Android.Packed.46970

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.SmsSend.967.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.umengc####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) log.o2####.com:8001
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) s####.o2####.com:80
TCP(HTTP/1.1) ad.o2####.com:8005
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk.bst.t####.com:80
TCP(HTTP/1.1) sf.o2####.com.####.com:80
TCP(HTTP/1.1) d####.opensp####.cn:80
TCP(HTTP/1.1) m.o2####.com:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) sf.o2####.com.####.com:443
TCP(TLS/1.0) api.o2####.com:443
TCP(TLS/1.0) s####.we####.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5225

Запросы DNS:

7j####.c####.z0.####.com
a####.u####.com
a####.umengc####.com
ad.o2####.com
api.o2####.com
api.w####.com
c-h####.g####.com
cm-1####.ig####.com
d####.opensp####.cn
h####.opensp####.cn
img.o2####.com
log.o2####.com
m.o2####.com
mt####.go####.com
s####.o2####.com
s####.we####.com
sdk-ope####.g####.com
sdk.bst.t####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sf.o2####.com

Запросы HTTP GET:

ad.o2####.com:8005/api/v1/Audio/AdvertConfigList.xml?ScreenHeight=####&v...
ad.o2####.com:8005/api/v2/Audio/AdvertShowSwitchSetting.xml?ScreenHeight...
h####.opensp####.cn/launchconfig?t=####&p=LnR5e####
log.o2####.com:8001/api/v1/log/addmpclientid.xml?imei=####&imsi=####&ver...
log.o2####.com:8001/api/v1/log/appendappuserhitinfo.xml?RelationID=####&...
m.o2####.com/hd/20190516/css/main.css?v=####
m.o2####.com/hd/20190516/css/mediaelement-and-player.min.js
m.o2####.com/hd/20190516/css/mediaelementplayer.min.css?v=####
m.o2####.com/hd/20190516/images/1.png
m.o2####.com/hd/20190516/images/2.png
m.o2####.com/hd/20190516/images/20190616.mp4
m.o2####.com/hd/20190516/images/3.png
m.o2####.com/hd/20190516/images/4.png
m.o2####.com/hd/20190516/images/70_01.png
m.o2####.com/hd/20190516/images/banner.jpg
m.o2####.com/hd/20190516/images/play.png
m.o2####.com/hd/20190516/index.aspx?ver=####&pno=####&imei=####&imsi=###...
m.o2####.com/hd/images/adclose.png
m.o2####.com/images/fx_tip_client_wx.png
m.o2####.com/js/jquery-1.12.3.min.js?v=####
m.o2####.com/js/jquery.cookie.js?v=####
m.o2####.com/js/md5.js
m.o2####.com/xhxw/images/btn_share.png
q####.c####.l####.####.com/config/hz-hzv6.conf
s####.o2####.com/api/v1/ub/getconfig.xml?imsi=####&ver=####&pno=####&use...
sf.o2####.com.####.com/Recommend/2018/07/201807121054372564.png
sf.o2####.com.####.com/Recommend/2018/12/201812291351122689.png
sf.o2####.com.####.com/Recommend/2019/05/201905270905462586.jpg
sf.o2####.com.####.com/Recommend/2019/07/201907241501022354.png
sf.o2####.com.####.com/Recommend/2019/07/201907251615291314.png
sf.o2####.com.####.com/Recommend/2019/07/201907251627172794.png
sf.o2####.com.####.com/Recommend/2019/09/201909021037462408.jpg
sf.o2####.com.####.com/Recommend/2019/09/201909201454242770.jpg
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20150616152726_4CG...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20150616153424_1H7...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20150616153518_J0Y...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20150914171212_CPF...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921141120_293...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921141430_L0Y...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921141529_AW4...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921142409_DLH...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921143533_6TY...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921144515_8JO...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921145014_JJ1...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921150239_EAF...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160921154019_FEA...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160923174255_TGU...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160923174531_TR6...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160923174622_FQH...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160923174655_Q8N...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160930171858_72L...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160930172051_PAG...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160930172133_WGR...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20160930172324_M2S...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20161014140302_7E1...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20161014140326_WXM...
sf.o2####.com.####.com/UploadFile/Recommend/RecHomePic20180119103032_PPY...
sf.o2####.com.####.com/UploadFile/topicImg201602231053179780000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201902191111543850000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201905200341132200000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201906140227568800000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201906280204129500000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201907310238577720000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201908090948391860000_640x250....
sf.o2####.com.####.com/UploadFile/topicImg201909090420456460000_640x250....
sf.o2####.com.####.com/api/v1/Audio/getbannerv3-1-640x250.xml
sf.o2####.com.####.com/api/v1/Audio/getcdninterface.xml
sf.o2####.com.####.com/api/v2/Audio/classpageinfo-TYYDYSB_A1.5.4.7.xml
sf.o2####.com.####.com/api/v2/Audio/gethomepageinfo5-TYYDYSB_A1.5.4.7.xml

Запросы HTTP POST:

a####.u####.com/app_logs
a####.umengc####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
s####.o2####.com/api/v1/ub/appendusageinfo.xml
sdk-ope####.g####.com/api.php?format=####&t=####
sdk.bst.t####.com/rain/index.php?/rain/p####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.filelog_pv
/data/data/####/.jg.ic
/data/data/####/201908020853041157.jpg
/data/data/####/AppendUpgradeInfo.xml
/data/data/####/BT_SharedPref.xml
/data/data/####/ListenRecords.db-journal
/data/data/####/MultiDex.lock
/data/data/####/bg_pref.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.anysoft.tyyd_preferences.xml
/data/data/####/com.iflytek.id.xml
/data/data/####/com.iflytek.msc.xml
/data/data/####/comanysofttyyd
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/first_use_v1.1.xml
/data/data/####/getui_client_id.xml
/data/data/####/getui_sp.xml
/data/data/####/ifly_launch_lib.xml
/data/data/####/iflytek_state_com.anysoft.tyyd.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu739112813.so
/data/data/####/multidex.version.xml
/data/data/####/pref.xml
/data/data/####/pref_server.xml
/data/data/####/profile.xml
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/selfupdate.xml
/data/data/####/themePrefs.xml
/data/data/####/tyydprovider.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_cache_1569294975920.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/version_code_sp.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.2F6E2C5B63F0F83B
/data/media/####/.comanysofttyyd
/data/media/####/.nomedia
/data/media/####/11s8mhfc7a6kriwkbw1h9ojwu
/data/media/####/12b5d8g0o8fjfrdsxernpztfk
/data/media/####/1cckme0ih9t2cgniwu24wvofe
/data/media/####/1gkw30jiz02nofxrj1q0vf86i
/data/media/####/1gv02rzk6ftywde82dlgjc2uv
/data/media/####/1jovtss5j82xfyh2e0s6o1nse
/data/media/####/1m95dyqy6bskal9ceqx1g2nqc
/data/media/####/1qjtqih5fvfhc5fvki7rbfdqa
/data/media/####/1rw3yq22yl11ixh4ey75628y0
/data/media/####/1sghvewyaynfg3axwpl2s9y7l
/data/media/####/2aqdnejssanbebkeuzf2e4bmf
/data/media/####/2bhq1qzo8blzz24m07wk62q0q
/data/media/####/2cg769jwcqn1lnpit3om7ciza
/data/media/####/2gpx2krl52yllfb7mwki7fwht
/data/media/####/2ikmokoux1k7wg99qz3gaoyvj
/data/media/####/2j81c0mnnxyy3blc6pnfmyih6
/data/media/####/2kwxpes8x03r9k7vr48cz2nrh
/data/media/####/2lum7gc707wuamfenuohmx6r6
/data/media/####/2o0qte9qvfaoz12ijzwqodqm2
/data/media/####/2stneyxipuxa7er5kbu1sfb0l
/data/media/####/2tbpeibjqcnlm1ucgf5gwre3m
/data/media/####/2tgzsp2p2zpajvx58jicdcguw
/data/media/####/2vrs0wxrqd0vmm6qfhnqcp22d
/data/media/####/2wt0rqap1semjcnmn812nxsea
/data/media/####/2xdu0ezkvte3epyfy8z9gro97
/data/media/####/2z44q6xz6gvoy3y79frvruezr
/data/media/####/31r71igvbyxx2mcj4jrtn5rmh
/data/media/####/31rbn4bnt0p7nd8chx55igc00
/data/media/####/324oigc1pzgz7jb0378sbvp7d
/data/media/####/34i2h7lo4hqzrmesdkfvylj0v
/data/media/####/3a4hitvy5ast3i5ckps52rieo
/data/media/####/3ad3mbqptgjdlm0v9a38uld5h
/data/media/####/3bb9zkxxqjp4ebn9jiea6gxka
/data/media/####/3f6mwdjompo6jwia5xxtha4rd
/data/media/####/3gd53zeun6snluay3r5nazv7i
/data/media/####/3n48cvre4tdjyckjg6gt776oj
/data/media/####/3nr51tn71u5boe6v0dgvkx2ok
/data/media/####/3oc00r2kdqi0d4dhv4r70llnz
/data/media/####/3wqpkdzz9gk1nlp2v9uhnjdvd
/data/media/####/3zj3tsab1nsmdvp3lroo5r5i6
/data/media/####/48oc8oc7aa7ljkz12yb8nw9gp
/data/media/####/4azi4llnc1z8k5atwefk6e2c5
/data/media/####/4byhtiely6jdl539cqo9wlzrs
/data/media/####/4chdeuii7l8mrhadjlo6mok1o
/data/media/####/4djcwkjhq7799ksr7vzjvaepz
/data/media/####/4jjqvmxph6xctq2pmzjhrx3e0
/data/media/####/4ldke11t1on7ty26c2ylutfqk
/data/media/####/4lm0fk6lw99yix9vr8ax8a9y
/data/media/####/4or0pgkbgo9kk60wxopqn2mfo
/data/media/####/4osvc3tot19h6q8mvb9lruwix
/data/media/####/4scxuekosli2ue3zbdawtmyo4
/data/media/####/4tbgdccer6wgv0gtae6v9q4cp
/data/media/####/4ut8iqr5prgx5weu3rcoq9di4
/data/media/####/4wbpjz882ypilvrezdhkehhla
/data/media/####/4yd3dov05950920avtv1h1bkm
/data/media/####/4z3z5gev2sfo4d8pshp4w5d9a
/data/media/####/505j8268h6432iawclf22vnkv
/data/media/####/53v1qbqtaos56pr2p04wcusgt
/data/media/####/56iaqcpw6zf5fj4w5bgs4uxfj
/data/media/####/57c4uh2syzqlq8cxxxnf46ezf
/data/media/####/5bi8uevjri0ou3sr5o5kidk7l
/data/media/####/5brs7nchl0kbrmxmpkztfcw7w
/data/media/####/5joghcih1vpgw8i6yk8xasrj3
/data/media/####/5jyr4ix9vjy2mubtj5znx14ri
/data/media/####/5l2l2bvgqkpj6cchtiya61lfv
/data/media/####/5ld344by7s51ef1fnfi4qlme3
/data/media/####/5li21pv0b78u3797wmxd3plpz
/data/media/####/5lqnb3vk4rjatm4jmw37e978
/data/media/####/5mxmkp6q8j78nttas3v9f04lx
/data/media/####/5nqus555aefl4dmnsrejtmgbl
/data/media/####/5qnebczegww635fmxkhi3v92s
/data/media/####/5rfyz0sxjex7eog734wppe4ys
/data/media/####/5x26pqxh9ewj5qharn5o15ebo
/data/media/####/5xj2wuqdyk7jqnnc3q1l9nomz
/data/media/####/61qnvxa7kpsz1631woygjws8g
/data/media/####/61tuuat0fguz684at1s2b8tj3
/data/media/####/63fy620gu9efl4qfhgn5yefdf
/data/media/####/651r4cm87pakx8v9so2luzucf
/data/media/####/65c1ya4ntd4ff48s221wz878q
/data/media/####/66ramiqycdn9p3sk12atl7p9s
/data/media/####/66u1bvdoksg2sucpajv9daxy6
/data/media/####/67a3b75czhthbm4ca3gw0xa0g
/data/media/####/67h3617wegy4nqp7ki3m60mn3
/data/media/####/69zlrthgt2fj58zp5t2dv0cqq
/data/media/####/6hh4fdsp7p9aqucfs9221h22d
/data/media/####/6hpxr68z6npiti6sp4o40cl2d
/data/media/####/6j6nh9248ly3bnur4zq3gn0yu
/data/media/####/6mh3buw1flvfk20tvi96wni6f
/data/media/####/6n8ruhypqwr79y8jywhh92yj1
/data/media/####/6nrnsf2lfp7yoexxi9s5sxnef
/data/media/####/6r1d5w2kcc2t9ckpttgbdyeou
/data/media/####/6unwk2ddj3zh8s7pxz5qa3jux
/data/media/####/6vsng21vcd5zbjxza65z4f51h
/data/media/####/6vt6991smjpvx4hpsz4joix4e
/data/media/####/6zbtz32tjoy019uazzouopi3z
/data/media/####/6zbvqzvl1c06p07jw1v3hg8ek
/data/media/####/71hxle3astkz62ymsgd8w8dt4
/data/media/####/74795ueq4zkm2y4kt32mr42gd
/data/media/####/75o5n9inl6szqetdg4s9gz516
/data/media/####/78dm1idj63wf7kmvgl3bk4py1
/data/media/####/79hjfan1wzdzf0n395ohi2nlt
/data/media/####/7ekbyva7q0mdnb1npymu0uiql
/data/media/####/7g0jbje54q1sbpl116o5im1ak
/data/media/####/7ghttnwtnlbnvn79jin5t8pmu
/data/media/####/7hhixbdmc9ram44tvfq1gfbth
/data/media/####/7if7emfe18w7ms9kjnmerh7yg
/data/media/####/7jl2h1sg7clh1vgdo5ar8hppm
/data/media/####/7jwjs9p1gvnviy4rzatixbpfr
/data/media/####/7ybut0lljetuy0j8w1sb44vf
/data/media/####/app.db
/data/media/####/com.anysoft.tyyd.bin
/data/media/####/com.anysoft.tyyd.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/h3qyrzas5q39z4o1vsv03lt4
/data/media/####/hqtm84vpaz3wfw40ys9rsc5f
/data/media/####/iflyworkdir_test
/data/media/####/itfxjnkaptokq463savdf0qo
/data/media/####/jk4rplj6eu232neoeaseng6f
/data/media/####/jkxv85oehe284qm9zd5m8uds
/data/media/####/m9hohqc9gzh0rgy3ffrz8nin
/data/media/####/qvg9348zqvk9b1crkxnwaav
/data/media/####/tytslog.tmp
/data/media/####/y24guqy1uutsek6hg1ja8b9u

Другие:

Запускает следующие shell-скрипты:

getprop ro.miui.ui.version.code
getprop ro.miui.ui.version.name
logcat -v time

Загружает динамические библиотеки:

getuiext3
libjiagu739112813
msc
weibosdkcore

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней