Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.348.origin
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p3.i####.com:80
- TCP(HTTP/1.1) st####.egret-####.org.####.com:80
- TCP p2.i####.com:7802
- TCP p1.i####.com:7801
- TCP p3.i####.com:7802
- TCP p3.i####.com:7803
Запросы DNS:
- a####.91.com
- f.you####.com
- p1.i####.com
- p2.i####.com
- p3.i####.com
- s1.u####.com
- st####.egret-####.org
Запросы HTTP GET:
- p3.i####.com/cdn?id=####
- st####.egret-####.org.####.com/h5game/41/ShareUtils.js
- st####.egret-####.org.####.com/h5game/41/app.css
- st####.egret-####.org.####.com/h5game/41/assets/art/all.png
- st####.egret-####.org.####.com/h5game/41/assets/art/background_1.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/background_2.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/background_3.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/background_4.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/button_highscore.png
- st####.egret-####.org.####.com/h5game/41/assets/art/button_submit.png
- st####.egret-####.org.####.com/h5game/41/assets/art/diver.png
- st####.egret-####.org.####.com/h5game/41/assets/art/explosion.png
- st####.egret-####.org.####.com/h5game/41/assets/art/fill.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/gui_font.png
- st####.egret-####.org.####.com/h5game/41/assets/art/hypnocat.png
- st####.egret-####.org.####.com/h5game/41/assets/art/map_1.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/map_2.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/map_3.jpg
- st####.egret-####.org.####.com/h5game/41/assets/art/map_panel_2.png
- st####.egret-####.org.####.com/h5game/41/assets/art/rotate.png
- st####.egret-####.org.####.com/h5game/41/assets/art/score_font.png
- st####.egret-####.org.####.com/h5game/41/assets/art/screw.png
- st####.egret-####.org.####.com/h5game/41/assets/art/splash.png
- st####.egret-####.org.####.com/h5game/41/assets/art/title.png
- st####.egret-####.org.####.com/h5game/41/assets/art/transform.png
- st####.egret-####.org.####.com/h5game/41/assets/art/water_splash.png
- st####.egret-####.org.####.com/h5game/41/assets/art/window.png
- st####.egret-####.org.####.com/h5game/41/assets/art/zibbo_button.png
- st####.egret-####.org.####.com/h5game/41/assets/sound/bomb.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/click.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/fail.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/freedom_1.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/freedom_2.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/jump.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/line.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/match_1.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/match_2.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/match_3.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/music.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/plus.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/popup_window.ogg
- st####.egret-####.org.####.com/h5game/41/assets/sound/win.ogg
- st####.egret-####.org.####.com/h5game/41/configs.xml/100/500/57674222728...
- st####.egret-####.org.####.com/h5game/41/createjs/easeljs-0.7.1.min.js
- st####.egret-####.org.####.com/h5game/41/createjs/preloadjs-NEXT.min.js
- st####.egret-####.org.####.com/h5game/41/createjs/soundjs-NEXT.min.js
- st####.egret-####.org.####.com/h5game/41/createjs/tweenjs-0.5.1.min.js
- st####.egret-####.org.####.com/h5game/41/game.js
- st####.egret-####.org.####.com/h5game/41/index.html
- st####.egret-####.org.####.com/h5game/41/share.png
- st####.egret-####.org.####.com/h5game/41/v1/game.min.js
- st####.egret-####.org.####.com/h5game/41/viewporter.js
- st####.egret-####.org.####.com/h5game/shareUtils/EgretBrowserShare.js
- st####.egret-####.org.####.com/h5game/shareUtils/EgretShare_Statistics.js
- st####.egret-####.org.####.com/h5game/shareUtils/EgretStatistics.js
- st####.egret-####.org.####.com/h5game/shareUtils/WeixinAPI.js
Изменения в файловой системе:
Создает следующие файлы:
- /data/com.wjBDsoft.ShuiXiaTS/####/yop_download.db
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/1604033598873u.dex (deleted)
- /data/data/####/1604033600217u.dex (deleted)
- /data/data/####/1604033600565q.dex (deleted)
- /data/data/####/apppr.xml
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/com.wjBDsoft.ShuiXiaTS
- /data/data/####/com.wjBDsoft.ShuiXiaTS.art
- /data/data/####/com.wjBDsoft.ShuiXiaTS.art.20
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/index
- /data/data/####/libsecexe.x86.so
- /data/data/####/libsecmain.x86.so
- /data/data/####/libsecpreload.x86.so
- /data/data/####/po_download.db
- /data/data/####/po_download.db-journal
- /data/data/####/webview.db
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yo_fac_pre.xml
- /data/data/####/yo_fconf_pre.xml
- /data/data/####/yo_finfo_pre.xml
- /data/data/####/yoappInfo_pre.xml
- /data/data/####/yoconf_pre.xml
- /data/data/####/yop_download.db-journal
- /data/data/####/yotrategy_pre.xml
- /data/media/####/.cuid
- /data/media/####/1604033598873u.jar
- /data/media/####/1604033600217u.jar
- /data/media/####/1604033600565q.jar
- /data/media/####/BaiduAppX_Log.txt
Другие:
Запускает следующие shell-скрипты:
- <Package> <Package> -1829594344 0 /data/app/<Package>-1.apk 41 <Package> 46 47 1 0
- <Package> <Package> -1829594344 0 /data/app/<Package>-1.apk 41 <Package> 52 53 1 0
- chmod 755 <Package Folder>/.cache/<Package>
- chmod 755 <Package Folder>/.cache/<Package>.art
- chmod 755 <Package Folder>/.cache/<Package>.art.20
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- libsecexe.x86
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
