Android.Packed.47255

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.611.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 4####.98.65.82:997
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) i####.j####.com:80
TCP(HTTP/1.1) p####.api.w5i.top:80
TCP(HTTP/1.1) app-t####.b0.a####.com:80
TCP(HTTP/1.1) t####.3g.qq.com:80
TCP(HTTP/1.1) api.chen####.com:80
TCP(HTTP/1.1) pic.87g.com.####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) a####.3gu.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) v3.bule####.cn:7001
TCP(HTTP/1.1) imgc####.qq.com.####.com:80
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(HTTP/1.1) 2####.205.239.188:80
TCP(TLS/1.0) mi.3####.com:443
TCP(TLS/1.0) mi.s####.qq.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) s####.e.qq.com:443
TCP(TLS/1.0) mi.g####.qq.com:443
TCP(TLS/1.0) dxp.b####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP m####.3g.qq.com:443

Запросы DNS:

a####.3gu.com
a####.u####.com
api.chen####.com
app-t####.img.3gu.com
dxp.b####.com
h####.b####.com
i####.360bu####.com
imgc####.qq.com
is.sn####.com
kua####.chen####.com
m####.3g.qq.com
mi.3####.com
mi.g####.qq.com
mi.s####.qq.com
p####.87g.com
p####.api.w5i.top
s####.e.qq.com
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
t####.3g.qq.com
v3.bule####.cn
w####.pcon####.com.cn

Запросы HTTP GET:

api.chen####.com/adApi/appAd
api.chen####.com/api/getCommentList?json=####
api.chen####.com/api/getHzCat?json=SM####
api.chen####.com/api/getHzList?json=####
api.chen####.com/api/getHzRelateNews?json=####
api.chen####.com/article/hz/504
app-t####.b0.a####.com/apps/ad_word.json
app-t####.b0.a####.com/resource/img/0e2ed1d7a2ec7c68b74fa0b0e967c448.jpg
app-t####.b0.a####.com/resource/img/1acad00b21ba12f28d1e146988ed2d11.jpg
app-t####.b0.a####.com/resource/img/1c46063712a238ea1675dd0e830aca9f.png
app-t####.b0.a####.com/resource/img/1dd0601149d6654e38d5d8eb6ed32fd1.jpg
app-t####.b0.a####.com/resource/img/2692bdfbf7586c8fd9afc6837ed09bc9.jpg
app-t####.b0.a####.com/resource/img/295aad61654234124351e05224e22373.png
app-t####.b0.a####.com/resource/img/2b4ab11062e90d4b68d0b89506a75289.jpg
app-t####.b0.a####.com/resource/img/418e08098928890cab8d406885876ca4.png
app-t####.b0.a####.com/resource/img/46bb8eec7db44f346943b7cb3085f094.jpg
app-t####.b0.a####.com/resource/img/4a3ba83d2ef0d12aebe9b5184d367359.jpg
app-t####.b0.a####.com/resource/img/51327f75dab2e48a301cf9454c28cf61.png
app-t####.b0.a####.com/resource/img/5d52dfa40b1c93a31dcfdad118ae7fa7.png
app-t####.b0.a####.com/resource/img/6cce35ec65d573cadac7ff4739082c6f.jpg
app-t####.b0.a####.com/resource/img/86621569740e1ace57ca53da2cd061a5.jpg
app-t####.b0.a####.com/resource/img/a4d21a594002f1f93abcd0a9f83ff403.png
app-t####.b0.a####.com/resource/img/a69764bb0455a450f892f30335ea4ffe.jpg
app-t####.b0.a####.com/resource/img/aff8325e2ea53df4bf77af33be02cec5.png
app-t####.b0.a####.com/resource/img/b2d06d967604428e598d82be4f491039.png
app-t####.b0.a####.com/resource/img/b653292cd0633574e52df330e42a4023.png
app-t####.b0.a####.com/resource/img/b7a0f60cd3eaf9d5a9ae12a667afb32c.jpg
app-t####.b0.a####.com/resource/img/c0188c2b95efeaab2f2e00f1f9ce9a5c.png
app-t####.b0.a####.com/resource/img/c3c4cdde2d45a728ccb7eff95c40b35d.jpg
app-t####.b0.a####.com/resource/img/c5a77160b0996e3b84a6dc1bc6a8a84b.png
app-t####.b0.a####.com/resource/img/d41a116d92e390bd0195d6c4079d4005.png
app-t####.b0.a####.com/resource/img/d666119ea30d577987e0848294d2fab0.png
app-t####.b0.a####.com/resource/img/d8197498ba76b476199473315f64d9f7.jpg
app-t####.b0.a####.com/resource/img/d9fcf890514f2974c571253efa614cbc.jpg
app-t####.b0.a####.com/resource/img/e575027c1ca932f4bc09d783694a12bf.png
app-t####.b0.a####.com/resource/img/e7bb1afb73b1f11f70c6472c138fc053.png
app-t####.b0.a####.com/resource/img/fbde6e11b8d18145e7841cd1c37a1951.jpg
i####.j####.com/pop/jfs/t1/100587/15/1827/31437/5dc675bcEa9ba0a1e/fc967c...
i####.j####.com/pop/jfs/t1/53362/21/15523/36470/5dc682ceEdd4eac7d/f49852...
i####.j####.com/pop/jfs/t1/61896/16/15058/42286/5dc6787dE4a906908/fe1507...
i####.j####.com/pop/jfs/t1/75684/37/14936/36639/5dc67ab7E3b6d1056/cb56cd...
imgc####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/progu...
pic.87g.com.####.com/upload/2017/0417/20170417012911844.jpg
pic.87g.com.####.com/upload/2017/0417/20170417014402920.jpg
pic.87g.com.####.com/upload/2017/0417/20170417015043533.jpg
pic.87g.com.####.com/upload/2017/0417/20170417020210790.jpg
pic.87g.com.####.com/upload/2017/0417/20170417021507373.jpg
pic.87g.com.####.com/upload/2017/0417/20170417021913744.jpg
pic.87g.com.####.com/upload/2017/0417/20170417124820417.jpg
pic.87g.com.####.com/upload/2017/0417/20170417125942816.jpg
pic.87g.com.####.com/upload/2018/0803/20180803152621726.jpg
pic.87g.com.####.com/upload/2018/0803/20180803152750105.jpg
pic.87g.com.####.com/upload/2018/0803/20180803153740296.jpg
pic.87g.com.####.com/upload/2018/0913/20180913015100614.jpg
pic.87g.com.####.com/upload/2018/0919/20180919081647938.jpg
pic.87g.com.####.com/upload/2018/0927/20180927053953365.jpg
pic.87g.com.####.com/upload/2018/0927/20180927060558672.jpg
pic.87g.com.####.com/upload/2018/0927/20180927061314882.jpg
pic.87g.com.####.com/upload/2018/0927/20180927180401144.jpg
pic.87g.com.####.com/upload/2018/0927/20180927180418794.jpg
pic.87g.com.####.com/upload/2018/0928/20180928082025207.jpg
pic.87g.com.####.com/upload/2019/0114/20190114011437895.gif
pic.87g.com.####.com/upload/2019/0114/20190114014211697.jpg
pic.87g.com.####.com/upload/2019/0114/20190114015746151.jpg
pic.87g.com.####.com/upload/2019/0114/20190114020546371.jpg
pic.87g.com.####.com/upload/2019/0114/20190114111137104.jpg
pic.87g.com.####.com/upload/2019/0114/20190114123134345.jpg
pic.87g.com.####.com/upload/2019/0114/20190114123153520.jpg
pic.87g.com.####.com/upload/2019/0114/20190114123220770.jpg
pic.87g.com.####.com/upload/2019/0114/20190114130714622.jpg
pic.87g.com.####.com/upload/2019/0114/20190114130724337.jpg
pic.87g.com.####.com/upload/2019/0116/20190116013051907.gif
pic.87g.com.####.com/upload/2019/0116/20190116013104941.gif
sf6-ttc####.ps####.com.####.com/obj/web.business.image/201911065d0d58a04...
t####.3g.qq.com/cw.html

Запросы HTTP POST:

a####.3gu.com/index.php/mcBox/code?json=####
a####.3gu.com/index.php/mcBox/js?json=####
a####.3gu.com/index.php/mcBox/material?json=####
a####.3gu.com/index.php/mcBox/save?json=####
a####.3gu.com/index.php/mcBox/skin?json=####
a####.u####.com/app_logs
p####.api.w5i.top/R/SS.ashx
s####.e.qq.com/activate
v3.bule####.cn:7001/v3/api_request.aspx
v3.bule####.cn:7001/v3/api_settings.aspx
w####.pcon####.com.cn/ip.jsp

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1127729055-1266689676
/data/data/####/.imprint
/data/data/####/.turing.dat
/data/data/####/.updateIV.dat
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_1.dex
/data/data/####/01a654c2cab7bfc1cee0f888bdecf5d4c164dac5ae91cd0....0.tmp
/data/data/####/01b9ba1e95829c877816d4de31537e341690feb8c85a6ac....0.tmp
/data/data/####/03126d7f4c8e34a6b29cff0538d4702ea18f9ffbd9acbac....0.tmp
/data/data/####/05ba101b5b2a1c6c863cdcda5384e9adc005603483b656e....0.tmp
/data/data/####/070e07a669624f10ed3a593236860787b945310ee509c58....0.tmp
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/1004
/data/data/####/1021689741840853517
/data/data/####/1s.jar
/data/data/####/206d070b1bc9c20b4237cd1070b17986a809977d63755a6....0.tmp
/data/data/####/2273.yaqcookie
/data/data/####/2363cfeed83d3938676cba86e6050b5672b1b2441a6ec8c....0.tmp
/data/data/####/24439e6afccef985c445bf9c2480c906ac437f7e582760f....0.tmp
/data/data/####/2a49df461533f611b2f0ab212374cd3485c4fd60cb3ba03....0.tmp
/data/data/####/2e0ba49ac5d8daf89e647516020fe451f86bb370d80d122....0.tmp
/data/data/####/307b9e4376c43a6f1cd36286309bd904a3ebc5f22fab162....0.tmp
/data/data/####/3762a7228f60ef2487e434d9b8fa6e594c4d0692218bc4e....0.tmp
/data/data/####/3b553c105412231f0fe595460f2c372c64ec9886a1f1add....0.tmp
/data/data/####/3d742ff2705cc3f967ec380bc9da9b2b85e4791605725a1....0.tmp
/data/data/####/43bb0c4a7221564bf1c65deb9b9e7d7b10037f6da09ec9d....0.tmp
/data/data/####/4ae8a56848d3f5dc6012e0ca0a8c43471b972faed0a83aa....0.tmp
/data/data/####/4cc75ff6e3547d5c3cc6161b75405951d1484d1465664e6....0.tmp
/data/data/####/4d0faee5b2f86557cc01e7563391282109cd0e797351fe9....0.tmp
/data/data/####/4db05865493740453cc3d4d56ed811f8c463132e5b678e8....0.tmp
/data/data/####/54d9ce4f0ee82f64b639664e899d4a37681044da673d814....0.tmp
/data/data/####/592ec4b72c3e644c2252c8e704dccd0d4386421609e04e9....0.tmp
/data/data/####/62cb0a452f97c3f781af03f68989a24db47e26c2ec9e0c6....0.tmp
/data/data/####/631496cf22aff75951c944ddd487d4971528c9ac2309a2d....0.tmp
/data/data/####/665b11a8c1ce41f687872583e102d65ce72a79ce19770c3....0.tmp
/data/data/####/6b6d47803d28b46ea9578e669720cc7655d9ca71611cc15....0.tmp
/data/data/####/72567f1079ac69fb77647c94ffa829ec4ea92438867f521....0.tmp
/data/data/####/74dd961aaf318ce792b7b0cb0638bbf4be236394306c9fe....0.tmp
/data/data/####/7af739d7aa62cc18fdffd81ffc5cf31190b4ef8d5ba91e6....0.tmp
/data/data/####/7b1486ecd55acb2da9e3649364f28d3ce06ee4522c524d6....0.tmp
/data/data/####/7c6bdd8a337ffec74581c0be745981ed5c9dddc135fd809....0.tmp
/data/data/####/7f7a818808c1d0cace90ecbe1b12a6a6051390bb257bb70....0.tmp
/data/data/####/86ab6e86747c389598bdff4770f2cb599e4998e48a87a0c....0.tmp
/data/data/####/8af8664890b16955f618006de3976fb865014a637118238....0.tmp
/data/data/####/900b36a543f7d586a7f164d9542ca05eadb7be6bc2b7244....0.tmp
/data/data/####/910613bbd96e3bd00952d0b0116cae0db5aebf1e5f62346....0.tmp
/data/data/####/9171745855896baeeaa9e58d884aa1034c8828d1df8d16e....0.tmp
/data/data/####/9508c3bf7e0c6855beb4a4a0b46fe9382f82ab57dfa75c8....0.tmp
/data/data/####/BuglySdkInfos.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MultiDex.lock
/data/data/####/VideoRes.apk
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__local_stat_full_cache.json
/data/data/####/__send_data_1573315468202
/data/data/####/a07327da2dab8678ff07f659e9ab47bf997510611dea994....0.tmp
/data/data/####/a0ff2658127cb75414d390a155da51151c45dbed8c16f38....0.tmp
/data/data/####/a312391b1dd725336a85f679682aa20cabb9e814670cb15....0.tmp
/data/data/####/a4a194d536022e56f7ee0ff1c47bc573dc21fe64e581515....0.tmp
/data/data/####/a7e8c346abf2b91d03bea9f2236373819025784d568905d....0.tmp
/data/data/####/app_crash_copy.xml
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/bc871a65f5a207c67494c3dd2ddde7212d8f8175e7b325c....0.tmp
/data/data/####/bebea3a9fa1e5bab52364571dcced2e10cdb24acd0591ad....0.tmp
/data/data/####/bf0b6b5b8b4e881e289326c9a506510f9d65ba718add0ee....0.tmp
/data/data/####/bf4f681d2827e10d8300937a110984de0f98a435579c6a0....0.tmp
/data/data/####/bugly_db_yaq-journal
/data/data/####/c1a0d3060b3fc252f93bd2de855ec0853969b4577af23ba....0.tmp
/data/data/####/c36fbb21f007f951c443f1088317f35974a89281bef98a3....0.tmp
/data/data/####/c3acfdb1e3eea7b963501cbbd48ca39ac0f8cac41d73379....0.tmp
/data/data/####/c7ab8e2f0154082af1a38ea2341f54a4d5cf6e9e1d3bc0a....0.tmp
/data/data/####/c87c060cb617141b3e9e8e529ab6b5fb702f9916bf62c7b....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/ccef6da8b68389e984045f649fce12b66d5c7c1b61f7a00....0.tmp
/data/data/####/ce78e6b13085891d74e2adc74d8193f02842a63299fd91c....0.tmp
/data/data/####/cf3f8c0776c84541963c7de8fe4190c9b4f6f0bbe47f895....0.tmp
/data/data/####/cfed4e2e38070d47aa6f1fe5e0958a85438d7ea4c6c1699....0.tmp
/data/data/####/com.mojang.minecraftpetool_preferences.xml
/data/data/####/com.mojang.minecraftpetool_preferences.xml.bak
/data/data/####/config
/data/data/####/config.xml
/data/data/####/crashrecord.xml
/data/data/####/d94cc597480a8f1f820b845fbe523b0580a5a300fd0729d....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dcecc4db4d641a6174477aba5ce069267cffa56ee6cf551....0.tmp
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/downloader.db-journal
/data/data/####/e5ccae1da5ff95693c42a7b968676aa88b281bcd2b7908f....0.tmp
/data/data/####/e89c30d0cdc7f66af894717d46859ba9bbe9f51c9f865bd....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f2bcecc22216a6dfe79070e9a3bd1c8ece859d1c228a706....0.tmp
/data/data/####/f48608f4901902f75ecc831f6acb7e12cbe7583198ef789....0.tmp
/data/data/####/f58bb0dc4c464ae52626553b21d72c864015d917c03f5f8....0.tmp
/data/data/####/f5c39196c8a83bb15b2c21fd13ecc975335b907ed668005....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/fdd879e8d3283970e1a82d9f9b386b47f1e3ee753a00f7c....0.tmp
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_stat.db
/data/data/####/gdt_stat.db-journal
/data/data/####/gdt_suid
/data/data/####/hxdata.xml
/data/data/####/idaf560660-d49d-4693-a324-6e80764613d5.tmp
/data/data/####/index
/data/data/####/journal.tmp
/data/data/####/libMMANDKSignature.2dae176c.so
/data/data/####/libcuid.so
/data/data/####/libshellx-super.2019.so
/data/data/####/libturingau.2dae176c.so
/data/data/####/libyaqbasic.2dae176c.so
/data/data/####/libyaqpro.2dae176c.so
/data/data/####/local_crash_lock
/data/data/####/mtj_autoTracker.js
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/phoneuid.xml
/data/data/####/read.db
/data/data/####/read.db-journal
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/sk.xml
/data/data/####/sp_push_time.xml
/data/data/####/tmp-com.mojang.minecraftpetool-1.apk.classes-137468305.zip
/data/data/####/tms_base.xml
/data/data/####/tosversion
/data/data/####/trace_circle.data
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak (deleted)
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/turingfd_conf_105498_28_audienceMini.xml
/data/data/####/turingfd_conf_105498_28_audienceMini.xml.bak (deleted)
/data/data/####/turingfd_protect_105498_28_audienceMini.xml
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/videokernel.apk
/data/data/####/videonewyd_db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/yaq.2dae176c.sec
/data/data/####/yaqsdkcookie
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/.turing.dat
/data/media/####/386951b6b855236ad25db9fbec853ecd.tmp
/data/media/####/cad3045803119acdd2554eb9884409e0.tmp
/data/media/####/ks.db
/data/media/####/ks.db-journal
/data/media/####/temp_pkg_info.json

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/df
/system/bin/getprop
/system/bin/sh -c getprop
cat /sys/class/net/wlan0/address
getprop
getprop ro.baseband
getprop ro.build.description
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.letv.release.version
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.smartisan.version
getprop ro.vivo.os.build.display.id
getprop ro.vivo.os.version

Загружает динамические библиотеки:

Bugly-yaq
Tcc-1.0
crash_analysis
libMMANDKSignature.2dae176c
libshellx-super.2019
libturingau.2dae176c
libyaqbasic.2dae176c
libyaqpro.2dae176c

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней