Android.Packed.19895

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.155.origin
Android.Triada.151.origin

Сетевая активность:

Подключается к:

h####.####.com
i####.####.com
w####.####.cn
i####.####.cn
1####.####.136:8090
a####.####.com

Запросы HTTP GET:

h####.####.com/album/s%3D1600%3Bq%3D90/sign=a91e719e9e25bc312f5d059e6eefb6c0/29381f30e924b8992deadd6869061d950b7bf688.jpg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=8ff7be8d53e736d15c13880eab6074b3/cefc1e178a82b9017d693362748da9773812ef9f.jpg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=caee331957da81cb4ae687cb6256eb67/14ce36d3d539b6005d73d45aef50352ac75cb79a.jpg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=b4218a2bac64034f0bcdc6009ff34240/77094b36acaf2edd5c160d1f8a1001e938019365.jpg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=9fae12de9445d688a702b6a294f2466f/500fd9f9d72a6059797e3af72e34349b023bbaf5.jpg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=a6828aa3d262853596e0d627a0df4db7/728da9773912b31b8d833d788118367adbb4e1f0.jpg
i####.####.com/ando-res/m/i0r*lg6v0h8-VWU1P*FQdeOi4Rt063q4kkFbwd7Db1IzyTD5msrpwg
h####.####.com/album/s%3D1600%3Bq%3D90/sign=9217028f71c6a7efbd26ac20cdca9420/f9198618367adab43febbc138cd4b31c8701e4a3.jpg

Запросы HTTP POST:

a####.####.com/ando/x/liv?app_id=9d918ef9-f3ff-4380-ae9c-6606528ba596&r=1053624443?r=####
i####.####.cn/iplookup/iplookup.php?format=####
a####.####.com/ando/x/liv?app_id=9d918ef9-f3ff-4380-ae9c-6606528ba596&r=1694347115?r=####
1####.####.136:8090/main.aspx
w####.####.cn/ip.jsp

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/kYaf9VoPNJoJLpCvaG6EtWhaX0MAfSp-bnbLI7x4c-g=/2f-wUl8G4WRE3HVigM7wUg==/W_GD9w8hmlhuLDM-.zip
/sdcard/tmpsd11012/test.dat76eabeba-5d43-4792-bd06-79cc7a3c361f.tmp
/sdcard/mmt/widegets/data/test.dat1e1fdf33-0689-4ad1-8c75-f1a6abd9f52d.tmp
/sdcard/.uct/uuid3d7f464b0-25e5-4282-8ab3-2ef335752df0.tmp
/sdcard/Android/data/####/cache/uil-images/2136662040
/data/data/####/files/kYaf9VoPNJoJLpCvaG6EtWhaX0MAfSp-bnbLI7x4c-g=/KIZnv979-aFg65liXgspCg==.new
/sdcard/tmpsd11012/test.dat158a0047-2cf8-490f-9900-fabb00249a20.tmp
/sdcard/logout/req_server.txt
/sdcard/tmpsd11012/test.datd3b888f4-241b-4edb-a727-3840e54dec54.tmp
/sdcard/Android/data/####/cache/uil-images/-1867705500
/sdcard/.env/.uunique.new
/sdcard/tmpsd11012/test.datf2cc5758-45d3-41c8-8d2c-6206c76acfff.tmp
/data/data/####/files/skmnaa_d/skmnaa_f.zip
/sdcard/sdtmp/id1e7b596de-c9f8-4ae6-83f5-fa3225ebe47c.tmp
/sdcard/.balt/sysds.datb06cb14b-dd1e-41f6-8905-fbc3f9284856.tmp
/sdcard/Android/data/####/cache/uil-images/-1707089506
/data/data/####/files/kYaf9VoPNJoJLpCvaG6EtWhaX0MAfSp-bnbLI7x4c-g=/WXMgaiiev4sU1TNA
/data/data/####/files/kYaf9VoPNJoJLpCvaG6EtWhaX0MAfSp-bnbLI7x4c-g=/AEKZ3cb2eRVVqXbSt-_jGA==
/sdcard/mmt/widegets/data/droidinfo-journal
/sdcard/logout/log.txt
/sdcard/mmt/widegets/data/test.datf02655a9-416e-46d2-a41b-cf1c5652a301.tmp
/sdcard/.hand/lastaccc96be9fd-c1dc-4cf7-9122-de6d04bf78de.tmp
/sdcard/Android/data/####/cache/.nomedia
/sdcard/sdtmp/id26b196fe0-3bf8-46b1-ad3c-cc42b3b13f77.tmp
/sdcard/mmt/widegets/data/test.dat898bebaf-f28a-4d41-a9c7-8c223b4988cc.tmp
/sdcard/.hand/developkeycb6b567d-6361-46a1-8e05-a2c7151264ca.tmp
/sdcard/Android/data/####/cache/uil-images/800581590
/sdcard/Android/data/####/cache/uil-images/1207311170
/sdcard/Android/data/####/cache/uil-images/1799940966
/data/data/####/files/kYaf9VoPNJoJLpCvaG6EtWhaX0MAfSp-bnbLI7x4c-g=/KIZnv979-aFg65liXgspCg==
/sdcard/Android/data/####/cache/uil-images/1746766035