Android.DownLoader.5428

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.1093.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) hub.mydians####.com:80
TCP(HTTP/1.1) 59.1####.52.30:80
TCP(HTTP/1.1) vod####.ip####.q####.####.com:80
TCP(HTTP/1.1) c####.cn.edg####.net:80
TCP(HTTP/1.1) l####.b####.com:80
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) api.whaletv####.com:80
TCP(HTTP/1.1) 1####.56.103.89:80
TCP(HTTP/1.1) detec####.math####.cn:80
TCP(HTTP/1.1) wc.cdn.tv####.com:80
TCP(HTTP/1.1) pro.wildpet####.com:201
TCP(HTTP/1.1) p####.api.math####.cn:80
TCP(HTTP/1.1) pro.wildpet####.com:80
TCP(HTTP/1.1) 1####.194.73.94:80
TCP(HTTP/1.1) api.o####.ads####.cn:80
TCP(HTTP/1.1) 1####.161.124.146:12340
TCP(HTTP/1.1) t####.dians####.com:80
TCP(HTTP/1.1) 39.1####.143.44:8001
TCP(HTTP/1.1) co####.ssp.math####.cn:80
TCP(HTTP/1.1) api.mydians####.com:80
TCP(HTTP/1.1) 1####.200.56.17:80
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) digital####.google####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) 1####.194.73.94:443
TCP(TLS/1.0) er####.u####.com.####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) 1####.177.14.138:443
TCP(TLS/1.2) www.go####.com:443
TCP(TLS/1.2) digital####.google####.com:443
TCP(TLS/1.2) 1####.194.73.94:443
TCP 1####.149.137.40:27462
TCP 1####.132.65.106:4010
UDP 1####.126.252.121:2071
UDP as3.binst####.live:3923
UDP 1.1####.176.43:2428
UDP 1####.37.6.45:3736
UDP 2####.12.27.87:1028
UDP 1####.244.248.160:1200
UDP 42.48.1####.73:3474
UDP 4####.49.25.57:3254
UDP as4.binst####.live:3924
UDP 39.1####.80.245:1619
UDP 61.1####.110.169:3439
TCP 1####.116.75.229:4010
TCP 60.17.2####.147:4010
TCP 1####.163.126.45:4010
UDP as3.binst####.live:3924
UDP digital####.google####.com:443
UDP tm1.binst####.live:3924
UDP 2####.200.58.27:1026
UDP as4.binst####.live:13
UDP 1####.37.157.56:3881
UDP 1####.43.78.236:2263
UDP 1####.118.156.253:1446
UDP 1####.254.248.44:2402
UDP 2####.255.255.250:1900
TCP 1####.179.23.240:4010
TCP 1####.55.173.180:4010
UDP as4.binst####.live:3923
UDP 61.1####.147.49:3561
UDP tm1.binst####.live:13
UDP as2.binst####.live:13
UDP 1####.0.1.254:4010
UDP as2.binst####.live:3923
UDP 1####.148.93.161:1929
UDP 1####.199.123.43:2406
UDP as3.binst####.live:13
UDP 1.1####.234.5:3529
UDP 1####.199.25.199:1858
TCP 1####.120.189.219:20487
TCP 1####.20.60.53:12354
UDP 1####.19.55.252:3940

Запросы DNS:

a####.u####.com
and####.a####.go####.com
and####.google####.com
api.c####.cn
api.mydians####.com
api.o####.ads####.cn
api.whaletv####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
cdn.tv####.com
co####.ssp.math####.cn
d####.100u####.com
detec####.math####.cn
digital####.google####.com
dy.cn.wildpet####.xyz
er####.u####.com
f####.gst####.com
hub.mydians####.com
l####.b####.com
newap####.math####.cn
p####.api.math####.cn
p####.google####.com
pro.wildpet####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
t####.dians####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
u####.u####.com
wc.cdn.tv####.com
www.go####.com

Запросы HTTP GET:

api.mydians####.com/api/config/deviceCompat?brand=####&model=####&osver=...
api.mydians####.com/api/v1/plugin?module=####&verCode=####&aver=####&tm=...
api.mydians####.com/api/v1/shin?injectConditions=####
api.mydians####.com/ipInfo
api.mydians####.com/time?ts=####
api.whaletv####.com/api/update/new_version
api.whaletv####.com/api/user/v1/equip/notify
c####.cn.edg####.net/epg/epginfo?serviceId=####&c=####&d=####
co####.ssp.math####.cn/api/v2/SDKCommonConfig?channelCode=####&version=#...
co####.ssp.math####.cn/api/v3/sdkTestConfig?send_ts=####
detec####.math####.cn/favicon.ico
detec####.math####.cn/images/sdk/detective.jpeg
detec####.math####.cn/js/finger20220224.js
detec####.math####.cn/sdk/checkCookie/httpClient?uniqueId=####&androidVe...
detec####.math####.cn/sdk/checkCookie/webview?uniqueId=####&androidVersi...
detec####.math####.cn/sdk/checkRedirect?uniqueId=####&androidVersion=###...
detec####.math####.cn/sdk/filterHeader/httpClient?uniqueId=####&androidV...
detec####.math####.cn/sdk/filterHeader/webview?uniqueId=####&androidVers...
detec####.math####.cn/sdk/openWebview?uniqueId=####&androidVersion=####&...
detec####.math####.cn/sdk/redirectHttpClientSecondPage?uniqueId=####&and...
detec####.math####.cn/sdk/redirectWebviewSecondPage?uniqueId=####&androi...
detec####.math####.cn/sdk/setCookie/httpClient?uniqueId=####&androidVers...
detec####.math####.cn/sdk/setCookie/webview?uniqueId=####&androidVersion...
detec####.math####.cn/sdk/validateCookie/httpClient?uniqueId=####&androi...
detec####.math####.cn/sdk/validateCookie/webview?uniqueId=####&androidVe...
detec####.math####.cn/sdk/webviewBasic?uniqueId=####&androidVersion=####...
l####.b####.com/jquery/2.1.4/jquery.min.js
newap####.math####.cn/favicon.ico
newap####.math####.cn/ssp/mgm_test/webview_version?channelCode=####&vers...
p####.api.math####.cn/ip?send_ts=####
vod####.ip####.q####.####.com/new/qjp/yunhi_default_1.1.7_68_release.apk
vod####.ip####.q####.####.com/static/ad/0d158fb721d3f142b8778ba6b0dcc7e7...
wc.cdn.tv####.com/static/plugin/3ffc824ce6a90a5ce7b5e9deb06f20d1
wc.cdn.tv####.com/static/plugin/bae7dc6701bc8e540ba4f4902dd17d9a.gz
wc.cdn.tv####.com/static/plugin/c3f5b16990736537bc46ebed2d68464b.gz
wc.cdn.tv####.com/static/plugin/f6a9f582f7bd6ccf27075144f551940e.gz

Запросы HTTP POST:

api.o####.ads####.cn/thirdparty/encsapi/enChn2
d####.100u####.com.####.net:443/reportcomp
er####.u####.com.####.com:443/apm_cc
hub.mydians####.com/u
new-####.u####.com:443/api/postZdata
newap####.math####.cn/titan/monitor/device_info
pro.wildpet####.com/dycn/update
pro.wildpet####.com:201/proxy/get?e=####&r=####
t####.dians####.com/v1/del_peer
t####.dians####.com/v1/new_peer
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.pylock
/data/data/####/0cdf16c8e9c7ec49_0
/data/data/####/32fe99e8d748c3b6b1c6959eaf3e7faf.0.tmp
/data/data/####/32fe99e8d748c3b6b1c6959eaf3e7faf.1
/data/data/####/32fe99e8d748c3b6b1c6959eaf3e7faf.1.tmp
/data/data/####/35913eeeb2c23458cdbd64c724f98593.0
/data/data/####/35913eeeb2c23458cdbd64c724f98593.1
/data/data/####/58095b0c6485c221_0
/data/data/####/58095b0c6485c221_1
/data/data/####/5954c2a03721523a837b4cde74d83c74.0.tmp
/data/data/####/5954c2a03721523a837b4cde74d83c74.1
/data/data/####/5954c2a03721523a837b4cde74d83c74.1.tmp
/data/data/####/5aff31e2570111919ecbf95e1f7edafc.0.tmp
/data/data/####/5aff31e2570111919ecbf95e1f7edafc.1
/data/data/####/5aff31e2570111919ecbf95e1f7edafc.1.tmp
/data/data/####/6eb68ea955d68f02_0
/data/data/####/6ef9de77a73a0799b8ca4b380d3d2a6d.0
/data/data/####/6ef9de77a73a0799b8ca4b380d3d2a6d.1
/data/data/####/70298c6eb6032706_0
/data/data/####/70298c6eb6032706_1
/data/data/####/71aabc12ce4f8996_0
/data/data/####/7d547b80782fce05_0
/data/data/####/80921c7b283e09c287694e8a93e76fc5
/data/data/####/9aeccc8ac824a7a9_0
/data/data/####/9c0e78f9e2e8fbe7_0 (deleted)
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/Cookies-journal
/data/data/####/PERMANENT_DATA.xml
/data/data/####/PERMANENT_DATA.xml.bak
/data/data/####/PERMANENT_DATA.xml.bak (deleted)
/data/data/####/PLAY.xml
/data/data/####/PROXYDATA.xml
/data/data/####/PROXYDATA.xml.bak
/data/data/####/STREAM_CONFIG.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzViMWEzYzUwOGY0YTlkNjZhYTAwMDAxMA.sp
/data/data/####/Y29uZmlnXzViMWEzYzUwOGY0YTlkNjZhYTAwMDAxMA.sp.bak
/data/data/####/a833d4a7a6f88602_0
/data/data/####/a==9.4.4&&1.1.6_1699752735291_dW5pZnlfbG9ncw==;.log
/data/data/####/b94050e0460258bdbdf93381a3087dc6.0.tmp
/data/data/####/b94050e0460258bdbdf93381a3087dc6.1
/data/data/####/bc880a5046d64a76_0
/data/data/####/bdb04f991c728689c7caee41161272e7__68.tmp
/data/data/####/c2bad3572aef1317_0
/data/data/####/c50d1cf8dd9182fa6a63b2135c6a9dcf4b55b808e9a4854....0.tmp
/data/data/####/c50d1cf8dd9182fa6a63b2135c6a9dcf4b55b808e9a4854...2823.0
/data/data/####/c635a2229b7c93d9_0
/data/data/####/c6f69eba0b8c5457_0
/data/data/####/channels
/data/data/####/com.fengyun.live_preferences.xml
/data/data/####/customs
/data/data/####/d5bdf84fbacd68c2_0
/data/data/####/dy_live.xml
/data/data/####/ea8fa563e4b287d4_0 (deleted)
/data/data/####/efs_launch.xml
/data/data/####/efsid
/data/data/####/efsid3269
/data/data/####/epg-cctv1-20231112.json
/data/data/####/epg.dex
/data/data/####/epg.dex.flock (deleted)
/data/data/####/epg.tmp
/data/data/####/event_conf.xml
/data/data/####/event_db.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fb8390232e2d5e1a5f8fb768ac555ea7.0
/data/data/####/fb8390232e2d5e1a5f8fb768ac555ea7.0.tmp
/data/data/####/fb8390232e2d5e1a5f8fb768ac555ea7.1.tmp
/data/data/####/hx_send_vip_helper.xml
/data/data/####/hxzb_api.xml
/data/data/####/hxzb_inject.xml
/data/data/####/hxzb_shared.xml
/data/data/####/hxzb_wan.xml
/data/data/####/i==1.2.0&&1.1.6_1699752735876_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/journal
/data/data/####/kb-cctv1.0
/data/data/####/kb-cctv1.0 (deleted)
/data/data/####/metrics_guid
/data/data/####/net_node.xml
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/player_strategy.xml
/data/data/####/player_strategy.xml.bak
/data/data/####/plugin.dex
/data/data/####/plugin.dex.flock (deleted)
/data/data/####/plugin.tmp
/data/data/####/plugin_config.xml
/data/data/####/pp.dex
/data/data/####/pp.dex.flock (deleted)
/data/data/####/pp.jar
/data/data/####/prefs_device.xml
/data/data/####/prefs_device.xml.bak
/data/data/####/proc_auxv
/data/data/####/promote.dex
/data/data/####/promote.dex.flock (deleted)
/data/data/####/promote.tmp
/data/data/####/sendlock
/data/data/####/settings.prefs.xml
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/spider_prefs.xml
/data/data/####/spider_prefs.xml.bak
/data/data/####/t==9.4.4&&1.1.6_1699752736253_dW5pZnlfbG9ncw==;.log
/data/data/####/the-real-index
/data/data/####/tvcore.tmp
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak
/data/data/####/unique
/data/data/####/ver
/data/data/####/x_google_ad_s_id_123
/data/data/####/z==1.2.0&&1.1.6_1699752722378_emNmZw==;.log
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor0
ip route get 8.8.8.8
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Загружает динамические библиотеки:

libcrashsdk
libmmkv
libtvcore
libumeng-spy

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней