Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.906.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.d####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) de.gtp.xy####.com:8844
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) dsp.huoli####.cn:80
- TCP(HTTP/1.1) f####.caiji####.com:80
- TCP(HTTP/1.1) 1####.75.141.67:666
- TCP(HTTP/1.1) d####.cn:80
- TCP(HTTP/1.1) c####.zhito####.com:8881
- TCP(HTTP/1.1) log.harm####.com:80
- TCP(HTTP/1.1) i####.d####.cn:80
- TCP(HTTP/1.1) 58.2####.203.36:654
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) www.pc####.com.####.cn:80
- TCP(HTTP/1.1) ip.j####.com:99
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) 2####.187.227.204:99
- TCP(HTTP/1.1) daliu####.c####.qini####.com:80
- TCP(HTTP/1.1) k####.kyli####.com.####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) p####.caiji####.com:80
- TCP(HTTP/1.1) ip.zhito####.com:807
- TCP(HTTP/1.1) c####.zhito####.com:807
- TCP(HTTP/1.1) 58.2####.201.145:654
- TCP(HTTP/1.1) d####.wos####.com:666
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) s####.al####.com:80
- TCP(HTTP/1.1) d####.wos####.com:80
- TCP(HTTP/1.1) 58.2####.198.157:999
- TCP(HTTP/1.1) k####.caiji####.com.####.com:80
- TCP(HTTP/1.1) a####.caiji####.com:80
- TCP(SSL/3.0) m####.m.sm.cn:443
- TCP(TLS/1.0) wtc.d####.com:443
- TCP(TLS/1.0) m####.m.sm.cn:443
- TCP(TLS/1.0) p####.m.jd.com:443
- TCP(TLS/1.0) mipst####.s####.cn:443
- TCP(TLS/1.0) mg####.pcon####.com.cn:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) et2.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) pc####.i####.com:443
- TCP(TLS/1.0) www.pcon####.com.cn:443
- TCP(TLS/1.0) js.3con####.com.####.cn:443
- TCP(TLS/1.0) img.pcon####.com.####.cn:443
- TCP(TLS/1.0) wl.jd.com.####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) s2.z####.cn:443
- TCP(TLS/1.0) log.mm####.com:443
- TCP(TLS/1.0) www.pc####.com.####.cn:443
- TCP(TLS/1.0) ims-####.sm.cn:443
- TCP(TLS/1.0) en####.tuia####.com:443
- TCP(TLS/1.0) ec####.b####.com:443
- TCP(TLS/1.0) c####.pc####.com.cn:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) st3.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) p####.pc####.com.cn:443
- TCP(TLS/1.0) a####.d####.com:443
- TCP(TLS/1.0) i####.j####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) ivy.pcon####.com.cn:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) u.j####.com:443
- TCP(TLS/1.0) i####.u####.cn:443
- TCP(TLS/1.0) s####.al####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) cdn.boo####.com.####.com:443
- TCP(TLS/1.0) i####.d####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) sw3.d####.com:443
- TCP(TLS/1.0) img.pc####.com.cn:443
Запросы DNS:
- a####.caiji####.com
- a####.caiji####.com
- a####.d####.com
- a####.m.sm.cn
- at.umt####.com
- c####.mm####.com
- c####.pc####.com.cn
- c####.zhito####.com
- c.c####.com
- cdn.boo####.com
- d####.cn
- d####.wos####.com
- de.gtp.xy####.com
- dsp.huoli####.cn
- dup.baidust####.com
- ec####.b####.com
- en####.tuia####.com
- f####.caiji####.com
- fou####.ta####.com
- g.al####.com
- gm.mm####.com
- h####.c####.com
- hm.b####.com
- i####.d####.cn
- i####.d####.com
- i####.u####.cn
- i####.uc.cn
- img.d####.com
- img.pc####.com.cn
- img.pcon####.com.cn
- ims-####.sm.cn
- ip.j####.com
- ip.zhito####.com
- ivy.pcon####.com.cn
- js.3con####.com
- k####.caiji####.com
- k####.kyli####.com
- l####.m.sm.cn
- log.harm####.com
- log.mm####.com
- m.360bu####.com
- mg####.pcon####.com.cn
- mipst####.s####.cn
- p####.caiji####.com
- p####.m.jd.com
- p####.pc####.com.cn
- p.gtp.xy####.com
- pc####.i####.com
- pco####.c####.com
- pos.b####.com
- pv.s####.com
- s####.al####.com
- s####.m.sm.cn
- s13.c####.com
- s2.z####.cn
- s4.c####.com
- s5.c####.com
- s95.c####.com
- sto####.360bu####.com
- sw3.d####.com
- u.j####.com
- v1.c####.com
- w####.jd.com
- w####.pc####.com.cn
- wtc.d####.com
- www.google-####.com
- www.pc####.com.cn
- www.pcon####.com.cn
- y####.m.sm.cn
- z11.c####.com
- z3.c####.com
- z6.c####.com
- z7.c####.com
- z9.c####.com
- zm.s####.cn
Запросы HTTP GET:
- 2####.187.227.204:99/wap/index.php?q####
- a####.caiji####.com/a/asdf?cnl=####&vv=####&vv2=####&aid=####&sid=####&d...
- a####.caiji####.com/u1/uuuu?cnl=####&vv=####&imei=####&imsi=####&mac=###...
- a####.d####.com/rewrite?fromid=####
- c####.zhito####.com:807/ip/ip.html
- c####.zhito####.com:8881/wap.html
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####
- d####.cn/aawc.html
- d####.cn/aawm.html
- d####.cn/baiduwm.html
- d####.cn/bbwc.html
- d####.cn/bbwm.html
- d####.cn/fenpei.html?c####
- d####.cn/xincan.html?3####
- d####.cn/xincan.html?4####
- d####.cn/yhyd.html
- d####.wos####.com/upload/csaa.jsp?a=####&b=####&c=####&d=####&e=####&f=#...
- dsp.huoli####.cn/fenpei.html?3####
- dsp.huoli####.cn/web/app.html
- dsp.huoli####.cn/web/wap.html
- dsp.huoli####.cn/xincan.html?3####
- dsp.huoli####.cn/xincan.html?4####
- dup.baidust####.com/js/os.js
- f####.caiji####.com/v1/cc/mobile?brand=####&model=####&andid=####&andv=#...
- gd.a.s####.com/cityjson?ie=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- i####.d####.cn/goldcool.php?id=####
- ip.j####.com:99/IP/Index/geturls
- ip.j####.com:99/Public/Access/js/modules/common.js
- ip.j####.com:99/Public/Access/js/modules/creifr.js
- ip.j####.com:99/cn/ios/cnzz.php
- ip.j####.com:99/ip/index.html
- ip.zhito####.com:807/1102/0.html
- ip.zhito####.com:807/1102/0.js
- ip.zhito####.com:807/1102/index.html
- ip.zhito####.com:807/1102/yrc_001mobile.js
- ip.zhito####.com:807/528/qing.html
- k####.caiji####.com.####.com/searchss2.min.js
- k####.kyli####.com.####.com/1575610779863_utils.ttf
- pco####.ta####.com/app.gif?&cna=####
- pos.b####.com/bcrm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/bcrm?psi=7a72c138574c3521ec8a9c5cf1dd4191&di=6669420&dri=0...
- pos.b####.com/bfp/snippetcacher.php?dpv=####&di=####
- pos.b####.com/dcgm?conwid=234&conhei=60&rtbid=3033352&rdid=13147349&dc=2...
- pos.b####.com/dcgm?psi=b553c6f4c336db9ebfe7540f9c80ae35&di=5897808&dri=0...
- pos.b####.com/ecmm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/ecmm?psi=7fbbd55b2aa4545fd2b4c7eb8f19fd46&di=6669420&dri=0...
- pos.b####.com/eczm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/eczm?psi=6f75647aaa498234c82d7d8f4bd572ae&di=6669420&dri=0...
- pos.b####.com/fcpm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/fcpm?psi=cb3266e0d12d0b42bc7e7b2efb236f55&di=6669420&dri=0...
- pos.b####.com/fcrm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/fcrm?psi=583eed2e43ae63d63c5b94399c0bbb39&di=6669420&dri=0...
- pos.b####.com/fctm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
- pos.b####.com/gcbm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/gcbm?psi=1022677a04aba7c07ac395787c884d12&di=6669420&dri=0...
- pos.b####.com/gcym?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/gcym?psi=7473576b590839aefab7a946b9d889ec&di=6669420&dri=0...
- pos.b####.com/icim?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/icim?psi=c90bb1d70013e19f62589440a53815a4&di=6669420&dri=0...
- pos.b####.com/kcim?psi=a69f48d61b134b631f3d62e39ef93631&di=6611856&dri=0...
- pos.b####.com/kclm?conwid=####&conhei=####&rtbid=####&rdid=####&dc=####&...
- pos.b####.com/kclm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
- pos.b####.com/lcim?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/lcim?psi=90ac962616e2caa48e22febb09b23fc6&di=6669420&dri=0...
- pos.b####.com/pcbm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/pcbm?psi=b12d4a7f2b3b208e6abc9ea555a18467&di=6669420&dri=0...
- pos.b####.com/pcem?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/pcem?psi=025ecb9ce90734b85a0203d3ef53efa4&di=6669420&dri=0...
- pos.b####.com/sccm?psi=f92886d3f0c8d6d0a6efe106c2889854&di=6688728&dri=0...
- pos.b####.com/scjm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/scjm?psi=70685c6146d133ad73c75e2ad03b0e5d&di=6669420&dri=0...
- pos.b####.com/scvm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/scvm?psi=456afa2c7ad07cfbf0695574f700ea7f&di=6669420&dri=0...
- pos.b####.com/tckm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/tckm?psi=0207a3a162967460f5a4ac271a931d4e&di=6669420&dri=0...
- pos.b####.com/tczm?psi=41bdc3ac3b9175692eef7b23e2e73744&di=6611856&dri=0...
- pos.b####.com/ucsm?conwid=234&conhei=60&rtbid=3033352&rdid=13147349&dc=2...
- pos.b####.com/ucsm?psi=a922739387232a49f40130483bde42d1&di=5897808&dri=0...
- pos.b####.com/ucxm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/ucxm?psi=92d30d69c92b3366c779563cdb68561b&di=6669420&dri=0...
- pos.b####.com/wcjm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/wcjm?psi=c58ee82c1bd06f426af29e2deb966b44&di=6669420&dri=0...
- pos.b####.com/zccm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/zccm?psi=b574197954e08ea3aca179c6fcb0d1e1&di=6669420&dri=0...
- pos.b####.com/zcgm?psi=e4730a5e134acdd9f5c0bd97aed40ad2&di=6688728&dri=0...
- s####.al####.com/L1/272/6837/static/wap/img/uc-32.png
- s####.al####.com/L1/272/6837/static/wap/img/uc.png
- www.pc####.com.####.cn/autox/x2.html
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- 1####.75.141.67:666/v1/config
- a####.caiji####.com/v2/load/mobile
- d####.wos####.com/upload/event2.jsp
- d####.wos####.com/upload/event9.jsp
- d####.wos####.com/upload/longheartbeat.jsp
- d####.wos####.com/upload/sdklongheartbeat.jsp
- daliu####.c####.qini####.com/package/2019/11/20/11/22/16/Vo6oFzMJEjJZcXqd
- daliu####.c####.qini####.com/package/2019/11/21/16/57/28/XIwJ7q3ruGh0szms
- de.gtp.xy####.com:8844/p
- f####.caiji####.com/v3/task/mobile
- log.harm####.com/sdk
- p####.caiji####.com/klv2/sdkkl/mobile
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1279d9032a31205f2b725ce2caee0bdd
- /data/data/####/688437050_app_spf_scli.xml
- /data/data/####/688437050_rss_pl_cty.xml
- /data/data/####/688437050_rws_sp.xml
- /data/data/####/688437050_sp_iconfig.xml
- /data/data/####/897a97abdd27b52ab8bdd495aa6a61c1.dex
- /data/data/####/A3AEECD8.dex
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/CachedGeoposition.db
- /data/data/####/CachedGeoposition.db-journal
- /data/data/####/c8600dd33bf6561ea53ac7ada9b8d162.dex
- /data/data/####/cache_688437050_onsp.xml
- /data/data/####/cache_688437050_pl_sp.xml
- /data/data/####/cache_update.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cm_cfgt_spf.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/datacache
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/http_ip.zhitoudsp.com_807.localstorage-journal
- /data/data/####/https_pos.baidu.com_0.localstorage-journal
- /data/data/####/https_pro.m.jd.com_0.localstorage-journal
- /data/data/####/https_sw3.duoyi.com_0.localstorage-journal
- /data/data/####/https_yz.m.sm.cn_0.localstorage-journal
- /data/data/####/imagedb
- /data/data/####/imagedb-journal
- /data/data/####/img-cache.zip
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/libA3AEECD8_arm64-v8a.so
- /data/data/####/libA3AEECD8_armeabi.so
- /data/data/####/load_MTAwMF8xMjAxXzEyODAwNDAw;.xml
- /data/data/####/mobclick_agent_cached_protect.eye.filterv27
- /data/data/####/prefs_crash.xml
- /data/data/####/prefs_framework.xml
- /data/data/####/rdata_@apkloader-unique.pkgname@.new
- /data/data/####/spfn_MTAwMF8xMjAxXzEyODAwNDAw;.xml
- /data/data/####/tray.db-journal
- /data/data/####/umengOnEvent.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.cjlocfile.txt
Другие:
Запускает следующие shell-скрипты:
- ls -l /system/bin/su
Загружает динамические библиотеки:
- libA3AEECD8_arm64-v8a
- libA3AEECD8_armeabi
Использует следующие алгоритмы для шифрования данных:
- DES-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
- DES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
