Android.Packed.47088

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.861.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) i.sn####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) bds.sn####.com:80
TCP(HTTP/1.1) ssl.c####.com.####.net:80
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(HTTP/1.1) www.miguv####.com:80
TCP(HTTP/1.1) sf1-ttc####.ps####.com:8080
TCP(TLS/1.0) bds.sn####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.217.17.106:443
TCP(TLS/1.0) i.sn####.com:443
TCP(TLS/1.0) 1####.217.20.74:443
TCP(TLS/1.2) 2####.58.211.110:443
TCP(TLS/1.2) 1####.217.17.106:443

Запросы DNS:

and####.b####.qq.com
and####.google####.com
bds.sn####.com
ex####.sn####.com
i.sn####.com
instant####.google####.com
is.sn####.com
log.sn####.com
log.u####.com
m####.go####.com
p####.byt####.com
plb####.u####.com
safebro####.google####.com
sf1-ttc####.ps####.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
t.l####.c####.cn
u####.u####.com
w####.cmv####.cn
www.ap####.cn
www.miguv####.com

Запросы HTTP GET:

i.sn####.com/img/web.business.image/201908275d0d6d2a0d457f794c0d88bd~100...
i.sn####.com/img/web.business.image/201909035d0d39ffe5913e354e06a406~100...
i.sn####.com/img/web.business.image/201909305d0d31c21b6164dd408ebde1~100...
i.sn####.com/obj/web.business.image/201909065d0d0f16fdd15c724a569df6
i.sn####.com/obj/web.business.image/201910085d0d91c62aeed6a24ceaa3a7
sf1-ttc####.ps####.com/img/ad-tetris-site/file/1569580569565/5c1e019a3c1...
sf1-ttc####.ps####.com/img/ad.union.api/0c2942a9902f75d115bb7278eff6bd1a...
sf1-ttc####.ps####.com/img/ad.union.api/2059fe1619757a1dc538d2d2c2f49ba1...
sf1-ttc####.ps####.com/img/ad.union.api/33c2842f6d71a6923b0056ab117f176d...
sf1-ttc####.ps####.com/img/ad.union.api/4ae0fa69663bf9f2233a40a90c2c0fca...
sf1-ttc####.ps####.com/img/ad.union.api/50f01d1a7bc303717836e20e302c7640...
sf1-ttc####.ps####.com/img/ad.union.api/80074aa96f51042eb089b8ec6427899e...
sf1-ttc####.ps####.com/img/ad.union.api/b59ffff14ec10a28f9e6cd2b0765480d...
sf1-ttc####.ps####.com/img/mosaic-legacy/2713500063f0616dad711~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2c54900050c9f64756037~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd35000189db509fe93b~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2cd4100050778befde30a~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d5390005618933646c27~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d637000591b4d45e3c69~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d69e000b4c7029d10f86~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d69e000c0515ac38c87d~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d6a1000c71b0d031acbe~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d6b100019b3e7f60e5ff~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d7680002b3f911358f32~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d79f00044b7a62f177f4~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d7de0004b233c97540ec~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d7f20004c303eb7a76e4~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d808000406cb539db363~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d87500013de46a30c89a~c1_1080x1...
sf1-ttc####.ps####.com/img/mosaic-legacy/2d8cb000907db2712ed46~c1_1080x1...
sf1-ttc####.ps####.com/img/web.business.image/201904105d0da1f782d178fd49...
sf1-ttc####.ps####.com/img/web.business.image/201908025d0de20a3eb17cfc42...
sf1-ttc####.ps####.com/img/web.business.image/201908195d0ddc265593ef3447...
sf1-ttc####.ps####.com/img/web.business.image/201909065d0d0f16fdd15c724a...
sf1-ttc####.ps####.com/img/web.business.image/201909175d0d0af86f9fed684e...
sf1-ttc####.ps####.com/img/web.business.image/201909205d0d282ce68418df4e...
sf1-ttc####.ps####.com/img/web.business.image/201909265d0dfd7cb6ee11c941...
sf1-ttc####.ps####.com/img/web.business.image/201909275d0d5a706ecf9abb4d...
sf1-ttc####.ps####.com:8080/publish/poms/image/5500/246/471/201803291318...
sf1-ttc####.ps####.com:8080/publish/poms/image/5500/332/199/201808011714...
sf6-ttc####.ps####.com.####.com/obj/ad-tetris-site/file/1569580569565/5c...
ssl.c####.com.####.net/imagehd/shenzhen_01.png?time=####
www.miguv####.com/wap/resource/pc/data/filmLibraryData.jsp?type=####&sea...

Запросы HTTP POST:

and####.b####.qq.com/rqd/async?aid=####
bds.sn####.com/service/2/app_log_exception/?os_api=####&device_platform=...
i.sn####.com/service/2/app_log_exception/?os_api=####&device_platform=##...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.bak
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/09a34308620fd81b2ffc762b55e2d15eed5b0d5c82b497f...leted)
/data/data/####/1002
/data/data/####/1004
/data/data/####/1570533548288
/data/data/####/1570533558836
/data/data/####/1570533562497
/data/data/####/1570533573326
/data/data/####/1570533582859
/data/data/####/1570533589846
/data/data/####/1bpraiaoy3ymf3e94d7b2k1rp
/data/data/####/1bpraiaoy3ymf3e94d7b2k1rp (deleted)
/data/data/####/1c8g5num3ou9qzxkm9r4g8f5a
/data/data/####/1c8g5num3ou9qzxkm9r4g8f5a.tmp
/data/data/####/1fws3ywg1yuciwi36cb44zzs2
/data/data/####/1fws3ywg1yuciwi36cb44zzs2.tmp
/data/data/####/2hc3whi5kkl9rapuz9yxdxmxb
/data/data/####/2hc3whi5kkl9rapuz9yxdxmxb.tmp
/data/data/####/374ynfaujljdxsccji9eudq9a
/data/data/####/374ynfaujljdxsccji9eudq9a.tmp
/data/data/####/37l25muvw8t2rt2kz57uryp4v
/data/data/####/37l25muvw8t2rt2kz57uryp4v.tmp
/data/data/####/3s7qj5tlzxjmmhori87w6e3ss
/data/data/####/3s7qj5tlzxjmmhori87w6e3ss.tmp
/data/data/####/4gcc3oml2ec8tyu0wtn1pvqo3
/data/data/####/4gcc3oml2ec8tyu0wtn1pvqo3 (deleted)
/data/data/####/4rf644bmyi9wfy16nmcx2ex4g
/data/data/####/4rf644bmyi9wfy16nmcx2ex4g (deleted)
/data/data/####/4u46h9wnrpx3407oomon3cb8u
/data/data/####/4u46h9wnrpx3407oomon3cb8u.tmp
/data/data/####/4w2y6oq4a9epr070wuvacfl9w
/data/data/####/4w2y6oq4a9epr070wuvacfl9w (deleted)
/data/data/####/5912b62d1d1acf1b2eb991ca51c0d4707af2591cf392d44....0.tmp
/data/data/####/5bx9bt3zn7qzjkwdthf7exhu7
/data/data/####/5bx9bt3zn7qzjkwdthf7exhu7.tmp
/data/data/####/5psxhtb10g4up8ps8d51rtrz
/data/data/####/5psxhtb10g4up8ps8d51rtrz.tmp
/data/data/####/5uvj3jmuy58x2bpe5l8stxnvs
/data/data/####/5uvj3jmuy58x2bpe5l8stxnvs (deleted)
/data/data/####/7c4ptap1pmwgos48we0ybdfey
/data/data/####/7c4ptap1pmwgos48we0ybdfey.tmp
/data/data/####/7ggg8d6t9pre445ry5jw5mfca
/data/data/####/7ggg8d6t9pre445ry5jw5mfca.tmp
/data/data/####/9bbd3171277f297d6598c7637a985cbc3c57ed012635050....0.tmp
/data/data/####/a==7.5.3&&1.9_1570533564340_envelope.log
/data/data/####/app_crash_copy.xml
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/com.superhd.mobile2.cdqingyun.BETA_VALUES.xml
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTI5OTc3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTM3OTQw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTQ4MTIx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTU4Nzg0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTYyNzE2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTczODM1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTg5OTI2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTcwNTMzNTgyOTA3;
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/i==1.2.0&&1.9_1570533529955_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533538086_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533548213_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533558785_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533574004_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533582778_envelope.log
/data/data/####/i==1.2.0&&1.9_1570533589966_envelope.log
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/pic_default.dex
/data/data/####/pic_default.dex.flock (deleted)
/data/data/####/pic_default.jar
/data/data/####/proc_auxv
/data/data/####/sdk_config.xml
/data/data/####/security_info
/data/data/####/share.db-journal
/data/data/####/tt_materialMeta.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_splash.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/pic_default.jar --oat-fd=50 --oat-location=/data/user/0/<Package>/app_dex/pic_default.dex --compiler-filter=speed
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id
logcat -d -v threadtime
ls /sys/class/thermal

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней