Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mart.1.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Mart.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- u####.####.com
- o####.####.com
- i####.####.org
- a####.####.org
- dispat####.####.com
Запросы HTTP GET:
- a####.####.org/3/genre/movie/list?api_key=####&language=####
- i####.####.org/t/p/w185/lUEn7f7xCLuT1kRCHoxMTRnYKXW.jpg
- i####.####.org/t/p/w185/33RypiHCQc3BkuzZ6WsonrhSIer.jpg
- i####.####.org/t/p/w342/jjBgi2r5cRt36xF6iNUEhzscEcb.jpg
- i####.####.org/t/p/w342/qjiskwlV1qQzRCjpV0cL9pEMF9a.jpg
- i####.####.org/t/p/w500/dkMD5qlogeRMiEixC4YNPUvax2T.jpg
- i####.####.org/t/p/w342/z4x0Bp48ar3Mda8KiPD1vwSY3D8.jpg
- i####.####.org/t/p/w342/5gJkVIVU7FDp7AfRAbPSvvdbre2.jpg
- i####.####.org/t/p/w185/n4DD1AYU7WEMNPLga1TxqnHivn1.jpg
- i####.####.org/t/p/w500/pJjIH9QN0OkHFV9eue6XfRVnPkr.jpg
- i####.####.org/t/p/w185/9O71WSILj1af9smwuN44nGd198Q.jpg
- i####.####.org/t/p/w342/tIKFBxBZhSXpIITiiB5Ws8VGXjt.jpg
- i####.####.org/t/p/w342/yNsdyNbQqaKN0TQxkHMws2KLTJ6.jpg
- i####.####.org/t/p/w342/bbxtz5V0vvnTDA2qWbiiRC77Ok9.jpg
- u####.####.com/sdk/HostDex_vshare_20170103101434.jar
- i####.####.org/t/p/w342/e1mjopzAS2KNsvpbpahQ1a6SkSn.jpg
- i####.####.org/t/p/w342/z09QAf8WbZncbitewNk6lKYMZsh.jpg
- a####.####.org/3/movie/135397?api_key=####&language=####
- i####.####.org/t/p/w342/bndiUFfJxNd2fYx8XO610L9a07m.jpg
- a####.####.org/3/movie/329865/videos?api_key=####
- i####.####.org/t/p/w342/WLQN5aiQG8wc9SeKwixW7pAR8K.jpg
- i####.####.org/t/p/w342/rXMWOZiCt6eMX22jWuTOSdQ98bY.jpg
- u####.####.com/sdk/libDaemonProcess_20160520175142.so
- a####.####.org/3/movie/popular?page=####&api_key=####&language=####
- a####.####.org/3/movie/135397/videos?api_key=####
- i####.####.org/t/p/w500/yIZ1xendyqKvY3FGeeUYUd5X9Mm.jpg
- a####.####.org/3/movie/135397/credits?api_key=####&language=####
- a####.####.org/3/movie/329865/credits?api_key=####&language=####
- a####.####.org/3/movie/329865?api_key=####&language=####
- i####.####.org/t/p/w342/gri0DDxsERr6B2sOR1fGLxLpSLx.jpg
- i####.####.org/t/p/w342/uSHjeRVuObwdpbECaXJnvyDoeJK.jpg
- i####.####.org/t/p/w185/xLjvSRDOl6CiAhVCt2eKPA78dnC.jpg
- i####.####.org/t/p/w342/hLudzvGfpi6JlwUnsNhXwKKg4j.jpg
- i####.####.org/t/p/w342/kqjL17yufvn9OVLyXYpvtyrFfak.jpg
- i####.####.org/t/p/w342/nHXiMnWUAUba2LZ0dFkNDVdvJ1o.jpg
- a####.####.org/3/configuration?api_key=####&language=####
- a####.####.org/3/movie/now_playing?page=####&api_key=####&language=####
- i####.####.org/t/p/w342/ylXCdC106IKiarftHkcacasaAcb.jpg
Запросы HTTP POST:
- o####.####.com/v2/get_update_time
- dispat####.####.com/v2.1/2000
- s####.####.com/v2.1/2004
- s####.####.com/v2.1/2003
- s####.####.com/v2.1/2002
- s####.####.com/v2.1/2001
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/image_cache/v2.ols100.1/18/GAohyEBcF0H49-CaCbNUiu7shEA.-206656822.tmp
- /data/data/####/databases/cc/cc.db
- /data/data/####/app_sdk.data/libDaemonProcess.so
- /sdcard/database/actiondown
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_sdk.data/libDaemonProcess_arm32_19.so
- /data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
- /data/data/####/app_sdk.data/dexhostinjection.jar_22.jar
- /data/data/####/app_sdk.data/MainJson.txt
- /data/data/####/app_sdk.data/libDaemonProcess.so_22.so
- /data/data/####/files/pid
- /data/data/####/databases/MoviesDB-journal
- /data/data/####/cache/image_cache/v2.ols100.1/87/l2FTot0qxd4Mpe7CHS4g2teEycU.-1071738235.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/31/oNGaZi8AkpuSpEQkytmZJbDys-s.569267849.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/database/mychannel
- /sdcard/database/5supdate_4.apk
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/AppEventsLogger.persistedevents
- /data/data/####/cache/image_cache/v2.ols100.1/31/hF2Y7ovqWqEmsMOoaHkNtRmAGR8.450827770.tmp
- /data/data/####/shared_prefs/SYSTEM_SETTING.xml.bak
- /data/data/####/app_sdk.data/libDaemonProcess_arm32_22.so
- /data/data/####/cache/image_cache/v2.ols100.1/0/sQ3qk9xZx2IblPOxOsyzNRqny_0.1574551619.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/64/tPtFC4_eLnKl-4xILr58N5ZpcZU.-933178493.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/57/VPiL21Krf9CsDIuPrxFrCOGh-Y8.2121962916.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/23/bA5JY-ir0HEc4czqba8IsBF4QgE.-440449647.tmp
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/app_sdk.data/dexhostinjection.jar
- /data/data/####/cache/image_cache/v2.ols100.1/41/8-ONQwnuxWgKpJ8WzOLkak3AmlQ.412304257.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/74/w7nDVTnt2ZhzqQMMr8Efaevda_M.1616815182.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/52/c6BhEPVNQo7tmuH2ssGUNJBGC4I.1100631265.tmp
- /data/data/####/shared_prefs/onlineconfig_agent_online_setting_####.xml
- /data/data/####/shared_prefs/FBAdPrefs.xml
- /sdcard/database/actionsuk
- /data/data/####/files/lockpid
- /data/data/####/cache/image_cache/v2.ols100.1/77/vEOslx9aRlaJBcFsBgr-AmXawnw.-733742465.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/82/JvpMoX2R4kZ9VKqNhotWIUWeg0I.-1378162213.tmp
- /data/data/####/shared_prefs/SDKIDFA.xml
- /data/data/####/cache/image_cache/v2.ols100.1/30/J3xu3WVFs5wkwAQ5KGCB5X8b-RM.131165080.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/1/y_T8ovvbdIxN3H_0xB1TiSHAmEA.884014335.tmp
- /data/data/####/files/mobclick_agent_cached_####3
- /data/data/####/cache/image_cache/v2.ols100.1/96/FU0m9_pGP3525XIqfF3GBH-FRRc.-1620789188.tmp
- /data/data/####/app_sdk.data/libDaemonProcess_arm64_19.so
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####.xml
- /data/data/####/app_sdk.data/libDaemonProcess_arm64_22.so
- /data/data/####/shared_prefs/SYSTEM_SETTING.xml
- /data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/cache/image_cache/v2.ols100.1/9/2AApTnQcFrkhz_l6ZEQXhdGHlYs.869497792.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/13/uuL-oYAqIFSvtKZzsne8ciXHnfk.1290107008.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/39/QRFJhc4ttZzNKqubq_ua0sM681o.-318719124.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/image_cache/v2.ols100.1/29/gl6xarmMaeOPx6pPy295WhQ1e2M.-1119477705.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/20/G47KKuMsTZu1VrazsqTHgZiZTKI.-601503745.tmp
- /data/data/####/shared_prefs/tempFile.xml
- /data/data/####/app_sdk.data/1.apk
- /data/data/####/cache/image_cache/v2.ols100.1/8/eIInRE0g5ELFH74Fqgjywg7pHh4.-1154545547.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/5/M6jppxNv9-mXyr_q6RAVbKdv6-c.-1284254929.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/69/UaqKYSC0hQHvrcM7Ycwas5jROrc.722344062.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/44/Yw-SlxWSSBcuyNkiIy5hm2XQ2FA.1187029910.tmp
- /data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/cache/image_cache/v2.ols100.1/63/FvauBydu9LOIc_HtZZYzy8qqm0w.-969546061.tmp
- /data/data/####/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- /data/data/####/databases/MoviesDB
- /data/data/####/shared_prefs/####.xml.bak
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/app_sdk.data/libDaemonProcess.so_22.so
- /data/data/####/app_sdk.data/1.apk
- /data/data/####/app_sdk.data/dexhostinjection.jar
- /data/data/####/app_sdk.data/dexhostinjection.jar_22.jar
- /data/data/####/app_sdk.data/libDaemonProcess.so
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /data/data/####/files/lockpid
- chmod 777 /data/data/####/app_sdk.data/libDaemonProcess.so
- chmod 777 /storage/emulated/0/database/5supdate_4.apk
- chmod 777 /storage/emulated/0/database/actiondown
- chmod 777 /storage/emulated/0/database/mychannel
- chmod 777 /data/data/####/app_sdk.data/libDaemonProcess.so_22.so
- chmod 777 /data/data/####/app_sdk.data
- chmod 777 /data/data/####/app_sdk.data/MainJson.txt
- chmod 777 /data/data/####/app_sdk.data/1.apk
- chmod 777 /data/data/####/app_sdk.data/dexhostinjection.jar
- chmod 777 /storage/emulated/0/database/actionsuk
- chmod 777 /data/data/####/app_sdk.data/dexhostinjection.jar_22.jar
Может автоматически отправлять СМС-сообщения.
