Android.Packed.55572

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Gexin.2.origin
Android.DownLoader.851.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) v2.res.log.####.com:80
TCP(HTTP/1.1) b####.g####.com:80
TCP(HTTP/1.1) pi####.qq.com:80
TCP(HTTP/1.1) g####.hun####.com:80
TCP(HTTP/1.1) ap####.v1.m####.com:80
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) ap####.log.m####.com:80
TCP(HTTP/1.1) 1####.190.124.3:80
TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) m####.api.m####.com:80
TCP(HTTP/1.1) mobi####.bz.m####.com:80
TCP(HTTP/1.1) mo####.bz.m####.com:80
TCP(HTTP/1.1) d####.log.hun####.com:80
TCP(HTTP/1.1) ap####.g####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(HTTP/1.1) b.qchann####.cn:80
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) b####.com:80
TCP(HTTP/1.1) api.d####.m####.com:80
TCP(HTTP/1.1) vip.log.m####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) ap####.v0.m####.com:80
TCP(HTTP/1.1) d####.t####.m####.com:80
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) 2####.h####.com.####.com:443
TCP(TLS/1.0) 1####.h####.com.####.com:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) wap.cmpass####.com:8443
TCP(TLS/1.0) cgi.con####.qq.com:443
TCP(TLS/1.0) a.qchann####.cn:443
TCP(TLS/1.0) ugc.h####.com.####.cn:443
TCP(TLS/1.0) log.qchann####.cn:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) noa####.api.m####.com:443
TCP(TLS/1.0) t####.qchann####.cn:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) def####.duals####.cn.####.com:443
TCP(TLS/1.2) 1####.177.119.94:443
TCP mo####.bz.m####.com:443
TCP mo####.api.m####.com:443
TCP nuc.api.m####.com:443
TCP na61-####.wagbr####.ali####.####.com:443
TCP pl-fo####.bz.m####.com:443
TCP unicomc####.api.m####.com:443
TCP 4####.h####.com:443
TCP vi####.m####.com:443
UDP www.google####.com:443
TCP me.bz.m####.com:443
TCP vip.log.m####.com:443
TCP m####.api.max.####.com:443

Запросы DNS:

0####.h####.com
1####.h####.com
2####.h####.com
3####.h####.com
4####.h####.com
a.qchann####.cn
ap####.g####.com
ap####.log.m####.com
ap####.v0.m####.com
ap####.v1.m####.com
api####.a####.com
api.d####.m####.com
api.w####.com
b####.com
b####.g####.com
b.qchann####.cn
c####.log.m####.com
cgi.con####.qq.com
d####.log.hun####.com
d####.t####.m####.com
g####.face####.com
g####.hun####.com
ip.ta####.com
l####.bz.m####.com
log.qchann####.cn
m####.3g.qq.com
m####.api.m####.com
m####.api.max.####.com
m.i####.com
m.i####.com.####.8
me.bz.m####.com
mo####.api.m####.com
mo####.api.m####.com
mo####.bz.m####.com
mob.bz.m####.com
mobi####.bz.m####.com
noa####.api.m####.com
nuc.api.m####.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
pi####.qq.com
pl-fo####.bz.m####.com
plb####.u####.com
sdk.o####.p####.####.com
t####.qchann####.cn
u####.u####.com
ugc.h####.com
unicomc####.api.m####.com
v2.res.log.####.com
vi####.m####.com
vip.bz.m####.com
vip.log.m####.com
wap.cmpass####.com
www.google####.com

Запросы HTTP GET:

1####.h####.com.####.com:443/preview/cms_icon/2021/10/13/10/202110131032...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/15/10/202110151016...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/16/10/202110161116...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/16/10/202110161119...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/16/10/202110161159...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/16/10/202110161913...
1####.h####.com.####.com:443/preview/cms_icon/2021/10/7/shoujiduanzhidin...
1####.h####.com.####.com:443/preview/cms_icon/2021/9/30/09/2021093011343...
2####.h####.com.####.com:443/preview/cms_icon/2021/9/30/zidongbo/2021093...
ap####.v0.m####.com/app.php?_support=####&mod=####&act=####&ch=####&guid...
ap####.v0.m####.com/cd.php?_support=####&act=####&mod=####&ch=####&imei=...
ap####.v0.m####.com/click.php?_support=####&act=####&mod=####&pos=####&c...
ap####.v0.m####.com/follow.php?_support=####&act=####&mod=####&pos=####&...
ap####.v0.m####.com/follow.php?_support=####&mod=####&ch=####&guid=####&...
ap####.v0.m####.com/show.php?_support=####&mod=####&ch=####&guid=####&pa...
api.d####.m####.com/api/eagleEye?_support=####&did=####&version=####&ter...
api.d####.m####.com/api/versionSwitch?_support=####&appId=####&appkey=##...
api.face####.com:443/v3.2/2231360520424256?fields=####&format=####&adver...
api.face####.com:443/v3.2/MG_2231360520424256/button_auto_detection_devi...
api.face####.com:443/v3.2/MG_2231360520424256/mobile_sdk_gk?fields=####&...
api.face####.com:443/v3.2/MG_2231360520424256?fields=####&format=####&ad...
api.w####.com:443/oauth2/getaid.json?appkey=####&mfp=####&key_hash=####&...
cgi.con####.qq.com:443/qqconnectopen/openapi/policy_conf?status_os=####&...
d####.log.hun####.com/orderinfo.php?_support=####&f=####&e=####&z=####&p...
d####.t####.m####.com/flow/getExtensionPosition?_support=####&devid=####...
d####.t####.m####.com/udf/sdkOrderQueryV2?_support=####&carreir=####&app...
g####.hun####.com/mobile/distribute.do?_support=####&deviceid=####
log.qchann####.cn:443/n/dpz/?app=####&uid=####&sv=####&appver=####&osver...
m####.api.m####.com/v2/mpns/getInitChannel?_support=####&device=####&osV...
m####.api.m####.com/v2/mpns/pushAlert/info?_support=####&device=####&osV...
mo####.bz.m####.com/odin/c1/channel/ads?_support=####&device=####&osVers...
mo####.bz.m####.com/odin/c1/channel/list?_support=####&device=####&osVer...
mo####.bz.m####.com/odin/c1/skin/config?_support=####&device=####&osVers...
mobi####.bz.m####.com/mobile/recommend/v1?_support=####&device=####&osVe...
na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####&_supp...
noa####.api.m####.com:443/noah/v4/global/config?_support=####&device=###...
noa####.api.m####.com:443/preview/cms_icon/2021/10/15/10/202110152132065...
noa####.api.m####.com:443/preview/cms_icon/2021/10/16/10/202110161022068...
ugc.h####.com.####.cn:443/platform_oss/28880F2230A64F268AA0CBD1C82DF440
ugc.h####.com.####.cn:443/platform_oss/F68395B71C98431ABD29EF928F55CA03....
v2.res.log.####.com/info.php?e=####&f=####&h=####&s=####&l=####&t=####&m...
vip.log.m####.com/s

Запросы HTTP POST:

a.qchann####.cn:443/lfc
al####.u####.com:443/unify_logs
ap####.g####.com/uploadIdBinding
ap####.log.m####.com/info
ap####.v1.m####.com/dispatcher.do
api.face####.com:443/v3.2/MG_2231360520424256/activities
b####.com/appapi/Config/action
b####.com/appapi/config/appconfig
b####.g####.com/api.php?format=####&t=####
b.qchann####.cn/n/adj?ak=####&uid=####&offline=####&r=####&sv=####
def####.duals####.cn.####.com:443/umpx_internal
m####.3g.qq.com/
m####.api.m####.com/v2/mpns/report/heartbeat
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
pi####.qq.com/mstat/report
res####.a####.com/v3/log/init
t####.qchann####.cn:443/truth?appkey=####&uid=####&sdk=####&type=####&ft...
vip.log.m####.com/crash
wap.cmpass####.com:8443/log/logReport

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/-1192248910
/data/data/####/-726354474
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0.log
/data/data/####/0.xml
/data/data/####/0e03b9978037ec752b4db9f2a349ba7b026051099b94310...c5b8.0
/data/data/####/0f5c7a12044ec0d91ea142c859afa18d
/data/data/####/166286030
/data/data/####/2ee9f73b1eb7770b64f9f3fc87a339a1
/data/data/####/560af74165e444e6eb9d5d11eca1296a
/data/data/####/614108960
/data/data/####/75e0bb388c1900b2b6f89f68ff4b7b71
/data/data/####/88a7e8193d7da4b000cca5d46d5c27b833a8e37ae8d887a....0.tmp
/data/data/####/ANwlWZva11fdp5j_hvozWlmwvEg.1957764511.tmp
/data/data/####/Alvin2.xml
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/ContextData.xml
/data/data/####/DENGTA_META.xml
/data/data/####/DNXg5VXNryZVGPU05Ixpbd9Xfx4.1388177439.tmp
/data/data/####/ERROR.xml
/data/data/####/EpOOrQ6MBuWORSSq9O7UXEca9vA.1344173809.tmp
/data/data/####/HMTAGENT_INFO.xml
/data/data/####/ImgoPad-journal (deleted)
/data/data/####/LItlH1hGX7t24MgCLbiDnnkCe7M.600266628.tmp
/data/data/####/MGMICommon.xml
/data/data/####/MGMI_PHONE-journal
/data/data/####/MGTVCommon.xml
/data/data/####/MGTVCommon.xml.bak
/data/data/####/MGTVCommon.xml.bak (deleted)
/data/data/####/PREF_NAME_AD_SHOW_TEXT.xml
/data/data/####/QT.xml
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/Statistics-journal
/data/data/####/TMAssistantSDKSharedPreference.xml
/data/data/####/TMSDKPrefer.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a==7.5.0&&6.2.9_1634448245637_envelope.log
/data/data/####/aMOhRIQV1XDopsNM7x-i0PhQerI.735430588.tmp
/data/data/####/arch.xml
/data/data/####/azaeaocnagabapaiaaaraeejazckcd.xml
/data/data/####/azaeaocnagabapaiaaaraeejazckcd.xml.bak
/data/data/####/azaeaocnagabapaiaaaraeejbbazalaacvbybz.xml
/data/data/####/b0997c111dbcb60f9900f4bf1b124e4d12aecd3ddf3a958....0.tmp
/data/data/####/b7m6UBcgUZZqoBKGX7YQUgavO6U.1296511883.tmp
/data/data/####/beacon_selfupdate_db-journal
/data/data/####/bfc9ef23b14b9bdfd355efd2428ba170db482b6fbaf893f....0.tmp
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.dex;classes8.dex
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.hunantv.imgo.activity.xml
/data/data/####/com.hunantv.imgo.activity_preferences.xml
/data/data/####/com.hunantv.imgo.activity_preferences.xml.bak
/data/data/####/com.tencent.open.config.json.101554503
/data/data/####/config
/data/data/####/config.gz (deleted)
/data/data/####/config_file_name
/data/data/####/dW1weF9pbnRlcm5hbF8xNjM0NDQ4MjE3NjAw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNjM0NDQ4MjMwMTAw;
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gamehall.db-journal
/data/data/####/gin.db-journal
/data/data/####/gls.db-journal
/data/data/####/gtc.db-journal
/data/data/####/hmt_agent_commonutill_com.hunantv.imgo.activity.xml
/data/data/####/hmt_agent_commonutill_device_id.xml
/data/data/####/hmt_agent_online_setting.xml
/data/data/####/hmt_agent_online_setting.xml.bak
/data/data/####/hmt_analytics
/data/data/####/hmt_analytics-journal
/data/data/####/hmt_init_savetime.xml
/data/data/####/hmt_session_id_savetime.xml
/data/data/####/i==1.2.0&&6.2.9_1634448217547_envelope.log
/data/data/####/iQrFRdW1zhq8f_a9YNJmxGU5BaU.1130244368.tmp
/data/data/####/import.lua
/data/data/####/info.xml
/data/data/####/journal.tmp
/data/data/####/jxlh_push.db-journal
/data/data/####/lO09KWWEzeuJ4XBAJRRfZ2WUtYE.453168712.tmp
/data/data/####/last_know_location.xml
/data/data/####/libjiagu.so
/data/data/####/mRF69JH4c_E8tfKy_WNyv_0_lr0.1042555857.tmp
/data/data/####/metrics_guid
/data/data/####/mgtv_data_aphone_sdk.db-journal
/data/data/####/mgtvbook.db-journal
/data/data/####/openudid_prefs.xml
/data/data/####/playinfo.db-journal
/data/data/####/proc_auxv
/data/data/####/q06AEezuI8qPu9iwhkuQYpdmQiA.998743413.tmp
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qt.csv.1634448237614.txt
/data/data/####/qtsession.xml
/data/data/####/settings.db-journal
/data/data/####/success
/data/data/####/t9H53qSu0T_ALmO9ligz9XeyEMg.785388015.tmp
/data/data/####/tencent_analysis.db-journal
/data/data/####/tmapkpatch_sdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/union_traffic_free.xml
/data/data/####/union_traffic_free.xml.bak
/data/data/####/userlist.xml
/data/data/####/weibo_sdk_aid1
/data/data/####/zkcontainerlog.dat
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/version
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /proc/net/raw
cat /proc/net/raw6
cat /proc/net/tcp
cat /proc/net/tcp6
cat /proc/net/udp
cat /proc/net/udp6
ls /
ls /sys/class/thermal

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о местоположении.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней