Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.RemoteCode.251.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) ds-####.oss-acc####.aliy####.####.com:80
- TCP(HTTP/1.1) nwap####.cdn.bc####.####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) 47.1####.152.28:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(TLS/1.0) 1####.194.73.95:443
- TCP(TLS/1.0) 1####.194.73.113:443
- TCP(TLS/1.0) nwap####.cdn.bc####.####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) thi####.q####.cn:443
- TCP(TLS/1.0) 1####.251.1.94:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 1####.251.1.94:443
Запросы DNS:
- a####.u####.com
- and####.a####.go####.com
- and####.google####.com
- api####.oss-acc####.aliy####.com
- n####.cdn.bc####.com
- nwap####.cdn.bc####.com
- oc.u####.com
- rr9---s####.g####.com
- sho####.netwa####.com
- thi####.q####.cn
Запросы HTTP GET:
- ds-####.oss-acc####.aliy####.####.com/api.txt?-119220####
- ds-####.oss-acc####.aliy####.####.com/api.txt?-55927####
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g10_w...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g1_wx...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g2_wx...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g3_wx...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g5_wx...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g6_wx...
- nwap####.cdn.bc####.####.com/admin/makesimg/output/gj_20230822/0530g9_wx...
- nwap####.cdn.bc####.####.com:443/guajiplugin_1074
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_001_cover.png?x-bc...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_001_img.png?x-bce-...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_002_cover.png?x-bc...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_002_img.png?x-bce-...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_003_cover.png?x-bc...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_003_img.png?x-bce-...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/gjv_show_004_cover2.png?x-b...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_004_img.png?x-bce-...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_005_cover.png?x-bc...
- nwap####.cdn.bc####.####.com:443/showmp4/gjv/show_gjv_005_img.png?x-bce-...
- thi####.q####.cn/mmopen/vi_32/Kic8NlGHLlad0oobicnUpiaz8RH9fussMiaqmeMDQ1...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTJGTHQh425z9IZcJkwOU8CibwvNsXiaX1...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTKr9P59XlR3BCMia13Tx8wwCI33sLEezK...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTKuNBHrK9rdztNqTkWfxN0Uu40fX75q2k...
- thi####.q####.cn/mmopen/vi_32/Q0j4TwGTfTLTVDib2xrpBMxDMLM6xRXGPyYyWZOhUc...
- thi####.q####.cn/mmopen/vi_32/iabrUF3ELZexNA9CSo1ziaFkzPkaH8qtxVHq4aicM9...
- thi####.q####.cn/mmopen/vi_32/x360TSqialicw0sLzVa9gic9sJjIGPry9vbxSAWKWK...
- thi####.q####.cn:443/mmopen/vi_32/8SdpYbicwXVXt0fIN7L0f2WdvTAbrkY91AloCy...
- thi####.q####.cn:443/mmopen/vi_32/QAZ5gLTK2At42xibUW5LDFIvmejFDp8rkmFkEl...
- thi####.q####.cn:443/mmopen/vi_32/gK9BjPHZicmLJicRvVsvNrY2RGxib6ia57Tgvg...
- thi####.q####.cn:443/mmopen/vi_32/pt4dOV9p5KBdLX14I8ruVNIHVMiavWLxVGWWRh...
- thi####.q####.cn:443/mmopen/vi_32/zIqugsZ8vTcibQNxfBrWhPe5c7Gjr0rjvuq8ae...
Запросы HTTP POST:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1241843868-1899521153
- /data/data/####/-1932087694568414378
- /data/data/####/-434068928-1303372751
- /data/data/####/-5799921812144330216
- /data/data/####/.base.dex
- /data/data/####/.base.dex.flock (deleted)
- /data/data/####/.base.jar
- /data/data/####/.imprint
- /data/data/####/13sjukz9n28ydcrwnd1kba2fi
- /data/data/####/13sjukz9n28ydcrwnd1kba2fi (deleted)
- /data/data/####/15yhsjpa8oejnck3pdyovpj31
- /data/data/####/15yhsjpa8oejnck3pdyovpj31.tmp
- /data/data/####/1835014708845509062
- /data/data/####/1kshi7km80rk4vgwa8uo2uyb7
- /data/data/####/1kshi7km80rk4vgwa8uo2uyb7.tmp
- /data/data/####/1rjrfw7u85jhz41me5427aigi
- /data/data/####/1rjrfw7u85jhz41me5427aigi.tmp
- /data/data/####/1vzm7dhmb3hdo592n20v11ra3
- /data/data/####/1vzm7dhmb3hdo592n20v11ra3.tmp
- /data/data/####/1wxq8euq2z153qr2r07nufw7b
- /data/data/####/1wxq8euq2z153qr2r07nufw7b.tmp
- /data/data/####/1xlgke4l3wmcl44goge8fe3wd
- /data/data/####/1xlgke4l3wmcl44goge8fe3wd.tmp
- /data/data/####/24i049w6mo4vef7gwz5a0k9zy
- /data/data/####/24i049w6mo4vef7gwz5a0k9zy.tmp
- /data/data/####/27dy1osqn2vohzokjsbwxfucr
- /data/data/####/27dy1osqn2vohzokjsbwxfucr (deleted)
- /data/data/####/373jboiev1rlmex92xjlo5ols
- /data/data/####/373jboiev1rlmex92xjlo5ols.tmp
- /data/data/####/3b5q6112eylqdqz1l2fwmtmjv
- /data/data/####/3b5q6112eylqdqz1l2fwmtmjv.tmp
- /data/data/####/3dy1w94xbz33d49q90t9n7d4s
- /data/data/####/3dy1w94xbz33d49q90t9n7d4s.tmp
- /data/data/####/3m4vay9qy4dz757ya2842u68g
- /data/data/####/3m4vay9qy4dz757ya2842u68g.tmp
- /data/data/####/3ohep8dqpni38egjohj8m5w2p
- /data/data/####/3ohep8dqpni38egjohj8m5w2p.tmp
- /data/data/####/3u1agpdrbi8e0n15d0yhdjodi
- /data/data/####/3u1agpdrbi8e0n15d0yhdjodi (deleted)
- /data/data/####/3zotfkhrjnf3mz81hy4ftfode
- /data/data/####/3zotfkhrjnf3mz81hy4ftfode.tmp
- /data/data/####/404vncpiwhlmd9mb1c3a35kzq
- /data/data/####/404vncpiwhlmd9mb1c3a35kzq.tmp
- /data/data/####/40hldaim3yf99ywfvxrcy6mfg
- /data/data/####/40hldaim3yf99ywfvxrcy6mfg.tmp
- /data/data/####/4tja4zs7r21iuld721rdeyy8j
- /data/data/####/4tja4zs7r21iuld721rdeyy8j.tmp
- /data/data/####/50ku15twbcu49hlrrulthj5kl
- /data/data/####/50ku15twbcu49hlrrulthj5kl (deleted)
- /data/data/####/5637uh535u483a8qsg22zr88w
- /data/data/####/5637uh535u483a8qsg22zr88w.tmp
- /data/data/####/5761398321117666360
- /data/data/####/5jslhf6sccv62ml9mabnsgbr1
- /data/data/####/5nt8cxgsrwr7ri250xd68gkn
- /data/data/####/5nt8cxgsrwr7ri250xd68gkn.tmp
- /data/data/####/5pakx9jpc4xu5fii35dwtocgo
- /data/data/####/5pakx9jpc4xu5fii35dwtocgo.tmp
- /data/data/####/5u4tnlcjcu283kopes9yand9v
- /data/data/####/5u4tnlcjcu283kopes9yand9v.tmp
- /data/data/####/5zx7yg9q6gs63uzau54oeo2gr
- /data/data/####/5zx7yg9q6gs63uzau54oeo2gr.tmp
- /data/data/####/63cshp4oz7k4u8twxdgmo5i6f
- /data/data/####/63cshp4oz7k4u8twxdgmo5i6f.tmp
- /data/data/####/6n8pw984cv3s6u9zx2indptyz
- /data/data/####/6n8pw984cv3s6u9zx2indptyz.tmp
- /data/data/####/75zzakbrlsp4g3p6tz4f9wb59
- /data/data/####/75zzakbrlsp4g3p6tz4f9wb59.tmp
- /data/data/####/78ui13kkimm1kq22ktqo97amo
- /data/data/####/78ui13kkimm1kq22ktqo97amo (deleted)
- /data/data/####/79dnwr02kbr7bk7udforp2cik
- /data/data/####/79dnwr02kbr7bk7udforp2cik.tmp
- /data/data/####/com.uto6o7jarle0n.h2qqvabmrj.xml
- /data/data/####/com.uto6o7jarle0n.h2qqvabmrj.xml.bak
- /data/data/####/hiqyujqhoun2xi3syplcoi5g
- /data/data/####/hiqyujqhoun2xi3syplcoi5g (deleted)
- /data/data/####/ie3r6u06as061pp7ouwwcs9h
- /data/data/####/ie3r6u06as061pp7ouwwcs9h.tmp
- /data/data/####/lsymxbcq5qxngbodzhsc9px0
- /data/data/####/lsymxbcq5qxngbodzhsc9px0 (deleted)
- /data/data/####/mobclick_agent_online_setting_com.uto6o7jarle0n...rj.xml
- /data/data/####/mytask.db
- /data/data/####/mytask.db-journal
- /data/data/####/nz62r19vl3ef5929hz0ewjct
- /data/data/####/nz62r19vl3ef5929hz0ewjct.tmp
- /data/data/####/proc_auxv
- /data/data/####/reyaeww33y76pqzsvsyg8lc9
- /data/data/####/reyaeww33y76pqzsvsyg8lc9.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/win.apk
- /data/data/####/win.dex
- /data/data/####/win.dex.flock (deleted)
- /data/media/####/.nomedia
- /data/media/####/guajiplugin_1074
- /data/media/####/journal
- /data/media/####/user.data
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- libuxsm
Отрисовывает собственные окна поверх других приложений.
