data/####/c933e6a0e0c73a45857f56d42e1f2d029bde3ea174aa687....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cloudms.conf.xml
/data/data/####/com.m4399.gamecenter_preferences.xml
/data/data/####/com.m4399.gamecenter_preferences.xml.bak
/data/data/####/com.shumei.xml
/data/data/####/comment.zip
/data/data/####/core_info
/data/data/####/d913e746a049d48fbc9c58b3d62e437b9be6c1d707380ac....0.tmp
/data/data/####/dbb38cbfc7e731c53a023c70cc870401fa13d6b3adba3b3....0.tmp
/data/data/####/deba23d768422a97af2b2d55d895cd2830d02759f2bf0e8....0.tmp
/data/data/####/debbb6cff8292d8923818f54b3e6ce6fb328aa16b3fb3c3....0.tmp
/data/data/####/downloads.db-journal
/data/data/####/e19bd80e93124a7d7455fb8d740a0e6d4356334c45f3fe3....0.tmp
/data/data/####/e3b632143410c51782bfe5f2920aa6733cc7eb2bf9e5ad6....0.tmp
/data/data/####/e53be25a8adf07dc834de6075b4b33e44b0f26a8c2a1dbe...addd.0
/data/data/####/e5430faf57de30a13820a3365961e23ce0bdfd2b0540d32....0.tmp
/data/data/####/e55bb1d965374c41d95371da5b3dcbc09baf48d2728650c....0.tmp
/data/data/####/ed03e85b6a2cfff3733a2504b59db72b6fa30cf2dd5d8f9....0.tmp
/data/data/####/f0b485041163edaa0133c19e28a330d7a5f8c98d74e1908....0.tmp
/data/data/####/f2e2903a44ba760d5edc88a8c3b76098ab1ac22f8cb66b6....0.tmp
/data/data/####/f71b209b4657bccd2853e2ec3acd7a41a4999f399950880....0.tmp
/data/data/####/f756fe536b4cdf39d9fe6226d914f6124c6391c9994df7b....0.tmp
/data/data/####/f85d8d4d064da3b88103189946c32518af3f6d69f66f564....0.tmp
/data/data/####/favicon.ico
/data/data/####/fc4fa73498e12113a0842ddfb5f24fbd26187087cfe731d....0.tmp
/data/data/####/framework.db-journal
/data/data/####/gamecenter.db-journal
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/index.css
/data/data/####/index.html
/data/data/####/index.js
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu1858054988.so
/data/data/####/loading_content0.png
/data/data/####/loading_content1.png
/data/data/####/loading_content2.png
/data/data/####/loading_content3.png
/data/data/####/m4399AppEmoji3.0.json
/data/data/####/m4399BBSEmoji3.0.json
/data/data/####/main.0dd8ffff.js
/data/data/####/main.87842ff9.js
/data/data/####/main.917cc7aa.css
/data/data/####/main.e4ddacdc.css
/data/data/####/main.eb5f5e6c.css
/data/data/####/main.ff76f3dd.js
/data/data/####/manifest.json
/data/data/####/mobclick_agent_cached_com.m4399.gamecenter1305
/data/data/####/multidex.version.xml
/data/data/####/placeholder.png
/data/data/####/plugin.meta
/data/data/####/pref.headup.message.chat.unread.pt
/data/data/####/push.jar
/data/data/####/push.pid
/data/data/####/push.zip
/data/data/####/push_box_sdk_version.xml
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.gif
/data/data/####/run.pid
/data/data/####/seq.xml
/data/data/####/service-worker.js
/data/data/####/skin_main_plugin_pref.xml
/data/data/####/statistics_agent_cached_com.m4399.gamecenter
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_Cta775
/data/data/####/tdata_Cta775.jar
/data/data/####/tdata_RyW085
/data/data/####/tdata_RyW085.jar
/data/data/####/tdata_YYn966
/data/data/####/tdata_YYn966.jar
/data/data/####/tdata_lOE499
/data/data/####/tdata_lOE499.jar
/data/data/####/template.zip
/data/data/####/tracker.db-journal
/data/data/####/type1
/data/data/####/type2
/data/data/####/umeng_general_config.xml
/data/media/####/.disys
/data/media/####/.nomedia
/data/media/####/.test.txt
/data/media/####/.thumbcache_idx0
/data/media/####/.udid
/data/media/####/4399GameCenter.1328.meta
/data/media/####/5c88bc29-15aba1b.downlad
/data/media/####/5c93090f-5ae86.downlad
/data/media/####/5c9c8639-2da2d.downlad
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.m4399.gamecenter.bin
/data/media/####/com.m4399.gamecenter.db
/data/media/####/com.m4399.gamecenter.sdklogin
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/shumei.txt
/data/media/####/t1v562.meta
/data/media/####/t2v401.meta
/data/media/####/tdata_Cta775
/data/media/####/tdata_RyW085
/data/media/####/tdata_YYn966
/data/media/####/tdata_lOE499
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GTPushService 24788 300 0
cat /proc/self/cgroup
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu1858054988.so
dmesg
getprop
getprop ro.product.cpu.abi
grep -i blueStacks
ls /system/bin
ls /system/lib
mount
ps
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.GTPushService 24788 300 0

Загружает динамические библиотеки:

getuiext2
libjiagu1858054988
m4399
smsdk

Использует следующие алгоритмы для шифрования данных:

AES-CFB-NoPadding
AES-ECB-PKCS5Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-ECB-PKCS5Padding
DES-ECB-NoPadding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней