Техническая информация
Вредоносные функции:
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) c####.im.qq.com:80
- TCP(HTTP/1.1) t.si####.net:80
- TCP(HTTP/1.1) doublee####.aa####.org:80
- TCP(HTTP/1.1) do.soi####.com:80
- TCP(HTTP/1.1) www.a.sh####.com:80
- TCP(HTTP/1.1) tj.ke####.com:80
- TCP(HTTP/1.1) lp.lapia####.com:6099
- TCP(HTTP/1.1) ssl.a####.com.####.net:80
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) 1####.217.20.74:443
- TCP(TLS/1.0) 1####.217.168.206:443
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.2) safebro####.google####.com:443
Запросы DNS:
- airdown####.a####.com
- and####.google####.com
- c####.im.qq.com
- do.soi####.com
- doublee####.aa####.org
- googl####.g.doublec####.net
- instant####.google####.com
- lp.lapia####.com
- lp4.lapia####.com
- mobi####.a####.com
- mobi####.a####.com.####.8
- safebro####.google####.com
- t.si####.net
- tj.ke####.com
- www.b####.com
Запросы HTTP GET:
- c####.im.qq.com/cgi-bin/cgi_svrtime
- do.soi####.com/201812/ww9.jar
- doublee####.aa####.org/02/slideShow/image/0784cc44-aa8f-45d2-b4b6-52d2e1...
- doublee####.aa####.org/02/slideShow/image/1317e547-d51b-472f-910c-cac6f1...
- doublee####.aa####.org/02/slideShow/image/137ce9af-ba5a-492d-9530-3d8a45...
- doublee####.aa####.org/02/slideShow/image/1dac3d15-3410-43ec-a13e-e61686...
- doublee####.aa####.org/02/slideShow/image/26fe1021-b43c-4a36-b50b-0ff5df...
- doublee####.aa####.org/02/slideShow/image/2abee4b1-b3a8-48b6-9d5d-f600a2...
- doublee####.aa####.org/02/slideShow/image/3c460e68-910d-42e0-bb9b-09b95b...
- doublee####.aa####.org/02/slideShow/image/3e855181-4841-49ac-823e-27de35...
- doublee####.aa####.org/02/slideShow/image/40b4da1f-49a8-43a6-bf9a-8e35ac...
- doublee####.aa####.org/02/slideShow/image/47b0ddfd-1177-46ba-a464-c0fc32...
- doublee####.aa####.org/02/slideShow/image/4ac99989-ae57-49d0-a7c0-9ac653...
- doublee####.aa####.org/02/slideShow/image/554ac911-00e9-490c-948b-aa0baf...
- doublee####.aa####.org/02/slideShow/image/55527543-856b-454c-981c-3c0b09...
- doublee####.aa####.org/02/slideShow/image/643eb21f-4492-4b78-bdb5-f0669a...
- doublee####.aa####.org/02/slideShow/image/74bc353c-b699-41cc-93f0-065939...
- doublee####.aa####.org/02/slideShow/image/765b9120-1389-407b-9484-a4a494...
- doublee####.aa####.org/02/slideShow/image/80e7fd21-e466-4b30-ad00-81b3a6...
- doublee####.aa####.org/02/slideShow/image/b7dca746-97d7-4c2e-9883-a2ea7d...
- doublee####.aa####.org/02/slideShow/image/b8fc3506-b79c-4c5b-bc4b-42cf17...
- doublee####.aa####.org/02/slideShow/image/d7fd2d91-3940-4420-8df7-fb1999...
- doublee####.aa####.org/02/slideShow/image/dc3a39dc-5129-4573-bd26-06027b...
- doublee####.aa####.org/02/slideShow/image/dc520dd0-088a-49c2-aab8-318028...
- doublee####.aa####.org/02/slideShow/image/e4503520-577e-4f91-a0aa-05c520...
- doublee####.aa####.org/02/slideShow/image/f904d588-a620-4b22-944e-934c71...
- doublee####.aa####.org/02/slideShow/image/ff6a1ae9-7c88-465e-994b-8ec81d...
- doublee####.aa####.org/02/slideShow/sound/07e058e2-d260-4fb0-b4bf-4dedb3...
- doublee####.aa####.org/02/slideShow/sound/139f1a5a-f029-4104-a808-bf9add...
- doublee####.aa####.org/02/slideShow/sound/20f40079-bd56-41c6-819d-cbd78f...
- doublee####.aa####.org/02/slideShow/sound/24b721df-bb75-4138-b7a4-2366f7...
- doublee####.aa####.org/02/slideShow/sound/292e050c-a143-481f-ac77-a0ddbd...
- doublee####.aa####.org/02/slideShow/sound/34a83449-d18a-4cf4-8da5-0be975...
- doublee####.aa####.org/02/slideShow/sound/422d4c5f-119c-4c37-8161-75f4e7...
- doublee####.aa####.org/02/slideShow/sound/49f9f78f-1942-4140-9263-4bc246...
- doublee####.aa####.org/02/slideShow/sound/4cb5b3c9-4d89-4f46-9c78-1f36d4...
- doublee####.aa####.org/02/slideShow/sound/4f83679a-d147-4c52-90a7-510db6...
- doublee####.aa####.org/02/slideShow/sound/56ddb575-cb8c-47fe-bc05-0feb0f...
- doublee####.aa####.org/02/slideShow/sound/5a4a2c81-6a72-432b-b231-67c615...
- doublee####.aa####.org/02/slideShow/sound/5a528c1c-4524-4dfb-8a59-358894...
- doublee####.aa####.org/02/slideShow/sound/5ceb8e3b-d607-4f0f-a714-83b4d3...
- doublee####.aa####.org/02/slideShow/sound/6257195a-e391-4c8e-8093-24bcda...
- doublee####.aa####.org/02/slideShow/sound/65acf881-d45f-4f69-88b1-cf72be...
- doublee####.aa####.org/02/slideShow/sound/72f4983e-d338-4ad2-916b-ede1ba...
- doublee####.aa####.org/02/slideShow/sound/7323a0cf-0977-40ad-aef6-422f52...
- doublee####.aa####.org/02/slideShow/sound/761374a0-48b6-44a2-869e-0d7535...
- doublee####.aa####.org/02/slideShow/sound/7774beeb-000b-43ab-bd0b-0ee8c6...
- doublee####.aa####.org/02/slideShow/sound/7805ae0d-97c4-4cce-ae39-a158a9...
- doublee####.aa####.org/02/slideShow/sound/7a99e997-4030-4f3f-950d-66067a...
- doublee####.aa####.org/02/slideShow/sound/88a3b922-ca8d-4627-be3e-6da9cd...
- doublee####.aa####.org/02/slideShow/sound/8c8c944b-00d0-48ec-9844-0f59af...
- doublee####.aa####.org/02/slideShow/sound/9b3e7f28-b6f0-41a5-8b28-d00d8a...
- doublee####.aa####.org/02/slideShow/sound/9c38984a-8b9c-4470-b979-fbca8f...
- doublee####.aa####.org/02/slideShow/sound/9e184c09-7250-4556-9d1c-211a4e...
- doublee####.aa####.org/02/slideShow/sound/a18ac620-8f6e-4951-964f-6c009f...
- doublee####.aa####.org/02/slideShow/sound/a921cacb-469b-4284-a868-53416a...
- doublee####.aa####.org/02/slideShow/sound/ae5fc7ef-1936-424b-b555-6a5d3d...
- doublee####.aa####.org/02/slideShow/sound/c4bbad94-8504-43d2-9708-0cfbcf...
- doublee####.aa####.org/02/slideShow/sound/c647d8e3-b86d-4cda-ac72-b3dc68...
- doublee####.aa####.org/02/slideShow/sound/d1044c35-0186-4137-a10b-8b0a6e...
- doublee####.aa####.org/02/slideShow/sound/d43ba7c6-4240-4a3b-ba36-eaece4...
- doublee####.aa####.org/02/slideShow/sound/d736ab15-3b43-433a-a5f5-49173b...
- doublee####.aa####.org/02/slideShow/sound/ed8f062e-52cd-474a-9467-53b8de...
- doublee####.aa####.org/02/slideShow/sound/edda78b4-947d-45a8-b24c-bf00bc...
- doublee####.aa####.org/02/slideShow/sound/fedc6b1d-d098-42aa-b2e1-c39d3f...
- doublee####.aa####.org/json/346.json
- doublee####.aa####.org/news/enPhonetic.xml
- ssl.a####.com.####.net/air?version=####&appid=####&runtimeType=####&os=#...
- tj.ke####.com/ads/js.php?md5=5Si####
- www.a.sh####.com/
Запросы HTTP POST:
- lp.lapia####.com:6099/aps/
- lp.lapia####.com:6099/scinit/
- t.si####.net/t2
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.hptc.cache_udw.vehuegfyief
- /data/data/####/1.jpg
- /data/data/####/10.jpg
- /data/data/####/11.jpg
- /data/data/####/12.jpg
- /data/data/####/13.jpg
- /data/data/####/14.jpg
- /data/data/####/15.jpg
- /data/data/####/1518650295230.dex
- /data/data/####/1518650295230.dex.flock (deleted)
- /data/data/####/1518650295230.jar
- /data/data/####/1518650295230.tmp
- /data/data/####/16.jpg
- /data/data/####/17.jpg
- /data/data/####/18.jpg
- /data/data/####/19.jpg
- /data/data/####/2.jpg
- /data/data/####/20.jpg
- /data/data/####/21.jpg
- /data/data/####/22.jpg
- /data/data/####/23.jpg
- /data/data/####/24.jpg
- /data/data/####/3.jpg
- /data/data/####/4.jpg
- /data/data/####/5.jpg
- /data/data/####/6.jpg
- /data/data/####/7.jpg
- /data/data/####/8.jpg
- /data/data/####/9.jpg
- /data/data/####/Cookies-journal
- /data/data/####/EnPhonetic.swf
- /data/data/####/FXAppCache.sol
- /data/data/####/FXAppCache.sxx
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/Y2EtYXBwLX.xml
- /data/data/####/admob.xml
- /data/data/####/application.xml
- /data/data/####/au.xml
- /data/data/####/classAddition.xml
- /data/data/####/com.auwhoudw.vehuegfyief_preferences.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/cookies
- /data/data/####/curl-ca-bundle.crt
- /data/data/####/extension.xml
- /data/data/####/image0
- /data/data/####/image1
- /data/data/####/image10
- /data/data/####/image11
- /data/data/####/image12
- /data/data/####/image13
- /data/data/####/image14
- /data/data/####/image15
- /data/data/####/image16
- /data/data/####/image17
- /data/data/####/image18
- /data/data/####/image19
- /data/data/####/image2
- /data/data/####/image20
- /data/data/####/image21
- /data/data/####/image22
- /data/data/####/image23
- /data/data/####/image3
- /data/data/####/image4
- /data/data/####/image5
- /data/data/####/image6
- /data/data/####/image7
- /data/data/####/image8
- /data/data/####/image9
- /data/data/####/javaTrustStore.tmp
- /data/data/####/library.swf
- /data/data/####/metrics_guid
- /data/data/####/mp301
- /data/data/####/mp3101
- /data/data/####/mp311
- /data/data/####/mp3111
- /data/data/####/mp3121
- /data/data/####/mp3131
- /data/data/####/mp3141
- /data/data/####/mp3151
- /data/data/####/mp3161
- /data/data/####/mp3171
- /data/data/####/mp3181
- /data/data/####/mp3191
- /data/data/####/mp3201
- /data/data/####/mp321
- /data/data/####/mp3211
- /data/data/####/mp3221
- /data/data/####/mp3231
- /data/data/####/mp3241
- /data/data/####/mp3251
- /data/data/####/mp3261
- /data/data/####/mp3271
- /data/data/####/mp3281
- /data/data/####/mp3291
- /data/data/####/mp3301
- /data/data/####/mp331
- /data/data/####/mp3311
- /data/data/####/mp3321
- /data/data/####/mp3331
- /data/data/####/mp3341
- /data/data/####/mp3351
- /data/data/####/mp3361
- /data/data/####/mp3371
- /data/data/####/mp341
- /data/data/####/mp351
- /data/data/####/mp361
- /data/data/####/mp371
- /data/data/####/mp381
- /data/data/####/mp391
- /data/data/####/navigator.xml
- /data/data/####/proc_auxv
- /data/data/####/purchase2.png
- /data/data/####/purchaseIco.png
- /data/data/####/swe.pl
- /data/data/####/xvm.dex
- /data/data/####/xvm.dex.flock (deleted)
- /data/data/####/xvm.jar
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/devices/system/cpu/present
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_jar/xvm.jar --oat-fd=36 --oat-location=/data/user/0/<Package>/app_dex/xvm.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/cache/1518650295230.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/cache/1518650295230.dex --compiler-filter=speed
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
Получает информацию об отправленых/принятых SMS.
