Android.RemoteCode.8242

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.1093.origin
Android.RemoteCode.345.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 1####.210.222.28:2013
TCP(HTTP/1.1) singl####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 64.2####.162.94:80
TCP(HTTP/1.1) mobilem####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) s2.starsch####.com:80
TCP(HTTP/1.1) d####.100u####.com.####.net:80
TCP(HTTP/1.1) c####.cn.edg####.net:80
TCP(HTTP/1.1) p####.api.math####.cn:80
TCP(HTTP/1.1) g3.l####.com:80
TCP(HTTP/1.1) 1####.57.193.52:80
TCP(HTTP/1.1) videopi####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 1####.92.163.136:8088
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) 1####.57.193.95:80
TCP(HTTP/1.1) co####.ssp.math####.cn:80
TCP(HTTP/1.1) cdn.sn####.cn:80
TCP(HTTP/1.1) 74.1####.131.106:80
TCP(HTTP/1.1) api.o####.ads####.cn:80
TCP(HTTP/1.1) detec####.math####.cn:80
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) 74.1####.131.105:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) dd.zxi####.cn:443
TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) appmk####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) new-####.u####.com:443
TCP(TLS/1.0) errne####.u####.com.####.com:443
TCP(TLS/1.0) to####.ctobsn####.com.####.net:443
TCP(TLS/1.0) sf3-fe####.pglstat####.com.####.com:443
TCP(TLS/1.0) 64.2####.162.94:443
TCP(TLS/1.0) d####.100u####.com.####.net:443
TCP(TLS/1.0) d####.han####.today:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) m####.vo####.com.####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) p####.google####.com:443
UDP tm4.binst####.live:3923
UDP as2.binst####.live:3924
UDP as3.binst####.live:13
UDP www.gst####.com:443
UDP tm4.binst####.live:3924
UDP 2####.255.255.250:1900
UDP as3.binst####.live:3923
UDP p####.google####.com:443
UDP as2.binst####.live:3923
UDP tm4.binst####.live:13
UDP tm1.binst####.live:13
UDP tm1.binst####.live:3923
TCP api-ac####.pangoli####.com.####.com:443
TCP lf6-ad-####.pglstat####.com.####.com:443
UDP as3.binst####.live:3924
UDP as2.binst####.live:13
TCP sf3-fe####.pglstat####.com.####.com:443

Запросы DNS:

and####.a####.go####.com
and####.google####.com
api-ac####.pangoli####.com
api-ac####.pangoli####.com
api.c####.cn
api.o####.ads####.cn
appmk####.oss-cn-####.aliy####.com
as1.binst####.live
as2.binst####.live
as3.binst####.live
as4.binst####.live
c####.dc.100u####.com
cdn.sn####.cn
co####.ssp.math####.cn
d####.100u####.com
d####.han####.today
dd.zxi####.cn
detec####.math####.cn
errne####.u####.com
g3.l####.com
lf6-ad-####.pglstat####.com
m####.go####.com
m####.vo####.com
mobilem####.oss-cn-####.aliy####.com
newap####.math####.cn
p####.api.math####.cn
p####.google####.com
p####.han####.today
piccpn####.v.myal####.com
pla####.google####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
s2.starsch####.com
sf3-fe####.pglstat####.com
singl####.oss-cn-####.aliy####.com
tm1.binst####.live
tm2.binst####.live
tm3.binst####.live
tm4.binst####.live
to####.ctobsn####.com
u####.u####.com
ucc.u####.com
ut####.u####.com
videopi####.oss-cn-####.aliy####.com
www.gst####.com

Запросы HTTP GET:

appmk####.oss-cn-####.aliy####.com:443/recommend/20231115180614170004277...
c####.cn.edg####.net/epg/epginfo?serviceId=####&c=####&d=####
cdn.sn####.cn/channel/202401121524481705044288321.zip
cdn.sn####.cn/plugin/202401161937581705405078467.jar
co####.ssp.math####.cn/api/v2/SDKCommonConfig?channelCode=####&version=#...
co####.ssp.math####.cn/api/v3/sdkTestConfig?send_ts=####
d####.100u####.com.####.net/sdkfile/111c402cfe4d616062d99ab6fbc3d922.jar...
d####.100u####.com.####.net/sdkfile/7d708e5667de342077cfab8cc1a0412a.apk...
d####.100u####.com.####.net/sdkfile/898092e3f1108fc5ab84211e6078203c.apk...
d####.100u####.com.####.net/sdkfile/d88ff57291eb7cb9851b1ae7163ff26c.apk...
dd.zxi####.cn:443/api/?ty=####&id=####&channel=####&callback=####
detec####.math####.cn/favicon.ico
detec####.math####.cn/sdk/checkCookie/httpClient?uniqueId=####&androidVe...
detec####.math####.cn/sdk/checkCookie/webview?uniqueId=####&androidVersi...
detec####.math####.cn/sdk/checkRedirect?uniqueId=####&androidVersion=###...
detec####.math####.cn/sdk/filterHeader/httpClient?uniqueId=####&androidV...
detec####.math####.cn/sdk/filterHeader/webview?uniqueId=####&androidVers...
detec####.math####.cn/sdk/redirectHttpClientSecondPage?uniqueId=####&and...
detec####.math####.cn/sdk/setCookie/httpClient?uniqueId=####&androidVers...
detec####.math####.cn/sdk/setCookie/webview?uniqueId=####&androidVersion...
detec####.math####.cn/sdk/validateCookie/httpClient?uniqueId=####&androi...
detec####.math####.cn/sdk/validateCookie/webview?uniqueId=####&androidVe...
g3.l####.com/r?format=####
mobilem####.oss-cn-####.aliy####.com/config/config.json
mobilem####.oss-cn-####.aliy####.com/config/update.json
p####.api.math####.cn/ip?send_ts=####
s2.starsch####.com/thumb/123/thumb@240_180.jpg
s2.starsch####.com/thumb/48/thumb@240_180.jpg
sf3-fe####.pglstat####.com.####.com:443/pic/cctv6_2.png
singl####.oss-cn-####.aliy####.com/config/mbconfig.json?token=####
to####.ctobsn####.com.####.net:443/service/2/app_alert_check/?aid=####&t...
videopi####.oss-cn-####.aliy####.com/liveing_1930.png
videopi####.oss-cn-####.aliy####.com/liveing_2136.png
videopi####.oss-cn-####.aliy####.com/liveing_2370.png
videopi####.oss-cn-####.aliy####.com/liveing_2372.png
videopi####.oss-cn-####.aliy####.com/liveing_47.png
videopi####.oss-cn-####.aliy####.com/liveing_48.png
videopi####.oss-cn-####.aliy####.com/mz.png
videopi####.oss-cn-####.aliy####.com/xiqu.webp

Запросы HTTP POST:

api.o####.ads####.cn/thirdparty/encsapi/enChn2
d####.100u####.com.####.net:443/pluginsync
d####.100u####.com.####.net:443/reportcomp
d####.100u####.com.####.net:443/reportcompbin
d####.100u####.com.####.net:443/sdk
d####.100u####.com.####.net:443/sdkbin
d####.han####.today:443/dycn/update
d####.han####.today:443/proxy/get?e=####&r=####
errne####.u####.com.####.com:443/apm_cc
m####.vo####.com.####.com:443/mscc/common_setting_otob?lc_id=####&platfo...
m####.vo####.com.####.com:443/ri/report_otob?lc_id=####&platform=####&de...
na61-####.wagbr####.ali####.####.com:443/v2/inn/fetch
new-####.u####.com:443/anti/postZdata
newap####.math####.cn/titan/monitor/device_info
to####.ctobsn####.com.####.net:443/service/2/app_log/?device_platform=##...
to####.ctobsn####.com.####.net:443/service/2/device_register_only/?aid=#...
to####.ctobsn####.com.####.net:443/service/2/log_settings/?device_platfo...
u####.u####.com:443/unify_logs
u####.u####.com:443/zcfg

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.bak
/data/data/####/.dmpvedpogjhejs.cfg
/data/data/####/.fsgkea
/data/data/####/.imprint
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jg.store.report_pid
/data/data/####/.msf3_31d659304230575c05a3c5ebd11c8d076e58118c
/data/data/####/.msf3_4101dff45425a5380675454177d6e6b4e29a5ebb
/data/data/####/.msf3_6f05be3a01810a12a0dce73b48e953e9237e0a2b
/data/data/####/.msf3_904f2636614f90c4f53ea2df4c3b31d5d606a64b
/data/data/####/.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
/data/data/####/.msp_589c22335a381f122d129225f5c0ba3056ed5811
/data/data/####/.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
/data/data/####/.mss_9b8ed9956d7e60469912dd239a0251f93cd1e80d
/data/data/####/.pylock
/data/data/####/0c8418c0f2386069_0
/data/data/####/1705440331823
/data/data/####/1705440331884
/data/data/####/1705440331937
/data/data/####/17e22849ba98dec2_0
/data/data/####/19d5b75cebbee26c_0
/data/data/####/2634634575.apk
/data/data/####/2634634575.apk.temp
/data/data/####/2634634575.dex
/data/data/####/2634634575.dex.flock (deleted)
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...0-5905
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...05.apk
/data/data/####/307a09b99651c393e8261e11c98d8008-49c99a9dd9184f...5.conf
/data/data/####/3688728299.apk
/data/data/####/3688728299.apk.temp
/data/data/####/3688728299.dex
/data/data/####/3688728299.dex.flock (deleted)
/data/data/####/4006947416.apk
/data/data/####/4006947416.apk.temp
/data/data/####/4006947416.dex
/data/data/####/4006947416.dex.flock (deleted)
/data/data/####/529398700.dex
/data/data/####/529398700.dex.flock (deleted)
/data/data/####/529398700.jar
/data/data/####/529398700.jar.temp
/data/data/####/6eb68ea955d68f02_0
/data/data/####/745a2f442935879b71d7c1592e411ba9.xml
/data/data/####/8d4af11beedb9435_0
/data/data/####/CHLfVtqJjCYW (deleted)
/data/data/####/Cookies-journal
/data/data/####/PROXYDATA.xml
/data/data/####/PROXYDATA.xml.bak
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Web Data-journal (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp
/data/data/####/Y29uZmlnXzYzOGI0ZjQ4ODhjY2RmNGI3ZTk0MDMyOQ.sp.bak
/data/data/####/a==9.6.1&&6.2.0_1705440325903_dW5pZnlfbG9ncw==;.log
/data/data/####/adc.xml
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/c6a46ad0f5c550909994dd81f5728cb5
/data/data/####/ccg_sp_config_file.xml
/data/data/####/cd75e7340733ca48a203532932c1ed29
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/com.byted.pangle.apk
/data/data/####/com.supertv.mobile.hdkan_preferences.xml
/data/data/####/compFully.dex
/data/data/####/datacdn_channel.0
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/download_history.xml
/data/data/####/download_sdk_config.sgv
/data/data/####/dy_live.xml
/data/data/####/efs_launch.xml
/data/data/####/efs_launch.xml.bak
/data/data/####/efsid
/data/data/####/efsid3627
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/file_sp_new.xml
/data/data/####/file_sp_new.xml.bak
/data/data/####/i==1.2.0&&6.2.0_1705440329765_dW5pZnlfbG9ncw==;.log
/data/data/####/index
/data/data/####/itconfig.sp
/data/data/####/itconfig.sp.bak
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jsonzip.json
/data/data/####/kk_sp_main_v2.xml
/data/data/####/kk_sp_main_v6.xml
/data/data/####/libPglbizssdk_ml.so
/data/data/####/libavmdl_lite.so
/data/data/####/libjiagu.so
/data/data/####/libkeva.so
/data/data/####/libmaparmor.so
/data/data/####/libpanglarmor.so
/data/data/####/libpanglearmor.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libttmplayer_lite.so
/data/data/####/metrics_guid
/data/data/####/miui.apk
/data/data/####/miui.dex
/data/data/####/miui.dex.flock (deleted)
/data/data/####/mkt_version_v6.xml
/data/data/####/mkt_version_v6.xml.bak
/data/data/####/mobile_db-journal
/data/data/####/mobile_tv_version.xml
/data/data/####/mobile_tv_version.xml.bak
/data/data/####/na.czl
/data/data/####/paconfig.sp
/data/data/####/paconfig.sp.bak
/data/data/####/pangle_com.byted.pangle_applog_net_cache.dat.xml
/data/data/####/pangle_com.byted.pangle_bd_embed_tea_agent.db-journal
/data/data/####/pangle_com.byted.pangle_d8b674543fc0b023b69f6a3...04.xml
/data/data/####/pangle_com.byted.pangle_downloader.db-journal
/data/data/####/pangle_com.byted.pangle_embed_applog_stats.xml
/data/data/####/pangle_com.byted.pangle_embed_applog_stats.xml....leted)
/data/data/####/pangle_com.byted.pangle_embed_header_custom.xml
/data/data/####/pangle_com.byted.pangle_embed_last_sp_session.xml
/data/data/####/pangle_com.byted.pangle_npth.xml
/data/data/####/pangle_com.byted.pangle_npth_log.db-journal
/data/data/####/pangle_com.byted.pangle_snssdk_openudid.xml
/data/data/####/pangle_com.byted.pangle_softdec.xml
/data/data/####/pangle_com.byted.pangle_softdec.xml.bak
/data/data/####/pangle_com.byted.pangle_sp_bidding_opt_libra.xml
/data/data/####/pangle_com.byted.pangle_sp_bidding_opt_libra.xml.bak
/data/data/####/pangle_com.byted.pangle_tt_sdk_settings_other.xml
/data/data/####/pangle_com.byted.pangle_tt_sdk_settings_other.xml.bak
/data/data/####/pangle_com.byted.pangle_ttopensdk.db-journal
/data/data/####/pangle_meta_data_sp.xml
/data/data/####/pangle_meta_data_sp.xml.bak
/data/data/####/plugin_oat_info.xml
/data/data/####/proc_auxv
/data/data/####/scheme_list_data.sgv
/data/data/####/sendlock
/data/data/####/share_edit_config.xml
/data/data/####/simple-main-msg.dat
/data/data/####/simple-main-req.dat
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/t==9.6.1&&6.2.0_1705440324978_dW5pZnlfbG9ncw==;.log
/data/data/####/temp_v_11.xml
/data/data/####/the-real-index
/data/data/####/tt_nd
/data/data/####/tt_sdk_settings_other.blk
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_policy_grant.xml
/data/data/####/um_session_id.xml
/data/data/####/um_umcrash.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_policy_result_flag
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/umzid_general_config.xml
/data/data/####/umzid_general_config.xml.bak (deleted)
/data/data/####/unique
/data/data/####/update.lock
/data/data/####/ver
/data/data/####/yh-cctv1-20240117.json
/data/data/####/yh-cctv2-20240117.json
/data/data/####/yh-zhejiang-20240117.json
/data/data/####/z==1.2.0&&6.2.0_1705440322025_emNmZw==;.log
/data/media/####/5796f032f776bf88c6d4c9ce9edd0850
/data/media/####/5ed27668d66d4361b5d6611db249f496
/data/media/####/67e2094305d6f146137ec3160b5f043f
/data/media/####/clientudid.dat
/data/media/####/temp_pkg_info.json
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

/data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
/system/bin/cat /proc/cpuinfo
app_process /system/bin com.android.commands.pm.Pm list features
app_process /system/bin com.android.commands.pm.Pm list libraries
app_process /system/bin com.android.commands.pm.Pm list packages -f
app_process /system/bin com.android.commands.pm.Pm path <Package>
app_process /system/bin com.android.commands.pm.Pm path com.ss.android.ugc.aweme
app_process /system/bin com.android.commands.pm.Pm path com.tencent.mm
app_process /system/bin com.android.commands.wm.Wm density
app_process /system/bin com.android.commands.wm.Wm size
cat /sys/class/net/eth0/address
cat /sys/class/net/wlan0/address
chmod 777 /data/user/0/<Package>/files/.honor
chmod 777 /data/user/0/<Package>/files/.honor/2634634575.apk
chmod 777 /data/user/0/<Package>/files/.honor/3688728299.apk
chmod 777 /data/user/0/<Package>/files/.honor/4006947416.apk
chmod 777 /data/user/0/<Package>/files/.honor/529398700.jar
chmod 777 /data/user/0/<Package>/files/pangle_com.byted.pangle/tt_nd
dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --compiler-filter=speed --dex-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5403/apk/base-1.apk --oat-file=/data/user/0/<Package>/files/pangle_p/com.byted.pangle/version-5403/dalvik-cache/compFully.dex
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.brand
getprop ro.product.model
getprop ro.system.build.id
getprop ro.vivo.os.build.display.id
ip route
ls -l /system/bin/su
ls /
ls /sys/class/thermal
sh
sh -c type su

Загружает динамические библиотеки:

libPglbizssdk_ml
libavmdl_lite
libcrashsdk
libjiagu
libkeva
libmaparmor
libmmkv
libpanglarmor
libtobEmbedEncrypt
libttmplayer_lite
libtvcore
libumeng-spy

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

AES
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
RSA-ECB-PKCS1Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней