Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.3887
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) zgx.powerle####.com:80
- TCP(HTTP/1.1) s2.z####.cn:80
- TCP(HTTP/1.1) www.zh####.com:80
- TCP(HTTP/1.1) nb.i36####.com:9000
- TCP(HTTP/1.1) sj.i36####.com:9000
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) b####.b0.a####.com:80
- TCP(HTTP/1.1) f####.caiji####.com:80
- TCP(HTTP/1.1) q####.com.a.####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) s.a.longy####.com:80
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) i.iqt####.com:651
- TCP(HTTP/1.1) api.xiub####.com:80
- TCP(HTTP/1.1) www.d####.xyz:80
- TCP(HTTP/1.1) ip.zhito####.com:807
- TCP(HTTP/1.1) np.bul####.cn:6087
- TCP(HTTP/1.1) cdn.1####.wang:80
- TCP(HTTP/1.1) st####.guantou####.com:80
- TCP(HTTP/1.1) 2####.98.33.230:8888
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) 1####.26.106.206:8088
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) k####.kyli####.com.####.com:80
- TCP(HTTP/1.1) a####.umengc####.com:80
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) api####.bao####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) j.i36####.com:9000
- TCP(HTTP/1.1) p####.caiji####.com:80
- TCP(HTTP/1.1) ny.bul####.cn:666
- TCP(HTTP/1.1) c.xz####.com:3350
- TCP(HTTP/1.1) p.rqco####.com:8806
- TCP(HTTP/1.1) s####.caiji####.com:666
- TCP(HTTP/1.1) imgc####.qq.com.####.com:80
- TCP(HTTP/1.1) yh####.e####.xin:8082
- TCP(HTTP/1.1) i####.u####.cn:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) d####.wos####.com:80
- TCP(HTTP/1.1) a####.caiji####.com:80
- TCP(SSL/3.0) s####.m.sm.cn:443
- TCP(SSL/3.0) pco####.sm.cn:443
- TCP(TLS/1.0) s2.z####.cn:443
- TCP(TLS/1.0) analy####.map.qq.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) s####.d####.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
- TCP(TLS/1.0) ims-####.sm.cn:443
- TCP(TLS/1.0) pco####.sm.cn:443
- TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) a####.quh####.com:443
- TCP(TLS/1.0) a####.d####.com:443
- TCP(TLS/1.0) pin####.qq.com:443
- TCP(TLS/1.0) i####.d####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) s####.m.sm.cn:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) l####.m.sm.cn:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) us-aebr####.ali####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) log.mm####.com:443
Запросы DNS:
- a####.caiji####.com
- a####.caiji####.com
- a####.d####.com
- a####.m.sm.cn
- a####.quh####.com
- a####.u####.com
- a####.umengc####.com
- analy####.map.qq.com
- api####.bao####.com
- api.3####.cn
- api.xiub####.com
- c####.mm####.com
- c.c####.com
- c.xz####.com
- cdn.1####.wang
- d####.wos####.com
- f####.caiji####.com
- fou####.ali####.com
- g.al####.com
- hm.b####.com
- i####.d####.com
- i####.u####.cn
- i####.uc.cn
- i.iqt####.com
- i1.bao####.com
- imgc####.qq.com
- ims-####.sm.cn
- ip.zhito####.com
- j.i36####.com
- k####.kyli####.com
- l####.m.sm.cn
- log.mm####.com
- m.kuaim####.com
- mi.g####.qq.com
- nb.i36####.com
- np.bul####.cn
- ny.bul####.cn
- p####.caiji####.com
- p.rqco####.com
- pco####.sm.cn
- pi####.qq.com
- pin####.qq.com
- ping####.qq.com
- pv.s####.com
- q####.com
- s####.caiji####.com
- s####.d####.com
- s####.e.qq.com
- s####.m.sm.cn
- s.a.longy####.com
- s2.z####.cn
- s23.c####.com
- s96.c####.com
- sj.i36####.com
- st####.guantou####.com
- w####.pcon####.com.cn
- www.d####.xyz
- www.google-####.com
- www.zh####.com
- y####.m.sm.cn
- yh####.e####.xin
- z####.heyc####.net
- z2.c####.com
- z5.c####.com
- zgx.powerle####.com
Запросы HTTP GET:
- a####.caiji####.com/a/asdf?cnl=####&vv=####&vv2=####&aid=####&sid=####&d...
- api.xiub####.com/calendar/cailing0225.png
- b####.b0.a####.com//download/2016/05/29/5453e2de2c6b1955633cded1c87d3839...
- b####.b0.a####.com/d/wallpaper/2019/01/09/baoruan.com_1922f31c181e029350...
- b####.b0.a####.com/d/wallpaper/2019/01/16/baoruan.com_5224d8a6787d252e2c...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_4173c6a95ac0c69163...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_82560ee70a37c9a42c...
- b####.b0.a####.com/d/wallpaper/2019/04/16/baoruan.com_9683c2df2047ee8513...
- b####.b0.a####.com/d/wallpaper/2019/04/24/baoruan.com_3159d3b8a255ff535f...
- b####.b0.a####.com/diy_user_info/2019/07/30/5CCA3BFE2FBF26215D7CFC44854F...
- cdn.1####.wang/sc_164
- f####.caiji####.com/v1/cc/mobile?brand=####&model=####&andid=####&andv=#...
- i####.u####.cn/13699896966466827678.jpg?id=####&from=####
- i####.u####.cn/14514362047514399104.jpg?id=####&from=####
- i####.u####.cn/16121442320519678282.jpg?id=####&from=####
- i####.u####.cn/5968673382380052010.jpg?id=####&from=####
- i####.u####.cn/7682362070864425267.jpg?id=####&from=####
- i####.u####.cn/9518422212562889601.jpg?id=####&from=####
- i####.u####.cn/9651076501650757481.jpg?id=####&from=####
- i####.u####.cn/9928353565476392921.jpg?id=####&from=####
- imgc####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/progu...
- ip.zhito####.com:807/1102/index.html
- ip.zhito####.com:807/offon.html?1102guo####
- j.i36####.com:9000/jsonServer/LanMei01
- j.i36####.com:9000/jsonServer/MGChannel001
- k####.kyli####.com.####.com/1565860278462_utils.ttf
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- p.rqco####.com:8806/c/1565939563681
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
- q####.com.a.####.com/WG011C11F5LSO2.jar
- s####.tc.qq.com/h5/stats.js?v2####
- s2.z####.cn/12517860723692104125.jpg?id=####&from=####
- s2.z####.cn/13699896966466827678.jpg?id=####&from=####
- s2.z####.cn/14104240161189136825.jpg?id=####&from=####
- s2.z####.cn/14207767941761032187.jpg?id=####&from=####
- s2.z####.cn/15987841399648749055.jpg?id=####&from=####
- s2.z####.cn/3134790223399931180.jpg?id=####&from=####
- s2.z####.cn/446908141483821450.jpg?id=####&from=####
- s2.z####.cn/7245388779350092828.jpg?id=####&from=####
- st####.guantou####.com/stat13.html
- www.zh####.com/api_release.php
- zgx.powerle####.com/dnfile/cmm/SWrapCMM08016.jar
Запросы HTTP POST:
- a####.caiji####.com/v2/load/mobile
- a####.u####.com/app_logs
- a####.umengc####.com/app_logs
- api####.bao####.com/dh3g/default/index?name=####&channelId=####&imei=###...
- api####.bao####.com/wallpaper/default/index?name=####&channelId=####&ime...
- api.xiub####.com/themes/default/index?name=####&channelId=####&imei=####...
- api.xiub####.com/wallpaper/default/carousel
- api.xiub####.com/wallpaper/default/getlist?channelId=####&imei=####&vers...
- api.xiub####.com/wallpaper/default/index?name=####
- api.xiub####.com/wallpaper/default/index?name=####&channelId=####&imei=#...
- c.xz####.com:3350/s/
- d####.wos####.com/upload/event.jsp
- d####.wos####.com/upload/event2.jsp
- d####.wos####.com/upload/longheartbeat.jsp
- d####.wos####.com/upload/sdklongheartbeat.jsp
- d####.wos####.com/upload/shortheartbeat.jsp
- f####.caiji####.com/v3/task/mobile
- gd.a.s####.com/cityjson
- i.iqt####.com:651/slsdk/getdata.aspx
- i.iqt####.com:651/slsdk/settings.aspx
- j.i36####.com:9000/api/jadReport.do
- nb.i36####.com:9000/api/getAdInfoByDevice.do
- nb.i36####.com:9000/api/getAdInfoById.do
- nb.i36####.com:9000/api/vsp/getVspCore.do
- np.bul####.cn:6087/Sdk/reportTask
- np.bul####.cn:6087/Sdk/task
- np.bul####.cn:6087/Sdk/tsReport
- np.bul####.cn:6087/sdk/patchPlayReport
- ny.bul####.cn:666/api_yi.aspx
- ny.bul####.cn:666/slsdk/api_lykdrli.aspx
- ny.bul####.cn:666/slsdk/api_report.aspx
- ny.bul####.cn:666/slsdk/cmm_settings.aspx
- ny.bul####.cn:666/slsdk/getdata.aspx
- p####.caiji####.com/klv2/sdkkl/mobile
- p.rqco####.com:8806/p/1565939565315
- p.rqco####.com:8806/t/1565939570314
- p.rqco####.com:8806/t/1565939570666
- p.rqco####.com:8806/t/1565939571317
- p.rqco####.com:8806/t/1565939571674
- p.rqco####.com:8806/t/1565939572269
- p.rqco####.com:8806/t/1565939572619
- p.rqco####.com:8806/t/1565939573185
- p.rqco####.com:8806/t/1565939573540
- p.rqco####.com:8806/t/1565939575741
- p.rqco####.com:8806/t/1565939576099
- p.rqco####.com:8806/t/1565939576735
- p.rqco####.com:8806/t/1565939577139
- p.rqco####.com:8806/t/1565939577917
- p.rqco####.com:8806/t/1565939578270
- p.rqco####.com:8806/t/1565939579128
- p.rqco####.com:8806/t/1565939579529
- p.rqco####.com:8806/t/1565939580230
- p.rqco####.com:8806/t/1565939580588
- p.rqco####.com:8806/t/1565939581178
- p.rqco####.com:8806/t/1565939581533
- p.rqco####.com:8806/t/1565939582147
- p.rqco####.com:8806/t/1565939582526
- p.rqco####.com:8806/t/1565939583253
- p.rqco####.com:8806/t/1565939583632
- p.rqco####.com:8806/t/1565939584366
- p.rqco####.com:8806/t/1565939584741
- p.rqco####.com:8806/t/1565939585420
- p.rqco####.com:8806/t/1565939586380
- p.rqco####.com:8806/t/1565939587036
- p.rqco####.com:8806/t/1565939587401
- s####.caiji####.com:666/v1/config
- s####.e.qq.com/activate
- s.a.longy####.com/
- sj.i36####.com:9000/api/getAdInfoById.do
- w####.pcon####.com.cn/ip.jsp
- www.d####.xyz/Orders/getlive?channel=####&Slevi=####
- www.d####.xyz/Orders/getliveshua?channel=####&Slevi=####&codeimei=####
- www.d####.xyz/Orders/pigchannel?channel=####&nochannel=####
- www.d####.xyz/Orders/setpnum?pnum=####&channel=####
- yh####.e####.xin:8082/ssp/api/client/upload.do
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-169248287-740642811
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/01FAA3F0CAE41EB843F6BF3A8A4AC72D.jar
- /data/data/####/01FAA3F0CAE41EB843F6BF3A8A4AC72D.tmp
- /data/data/####/1603974275_app_spf_scli.xml
- /data/data/####/1603974275_pl_sp.xml
- /data/data/####/1603974275_rss_pl_cty.xml
- /data/data/####/1603974275_rws_sp.xml
- /data/data/####/1603974275_sp_iconfig.xml
- /data/data/####/1603974275_sp_iconfig.xml.bak
- /data/data/####/2019_08_16.xml
- /data/data/####/2019_08_16read.xml
- /data/data/####/2019_08_16shuareads.xml
- /data/data/####/2157.yaqcookie
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/MultiDex.lock
- /data/data/####/aba7df4bb014a16716753176ced62cef
- /data/data/####/base_prefe.xml
- /data/data/####/cache_1603974275_onsp.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cm_cfgt_spf.xml
- /data/data/####/config.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dpi
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/hid.db
- /data/data/####/hw_share_data.xml
- /data/data/####/img-cache.zip
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/kitty1.xml
- /data/data/####/kobox.0.sp.xml
- /data/data/####/launcher.settings.prefs.xml
- /data/data/####/libjiagu-1664829852.so
- /data/data/####/libyaqbasic.ca4c17ab.so
- /data/data/####/libyaqpro.ca4c17ab.so
- /data/data/####/load_MTAwMF8xMjAxXzE4NDAwMzAw;.xml
- /data/data/####/multidex.version.xml
- /data/data/####/prdopt.xml
- /data/data/####/preference_check_permission.xml
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/quad_sdk.xml
- /data/data/####/read.xml
- /data/data/####/screen_lock_preference.xml
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/spfn_MTAwMF8xMjAxXzE4NDAwMzAw;.xml
- /data/data/####/tdargs.xml
- /data/data/####/tmp7.xml
- /data/data/####/tools8977.xml
- /data/data/####/tools8977New.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/yaq.ca4c17ab.sec
- /data/data/####/yaqsdkcookie
- /data/data/####/yhtpva
- /data/media/####/.cdeviceID
- /data/media/####/.nid
- /data/media/####/.nomedia
- /data/media/####/10286f99e29bb2f28658c37f91854faf631569cf7e19b7....0.tmp
- /data/media/####/1199CE723394EB6C71C523B0D85DCB64.tmp
- /data/media/####/2019_08_16
- /data/media/####/2FB9F171FEDB5FD8195D98B5990CC80F.tmp
- /data/media/####/43AA35889A6E7F088A1852BBBB3CA25A.tmp
- /data/media/####/4A3554E5C868D6DBB43CA8BA7FCCB8E3.tmp
- /data/media/####/4F44941436A2EE465BE0C3CC11A91231.tmp
- /data/media/####/65E839A1106FB2A553F9A808D503CEDC.tmp
- /data/media/####/9E9758C18B6C5C051223130C055342B1.tmp
- /data/media/####/A0DC82092261C2C90BC66ED091505ED7.tmp
- /data/media/####/B5BDBFA64951546F3DD4A3A8B8564867.tmp
- /data/media/####/CC8011227587B1B18A0A596EFFA62735.tmp
- /data/media/####/D06DF3A4FC5DA3C237C8D1669B982092.tmp
- /data/media/####/E52C67A8BA89729AF69EF0A9AC6639E8.tmp
- /data/media/####/F1FB705B2C7BD13F5002C0B1C3FE61CA.tmp
- /data/media/####/F389DD48A9FDB4969C9EDA3E7A32D8DD.tmp
- /data/media/####/F8ABEE09B527E27545E7D9F020D6BF5C.tmp
- /data/media/####/adv
- /data/media/####/config
- /data/media/####/deviceId
- /data/media/####/engc.jar
- /data/media/####/icon_-1064359927
- /data/media/####/icon_-1133528357
- /data/media/####/icon_-1213825779
- /data/media/####/icon_-186851193
- /data/media/####/icon_-1994592668
- /data/media/####/icon_1335869356
- /data/media/####/icon_1656857395
- /data/media/####/icon_1726530556
- /data/media/####/icon_1975464561
- /data/media/####/icon_2133251161
- /data/media/####/icon_2138330644
- /data/media/####/isread
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/launcher_log.file
- /data/media/####/master
- /data/media/####/master.lock
- /data/media/####/null
- /data/media/####/null.jpg
- /data/media/####/stat13.guantouyouxi.com.cookie
- /data/media/####/tag2.dat57f0e633-5149-4394-b63d-ce6a91de3876.tmp
- /data/media/####/tmpbl.jar
- /data/media/####/webengine.jar
- /data/media/####/xio_ckn.jar
- /data/media/####/xio_cku.jar
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh
- <Package Folder>/app_bin/daemon -p <Package> -s com.example.zzb.screenlock.LockService -t 30
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- getprop
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Загружает динамические библиотеки:
- X86Bridge
- libjiagu-1664829852
- libyaqbasic.ca4c17ab
- libyaqpro.ca4c17ab
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Управляет Wi-Fi-подключением.
