Android.SmsSpy.10564

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.SmsSpy.69.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) php.lao####.com:80
TCP(HTTP/1.1) c.lao####.com:80
TCP(HTTP/1.1) sdk####.hp####.cn:80
TCP(HTTP/1.1) imageqi####.lao####.com.####.com:80
TCP(HTTP/1.1) q.lao####.com:80
TCP(HTTP/1.1) api.lao####.com.####.com:80
TCP(HTTP/1.1) imageq####.lao####.com.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) log####.lao####.com:80
TCP(HTTP/1.1) 1####.254.116.116:80
TCP(HTTP/1.1) norma-e####.m####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) rp.hp####.com.cn:80
TCP(HTTP/1.1) idv####.qini####.com:80
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) acceler####.tencent####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) imageqi####.lao####.com.####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) sf6-ttc####.ps####.com.####.com:443
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) 1####.217.17.78:443
TCP(TLS/1.0) all.t####.httpdn####.####.net:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) playato####.google####.com:443
TCP(TLS/1.0) voledev####.google####.com:443
TCP(TLS/1.2) 1####.217.17.74:443
TCP(TLS/1.2) 1####.217.20.106:443
TCP(TLS/1.2) safebro####.google####.com:443
TCP(TLS/1.2) 1####.217.17.78:443
TCP zb-cent####.m.ta####.com:443
TCP 2####.205.253.149:8080
TCP 2####.205.254.165:8080

Запросы DNS:

a####.man.aliy####.com
amdc####.m.ta####.com
and####.b####.qq.com
api.lao####.com
api.map.b####.com
c####.x####.com
c.lao####.com
connect####.gst####.com
dig.b####.net
imageq####.lao####.com
imageqi####.lao####.com
is.sn####.com
l####.tbs.qq.com
log####.lao####.com
log.u####.com
norma-e####.m####.com
p####.google####.com
php.lao####.com
playato####.google####.com
plb####.u####.com
q.lao####.com
red.lao####.com
rp.hp####.com.cn
safebro####.google####.com
sdk####.hp####.cn
sf3-ttc####.ps####.com
sf6-ttc####.ps####.com
to####.ctobsn####.com
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com
voledev####.google####.com
www.gst####.com
y####.tim.qq.com

Запросы HTTP GET:

api.lao####.com.####.com/sns/androidversioninfo/
c.lao####.com/pvLog?action=&md5=f0d6fa42033238bd8cff5e421faf9585&product...
idv####.qini####.com/p.php
imageq####.lao####.com.####.com/Flx_wGABFf6t7MAuHK1OpXlrGdoS?imageVi####
imageq####.lao####.com.####.com/FnaUbEj6qciUq_Nk-P7f3Tdmj0VO?imageVi####
imageq####.lao####.com.####.com/Fq9szG-WK70B4HXDAGWhDNhuaEiK?imageVi####
imageq####.lao####.com.####.com/Fr_jXflZd7wGsbMCyei8Bv_M7mPL?imageVi####
imageq####.lao####.com.####.com/Fuuv9a4DZbg-1ahCleERs_KHk5sp?imageVi####
imageqi####.lao####.com.####.com/Fv87RzTT03DquJpwUqZpTkSt5GJ_?imageVi####
log####.lao####.com/index.html?action=####&md5=####&production=####&prod...
log####.lao####.com/index.html?action=addsysmsg&md5=8b0e59989481fa20d707...
log####.lao####.com/index.html?action=addxposedinfo&md5=6383b570176d4af7...
log####.lao####.com/index.html?action=applicationlist&md5=82f6427b4ab6a0...
log####.lao####.com/index.html?action=btnevent&md5=8d02f598117a0d872e908...
log####.lao####.com/index.html?action=netelapsedtime&md5=0a76fae3ea60277...
log####.lao####.com/index.html?action=netelapsedtime&md5=0cccb9742a89a8c...
log####.lao####.com/index.html?action=netelapsedtime&md5=0e78c17564eccea...
log####.lao####.com/index.html?action=netelapsedtime&md5=37f3b78f2b420a7...
log####.lao####.com/index.html?action=netelapsedtime&md5=3fec8bd0a7724bf...
log####.lao####.com/index.html?action=netelapsedtime&md5=7a4416d1c268448...
log####.lao####.com/index.html?action=netelapsedtime&md5=902f0e2f01bccf8...
log####.lao####.com/index.html?action=netelapsedtime&md5=b716add8b4b744d...
log####.lao####.com/index.html?action=netelapsedtime&md5=ba22cd9424bf69b...
log####.lao####.com/index.html?action=netelapsedtime&md5=bcf795866452aa7...
log####.lao####.com/index.html?action=netelapsedtime&md5=da950212e75d6f6...
log####.lao####.com/index.html?action=netelapsedtime&md5=e3a02b9cf2b220e...
log####.lao####.com/index.html?action=netelapsedtime&md5=f21f7fcf931ee9b...
log####.lao####.com/index.html?action=pageintime&md5=0416d872c0727d37b50...
log####.lao####.com/index.html?action=pageintime&md5=5486f2537cdd5ebe133...
log####.lao####.com/index.html?action=pv&md5=93838a0f1be50caef71514c81e7...
norma-e####.m####.com/android/exchange/getpublickey.do
q.lao####.com/getNetwork?&uid=####&vaildKey=####
rp.hp####.com.cn/logins?v=####&s=####&6####&767####&11B9s77####&f####&00...

Запросы HTTP POST:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
api.lao####.com.####.com/home/state/4/3/?md5=####&production=####&produc...
api.lao####.com.####.com/home/state/4/3/?md5=85db5f752d437b9503f36300556...
api.lao####.com.####.com/home/state/4/3/?md5=887d6bd2854bf261126aed98a1f...
api.lao####.com.####.com/home/state/4/3/?md5=b4c3bfa383171ef5905235c994d...
api.lao####.com.####.com/home/ywf/getfox/4/3/?md5=####&production=####&p...
api.lao####.com.####.com/home/ywf/hotserieslist/4/8/?md5=####&production...
api.lao####.com.####.com/home/ywf/hotserieslist/4/8/?md5=88f0a63af9970f1...
api.lao####.com.####.com/home/ywf/hotserieslist/4/8/?md5=c6b5bc37575b5f5...
api.lao####.com.####.com/home/ywf/topfeed/4/3/?md5=27bef13f6cb5c54e33585...
api.lao####.com.####.com/home/ywf/topfeed/4/3/?md5=738b44e94a2522aafeb5d...
api.lao####.com.####.com/qc/list/4/3/?md5=####&production=####&productio...
api.lao####.com.####.com/qc/resourcelist/4/3/?md5=63024f41c47e0a0e8c4372...
api.lao####.com.####.com/qc/resourcelist/4/3/?md5=f36cc01c716865f840e5d7...
api.lao####.com.####.com/recommend/getnew/4/11/?md5=013da242ef6d867d295e...
api.lao####.com.####.com/recommend/getnew/4/11/?md5=cb0b3fe6ca4f5a383625...
api.lao####.com.####.com/recommend/listsnsids/4/3/?md5=f73011351203ff69c...
api.lao####.com.####.com/search/ywf/hotsearchword/one/4/3/?md5=####&prod...
api.lao####.com.####.com/user/messagecount/4/3/?md5=8132648c6773ee399a19...
api.lao####.com.####.com/user/messagecount/4/3/?md5=c9e54b0cb3aba70c152d...
api.lao####.com.####.com/user/ywf/login/4/3/?md5=####&production=####&pr...
api.lao####.com.####.com/user/ywf/login/4/3/?md5=c37b31e88074f7e06da65cb...
api.lao####.com.####.com/user/ywf/login/4/3/?md5=ffac4f7b6c9a92124777da5...
api.lao####.com.####.com/user/ywf/updatedevicemark/4/3/?md5=####&product...
l####.tbs.qq.com/ajax?c=####&k=####
norma-e####.m####.com/push/android/external/add.do
php.lao####.com/PublicRoadTest/log-file-receiver.php
sdk####.hp####.cn/Author/PhoneAuthor/?appid=####&uid=####&version=####&p...

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/-1415860144-1332186144
/data/data/####/-H4qVReGzgEcouTKt9NQkQJ5CEQ.605846757.tmp
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/586dba9d99ca4987b47cf9b8bfa2cbfa
/data/data/####/A3AEECD8.dex
/data/data/####/A3AEECD8.dex.flock (deleted)
/data/data/####/ACCS_BINDumeng;58624494310c931c3f001e4b.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/DeviceInfo.xml
/data/data/####/IufEm-tjq_2dASwK4EUQbBOAu5c.749321614.tmp
/data/data/####/LicenceCheck.lastModified.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MpzdQfZr6B9QuvyFPzg96MnYpT4.297304008.tmp
/data/data/####/MsgLogStore.db-journal
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_cloudcontrol2.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WualJUdWw4F4drYGjJV89e0Db3Y.cnt
/data/data/####/accs.db-journal
/data/data/####/ad_auth.xml
/data/data/####/agoo.pid
/data/data/####/androidx.work.util.id.xml
/data/data/####/androidx.work.workdb-journal
/data/data/####/authStatus_com.feng.car.xml
/data/data/####/b8637321f59f4cb59a74afc7df388086
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/bytedance_downloader.db-journal
/data/data/####/c31bd24df7074fabb2a26d4562eee7a7
/data/data/####/channel_umeng_common_config.xml
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/com.feng.car_preferences.xml
/data/data/####/com.x.y.1.xml
/data/data/####/com.x.y.2.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgyNDI3NzAzMTI1;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgyNDI3NzEyMDU0;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTgyNDI3NzM4MjI4;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTgyNDI3NzQ4ODg3;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1ODI0Mjc3MTIwNDA=;
/data/data/####/download_upload
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/feng.db
/data/data/####/feng.db-journal
/data/data/####/feng_sp.xml
/data/data/####/feng_sp.xml.bak
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.9.5_1582427702659_envelope.log
/data/data/####/i==1.2.0&&3.9.5_1582427712049_envelope.log
/data/data/####/i==1.2.0&&3.9.5_1582427738428_envelope.log
/data/data/####/imsdk_20200223.log
/data/data/####/info.xml
/data/data/####/kvEPr63RIyJrA0ogLRO22KUER80.cnt
/data/data/####/libcuid_v3.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mz_push_preference.xml
/data/data/####/native_record_lock
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/share.db-journal
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_push_time.xml
/data/data/####/t==8.1.0&&3.9.5_1582427704597_envelope.log
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak (deleted)
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdid.xml
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/uVEtembZevmhJ1deRa0Md-LUp3U.cnt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/.00000000000/A3AEECD8.dex --oat-fd=85 --oat-location=/data/user/0/<Package>/.11111111111/A3AEECD8.dex --compiler-filter=speed
cat /proc/cpuinfo
cat /sys/class/net/eth0/address
chmod 777 /data/user/0/<Package>/cache/Download
getprop
getprop ro.build.version.emui
getprop ro.product.cpu.abi
ls /
ls /sys/class/thermal

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-CBC-PKCS7Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней