Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Airpush.24.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) kx####.k####.cn:80
- TCP(HTTP/1.1) wac.1####.m####.net:80
- TCP(HTTP/1.1) cc####.com.cn:80
- TCP(HTTP/1.1) m.cc####.cc:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) cha####.api.d####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) www.cc####.cc:80
- TCP(TLS/1.0) 1####.217.17.78:443
Запросы DNS:
- a####.u####.com
- c.c####.com
- cc####.com.cn
- cha####.api.d####.com
- hm.b####.com
- i1.reso####.cc####.cc
- i2.reso####.cc####.cc
- i3.reso####.cc####.cc
- i4.reso####.cc####.cc
- kx####.k####.cn
- m.cc####.cc
- oc.u####.com
- p####.co
- reso####.cc####.cc
- st####.cc####.cc
- www.cc####.cc
- z4.c####.com
Запросы HTTP GET:
- c.c####.com/wapstat.php?siteid=####&r=####&rnd=####
- cc####.com.cn/
- hm.b####.com/h.js?25e5099####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- kx####.k####.cn/seallogo.dll?sn=####&size=####
- m.cc####.cc/
- t####.c####.q####.####.com/media/images/topic/2018/11/21/1500-23-999/950...
- t####.c####.q####.####.com/media/images/topic/2018/12/28/1614-27-730/ico...
- t####.c####.q####.####.com/media/images/topic/2019/03/26/0958-40-225/190...
- t####.c####.q####.####.com/media/images/topic/2019/05/29/1432-04-423/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/06/1331-17-054/950...
- t####.c####.q####.####.com/media/images/topic/2019/06/06/1539-25-131/ico...
- t####.c####.q####.####.com/media/images/topic/2019/06/10/1012-22-957/950...
- t####.c####.q####.####.com/media/images/topic/2019/06/10/1616-16-364/ico...
- t####.c####.q####.####.com/media/images/topic/2019/06/12/0956-12-714/950...
- t####.c####.q####.####.com/media/images/topic/2019/06/12/1200-02-313/950...
- t####.c####.q####.####.com/media/images/topic/2019/06/12/1649-16-399/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/12/1812-11-493/750...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1009-58-623/950...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1153-41-262/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1155-02-410/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1211-03-183/1.j...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1433-41-433/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1434-27-642/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1435-11-940/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1442-13-580/512...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1444-51-241/xw....
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1641-53-282/1.p...
- t####.c####.q####.####.com/media/images/topic/2019/06/13/1642-54-903/1.p...
- t####.c####.q####.####.com/media/packages/2018/03/30/1112-38-939/0.png-i...
- t####.c####.q####.####.com/media/packages/2018/08/16/1934-50-968/1.png-i...
- t####.c####.q####.####.com/media/packages/2018/09/01/1211-15-845/wdsjhyz...
- t####.c####.q####.####.com/media/packages/2019/02/28/1417-57-817/111.png...
- t####.c####.q####.####.com/media/packages/2019/03/08/1827-11-840/11.png-...
- t####.c####.q####.####.com/media/packages/2019/04/04/1558-14-945/1.png-i...
- t####.c####.q####.####.com/media/packages/2019/04/12/1955-47-785/1.jpg-i...
- t####.c####.q####.####.com/media/packages/2019/05/13/1149-29-047/512.png...
- t####.c####.q####.####.com/media/packages/2019/05/13/2047-32-931/虫虫icon1...
- t####.c####.q####.####.com/media/packages/2019/05/15/1008-10-204/流浪者小岛虫虫...
- t####.c####.q####.####.com/media/packages/2019/05/16/1028-59-136/虫虫.png-...
- t####.c####.q####.####.com/media/packages/2019/05/20/1222-45-986/1.jpg-i...
- t####.c####.q####.####.com/media/packages/2019/05/28/1822-43-126/512-虫虫 ...
- t####.c####.q####.####.com/media/packages/2019/06/03/1443-56-179/3.png-i...
- t####.c####.q####.####.com/media/packages/2019/06/05/1617-45-411/1.jpg-i...
- t####.c####.q####.####.com/media/packages/2019/06/05/1816-55-414/512x512...
- t####.c####.q####.####.com/media/packages/2019/06/06/1148-32-098/7.jpg-i...
- t####.c####.q####.####.com/media/packages/2019/06/06/1807-23-164/0.jpg-i...
- t####.c####.q####.####.com/media/packages/2019/06/11/0957-44-279/虫虫icon....
- t####.c####.q####.####.com/media/packages/2019/06/12/1348-38-979/虫虫.png-...
- t####.c####.q####.####.com/media/packages/2019/06/13/1053-28-014/7.jpg-n...
- t####.c####.q####.####.com/media/packages/2019/06/13/1057-21-009/1.jpg-n...
- t####.c####.q####.####.com/media/packages/2019/06/13/1108-37-531/1.jpg-n...
- t####.c####.q####.####.com/media/packages/2019/06/13/1111-36-947/1.JPG-n...
- t####.c####.q####.####.com/media/packages/2019/06/13/1112-47-256/icon 51...
- t####.c####.q####.####.com/media/packages/2019/06/13/1115-08-038/1.jpg-n...
- t####.c####.q####.####.com/static/common/img/favicon.png
- t####.c####.q####.####.com/wap/wap2/css/basic.css?v=####
- t####.c####.q####.####.com/wap/wap2/css/common.css?v=####
- t####.c####.q####.####.com/wap/wap2/css/reset.css?v=####
- t####.c####.q####.####.com/wap/wap2/css/swiper.min.css?v=####
- t####.c####.q####.####.com/wap/wap2/images/bg_gift.jpg
- t####.c####.q####.####.com/wap/wap2/images/brower.png
- t####.c####.q####.####.com/wap/wap2/images/icon-fire.png
- t####.c####.q####.####.com/wap/wap2/images/icon-mode-bt.png
- t####.c####.q####.####.com/wap/wap2/images/icon-mode.png
- t####.c####.q####.####.com/wap/wap2/images/icon-police.png
- t####.c####.q####.####.com/wap/wap2/images/icon_clear.png
- t####.c####.q####.####.com/wap/wap2/images/icon_gift_top.png
- t####.c####.q####.####.com/wap/wap2/images/icon_search_grey.png
- t####.c####.q####.####.com/wap/wap2/images/icon_top.png
- t####.c####.q####.####.com/wap/wap2/images/img_jz.png
- t####.c####.q####.####.com/wap/wap2/images/logo_share.png
- t####.c####.q####.####.com/wap/wap2/images/sm_83x30.png
- t####.c####.q####.####.com/wap/wap2/images/sprite.png
- t####.c####.q####.####.com/wap/wap2/images/wenhuajingying.png
- t####.c####.q####.####.com/wap/wap2/js/common.js?v=####
- t####.c####.q####.####.com/wap/wap2/js/font.js?v=####
- t####.c####.q####.####.com/wap/wap2/js/iscroll.js?v=####
- t####.c####.q####.####.com/wap/wap2/js/swiper.min.js?v=####
- t####.c####.q####.####.com/wap/wap2/js/zepto.min.js?v=####
- wac.1####.m####.net/a/en/npuzzle750.zip
- www.cc####.cc/
- z.c####.com/stat.htm?id=####&r=####&iw=####&showp=####&lg=####&cnzz_eid=...
Запросы HTTP POST:
- cha####.api.d####.com/rest/2.0/channel/channel
- oc.u####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/cbPrefs.xml
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/com.gameone.bravepuzzle
- /data/data/####/com.gameone.bravepuzzle.push_sync.xml
- /data/data/####/com.gameone.bravepuzzle.xml
- /data/data/####/com.gameone.bravepuzzle_preferences.xml
- /data/data/####/com_umeng__crash.cache
- /data/data/####/hedgedata
- /data/data/####/hedgedata-journal
- /data/data/####/hedgedata.dat
- /data/data/####/mobclick_agent_header_com.gameone.bravepuzzle.xml
- /data/data/####/mobclick_agent_online_setting_com.gameone.bravepuzzle.xml
- /data/data/####/mobclick_agent_state_com.gameone.bravepuzzle.xml
- /data/data/####/notification_builder_storage.xml
- /data/data/####/plugin-deploy.dex
- /data/data/####/plugin-deploy.jar
- /data/data/####/plugin-deploy.key
- /data/data/####/pst.xml
- /data/media/####/.cuid
- /data/media/####/apps
- /data/media/####/pushstat.db-journal
Другие:
Запускает следующие shell-скрипты:
- <Package> <Package> -1829376808 0 /data/app/<Package>-1.apk 41 <Package> 47 48
- <Package> <Package> -1829376808 0 /data/app/<Package>-1.apk 43 <Package> 48 49
- <Package> <Package> -1830441768 0 /data/app/<Package>-1.apk 41 <Package> 45 47
- <Package> <Package> -1836765992 0 /data/app/<Package>-1.apk 43 <Package> 48 49
- chmod 755 <Package Folder>/.cache/<Package>
Загружает динамические библиотеки:
- bdpush_V1_0
- gdx
- libsecexe.x86
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
