Android.Packed.36889

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.683.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) 4####.92.62.1:80
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.1) w####.down####.ks####.####.com:80
TCP(HTTP/1.1) sdk.checkup####.g####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) ss####.g####.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) gamehe####.g####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(TLS/1.0) ho####.h####.top:443
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224

Запросы DNS:

7j####.c####.z0.####.com
c####.g####.ig####.com
c-h####.g####.com
c.c####.com
cdn.app.h####.top
cdn.game####.org
gamehe####.g####.com
ho####.h####.top
l####.tbs.qq.com
log.u####.com
mt####.go####.com
pic####.wan####.com
pic.wan####.com
pis.al####.com
plb####.u####.com
pns.al####.com
pss.al####.com
pus.al####.com
s####.u####.com
s4.c####.com
sdk.c####.ig####.com
sdk.checkup####.g####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
ss####.g####.com
u####.u####.com
z11.c####.com

Запросы HTTP GET:

c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
gamehe####.g####.com/apk/report/activate?from=####&channel_id=####&app_i...
gamehe####.g####.com/apk/report/checkupdate?channel_id=####&app_id=####&...
gamehe####.g####.com/apk/report/openapk?channel_id=####&app_id=####&game...
gamehe####.g####.com/static/wzry/css/article_detail.css?v=####
gamehe####.g####.com/static/wzry/js/jquery-1.9.1.min.js
gamehe####.g####.com/wzry/article/48142.html?channel_id=####&app_id=####...
gamehe####.g####.com/wzry/comment/list?module_type=####&module_id=####&p...
gamehe####.g####.com/wzry/hero/free?channel_id=####&app_id=####&game_id=...
gamehe####.g####.com/wzry/hot/information?channel_id=####&app_id=####&ga...
gamehe####.g####.com/wzry/news/list?pn=####&channel_id=####&app_id=####&...
gamehe####.g####.com/wzry/video/new_detail?access_token=####&v_id=####&c...
gamehe####.g####.com/wzry/video/new_list?access_token=####&k_id=####&pn=...
gamehe####.g####.com/wzry/video/new_tags?access_token=####&k_ids=####&ch...
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
sdk.checkup####.g####.com/sspsdk/checkupdate?svr=####&channel_id=####&ap...
sh.wagbr####.alibaba####.com/bar/get/58f723aa310c933fc1000bf4/?ud_get=####
ss####.g####.com/v1.0/mapping?&channel_id=####&device=####&cuid=####&cli...
ss####.g####.com/v2.0/getad?reqjson####&channel_id=####&device=####&cuid...
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_TSb400
ti####.c####.l####.####.com/config/hz-hzv3.conf
w####.down####.ks####.####.com/2017-04-26_59005ed2d5ad2.png
w####.down####.ks####.####.com/2017-04-26_59005ed7228c5.png
w####.down####.ks####.####.com/2017-04-26_59005edf019a9.png
w####.down####.ks####.####.com/2017-04-26_59005edfcdfa8.png
w####.down####.ks####.####.com/2017-04-26_59005efc7a802.png
w####.down####.ks####.####.com/2017-04-26_59005f1ec7122.png
w####.down####.ks####.####.com/2017-04-26_59005f237705b.png
w####.down####.ks####.####.com/2017-04-28_5903166adc5c9.jpeg
w####.down####.ks####.####.com/2017-04-28_59031676397b3.jpeg
w####.down####.ks####.####.com/2017-05-15_5919a872dd885.png
w####.down####.ks####.####.com/2017-05-15_5919a87336ea3.png
w####.down####.ks####.####.com/2017-05-15_5919a873bd761.png
w####.down####.ks####.####.com/2017-05-15_5919a87407b8e.png
w####.down####.ks####.####.com/2018-03-29_5abc60ffe0dc3.jpeg
w####.down####.ks####.####.com/2018-04-02_5ac1c7f64dca1.png
w####.down####.ks####.####.com/2018-04-03_5ac341cbf0621.jpeg
w####.down####.ks####.####.com/2018-04-08_5ac974d2b215f.jpeg
w####.down####.ks####.####.com/2018-04-10_5acc2f5f5f2af.png/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc324105cfc.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc330c26b36.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc33efca565.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc3431ea2d5.png/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc373d12997.jpeg
w####.down####.ks####.####.com/2018-04-10_5acc5f34d226e.png/thumblist
w####.down####.ks####.####.com/2018-04-10_5acc9bcaac014.jpeg
w####.down####.ks####.####.com/2018-04-11_5acd6bd86a379.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd6d4b31351.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd6fabc6a24.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd70148c909.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd70ec498ec.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd765e7de4e.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd7704a3e65.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd778a79a07.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd7f3225887.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd7fe981bcf.jpeg/thumblist
w####.down####.ks####.####.com/2018-04-11_5acd82ade5c45.jpeg
w####.down####.ks####.####.com/2018-04-11_5acd8300a5257.jpeg
w####.down####.ks####.####.com/swenjian/322
w####.down####.ks####.####.com/swenjian/322m
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

Запросы HTTP POST:

c-h####.g####.com/api.php?format=####&t=####
gamehe####.g####.com/apk/report/statistics?channel_id=####&app_id=####&g...
l####.tbs.qq.com/ajax?c=####&k=####
l####.tbs.qq.com/ajax?c=####&v=####&k=####
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
sdk.o####.p####.####.com/api.php?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/06ebacda-7704-43a0-9da0-ff4b4fceaaea.jar
/data/data/####/0a311b288ca9416aff2c092e01160c90ba5e67c1ac6acb8....0.tmp
/data/data/####/0bc58a2fb6b571eb597b8acbb4a19190a61cea6e43c5e25....0.tmp
/data/data/####/11660def-2709-4391-9d9b-a74d6e18d3cb
/data/data/####/11d2fa3bb517afc0d675c526d31751f09fa6d33539e7014....0.tmp
/data/data/####/1523472739980.log
/data/data/####/1740c449fc10be62df60ba0f18696c9f
/data/data/####/1cacd8928625f159188e7b451c50d52d335409256070df6....0.tmp
/data/data/####/276c9f975637a305783d1dfda634285ccc9f81a0fa32c99....0.tmp
/data/data/####/289bfa270649df01c647cc599dd5f92b140ccfafdc3e2cb....0.tmp
/data/data/####/2fe4ef04-586c-489f-8152-fc27054d6f5a.jar
/data/data/####/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/377185b5-f43a-464c-9584-dffeded633de
/data/data/####/3c5d54ef-0e19-4eb1-8a28-ef87002e5414
/data/data/####/41f4ff6a422d5991c06baf89ce53a49e0073d9fa3a1275a....0.tmp
/data/data/####/4bad8e61096f25f57b848cc9f19ee8a24b4f7a04a71afa4....0.tmp
/data/data/####/5a8153e82add3b33112e247b07cfa9f5ae7de15c2e5d6dc....0.tmp
/data/data/####/5e602d9ece2cb6a418dae8f0c2bd722949c29df42c80028....0.tmp
/data/data/####/67309225-d7c8-475c-b7f0-c63fd48ab3c6
/data/data/####/698ad22e67da8fb6d0ec988e84336166d4c545453c2980c....0.tmp
/data/data/####/71a9260a-7c82-4a07-8774-c69942da080e
/data/data/####/77fb62108338d4b9db55e8edc79c94be3205a106d625857....0.tmp
/data/data/####/7c264404572057affc38bb8c7b096c88a420c72b3cc958f....0.tmp
/data/data/####/7e05f2cc3912c55d04d813140978a44971b8a72993457cf....0.tmp
/data/data/####/82df4d9cedda70645d65ca808781f514aaff1f25bb9a678....0.tmp
/data/data/####/8a85fd88-cd96-47e8-be15-bf7e5d3588d8
/data/data/####/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/8c7a4f27-fddc-42bc-aaa0-644709001aa2
/data/data/####/91a149ed-4561-4d1e-9af1-d062ecede4b3
/data/data/####/9266d025a484122dd4f4f79b49cbe94145f73163bf9d0d8....0.tmp
/data/data/####/93be69af-8abc-47d6-8bb0-a086c6965588
/data/data/####/96634124607d8bd6439216666388aeb5f422ce2f6facd5e....0.tmp
/data/data/####/977c3176d32b1e9a6877db4636ca962050f437c0bdc2fee....0.tmp
/data/data/####/ApplicationCache.db-journal
/data/data/####/ApplicationCache.db-journal (deleted)
/data/data/####/Matrix
/data/data/####/SUBOXLOG_
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewSettings.xml
/data/data/####/a03cf236-c9ee-4706-b70c-acae3f733d90
/data/data/####/a6a428ac6e327ac57662ef32567bb67d9f1034d78ee1321....0.tmp
/data/data/####/a==7.4.0&&12.0.8_1523472734983_envelope.log
/data/data/####/a==7.4.0&&12.0.8_1523472779481_envelope.log
/data/data/####/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/b18a021d11a3004d25017230b681476b
/data/data/####/b98a80da-e598-4b41-b4c2-b52379ce8b4a
/data/data/####/bcaaa4e2cb0363707540c610f7895e31e655c26d626f453....0.tmp
/data/data/####/behavior_db_name.db-journal
/data/data/####/bzwn.db-journal
/data/data/####/c2d5982abee95e14dd6595f3c74fa937ed75bcb0bd96f24....0.tmp
/data/data/####/c45b157004989f7ff6e606d85dd8a0db5d5a0cf28b1c085....0.tmp
/data/data/####/c4a633bf-21c2-4e6c-88f4-6ecc55b10445
/data/data/####/c61913b615fb6224701377a119081f36
/data/data/####/c921984e797c4c363a8bb3839063a07cf21fe7cd1865dfa....0.tmp
/data/data/####/com.rc.s.Kz.jar
/data/data/####/com.rc.s.Kz.xml
/data/data/####/com.rc.s.Uxd.xml
/data/data/####/config.xml
/data/data/####/config.xml.bak
/data/data/####/core_info
/data/data/####/d0ba05a4ad1e027a92061beddac695a18535d0eb0b16aa5....0.tmp
/data/data/####/d5a8cdbdb1d0170fa444775b2a7017c03c0e81802250fd6....0.tmp
/data/data/####/da59034e38cfcd48d8743411a58cc9127c13a707224c138....0.tmp
/data/data/####/dafe77b14cf66092182bd6bd600ce680a3b090ce17beaeb....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/ddexe
/data/data/####/debug.conf
/data/data/####/debuggerd
/data/data/####/device.db
/data/data/####/download_info.db
/data/data/####/download_info.db-journal
/data/data/####/e47c80c00fe8d34f0a97c6c59f096752051a4663a70fc19....0.tmp
/data/data/####/e97f5588d82bc20629ac3725f4127ea09480fd90413d4fc....0.tmp
/data/data/####/ebn.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/fabd531e966d575c5f4bc233390cb95bce0e290661d0195....0.tmp
/data/data/####/fileWork
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hj_cuid_cache.xml
/data/data/####/hj_settings.xml
/data/data/####/hjofficalstrategy.db-journal
/data/data/####/huanju_ad.db
/data/data/####/huanju_ad.db-journal
/data/data/####/huanju_ad_info.xml
/data/data/####/i==1.2.0&&12.0.8_1523472734453_envelope.log
/data/data/####/i==1.2.0&&12.0.8_1523472778829_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/install-recovery.sh
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/journal.tmp
/data/data/####/libjiagu.so
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc_new.so
/data/data/####/multidex.version.xml
/data/data/####/pcdnconfigs.xml
/data/data/####/pcdnconfigs.xml.bak
/data/data/####/pidof
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/root3
/data/data/####/run.pid
/data/data/####/splash.jpg
/data/data/####/ssp_download_info.db
/data/data/####/ssp_download_info.db-journal
/data/data/####/su
/data/data/####/supolicy
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_TSb400
/data/data/####/tdata_TSb400.jar
/data/data/####/toolbox
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_socialize.xml (deleted)
/data/data/####/umeng_socialize.xml.bak
/data/data/####/video_collect.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wsroot.sh
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.cuid
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/app.db
/data/media/####/com.edwfwf.ewgw.ewgg.weg.rwg.bin
/data/media/####/com.edwfwf.ewgw.ewgg.weg.rwg.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/myself.dat
/data/media/####/sysid.dat
/data/media/####/tbslog.txt
/data/media/####/tdata_Soq141
/data/media/####/tdata_TSb400
/data/media/####/test.log

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.huanju.wzry.push.PushService 25719 300 0
cat /proc/cpuinfo
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
getprop ro.product.cpu.abi
ls /
ls /sys/class/thermal
sh

Загружает динамические библиотеки:

getuiext2
libjiagu
libpcdn_acc
pcdn_acc

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DESede-ECB-PKCS5Padding
RSA-ECB-NoPadding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней