Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.RemoteCode.345.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) co####.ssp.math####.cn:80
- TCP(HTTP/1.1) p####.api.math####.cn:80
- TCP(HTTP/1.1) d####.100u####.com.####.net:80
- TCP(HTTP/1.1) newap####.math####.cn:80
- TCP(HTTP/1.1) detec####.math####.cn:80
- TCP(HTTP/1.1) 1####.161.124.146:12340
- TCP(HTTP/1.1) connect####.gst####.com:80
- TCP(HTTP/1.1) l####.b####.com:80
- TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) cc.fou####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) 64.2####.162.100:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) d####.100u####.com.####.net:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.2) 1####.177.14.106:443
- TCP(TLS/1.2) md####.google####.com:443
- UDP md####.google####.com:443
- UDP rr18---####.g####.com:443
- UDP hs9.hangzho####.com:16000
- TCP 1####.20.60.53:12354
Запросы DNS:
- and####.a####.go####.com
- and####.google####.com
- api.yunco####.com
- c####.dc.100u####.com
- cc.fou####.com
- co####.ssp.math####.cn
- connect####.gst####.com
- d####.100u####.com
- detec####.math####.cn
- gmscomp####.google####.com
- hs9.hangzho####.com
- ip.ta####.com
- l####.b####.com
- m####.go####.com
- md####.google####.com
- newap####.math####.cn
- p####.api.math####.cn
- p####.google####.com
- rr18---####.g####.com
- rr2---s####.g####.com
- rr9---s####.g####.com
- w####.pcon####.com.cn
- www.go####.com
Запросы HTTP GET:
- api.yunco####.com/analyze/report?imei=####&anid=####&mmmm=####&oaid=####...
- co####.ssp.math####.cn/api/v2/SDKActiveConfig?version=####&channelCode=#...
- co####.ssp.math####.cn/api/v2/SDKCommonConfig?channelCode=####&version=#...
- co####.ssp.math####.cn/api/v3/mgmConfig?channelCode=####&version=####&an...
- co####.ssp.math####.cn/api/v3/sdkTestConfig?send_ts=####
- d####.100u####.com.####.net/sdkfile/111c402cfe4d616062d99ab6fbc3d922.jar...
- d####.100u####.com.####.net/sdkfile/2e3cbb79f9271ef1ecef6ed42250dbbb.apk...
- d####.100u####.com.####.net/sdkfile/63d2a0466b49cd3cf3306703a8368f27.apk...
- d####.100u####.com.####.net/sdkfile/717a405fdefb30435cfe5295db4020d1.apk...
- d####.100u####.com.####.net/sdkfile/d32cd3b8c54541bc36f56a0872f3f1e0.apk...
- detec####.math####.cn/favicon.ico
- detec####.math####.cn/images/sdk/detective.jpeg
- detec####.math####.cn/js/finger20220224.js
- detec####.math####.cn/sdk/checkCookie/httpClient?uniqueId=####&androidVe...
- detec####.math####.cn/sdk/checkCookie/webview?uniqueId=####&androidVersi...
- detec####.math####.cn/sdk/checkRedirect?uniqueId=####&androidVersion=###...
- detec####.math####.cn/sdk/filterHeader/httpClient?uniqueId=####&androidV...
- detec####.math####.cn/sdk/filterHeader/webview?uniqueId=####&androidVers...
- detec####.math####.cn/sdk/oneShot?uniqueId=####&androidVersion=####&sdkV...
- detec####.math####.cn/sdk/openWebview?uniqueId=####&androidVersion=####&...
- detec####.math####.cn/sdk/redirectHttpClientSecondPage?uniqueId=####&and...
- detec####.math####.cn/sdk/redirectWebviewSecondPage?uniqueId=####&androi...
- detec####.math####.cn/sdk/setCookie/httpClient?uniqueId=####&androidVers...
- detec####.math####.cn/sdk/setCookie/webview?uniqueId=####&androidVersion...
- detec####.math####.cn/sdk/validateCookie/httpClient?uniqueId=####&androi...
- detec####.math####.cn/sdk/validateCookie/webview?uniqueId=####&androidVe...
- detec####.math####.cn/sdk/webviewBasic?uniqueId=####&androidVersion=####...
- l####.b####.com/jquery/2.1.4/jquery.min.js
- na61-####.wagbr####.ali####.####.com/service/getIpInfo2.php?ip=####
- newap####.math####.cn/ssp/mgm/task?taskId=####&ip=####&channelCode=####&...
- p####.api.math####.cn/ip?send_ts=####
- w####.pcon####.com.cn/ipJson.jsp?json=####&level=####
Запросы HTTP POST:
- api.yunco####.com/service/rest
- cc.fou####.com:443/service/rest
- d####.100u####.com.####.net:443/pluginsync
- d####.100u####.com.####.net:443/reportcomp
- d####.100u####.com.####.net:443/reportcompbin
- d####.100u####.com.####.net:443/sdk
- d####.100u####.com.####.net:443/sdkbin
- newap####.math####.cn/titan/monitor/device_info
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/0ceecba5a7987101_0 (deleted)
- /data/data/####/1703928358587
- /data/data/####/1703928358747
- /data/data/####/1703928358819
- /data/data/####/1703928359090
- /data/data/####/1f39cadb47949e30_0
- /data/data/####/275dd31ddf24f723_0
- /data/data/####/3045372695.apk
- /data/data/####/3045372695.apk.temp
- /data/data/####/3045372695.dex
- /data/data/####/3045372695.dex.flock (deleted)
- /data/data/####/32d6a06f4d1c091f_0
- /data/data/####/3327062531.apk
- /data/data/####/3327062531.apk.temp
- /data/data/####/3327062531.dex
- /data/data/####/3327062531.dex.flock (deleted)
- /data/data/####/3981590050.apk
- /data/data/####/3981590050.apk.temp
- /data/data/####/3981590050.dex
- /data/data/####/3981590050.dex.flock (deleted)
- /data/data/####/3faf8a1e7424fe27_0
- /data/data/####/4411972fda500158_0
- /data/data/####/4eb0e5e0e7eb7b81_0
- /data/data/####/51538994f74c433d_0
- /data/data/####/529398700.dex
- /data/data/####/529398700.dex.flock (deleted)
- /data/data/####/529398700.jar
- /data/data/####/529398700.jar.temp
- /data/data/####/533675113.apk
- /data/data/####/533675113.apk.temp
- /data/data/####/533675113.dex
- /data/data/####/533675113.dex.flock (deleted)
- /data/data/####/58095b0c6485c221_0
- /data/data/####/58095b0c6485c221_1
- /data/data/####/647c0b2627c6dbe6_0
- /data/data/####/69caf6d4c7c70e0a_0
- /data/data/####/6eb68ea955d68f02_0
- /data/data/####/6ebe04f358d53a2075d3819d1d8a688a
- /data/data/####/70298c6eb6032706_0
- /data/data/####/70298c6eb6032706_1
- /data/data/####/745a2f442935879b71d7c1592e411ba9.xml
- /data/data/####/7d547b80782fce05_0
- /data/data/####/9f22e6564d589018_0
- /data/data/####/Cookies-journal
- /data/data/####/ForestDataReportImpl.dex
- /data/data/####/ForestDataReportImpl.dex.flock (deleted)
- /data/data/####/ForestDataReportImpl.jar
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/ahq_spu_ti.xml
- /data/data/####/bd7e9818ddfd2382_0
- /data/data/####/bf4980b910c9f9ce703cba3653adb885
- /data/data/####/bigdatareport.db-journal
- /data/data/####/com.xiaopaitech.supportsdk_preferences.xml
- /data/data/####/dexjarfile.db-journal
- /data/data/####/dsspu_ti.xml
- /data/data/####/file_sp_new.xml
- /data/data/####/file_sp_new.xml.bak
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/skyworth_uniqueid.properties
- /data/data/####/spu_gz.xml
- /data/data/####/spu_ti.xml
- /data/data/####/spu_ti.xml.bak
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/xUtils_http_cookie.db
- /data/data/####/xUtils_http_cookie.db-journal
- /data/data/####/xUtils_http_cookie.db-journal (deleted)
- /data/data/####/x_google_ad_s_id_123
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- busybox ifconfig
- cat /sys/class/net/eth0/address
- cat /sys/class/net/wlan0/address
- chmod 777 /data/user/0/<Package>/files/.honor
- chmod 777 /data/user/0/<Package>/files/.honor/3045372695.apk
- chmod 777 /data/user/0/<Package>/files/.honor/3327062531.apk
- chmod 777 /data/user/0/<Package>/files/.honor/3981590050.apk
- chmod 777 /data/user/0/<Package>/files/.honor/529398700.jar
- chmod 777 /data/user/0/<Package>/files/.honor/533675113.apk
- getprop
- sh
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- AES-CBC-NoPadding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
