Android.DownLoader.4398

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.RemoteCode.41.origin
Android.Xiny.20

Загружает из Интернета следующие детектируемые угрозы:

Android.Xiny.20

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) img.cool####.cn:80
TCP(HTTP/1.1) yun.tuis####.com:80
TCP(HTTP/1.1) adv.jpi####.com:80
TCP(HTTP/1.1) en####.tui####.com:80
TCP(HTTP/1.1) yun.russi####.cn.####.com:80
TCP(HTTP/1.1) acti####.russi####.cn:80
TCP(HTTP/1.1) embe####.d####.com.cn:80
TCP(HTTP/1.1) fi####.d####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) z####.heyc####.net:80
TCP(HTTP/1.1) yun.t####.cn:80
TCP(HTTP/1.1) www.ye####.org:80
TCP(HTTP/1.1) t.si####.net:80
TCP(HTTP/1.1) yun.d####.com.cn:80
TCP(HTTP/1.1) a####.b####.com:80
TCP(HTTP/1.1) adv.99y####.com:80
TCP(HTTP/1.1) e.ghe####.net:9908
TCP(HTTP/1.1) d####.dd7####.com:80
TCP(HTTP/1.1) c####.im.qq.com:80
TCP(HTTP/1.1) d.bjsd####.com:80
TCP(HTTP/1.1) g####.mc####.com:9013
TCP(HTTP/1.1) php.sho####.com:80
TCP(HTTP/1.1) yun.d####.com:80
TCP(HTTP/1.1) l.bjsd####.com:80
TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) st####.adhu####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) lhyysdk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) dis####.eq####.com:443
TCP(TLS/1.0) yun.russi####.cn.####.com:443
TCP(TLS/1.0) s####.yy.com:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) hunter-####.d####.com:443

Запросы DNS:

a####.b####.com
a.bjsd####.com
acti####.russi####.cn
adv.99y####.com
adv.jpi####.com
adv.my####.com
aliyuno####.oss-cn-####.aliy####.com
aliyuns####.oss-cn-####.aliy####.com
c####.im.qq.com
c.c####.com
cdn.boo####.com
d####.dd7####.com
d.bjsd####.com
dis####.eq####.com
e.ghe####.net
embe####.d####.com.cn
en####.tui####.com
fi####.d####.com
g####.mc####.com
hotfix####.oss-cn-####.aliy####.com
hunter-####.d####.com
i####.adhu####.com
i####.adhu####.com
i####.adhu####.com
img.cool####.cn
l.bjsd####.com
lhyysdk####.oss-cn-####.aliy####.com
mt####.go####.com
nfsjar####.funu####.com
php.sho####.com
s####.yy.com
s19.c####.com
st####.adhu####.com
t.si####.net
www.ye####.org
yun.d####.com
yun.d####.com.cn
yun.russi####.cn
yun.t####.cn
yun.tuis####.com
yun.tuit####.com
z####.heyc####.net
z5.c####.com
z8.c####.com
z9.c####.com

Запросы HTTP GET:

a####.b####.com/channl_adong.png
a####.b####.com/channl_adong2.png
a####.b####.com/channl_haoqi1.png
acti####.russi####.cn/activity/getAllSkin?timestamp=####&couponSkinId=##...
acti####.russi####.cn/activity/getKefu?id=####&slotId=####
acti####.russi####.cn/activity/getReturnPage?timestamp=####&slotId=####&...
acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
acti####.russi####.cn/activity/showLog?dpm=####&couponSource=####&orderI...
acti####.russi####.cn/activityRegion/getByActivityId?timestamp=####&acti...
acti####.russi####.cn/common/ip
acti####.russi####.cn/statistics/activityPagePerf?group_type=####&platfo...
acti####.russi####.cn/statistics/click?timestamp=####&dpm=####&consumerI...
c####.im.qq.com/cgi-bin/cgi_svrtime
d####.dd7####.com//upload/plog/dfkn.jar
d####.dd7####.com//upload/sdk2/LHYY20190402.jar
d####.dd7####.com//upload/sdk2/sdk04dex20190218.jar
d####.dd7####.com//upload/sdk3/cjmob20190301.jar
d####.dd7####.com//upload/sdk3/papp20190412.jar
d####.dd7####.com/upload/plog/N38de20181225.jar
d####.dd7####.com/upload/plog/mfgz.jar
d####.dd7####.com/upload/sdk2/kzd20190428.jar
embe####.d####.com.cn/exposure/standard?dpm=####&consumerId=####&deliver...
embe####.d####.com.cn/exposure/standard?dpm=####&consumer_id=####&domain...
embe####.d####.com.cn/exposure/standard?dpm=####&couponSource=####&order...
en####.tui####.com/index/activity?appKey=####&adslotId=####
img.cool####.cn/201812/ww9.jar
yun.d####.com.cn/h5-tuia/couponPrize/lucky.png?nnn=####
yun.d####.com/figerprint/webfiger.cache.js?x=####
yun.d####.com/h5-mami/objectModal/index_201801031418.css
yun.russi####.cn.####.com/h5-mami/h5-discern-simulator-1.0.19.min.js?t=#...
yun.russi####.cn.####.com/h5-mami/insurance/taobao/clipboard.min.js
yun.russi####.cn.####.com/h5-mami/shendun/shendun0313.js
yun.russi####.cn.####.com/mami-media/img/7qzdo2a6id.png
yun.russi####.cn.####.com/mami-media/img/8ehk6s0o66.png
yun.russi####.cn.####.com/mami-media/img/8i44eaa3td.png
yun.russi####.cn.####.com/mami-media/img/j07n5h6jfo.png
yun.russi####.cn.####.com/mami-media/img/mdy3nym3bt.png
yun.russi####.cn.####.com/mami-media/img/w2u5t8ktkm.png
yun.russi####.cn.####.com/mami-media/img/zcttaq83p9.png
yun.russi####.cn.####.com/newactivity/assets/gyroscope.90b7461a.js
yun.russi####.cn.####.com/newactivity/assets/touchs.3bae3309.js
yun.t####.cn/tuia/skyeye/skyeye.js
yun.tuis####.com/babi/img/85342d1e-fjxqz4yd48.png
yun.tuis####.com/h5-mami/QBModal/index_201801031421.css
yun.tuis####.com/h5-mami/QBModal/index_201801171227.js
yun.tuis####.com/h5-mami/activity/moneyTree/bg01.jpg?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/bg02.jpg?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/chouBtn.png?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/hand.png?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/pointer.png?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/prizes.png?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/rulebtn.png?x-oss-process=####
yun.tuis####.com/h5-mami/activity/moneyTree/zp.png?x-oss-process=####
yun.tuis####.com/h5-mami/biiModal/index_201801242113.css
yun.tuis####.com/h5-mami/biiModal/index_201801242113.js
yun.tuis####.com/h5-mami/couponPrize/1.27/index_201804041740.js
yun.tuis####.com/h5-mami/dist/0.5f1dc24ee6a69821d0b2.js
yun.tuis####.com/h5-mami/dist/1.e92f4d1a92dcb9fb3872.js
yun.tuis####.com/h5-mami/dist/2.b1cd3d795fc5993e7af4.js
yun.tuis####.com/h5-mami/dist/26da0ecb89db616a3e7080fc0e0e03dc.png
yun.tuis####.com/h5-mami/dist/2fb948d47ba68e7ee7d6742f7b16fe21.png
yun.tuis####.com/h5-mami/dist/3.4c3521c5112830f0a4b3.js
yun.tuis####.com/h5-mami/dist/4a99d3eeebfc2f9560d5cfe70c78c838.png
yun.tuis####.com/h5-mami/dist/5.dce226cfe4f939363c7c.js
yun.tuis####.com/h5-mami/dist/6acb8537c16241558bc8b63a80e87224.png
yun.tuis####.com/h5-mami/dist/6b2c766020cfecf026a42061351aab87.png
yun.tuis####.com/h5-mami/dist/7ec676cd2168600b316c7e9e09accf2d.png
yun.tuis####.com/h5-mami/dist/878acde5f0d6b512b5a40976378be7c7.png
yun.tuis####.com/h5-mami/dist/9437fce488f056a8f2a841a6352d434d.png
yun.tuis####.com/h5-mami/dist/a5a4c80e5d150b0a557f33348a2d9a55.png
yun.tuis####.com/h5-mami/dist/activity-moneyTree-v2-entry.8d0d98b04b9223...
yun.tuis####.com/h5-mami/dist/activity-moneyTree-v2-entry.c3c2243d64f9e5...
yun.tuis####.com/h5-mami/dist/eea409bdde08c83d3e7db8cbcf5fcb95.png
yun.tuis####.com/h5-mami/dist/es6-promise.auto.min.js
yun.tuis####.com/h5-mami/dist/fastclick.8b059c8a8597f4b01733.js
yun.tuis####.com/h5-mami/dist/plugin-skins-coinTree_hq-entry.23b4aa89781...
yun.tuis####.com/h5-mami/dist/plugin-skins-coinTree_hq-entry.e1133ea0a4e...
yun.tuis####.com/h5-mami/kefuModal/1/index_201712260000.css
yun.tuis####.com/h5-mami/kefuModal/1/index_20180425956.js
yun.tuis####.com/h5-mami/pluginAct/customer/icon-service.png?x-oss-proce...
yun.tuis####.com/newactivity/assets/1.27.4935695d.css
yun.tuis####.com/newactivity/assets/encourageIcon.3422c221.css
yun.tuis####.com/newactivity/assets/encourageIcon.963233e3.js
yun.tuis####.com/newactivity/assets/encourageLayer.01e3ec8b.js
yun.tuis####.com/newactivity/assets/encourageLayer.06e61cea.css
yun.tuis####.com/newactivity/assets/showAlipayPrize.44d0e564.js
yun.tuis####.com/newactivity/assets/showAlipayPrize.9b0efbb9.css
yun.tuis####.com/newactivity/assets/showAlipayPrize.da021a98.css
yun.tuis####.com/newactivity/assets/showObjectPrize.81883106.js
yun.tuis####.com/newactivity/assets/showThanks.18de8f8a.css
yun.tuis####.com/newactivity/assets/showThanks.baa45fac.js
yun.tuis####.com/newactivity/assets/showVirtualPrize.22064505.css
yun.tuis####.com/newactivity/assets/showVirtualPrize.5452e95e.js
yun.tuis####.com/tuia/hunter/2.5.2/hunter.js
z.c####.com/stat.htm?id=####&cnzz_eid=####

Запросы HTTP POST:

acti####.russi####.cn/pluginTools/dojoin
acti####.russi####.cn/pluginTools/embeddedIndex
acti####.russi####.cn/pluginTools/result
acti####.russi####.cn/statistics/activityPagePerf?type=####&dns=####&tcp...
adv.99y####.com/adv/pluginReq
adv.jpi####.com/adv/pluginReq
d.bjsd####.com/index.php?r=####
e.ghe####.net:9908/e/a/t
fi####.d####.com/fingerprint/UVCount
fi####.d####.com/fingerprint/userFind
g####.mc####.com:9013/nfs/nf_s/u_j
l.bjsd####.com/index.php?r=####
php.sho####.com/index.php?r=####
t.si####.net/t2
www.ye####.org/i?requestId=####&g=####&ua=####
z####.heyc####.net/getlist
z####.heyc####.net/xlogin

Запросы HTTP OPTIONS:

fi####.d####.com/fingerprint/UVCount
fi####.d####.com/fingerprint/userFind

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/8DaQrYqgvY.jar
/data/data/####/CachedGeoposition.db
/data/data/####/CachedGeoposition.db-journal
/data/data/####/JDpiqtcy6.jar
/data/data/####/JSON.xml
/data/data/####/TA2GJR.jar
/data/data/####/W_Key.xml
/data/data/####/au.xml
/data/data/####/cdsdfdse.xml
/data/data/####/cdsdfdse.xml.bak
/data/data/####/cfwszwaf.xml
/data/data/####/cfwszwaf.xml.bak (deleted)
/data/data/####/cni4eH.jar
/data/data/####/com.showka.wnmm_preferences.xml
/data/data/####/com.showka.wnmm_preferences.xml.bak
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/dpi
/data/data/####/dwsaer.data-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/hid.db
/data/data/####/index
/data/data/####/nhgbbpxz.xml
/data/data/####/st.xml
/data/data/####/u6xpDB.jar
/data/data/####/ugmarssp.xml
/data/data/####/vgsvfshq.data-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nid
/data/media/####/5.0ww9.jar.t
/data/media/####/LHYY20190402.jar
/data/media/####/N38de20181225.jar
/data/media/####/cjmob20190301.jar
/data/media/####/dfkn.jar
/data/media/####/kzd20190428.jar
/data/media/####/mfgz.jar
/data/media/####/papp20190412.jar
/data/media/####/restime.dat
/data/media/####/sdk04dex20190218.jar

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh
cat /proc/version
cat /sys/class/android_usb/android0/idProduct
cat /sys/class/android_usb/android0/idVendor
getprop
ls -l /dev
ls -l /dev/block
ls -l /dev/block/vold
ls -l /dev/bus
ls -l /dev/bus/usb
ls -l /dev/bus/usb/001
ls -l /dev/com.android.settings.daemon
ls -l /dev/cpuctl
ls -l /dev/cpuctl/apps
ls -l /dev/cpuctl/apps/bg_non_interactive
ls -l /dev/graphics
ls -l /dev/input
ls -l /dev/log
ls -l /dev/pts
ls -l /dev/snd
ls -l /dev/socket
ps

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
ARCFOUR
DES
DES-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней