Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Backdoor.564.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) d####.g####.com.####.com:80
- TCP(HTTP/1.1) cmswe####.ahea####.com:80
- TCP(HTTP/1.1) b####.ge####.com:80
- TCP(HTTP/1.1) www.ahea####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(TLS/1.0) c####.g####.net:443
- TCP(TLS/1.0) 1####.217.16.42:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) b####.ge####.com:443
- TCP(TLS/1.0) d####.g####.com.####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) cmswe####.ahea####.com:443
- TCP(TLS/1.0) vo####.ahea####.com:443
- TCP(TLS/1.0) gtc.g####.net:443
- TCP(TLS/1.0) ti####.c####.l####.####.com:443
- TCP(TLS/1.0) new-####.u####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) dot.wts.xi####.cn:443
- TCP(TLS/1.2) 1####.250.186.195:443
- TCP(TLS/1.2) 1####.217.16.35:443
- TCP(TLS/1.2) 1####.217.16.42:443
- TCP(TLS/1.2) cmswe####.ahea####.com:443
- TCP(TLS/1.2) 2####.58.215.74:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP dot.wts.xi####.cn:443
- TCP cm-10####.g####.com:5225
Запросы DNS:
- a####.u####.com
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- b####.ge####.com
- c####.ahea####.com
- c####.g####.net
- c-h####.g####.com
- cdn-sdk####.g####.com
- cm-10####.g####.com
- cms####.ahea####.com
- cmsap####.ahea####.com
- cmswe####.ahea####.com
- d####.g####.com
- dot.wts.xi####.cn
- ga####.lotu####.com
- gtc.g####.net
- instant####.google####.com
- l####.tbs.qq.com
- log.u####.com
- on####.lotu####.com
- q####.ahea####.com
- qn.res.ahea####.com
- sdk-####.g####.com
- sdk-ope####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- u####.u####.com
- vo####.ahea####.com
- votea####.ahea####.com
- www.ahea####.com
- yaoji####.ahea####.com
Запросы HTTP GET:
- b####.ge####.com/api/addr.htm
- cmswe####.ahea####.com//UploadFile/2015-12-16/52897302-03e5-4f00-80dd-dd...
- cmswe####.ahea####.com:443//api/Article/List4PersonalizedRecommender?New...
- cmswe####.ahea####.com:443/UploadFile/2015-12-16/52897302-03e5-4f00-80dd...
- cmswe####.ahea####.com:443/UploadFile/8609/2020/01-17/7623b82b-7ead-4805...
- cmswe####.ahea####.com:443/UploadFile/8609/2021/11-26/6e8c164b-c112-471e...
- cmswe####.ahea####.com:443/api/Article/Classify?Pidx=####&TypeId=####&To...
- cmswe####.ahea####.com:443/api/Article/GetClassifyLastPostDate?Type=####...
- cmswe####.ahea####.com:443/api/Article/GetClassifyLastUpdateDate?Type=##...
- cmswe####.ahea####.com:443/api/Article/List?PageIndex=####&ClassifyType=...
- cmswe####.ahea####.com:443/api/Article/ListYanBian?Type=####&t=####&Clas...
- cmswe####.ahea####.com:443/api/Article/TouchNewsList?Width=####&Height=#...
- cmswe####.ahea####.com:443/api/Classify/QueryClassify?CityID=####&MenuTy...
- cmswe####.ahea####.com:443/api/HotActivity?HotCount=####&NewsPaperGroupI...
- cmswe####.ahea####.com:443/api/Merchant/Index?MenuTypeInClassify=####&Ci...
- cmswe####.ahea####.com:443/api/Newspaper/GetNewspaperGroup?Id=####
- cmswe####.ahea####.com:443/api/Newspaper/GetUpdateTimeStamp?NewspaperGro...
- cmswe####.ahea####.com:443/api/Region/GetWeather?Id=####
- cmswe####.ahea####.com:443/api/ServiceLinkApi/GetServiceLinkTypeList?Typ...
- cmswe####.ahea####.com:443/api/SilderActivity?SliderCount=####&NewsPaper...
- cmswe####.ahea####.com:443/cmsapi/resource/8609/image/2021/09/22/8ad9284...
- d####.g####.com.####.com/tdata_EDB102
- d####.g####.com.####.com/tdata_PwV676
- d####.g####.com.####.com/tdata_hll590
- d####.g####.com.####.com:443/file/2c58adf4-1c3b-4b04-8493-dd949943f5ed
- def####.cn.zb.####.com:443/bar/get/5735663de0f55aa19a000a36/?pcv=####&de...
- ti####.c####.l####.####.com/8609/2020/06-16/da0f27ca744c45b4aa947db7eec6...
- ti####.c####.l####.####.com/8609/2020/06-27/1a4722b77f724013bfe86e798145...
- ti####.c####.l####.####.com/8609/2020/06-30/3efb786a04fa40bdb6b6830b2f58...
- ti####.c####.l####.####.com/8609/2020/10-05/08d3bdad1f3c45da9bf8c8c57f82...
- ti####.c####.l####.####.com/8609/2020/10-05/8fde5c88e0154808ae1d6c2d4820...
- ti####.c####.l####.####.com/8609/2020/10-05/99f519c6fe774bbc8129f738bcf7...
- ti####.c####.l####.####.com/8609/2021/12-06/0f31602255fc4e50988e99c5320a...
- ti####.c####.l####.####.com/8609/2022/01-20/363ad9ed91284fdfb43847d90868...
- ti####.c####.l####.####.com:443/8609-20220109-e9049f97b4374ac3b0b0a64c9f...
- ti####.c####.l####.####.com:443/8609-20220117-7ab1d14babf74494b5c1129fcf...
- ti####.c####.l####.####.com:443/8609-20220121-421ec937583342cd9fc0a563ed...
- ti####.c####.l####.####.com:443/8609-20220123-2c606e2941c742b79e5fabdf7e...
- vo####.ahea####.com:443//UploadFile/2017-05-10/Thumb_640x390_60460428-4f...
- vo####.ahea####.com:443//UploadFile/2018-05-16/Thumb_640x390_113188cd-2f...
- www.ahea####.com/
Запросы HTTP POST:
- al####.u####.com:443/umpx_share
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- b####.ge####.com:443/api.php?format=####&t=####
- b####.ge####.com:443/api.php?format=####&t=####&d=####&k=####
- c####.g####.net:443/api.php?format=####&t=####
- cmswe####.ahea####.com:443/api/Device/SaveDetailInfo
- gtc.g####.net:443/cidserver/getcid
- l####.tbs.qq.com/ajax?c=####&k=####
- new-####.u####.com:443/api/postZdata
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.cl
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0ab2a9decb0813dfd23db344299fb91b
- /data/data/####/17231fa6bd89
- /data/data/####/1c54ba0b1489ba3ae39ec7b7d254969d69fdd59619a269d....0.tmp
- /data/data/####/282672c4e9f4921169373cbcf8eef633cf343b85d1d8e7d...d76c.0
- /data/data/####/594afbeb923c17ce4e4ad8762c283d05c09df5ee55dedeb....0.tmp
- /data/data/####/5a80004a7175f579c0bed2e300448c8fe0eb0d214eecd95....0.tmp
- /data/data/####/81124c0aa3e299860967c98a721538a4dbd623b1483762c....0.tmp
- /data/data/####/82b2089eb59a6caed51aa0346852c3e30bd802682c8eef9....0.tmp
- /data/data/####/952226bbd186b316909cc4b91aace19cc033d9708685a11...713d.0
- /data/data/####/9f477e8b18ae291cedc7ee62f282e7f110c2f757e96f429....0.tmp
- /data/data/####/AheadNews280.db
- /data/data/####/AheadNews280.db-journal
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/PrefsFile.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/_tmp_PRIORITIZED_3363_1643004477837
- /data/data/####/_tmp_PRIORITIZED_3363_1643004481211
- /data/data/####/_tmp_PRIORITIZED_3363_1643004481747
- /data/data/####/_tmp_PRIORITIZED_3560_1643004493152
- /data/data/####/_tmp_PRIORITIZED_3560_1643004494220
- /data/data/####/_tmp_PRIORITIZED_3579_1643004491736
- /data/data/####/_tmp_PRIORITIZED_3579_1643004493393
- /data/data/####/_tmp_PRIORITIZED_3579_1643004494588
- /data/data/####/_tmp_PRIORITIZED_3579_1643004547163
- /data/data/####/_tmp_PRIORITIZED_3579_1643004547440
- /data/data/####/a5e1c1ba70c9000dfd130cd7af403e97
- /data/data/####/alsn20170807.db
- /data/data/####/alsn20170807.db-journal
- /data/data/####/b7f02945541351219f2e37def490f458
- /data/data/####/bullet_PRIORITIZED_3579_1643004494588
- /data/data/####/bullet_PRIORITIZED_3579_1643004547163
- /data/data/####/c730959aa079fd218fa2566efb8a863f5093f4a564bafe1...860c.0
- /data/data/####/cg.db-journal
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.oat
- /data/data/####/com.aheading.news.yaojierb_preferences.xml
- /data/data/####/core_info
- /data/data/####/d4f25e7c6def75a2d515e4ce267b72cab5dcde36564b582...530f.0
- /data/data/####/ddc45803f13e8c4e911e6aff5f198d28a03103018e7ba53....0.tmp
- /data/data/####/debug.conf
- /data/data/####/dim.db-journal
- /data/data/####/e2aea0d4a4fb1b90ba01bdac2fc4a2c0.0
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f1d9afa9d584ffd610ba9db1ed91d655668a65206a5cbed...e9a7.0
- /data/data/####/f26112572a0ac0f60c9a263b75b5ce9492e759a48261ced....0.tmp
- /data/data/####/f390acd7e6ce07949eab0b97e9768b20d8c769fe510d337....0.tmp
- /data/data/####/fa85f5d3226631dd795eac71aba2794d9ba7315145fbfe2...5967.0
- /data/data/####/fb402c7c819d9af779d862cb589170b7fd4c595ec9119d3....0.tmp
- /data/data/####/getui_sp.xml
- /data/data/####/grp.prop
- /data/data/####/gtc3.db-journal
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/i==1.2.0&&3.4.06_1643004508195_dW5pZnlfbG9ncw==;.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/init_c1.pid
- /data/data/####/journal
- /data/data/####/k.store
- /data/data/####/libjiagu.so
- /data/data/####/lotuseed.apps
- /data/data/####/lotuseed.lock
- /data/data/####/lotuseed.s
- /data/data/####/lotuseed.task
- /data/data/####/lotuseed_global.xml
- /data/data/####/lotuseed_main.xml
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/pushg3.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/pushservice_umeng_common_config.xml
- /data/data/####/pushwgs.db-journal
- /data/data/####/s==7.1.4&&3.4.06_1643004495533_dW1weF9zaGFyZQ==;.log
- /data/data/####/share.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_PwV676
- /data/data/####/tdata_PwV676.dex
- /data/data/####/tdata_PwV676.dex.flock (deleted)
- /data/data/####/tdata_PwV676.jar
- /data/data/####/tdata_hll590
- /data/data/####/tdata_hll590.dex
- /data/data/####/tdata_hll590.dex.flock (deleted)
- /data/data/####/tdata_hll590.jar
- /data/data/####/the-real-index
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/um_session_id.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/umeng_zcfg_flag
- /data/data/####/umeng_zero_cache.db
- /data/data/####/umeng_zero_cache.db-journal
- /data/data/####/umzid_general_config.xml
- /data/data/####/umzid_general_config.xml.bak
- /data/data/####/webview_data.lock
- /data/data/####/z==1.2.0&&3.4.06_1643004477708_emNmZw==;.log
- /data/data/####/zy_unique_id.bin
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- app_process /system/bin com.android.commands.pm.Pm list packages
- getprop ro.product.cpu.abi
- ls /
- ls /sys/class/thermal
- mount
- ps
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- RC4
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
- AES-CFB-NOPADDING
- AES-CFB-NoPadding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
Запрашивает разрешение на отображение системных уведомлений.
