Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.HiddenAds.418.origin
Скрывает свою иконку с экрана.
Детект на основе машинного обучения.
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) a####.sm####.com:9099
- TCP(HTTP/1.1) sm.hai####.com:1610
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) 1####.217.17.106:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.2) 1####.217.17.106:443
- TCP(TLS/1.2) 1####.217.19.195:443
- TCP(TLS/1.2) 2####.58.211.110:443
Запросы DNS:
- a####.sm####.com
- and####.google####.com
- android####.go####.com
- instant####.google####.com
- m####.go####.com
- md####.google####.com
- p####.google####.com
- safebro####.google####.com
- sm.hai####.com
Запросы HTTP GET:
- sm.hai####.com:1610/adpush/servlet/si/request/requestAdv?channelid=####&...
Запросы HTTP POST:
- a####.sm####.com:9099/apply
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1598031725332.jar
- /data/data/####/1598031728760.dex
- /data/data/####/1598031728760.dex.flock (deleted)
- /data/data/####/1598031728760.jar
- /data/data/####/5000515-90900_sp_bridge.xml
- /data/data/####/5000515-90900_sp_bridge.xml.bak
- /data/data/####/AndroidManifest.xml
- /data/data/####/DIMAS.RSA
- /data/data/####/DIMAS.SF
- /data/data/####/abc_ab_share_pack_mtrl_alpha.9.png
- /data/data/####/abc_action_bar_item_background_material.xml
- /data/data/####/abc_action_bar_title_item.xml
- /data/data/####/abc_action_bar_up_container.xml
- /data/data/####/abc_action_bar_view_list_nav_layout.xml
- /data/data/####/abc_action_menu_item_layout.xml
- /data/data/####/abc_action_menu_layout.xml
- /data/data/####/abc_action_mode_bar.xml
- /data/data/####/abc_action_mode_close_item_material.xml
- /data/data/####/abc_activity_chooser_view.xml
- /data/data/####/abc_activity_chooser_view_list_item.xml
- /data/data/####/abc_alert_dialog_button_bar_material.xml
- /data/data/####/abc_alert_dialog_material.xml
- /data/data/####/abc_background_cache_hint_selector_material_dark.xml
- /data/data/####/abc_background_cache_hint_selector_material_light.xml
- /data/data/####/abc_btn_borderless_material.xml
- /data/data/####/abc_btn_check_material.xml
- /data/data/####/abc_btn_check_to_on_mtrl_000.png
- /data/data/####/abc_btn_check_to_on_mtrl_015.png
- /data/data/####/abc_btn_colored_material.xml
- /data/data/####/abc_btn_default_mtrl_shape.xml
- /data/data/####/abc_btn_radio_material.xml
- /data/data/####/abc_btn_radio_to_on_mtrl_000.png
- /data/data/####/abc_btn_radio_to_on_mtrl_015.png
- /data/data/####/abc_btn_rating_star_off_mtrl_alpha.png
- /data/data/####/abc_btn_rating_star_on_mtrl_alpha.png
- /data/data/####/abc_btn_switch_to_on_mtrl_00001.9.png
- /data/data/####/abc_btn_switch_to_on_mtrl_00012.9.png
- /data/data/####/abc_cab_background_internal_bg.xml
- /data/data/####/abc_cab_background_top_material.xml
- /data/data/####/abc_cab_background_top_mtrl_alpha.9.png
- /data/data/####/abc_color_highlight_material.xml
- /data/data/####/abc_control_background_material.xml
- /data/data/####/abc_dialog_material_background_dark.xml
- /data/data/####/abc_dialog_material_background_light.xml
- /data/data/####/abc_dialog_title_material.xml
- /data/data/####/abc_edit_text_material.xml
- /data/data/####/abc_expanded_menu_layout.xml
- /data/data/####/abc_fade_in.xml
- /data/data/####/abc_fade_out.xml
- /data/data/####/abc_grow_fade_in_from_bottom.xml
- /data/data/####/abc_ic_ab_back_mtrl_am_alpha.png
- /data/data/####/abc_ic_clear_mtrl_alpha.png
- /data/data/####/abc_ic_commit_search_api_mtrl_alpha.png
- /data/data/####/abc_ic_go_search_api_mtrl_alpha.png
- /data/data/####/abc_ic_menu_copy_mtrl_am_alpha.png
- /data/data/####/abc_ic_menu_cut_mtrl_alpha.png
- /data/data/####/abc_ic_menu_moreoverflow_mtrl_alpha.png
- /data/data/####/abc_ic_menu_paste_mtrl_am_alpha.png
- /data/data/####/abc_ic_menu_selectall_mtrl_alpha.png
- /data/data/####/abc_ic_menu_share_mtrl_alpha.png
- /data/data/####/abc_ic_search_api_mtrl_alpha.png
- /data/data/####/abc_ic_voice_search_api_mtrl_alpha.png
- /data/data/####/abc_item_background_holo_dark.xml
- /data/data/####/abc_item_background_holo_light.xml
- /data/data/####/abc_list_divider_mtrl_alpha.9.png
- /data/data/####/abc_list_focused_holo.9.png
- /data/data/####/abc_list_longpressed_holo.9.png
- /data/data/####/abc_list_menu_item_checkbox.xml
- /data/data/####/abc_list_menu_item_icon.xml
- /data/data/####/abc_list_menu_item_layout.xml
- /data/data/####/abc_list_menu_item_radio.xml
- /data/data/####/abc_list_pressed_holo_dark.9.png
- /data/data/####/abc_list_pressed_holo_light.9.png
- /data/data/####/abc_list_selector_background_transition_holo_dark.xml
- /data/data/####/abc_list_selector_background_transition_holo_light.xml
- /data/data/####/abc_list_selector_disabled_holo_dark.9.png
- /data/data/####/abc_list_selector_disabled_holo_light.9.png
- /data/data/####/abc_list_selector_holo_dark.xml
- /data/data/####/abc_list_selector_holo_light.xml
- /data/data/####/abc_menu_hardkey_panel_mtrl_mult.9.png
- /data/data/####/abc_popup_background_mtrl_mult.9.png
- /data/data/####/abc_popup_enter.xml
- /data/data/####/abc_popup_exit.xml
- /data/data/####/abc_popup_menu_item_layout.xml
- /data/data/####/abc_primary_text_disable_only_material_dark.xml
- /data/data/####/abc_primary_text_disable_only_material_light.xml
- /data/data/####/abc_primary_text_material_dark.xml
- /data/data/####/abc_primary_text_material_light.xml
- /data/data/####/abc_ratingbar_full_material.xml
- /data/data/####/abc_screen_content_include.xml
- /data/data/####/abc_screen_simple.xml
- /data/data/####/abc_screen_simple_overlay_action_mode.xml
- /data/data/####/abc_screen_toolbar.xml
- /data/data/####/abc_scrubber_control_off_mtrl_alpha.png
- /data/data/####/abc_scrubber_control_to_pressed_mtrl_000.png
- /data/data/####/abc_scrubber_control_to_pressed_mtrl_005.png
- /data/data/####/abc_scrubber_primary_mtrl_alpha.9.png
- /data/data/####/abc_scrubber_track_mtrl_alpha.9.png
- /data/data/####/abc_search_dropdown_item_icons_2line.xml
- /data/data/####/abc_search_url_text.xml
- /data/data/####/abc_search_view.xml
- /data/data/####/abc_secondary_text_material_dark.xml
- /data/data/####/abc_secondary_text_material_light.xml
- /data/data/####/abc_seekbar_thumb_material.xml
- /data/data/####/abc_seekbar_track_material.xml
- /data/data/####/abc_select_dialog_material.xml
- /data/data/####/abc_shrink_fade_out_from_bottom.xml
- /data/data/####/abc_slide_in_bottom.xml
- /data/data/####/abc_slide_in_top.xml
- /data/data/####/abc_slide_out_bottom.xml
- /data/data/####/abc_slide_out_top.xml
- /data/data/####/abc_spinner_mtrl_am_alpha.9.png
- /data/data/####/abc_spinner_textfield_background_material.xml
- /data/data/####/abc_switch_thumb_material.xml
- /data/data/####/abc_switch_track_mtrl_alpha.9.png
- /data/data/####/abc_tab_indicator_material.xml
- /data/data/####/abc_tab_indicator_mtrl_alpha.9.png
- /data/data/####/abc_text_cursor_material.xml
- /data/data/####/abc_textfield_activated_mtrl_alpha.9.png
- /data/data/####/abc_textfield_default_mtrl_alpha.9.png
- /data/data/####/abc_textfield_search_activated_mtrl_alpha.9.png
- /data/data/####/abc_textfield_search_default_mtrl_alpha.9.png
- /data/data/####/abc_textfield_search_material.xml
- /data/data/####/activity_main.xml
- /data/data/####/base.so
- /data/data/####/classes.dex
- /data/data/####/com.ucc.sbs.paper.news-.xml
- /data/data/####/com.ucc.sbs.paper.news_channel.xml
- /data/data/####/comnewspapernjsabr.dex
- /data/data/####/comnewspapernjsabr.dex.flock (deleted)
- /data/data/####/comnewspapernjsabr.jar
- /data/data/####/defualt_big_pic.png
- /data/data/####/gyto_abbc.db-journal
- /data/data/####/icon.png
- /data/data/####/network_config.xml
- /data/data/####/notification_media_action.xml
- /data/data/####/notification_media_cancel_action.xml
- /data/data/####/notification_template_big_media.xml
- /data/data/####/notification_template_big_media_narrow.xml
- /data/data/####/notification_template_lines.xml
- /data/data/####/notification_template_media.xml
- /data/data/####/notification_template_part_chronometer.xml
- /data/data/####/notification_template_part_time.xml
- /data/data/####/resources.arsc
- /data/data/####/secret-classes.dex
- /data/data/####/secret-classes.dex.flock (deleted)
- /data/data/####/select_dialog_item_material.xml
- /data/data/####/select_dialog_multichoice_material.xml
- /data/data/####/select_dialog_singlechoice_material.xml
- /data/data/####/smail_icon.png
- /data/data/####/support_simple_spinner_dropdown_item.xml
- /data/data/####/switch_thumb_material_dark.xml
- /data/data/####/switch_thumb_material_light.xml
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_<Package>/app/secret-classes.dex --oat-fd=33 --oat-location=/data/user/0/<Package>/app_<Package>/secret-classes.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/5000515-90900/V4/1598031725332.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/5000515-90900/V4/1598031725332/1598031725332.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/5000515-90900/V4/1598031728760.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/5000515-90900/V4/1598031728760/1598031728760.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/5000515-90900/comnewspapernjsabr.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/5000515-90900/1598031724171/comnewspapernjsabr.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --debuggable --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/5000515-90900/comnewspapernjsabr.jar --oat-fd=34 --oat-location=/data/user/0/<Package>/files/5000515-90900/1598031728195/comnewspapernjsabr.dex --compiler-filter=speed
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
