Android.RemoteCode.8015

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Proxy.44.origin
Android.Proxy.45.origin
Android.RemoteCode.345.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) d####.100u####.com.####.net:80
TCP(HTTP/1.1) p####.fengmiz####.com:80
TCP(HTTP/1.1) l####.fengmiz####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) 1####.28.228.62:14305
TCP(HTTP/1.1) cpu.f####.skywort####.####.com:80
TCP(HTTP/1.1) jar.fengmiz####.com.####.cn:80
TCP(HTTP/1.1) 1####.9.145.224:3918
TCP(HTTP/1.1) u####.fengmiz####.cn:80
TCP(HTTP/1.1) ad.m####.cn:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) ad####.fengman####.com:80
TCP(HTTP/1.1) cig.x.adan####.com:80
TCP(HTTP/1.1) 7.1####.xd.####.com:80
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) 1####.194.179.152:443
TCP(TLS/1.0) pos.zblqo####.com:8657
TCP(TLS/1.0) 64.2####.162.95:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.0) d####.beev####.tv:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) 64.2####.163.95:443
TCP(TLS/1.0) 1####.194.222.95:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.2) 64.2####.162.95:443
TCP(TLS/1.2) 64.2####.165.94:443
TCP(TLS/1.2) 1####.194.221.139:443
UDP as2.binst####.live:3924
UDP 1.2####.122.9:24432
UDP 1####.57.141.178:9483
UDP 1####.250.226.121:9350
UDP 1####.39.73.38:8115
TCP 1.1####.194.54:34863
UDP 1####.199.188.244:23864
UDP 2####.68.49.40:1028
UDP as2.binst####.live:3925
UDP 42.2####.107.176:13547
TCP 1####.175.112.199:38683
TCP 1####.181.235.177:39877
UDP 1####.198.239.100:13969
UDP 2####.101.33.248:9762
UDP as4.binst####.live:13
UDP 1####.230.224.127:3380
UDP 1####.197.31.199:1425
UDP 36.1####.173.179:18136
UDP 1####.19.57.203:4313
UDP 2####.101.140.218:7702
UDP 1####.235.105.185:8586
UDP 1####.14.128.140:20357
UDP 1####.63.183.94:4032
UDP 1####.148.112.54:2586
UDP 1.1####.207.138:2047
TCP 60.0.2####.204:38466
UDP 1####.0.9.254:36192
UDP 1####.179.183.165:6702
UDP as1.binst####.live:13
UDP 1####.44.182.90:7809
UDP 4####.48.94.171:19395
UDP 1####.0.9.1:137
UDP 2####.255.255.250:1900
TCP 4####.86.97.171:38203
UDP 1.2####.1.78:23600
UDP 1####.12.245.234:17760
UDP 1####.202.220.28:34726
UDP 1####.19.61.117:28558
UDP 59.35.1####.128:11833
UDP 2####.101.6.237:9915
UDP 1.82.1####.234:5858
UDP 2####.90.3.3:11129
UDP 1####.154.145.27:15165
UDP 1####.29.171.6:9954
UDP 1####.124.234.31:27909
UDP 1####.8.50.238:12335
UDP 1####.55.62.2:5466
UDP 1####.14.229.201:2828
UDP 1####.226.139.198:9641
UDP 2####.163.73.115:28767
UDP 42.2####.185.142:9863
UDP 1####.62.209.196:3489
UDP 1####.9.205.149:8976
UDP tm3.binst####.live:3925
UDP hs9.hangzho####.com:16000
UDP tm3.binst####.live:3923
UDP 1####.89.114.22:12112
UDP 2####.74.202.54:23963

Запросы DNS:

7.1####.xd.####.com
a####.u####.com
ad####.fengman####.com
ad.m####.cn
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
c####.dc.100u####.com
cig.x.adan####.com
cpu.f####.skywort####.####.com
d####.100u####.com
d####.beev####.tv
er####.u####.com
g3.l####.com
hs9.hangzho####.com
img.m####.cn
jar.fengmiz####.com
l####.fengmiz####.com
log.x.adan####.com
p####.fengmiz####.com
p2####.fengmiz####.com
pos.zblqo####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
u####.fengmiz####.cn
u####.u####.com
w####.pcon####.com.cn
www.b####.com

Запросы HTTP GET:

ad.m####.cn/schedule/api/getIpInfo?t=####&snNo=####&deviceId=####&checks...
ad.m####.cn/schedule/api/listNewAdSpace?channelId=####&modelId=####&mac=...
ad.m####.cn/schedule/api/v4/listAllMaterial?regionId=####&cityId=####&ch...
ad.m####.cn/switch/api/listSwitch?channelId=####&projectName=####&modelI...
cpu.f####.skywort####.####.com/skyworthdigital-mipt/000/0NuNUOAbCf/Skywo...
d####.100u####.com.####.net/sdkfile/239214dc0e620b9c7d77f01eab58e3ec.apk...
d####.100u####.com.####.net/sdkfile/63d2a0466b49cd3cf3306703a8368f27.apk...
d####.100u####.com.####.net/sdkfile/78479b79d677a1b2af6ebc3d75b50105.jar...
d####.100u####.com.####.net/sdkfile/963215350b45dcec76b719f3188ed64f.apk...
g3.l####.com/r?format=####
jar.fengmiz####.com.####.cn/adsys/pic/04d/52818b792fe64d28a3e87e1f8c3fd8...
jar.fengmiz####.com.####.cn/adsys/pic/108/19236834889e4552867b76ad1520b2...
jar.fengmiz####.com.####.cn/adsys/pic/110/e7b1be22f2f84e37ab89f0e96ef1fc...
jar.fengmiz####.com.####.cn/adsys/pic/252/306fda4bfd3449178108842fc87974...
jar.fengmiz####.com.####.cn/adsys/pic/29c/86e13100a134441ba27d31fee5cec5...
jar.fengmiz####.com.####.cn/adsys/pic/2d3/6f81731b108f48c9addccb622d42ee...
jar.fengmiz####.com.####.cn/adsys/pic/368/9f9fdcd52904454bb3d00549fa1f3f...
jar.fengmiz####.com.####.cn/adsys/pic/3b7/e2abfebf29384c3fa79f9a51ad6114...
jar.fengmiz####.com.####.cn/adsys/pic/462/ee7d3f80a19c489ab96dc6c870c0b5...
jar.fengmiz####.com.####.cn/adsys/pic/4b1/2f858170fa4d469c88dad1031b9193...
jar.fengmiz####.com.####.cn/adsys/pic/510/0e622c2b03394a56ad4bbf0dd4a09c...
jar.fengmiz####.com.####.cn/adsys/pic/514/4312344b31cc4726a3cca47ef01b63...
jar.fengmiz####.com.####.cn/adsys/pic/563/050ee91a8589413ab87ef75843d7ce...
jar.fengmiz####.com.####.cn/adsys/pic/563/b2fbc3aadb2f44a2b6af7400a550fe...
jar.fengmiz####.com.####.cn/adsys/pic/67d/15da1e4a6171437f9b1fd9d79c7278...
jar.fengmiz####.com.####.cn/adsys/pic/7d4/a9c9669f49b24a3fa7cf2d5ae3ed0c...
jar.fengmiz####.com.####.cn/adsys/pic/829/5ccb9c59807a4414a0d8f7be789048...
jar.fengmiz####.com.####.cn/adsys/pic/9b1/de9f429cdea84155a6aa84b9f5ee23...
jar.fengmiz####.com.####.cn/adsys/pic/9d0/f0151a9e4d694113bf354b56b08ca3...
jar.fengmiz####.com.####.cn/adsys/pic/b30/dddd8726530f4bce8eecff411ca411...
jar.fengmiz####.com.####.cn/adsys/pic/b5d/1f5625ad85a24e32a25fd5b6cb0096...
jar.fengmiz####.com.####.cn/adsys/pic/dd1/e7d1449a436f40aa8b1dcc6245dceb...
jar.fengmiz####.com.####.cn/adsys/pic/ea1/3c46af9c99b14dfcb418356d733a8d...
jar.fengmiz####.com.####.cn/adsys/pic/f4b/df7afb5d4c6042eaa9a3a570f6fddd...
jar.fengmiz####.com.####.cn/live/201901/1bf46cf22015470bb32999a026ba06a1...
jar.fengmiz####.com.####.cn/live/202106/e1ad88b5e02a4fd0a1d448c119466652...
jar.fengmiz####.com.####.cn/live/202111/5d3d3fb2c27a4c7185e294ea86ad173a...
jar.fengmiz####.com.####.cn/p2pstat/202106/e0a5581dd514409bab98c55ed0b51...
l####.fengmiz####.com/api/service/soInfo.action?type=####
l####.fengmiz####.com/beeLiveRec/api/listPauseBanner.action
l####.fengmiz####.com/liveApi/api/v2/channelDetail.action?channelId=####...
l####.fengmiz####.com/liveApi/api/v2/hotList
l####.fengmiz####.com/liveApi/api/v2/jarsoInfo.action?type=####
l####.fengmiz####.com/liveApi/api/v2/listClassAndChannelv2.action?hideCa...
l####.fengmiz####.com/liveApi/api/v2/listScheduleByClass.action?batchCha...
l####.fengmiz####.com/liveApi/api/v2/liveConfig.action
l####.fengmiz####.com/liveApi/api/v2/liveTester.action
l####.fengmiz####.com/liveApi/api/v2/player?androidVersion=####&software...
l####.fengmiz####.com/liveApi/api/v2/uploadPlayStatus.action?channelName...
l####.fengmiz####.com/liveApi/service/soInfo.action?type=####
l####.fengmiz####.com/oms/download/clientVersion.action?sdkLevel=####&pk...
l####.fengmiz####.com/switch/api/listSwitch?channelId=####&projectName=#...
p####.fengmiz####.com/p2pstat/api/getJarInfo
u####.fengmiz####.cn/liveUser/client/cleanShareLiveUrl
w####.pcon####.com.cn/ipJson.jsp?json=####
www.a.sh####.com:443/

Запросы HTTP HEAD:

l####.fengmiz####.com/api/tvlive2.0/tvliveTest.action

Запросы HTTP POST:

7.1####.xd.####.com/x/10075/a05
ad####.fengman####.com/v1/c
ad####.fengman####.com/v1/t
cig.x.adan####.com/x/r/cig?k=####
cig.x.adan####.com/x/r/log/lpfAd
d####.100u####.com.####.net/sdk
d####.100u####.com.####.net:443/pluginsync
d####.100u####.com.####.net:443/reportcomp
d####.100u####.com.####.net:443/sdk
er####.u####.com.####.com:443/api/crashsdk/logcollect?chk=####&vno=####&...
er####.u####.com.####.com:443/apm_cc
l####.fengmiz####.com/liveApi/api/v2/uploadChannelStatus
l####.fengmiz####.com/liveApi/api/v2/uploadplayer?channel=####
new-####.u####.com:443/api/postZdata
pos.zblqo####.com:8657/config?&st=####
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg
w####.pcon####.com.cn/ipJson.jsp?json=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/014982f2d1a9bdd3881d32eaa5187691.0.tmp
/data/data/####/014982f2d1a9bdd3881d32eaa5187691.1
/data/data/####/0b20037d88c975735e7c00453c5868d0.0.tmp
/data/data/####/0b20037d88c975735e7c00453c5868d0.1
/data/data/####/0b20037d88c975735e7c00453c5868d0.1.tmp
/data/data/####/0c894b24024e5f9ef1171b7bc315d3b8
/data/data/####/12b665002ffbc156fba8805361999de1.0.tmp
/data/data/####/12b665002ffbc156fba8805361999de1.1
/data/data/####/149ab74dc1480c934fbfd8deddef2dfc
/data/data/####/1682708935825
/data/data/####/1682708935861
/data/data/####/1682708935909
/data/data/####/1753926458.dex
/data/data/####/1753926458.dex.flock (deleted)
/data/data/####/1753926458.jar
/data/data/####/1753926458.jar.temp
/data/data/####/18a0f8a14648ac12b65428a19d454241.0.tmp
/data/data/####/18a0f8a14648ac12b65428a19d454241.1
/data/data/####/18a0f8a14648ac12b65428a19d454241.1.tmp
/data/data/####/3438967395.apk
/data/data/####/3438967395.apk.temp
/data/data/####/3438967395.dex
/data/data/####/3438967395.dex.flock (deleted)
/data/data/####/3454458149.apk
/data/data/####/3454458149.apk.temp
/data/data/####/3454458149.dex
/data/data/####/3454458149.dex.flock (deleted)
/data/data/####/3981590050.apk
/data/data/####/3981590050.apk.temp
/data/data/####/3981590050.dex
/data/data/####/3981590050.dex.flock (deleted)
/data/data/####/4ba629aa1570b403a2886e792379cac1.0
/data/data/####/4ba629aa1570b403a2886e792379cac1.0.tmp
/data/data/####/4ba629aa1570b403a2886e792379cac1.1
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/74cea724b5ad278d58dea525406fa487.0.tmp
/data/data/####/74cea724b5ad278d58dea525406fa487.1
/data/data/####/74cea724b5ad278d58dea525406fa487.1.tmp
/data/data/####/7c3102b67c11bf0f13eac042aca571a7.0.tmp
/data/data/####/7c3102b67c11bf0f13eac042aca571a7.1
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.0.tmp
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.1
/data/data/####/7ec7c414c82dc425294fa6c8b86b5792.1.tmp
/data/data/####/884c5171afa80056cfd10e25f5a2c362.0.tmp
/data/data/####/884c5171afa80056cfd10e25f5a2c362.1
/data/data/####/884c5171afa80056cfd10e25f5a2c362.1.tmp
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.0.tmp
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.1
/data/data/####/99d2479f31b14a3a0ecc3c149c28d339.1.tmp
/data/data/####/9dfaa2b2f4f436bf351bbed75591dc0e.0.tmp
/data/data/####/9dfaa2b2f4f436bf351bbed75591dc0e.1
/data/data/####/BeeUrlManager.xml
/data/data/####/EVIL0OBIHZIMGNEF0MOC.ss
/data/data/####/EVIL0OBIHZIMGNEF0MOC.st
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Y29uZmlnXzU5MDk3NzY2ZjQzZTQ4N2NlMTAwMTIxYw.sp
/data/data/####/Y29uZmlnXzU5MDk3NzY2ZjQzZTQ4N2NlMTAwMTIxYw.sp.bak
/data/data/####/a==9.4.0&&2.17.03_1682708931539_dW5pZnlfbG9ncw==;.log
/data/data/####/abc.dex
/data/data/####/abc.dex.flock (deleted)
/data/data/####/abc.jar
/data/data/####/ad.db
/data/data/####/ad.db-journal
/data/data/####/b36091013a71e54b8d5846e220843612.0.tmp
/data/data/####/b36091013a71e54b8d5846e220843612.1
/data/data/####/b36091013a71e54b8d5846e220843612.1.tmp
/data/data/####/ca1f8ed15d79cb45a02530f3afbffd60.0.tmp
/data/data/####/ca1f8ed15d79cb45a02530f3afbffd60.1
/data/data/####/cdt.wa
/data/data/####/com.fengmizhibo.live_preferences.xml
/data/data/####/com.fengmizhibo.live_preferences.xml.bak
/data/data/####/com.fengmizhibo.liveax.xml
/data/data/####/com.fengmizhibo.liveax.xml.bak
/data/data/####/cr.wa
/data/data/####/device_mac_address_config.xml
/data/data/####/deviceid
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/dt.wa
/data/data/####/edaa106356fb37395a355e4d3b5cf339.0.tmp
/data/data/####/edaa106356fb37395a355e4d3b5cf339.1
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid3547
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/i==1.2.0&&2.17.03_1682708931612_dW5pZnlfbG9ncw==;.log
/data/data/####/info.xml
/data/data/####/jikeConfig.xml
/data/data/####/journal
/data/data/####/libbv.so
/data/data/####/libbv.so.zip (deleted)
/data/data/####/libfmcore.so
/data/data/####/libfmcore.so.zip (deleted)
/data/data/####/libztvb321.2.2.2.so
/data/data/####/mifeng_live.db-journal
/data/data/####/p2pnat.jar
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/pid.txt
/data/data/####/proc_auxv
/data/data/####/sendlock
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.4.0&&2.17.03_1682708931297_dW5pZnlfbG9ncw==;.log
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/unique
/data/data/####/unknown.xml
/data/data/####/urlloader.dex
/data/data/####/urlloader.dex.flock (deleted)
/data/data/####/urlloader.jar
/data/data/####/ver
/data/data/####/wa_gzip_1_1_3712_3946_1682708995303
/data/data/####/wa_gzip_1_1_3712_6790_1682708944360
/data/data/####/wa_none_1_1_3712_5206_1682708935296 (deleted)
/data/data/####/z==1.2.0&&2.17.03_1682708929798_emNmZw==;.log
/data/media/####/050ee91a8589413ab87ef75843d7ceeb.png
/data/media/####/0e622c2b03394a56ad4bbf0dd4a09c77.jpg
/data/media/####/15da1e4a6171437f9b1fd9d79c727835.png
/data/media/####/19236834889e4552867b76ad1520b2b3.png
/data/media/####/1f5625ad85a24e32a25fd5b6cb0096df.png
/data/media/####/2f858170fa4d469c88dad1031b9193cd.png
/data/media/####/306fda4bfd3449178108842fc87974f3.png
/data/media/####/3c46af9c99b14dfcb418356d733a8dc0.png
/data/media/####/4312344b31cc4726a3cca47ef01b63f5.png
/data/media/####/52818b792fe64d28a3e87e1f8c3fd803.png
/data/media/####/5ccb9c59807a4414a0d8f7be789048cb.png
/data/media/####/6f81731b108f48c9addccb622d42ee10.png
/data/media/####/86e13100a134441ba27d31fee5cec5ed.webp
/data/media/####/9f9fdcd52904454bb3d00549fa1f3f29.png
/data/media/####/a9c9669f49b24a3fa7cf2d5ae3ed0c9d.webp
/data/media/####/b2fbc3aadb2f44a2b6af7400a550fe28.png
/data/media/####/dddd8726530f4bce8eecff411ca411e3.png
/data/media/####/de9f429cdea84155a6aa84b9f5ee236b.png
/data/media/####/df7afb5d4c6042eaa9a3a570f6fddd67.png
/data/media/####/dvc
/data/media/####/e2abfebf29384c3fa79f9a51ad6114de.webp
/data/media/####/e7b1be22f2f84e37ab89f0e96ef1fcfa.webp
/data/media/####/e7d1449a436f40aa8b1dcc6245dceb44.png
/data/media/####/ee7d3f80a19c489ab96dc6c870c0b50a.webp
/data/media/####/f0151a9e4d694113bf354b56b08ca3c4.png
/data/media/####/file.test (deleted)
/data/media/####/sysid.dat
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
arp -a
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/1753926458.jar
chmod 777 /data/user/0/<Package>/files/.honor/3438967395.apk
chmod 777 /data/user/0/<Package>/files/.honor/3454458149.apk
chmod 777 /data/user/0/<Package>/files/.honor/3981590050.apk
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Загружает динамические библиотеки:

libcrashsdk
libimagepipeline
libpixel
libtvcore
libumeng-spy
libztvb321.2.2.2

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней