Android.Packed.54230

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.893.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) hlsmgsp####.miguv####.com.####.com:8080
TCP(HTTP/1.1) gslbmgs####.miguv####.com:80
TCP(HTTP/1.1) a####.juyo####.net:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) prox####.juyo####.net:80
TCP(HTTP/1.1) cctvcnc####.v.ws####.com:80
TCP(HTTP/1.1) we####.miguv####.com:80
TCP(HTTP/1.1) up####.juyo####.net:80
TCP(TLS/1.0) h####.b####.com:443
UDP tm2.binst####.live:13
UDP tm2.binst####.live:3925
UDP tm3.binst####.live:3923
UDP as1.binst####.live:13
UDP tm2.binst####.live:3924
UDP 2####.255.255.250:1900
UDP tm3.binst####.live:3925

Запросы DNS:

a####.juyo####.net
and####.b####.qq.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
cctvcnc####.v.ws####.com
gslbmgs####.miguv####.com
h####.b####.com
hlsmgsp####.miguv####.com
prox####.juyo####.net
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
up####.juyo####.net
w####.pcon####.com.cn
we####.miguv####.com

Запросы HTTP GET:

a####.juyo####.net/epg_v2/epg_20200824.zip
a####.juyo####.net/plugins/libfuck/202008101025/libfuck.so
a####.juyo####.net/plugins/libsign/202005121104/libsign.so
cctvcnc####.v.ws####.com/live/cctv1_2/1597603200.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603201.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603202.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603203.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603204.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603205.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/1597603206.ts?wsApp=####&wsMonitor...
cctvcnc####.v.ws####.com/live/cctv1_2/index.m3u8
gslbmgs####.miguv####.com/wd_r2/cctv/cctv1hd/1200/index.m3u8?msisdn=####...
hlsmgsp####.miguv####.com.####.com:8080/wd_r2/cctv/cctv1hd/1200/01.m3u8?...
hlsmgsp####.miguv####.com.####.com:8080/wd_r2/cctv/cctv1hd/1200/index.m3...
prox####.juyo####.net/dli0002/?oskey=####
up####.juyo####.net/data/channels_new_v2/carousel/66_product.zip?Expires...
up####.juyo####.net/data/channels_new_v2/cctv/273_product.zip?Expires=##...
up####.juyo####.net/data/channels_new_v2/local/159_product.zip?Expires=#...
up####.juyo####.net/data/channels_new_v2/shopping/27_product.zip?Expires...
up####.juyo####.net/hdp_config/ad.json?Expires=####&OSSAccessKeyId=####&...
up####.juyo####.net/hdp_config/apk-config.json?Expires=####&OSSAccessKey...
up####.juyo####.net/hdp_config/channel-configs.json?Expires=####&OSSAcce...
up####.juyo####.net/hdp_config/operations.json?Expires=####&OSSAccessKey...
up####.juyo####.net/hdp_config/play-order.json?Expires=####&OSSAccessKey...
up####.juyo####.net/hdp_config/plugins-113.json?Expires=####&OSSAccessKe...
up####.juyo####.net/hdp_config/prepare-block.json?Expires=####&OSSAccess...
up####.juyo####.net/hdp_config/shopping.json?Expires=####&OSSAccessKeyId...
up####.juyo####.net/plugins/hdp/202008170937/hdp_306.jar?Expires=####&OS...
up####.juyo####.net/plugins/libtvcore/202005080953/libtvcore.so?Expires=...
w####.pcon####.com.cn/ipJson.jsp?json=####
we####.miguv####.com/gateway/playurl/v3/play/playurl?contId=####&rateTyp...

Запросы HTTP HEAD:

up####.juyo####.net/data/channels_new_v2/carousel/66_product.zip?Expires...
up####.juyo####.net/data/channels_new_v2/cctv/273_product.zip?Expires=##...
up####.juyo####.net/data/channels_new_v2/local/159_product.zip?Expires=#...
up####.juyo####.net/data/channels_new_v2/shopping/27_product.zip?Expires...

Запросы HTTP POST:

rq####.sp####.mig.####.net/rqd/async?aid=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/._098add4a8c1da3c3b37b1afff5fa7c39.html
/data/data/####/._2ab2393cbd987f25f26deaffbf46b81f.html
/data/data/####/._4e00c380665f9ea39dbe949c1393dc6c.html
/data/data/####/._72e95c40f478f167d7c4250954f50a87.html
/data/data/####/._ad_duolebo.png
/data/data/####/._ad_haomaishou.png
/data/data/####/._ad_jusha.png
/data/data/####/._ad_yangguang.png
/data/data/####/._ad_yougou_other.png
/data/data/####/._ad_yougouwu.png
/data/data/####/._bootstrap.min.css
/data/data/####/._bootstrap.min.js
/data/data/####/._brower.js
/data/data/####/._css
/data/data/####/._dropzone.js
/data/data/####/._head.png
/data/data/####/._img
/data/data/####/._img_bottom.png
/data/data/####/._index1.html
/data/data/####/._index2.html
/data/data/####/._jquery.min.js
/data/data/####/._js
/data/data/####/._modal.js
/data/data/####/._plus.jpg
/data/data/####/._shop.json
/data/data/####/._upload.css
/data/data/####/._upload.png
/data/data/####/0254575541.jar
/data/data/####/098add4a8c1da3c3b37b1afff5fa7c39.html
/data/data/####/1004
/data/data/####/19bbf2b7f594c435f6aef9817ac39163.0.tmp
/data/data/####/19bbf2b7f594c435f6aef9817ac39163.1.tmp
/data/data/####/20200824.rep
/data/data/####/2ab2393cbd987f25f26deaffbf46b81f.html
/data/data/####/458b1854cd316de1cfc3d11feb2109bd.0.tmp
/data/data/####/458b1854cd316de1cfc3d11feb2109bd.1.tmp
/data/data/####/46c8a4a4841b5f10dc8940fd948999ea.0.tmp
/data/data/####/46c8a4a4841b5f10dc8940fd948999ea.1.tmp
/data/data/####/4e00c380665f9ea39dbe949c1393dc6c.html
/data/data/####/515ecbaa3b82bebd5ca6dc74bdf52e16.0.tmp
/data/data/####/515ecbaa3b82bebd5ca6dc74bdf52e16.1.tmp
/data/data/####/545cc1d57eaf988915cd29efa769f1a1.0.tmp
/data/data/####/545cc1d57eaf988915cd29efa769f1a1.1.tmp
/data/data/####/5c302cfe5c209ff76b95168d34d07769.0.tmp
/data/data/####/5c302cfe5c209ff76b95168d34d07769.1.tmp
/data/data/####/5cc2cb037baf7f4c6348aba232cc34cc.0.tmp
/data/data/####/5cc2cb037baf7f4c6348aba232cc34cc.1.tmp
/data/data/####/68a4b04f89a224afcf8462ef42d2658e.0.tmp
/data/data/####/68a4b04f89a224afcf8462ef42d2658e.1.tmp
/data/data/####/69ace8f2d4e3623cbcec6c36b81981fc.0.tmp
/data/data/####/69ace8f2d4e3623cbcec6c36b81981fc.1.tmp
/data/data/####/6bee21df37885f283cbc3cd2d2e8d908.0.tmp
/data/data/####/6bee21df37885f283cbc3cd2d2e8d908.1.tmp
/data/data/####/6f34fea9842fd8622b36549f83de765c.0.tmp
/data/data/####/6f34fea9842fd8622b36549f83de765c.1.tmp
/data/data/####/72e95c40f478f167d7c4250954f50a87.html
/data/data/####/745df405b74d5a4b5ab06c38f7c03ccb.0.tmp
/data/data/####/745df405b74d5a4b5ab06c38f7c03ccb.1.tmp
/data/data/####/7b5febdd53d3e6cfc8afb850b29bae9c.0.tmp
/data/data/####/7b5febdd53d3e6cfc8afb850b29bae9c.1.tmp
/data/data/####/87413a560dcf5fc708174d6ed0060e20.0.tmp
/data/data/####/87413a560dcf5fc708174d6ed0060e20.1.tmp
/data/data/####/9cae0c16a98d5bbd4c70fbc0e6d6f2e9.0.tmp
/data/data/####/9cae0c16a98d5bbd4c70fbc0e6d6f2e9.1.tmp
/data/data/####/HDP_e249e6.mmap3
/data/data/####/HDP_e249e6_20200824.xlog
/data/data/####/MultiDex.lock
/data/data/####/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1598296802050
/data/data/####/__send_data_1598296809637
/data/data/####/ad_duolebo.png
/data/data/####/ad_haomaishou.png
/data/data/####/ad_jusha.png
/data/data/####/ad_yangguang.png
/data/data/####/ad_yougou_other.png
/data/data/####/ad_yougouwu.png
/data/data/####/b.xml
/data/data/####/baidu_mtj_sdk_record.xml
/data/data/####/baidu_mtj_sdk_record.xml.bak
/data/data/####/bb94fa4d18acc948275ff4091967c47d.0.tmp
/data/data/####/bb94fa4d18acc948275ff4091967c47d.1.tmp
/data/data/####/bootstrap.min.css
/data/data/####/bootstrap.min.js
/data/data/####/brower.js
/data/data/####/bugly_db_-journal
/data/data/####/carousel.zip
/data/data/####/carousel.zip.download
/data/data/####/carousel.zip.tmp
/data/data/####/carousel_66_product.php
/data/data/####/cctv.zip
/data/data/####/cctv.zip.download
/data/data/####/cctv.zip.tmp
/data/data/####/cctv_273_product.php
/data/data/####/ce949e580daa2a3c282e3a0b596fd0a3.0.tmp
/data/data/####/ce949e580daa2a3c282e3a0b596fd0a3.1
/data/data/####/ce949e580daa2a3c282e3a0b596fd0a3.1.tmp
/data/data/####/cfb652d438768424823b5b6db821c67a.0.tmp
/data/data/####/cfb652d438768424823b5b6db821c67a.1.tmp
/data/data/####/channel.xml
/data/data/####/crashrecord.xml
/data/data/####/d1697768067887110dc14de24040a5d5.0.tmp
/data/data/####/d1697768067887110dc14de24040a5d5.1.tmp
/data/data/####/dropzone.js
/data/data/####/epg_20200824.zip
/data/data/####/hdp.db-journal
/data/data/####/hdp.db-wal
/data/data/####/hdp.jar
/data/data/####/hdpfans.com_preferences.xml
/data/data/####/head.png
/data/data/####/img_bottom.png
/data/data/####/index1.html
/data/data/####/index2.html
/data/data/####/journal.tmp
/data/data/####/jquery.min.js
/data/data/####/libcuid.so
/data/data/####/libfuck.so
/data/data/####/libsign.so
/data/data/####/libtvcore.so
/data/data/####/local.zip (deleted)
/data/data/####/local.zip.download
/data/data/####/local.zip.tmp
/data/data/####/local.zip.tmp (deleted)
/data/data/####/local_159_product.php
/data/data/####/local_crash_lock
/data/data/####/modal.js
/data/data/####/multidex.version.xml
/data/data/####/plugins.xml
/data/data/####/plus.jpg
/data/data/####/region.xml
/data/data/####/security_info
/data/data/####/share_date.xml
/data/data/####/shop.json
/data/data/####/shopping.zip
/data/data/####/shopping.zip.download
/data/data/####/shopping.zip.tmp
/data/data/####/shopping_27_product.php
/data/data/####/tvsou-019d9e5e.json
/data/data/####/tvsou-0a2de840.json
/data/data/####/tvsou-0ccc41bf.json
/data/data/####/tvsou-131cdbbf.json
/data/data/####/tvsou-13e8f054.json
/data/data/####/tvsou-15e474b2.json
/data/data/####/tvsou-1877ed89.json
/data/data/####/tvsou-1c4d4f90.json
/data/data/####/tvsou-1e741cb1.json
/data/data/####/tvsou-1e983148.json
/data/data/####/tvsou-25feea76.json
/data/data/####/tvsou-27e097bf.json
/data/data/####/tvsou-2983827a.json
/data/data/####/tvsou-3201ff16.json
/data/data/####/tvsou-34223eae.json
/data/data/####/tvsou-3a19b822.json
/data/data/####/tvsou-3e2d42b6.json
/data/data/####/tvsou-3e5a5dd9.json
/data/data/####/tvsou-442cb1d6.json
/data/data/####/tvsou-50ca1f4c.json
/data/data/####/tvsou-526cbae7.json
/data/data/####/tvsou-53eda06f.json
/data/data/####/tvsou-54cb9087.json
/data/data/####/tvsou-568c1d01.json
/data/data/####/tvsou-59690d2e.json
/data/data/####/tvsou-59736a35.json
/data/data/####/tvsou-5a44bb16.json
/data/data/####/tvsou-5ce23afa.json
/data/data/####/tvsou-606891670.json
/data/data/####/tvsou-61914025.json
/data/data/####/tvsou-648e72a2.json
/data/data/####/tvsou-660321844.json
/data/data/####/tvsou-696f2203.json
/data/data/####/tvsou-69e7e66e.json
/data/data/####/tvsou-6b26bee1.json
/data/data/####/tvsou-6cf61152.json
/data/data/####/tvsou-6ed65109.json
/data/data/####/tvsou-6ef94ac4.json
/data/data/####/tvsou-6fff4f43.json
/data/data/####/tvsou-7651a0a2.json
/data/data/####/tvsou-789d0d22.json
/data/data/####/tvsou-7d4daf1f.json
/data/data/####/tvsou-7eb6346e.json
/data/data/####/tvsou-8024c685.json
/data/data/####/tvsou-8125ead4.json
/data/data/####/tvsou-8e03f801.json
/data/data/####/tvsou-8f932b7b.json
/data/data/####/tvsou-92c15909.json
/data/data/####/tvsou-92f99bbf.json
/data/data/####/tvsou-955ecdd7.json
/data/data/####/tvsou-95f40184.json
/data/data/####/tvsou-9c61c74c.json
/data/data/####/tvsou-a136a49d.json
/data/data/####/tvsou-a3659498.json
/data/data/####/tvsou-a3aa4d01.json
/data/data/####/tvsou-aa83e122.json
/data/data/####/tvsou-b3666b9d.json
/data/data/####/tvsou-b3ca31d8.json
/data/data/####/tvsou-c25b6c39.json
/data/data/####/tvsou-c5717c2d.json
/data/data/####/tvsou-c62d45e9.json
/data/data/####/tvsou-c77b68e3.json
/data/data/####/tvsou-cb608c10.json
/data/data/####/tvsou-cdbe165f.json
/data/data/####/tvsou-ce743104.json
/data/data/####/tvsou-d5a27a1e.json
/data/data/####/tvsou-d6253770.json
/data/data/####/tvsou-d667526e.json
/data/data/####/tvsou-d8bee9f9.json
/data/data/####/tvsou-d9d2a299.json
/data/data/####/tvsou-da0c3f96.json
/data/data/####/tvsou-da60566f.json
/data/data/####/tvsou-da6cc342.json
/data/data/####/tvsou-ddb707c0.json
/data/data/####/tvsou-e04d023a.json
/data/data/####/tvsou-e0f83832.json
/data/data/####/tvsou-e237763b.json
/data/data/####/tvsou-e4e3801d.json
/data/data/####/tvsou-e5b252e4.json
/data/data/####/tvsou-edb5b4ac.json
/data/data/####/tvsou-f0a3d1b2.json
/data/data/####/tvsou-f2d13f2a.json
/data/data/####/tvsou-f5b1a323.json
/data/data/####/tvsou-fac1ecf6.json
/data/data/####/tvsou-gd3c23e1.json
/data/data/####/tvsou-gd4fbacb.json
/data/data/####/tvsou-gd57546f.json
/data/data/####/tvsou-gd7a4866.json
/data/data/####/tvsou-gd80e7b1.json
/data/data/####/tvsou-gd81a6ec.json
/data/data/####/tvsou-gda4647d.json
/data/data/####/tvsou-gda78b2c.json
/data/data/####/tvsou-gdbbacdc.json
/data/data/####/tvsou-gdcc1668.json
/data/data/####/tvsou-gddebc36.json
/data/data/####/tvsou-gddf7847.json
/data/data/####/tvsou-pp19b822.json
/data/data/####/tvsou-pp24c685.json
/data/data/####/tvsou-pp253770.json
/data/data/####/tvsou-pp36a49d.json
/data/data/####/tvsou-pp37763b.json
/data/data/####/tvsou-pp4d4f90.json
/data/data/####/tvsou-pp736a35.json
/data/data/####/tvsou-pp83e122.json
/data/data/####/tvsou-pp9d9e5e.json
/data/data/####/tvsou-ppaa4d01.json
/data/data/####/tvsou-ppbee9f9.json
/data/data/####/tvsou-ppc1ecf6.json
/data/data/####/tvsou-ppf61152.json
/data/data/####/update-config.xml
/data/data/####/upload.css
/data/data/####/upload.png
/data/data/####/wt.xml
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.timestamp
/data/media/####/logs.csv

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh -c getprop
/system/bin/sh -c type su
getprop
getprop ro.build.display.id
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.smartisan.version
getprop ro.vivo.os.version

Загружает динамические библиотеки:

Bugly
UrlDecode
c++_shared
ijkffmpeg
ijkplayer
ijksdl
libtvcore
marsxlog

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней