Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
- Android.Loki.10.origin
Сетевая активность:
Подключается к:
- lo####.####.net
- g####.cn
- a####.####.net
- analy####.####.com
- p####.####.com
- and####.####.com
- d####.####.com
- set####.####.com
- cdn####.####.com
- p####.####.com:3090
- n####.####.com
- a####.####.com
Запросы HTTP GET:
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/15/58c6551bcbe58.png
- cdn####.####.com/cdn-adn/dmp/17/03/31/01/16/58dd3d6141c2e.JPEG
- cdn####.####.com/cdn-adn/html/common/2016/02/22/22/03/com.qihoo.security1456149668.2_1200X627.JPEG
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6543ca78b3.png
- cdn####.####.com/cdn-adn/dmp/17/03/30/23/14/58dd20cd1a74c.JPEG
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_type=####&sign=####&ad_num=####&ping_mode=####&only_impression=####&offset=###...
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/09/58c653d62af4a.png
- n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&or...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&ad_num=####&only_impression=####&ping_mode=####&native_info=####&tnum=##...
- cdn####.####.com/cdn-adn/offersync/17/03/28/18/30/58da3b5f853e1.jpg
- d####.####.com/onlyImpression?k=####&p=####
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=##...
- a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&screen_w=####&img_rule=####&icc=####&token=...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&only_impression=####&ad_num=####&ping_mode=####&ttc_ids=####&tnum=####&o...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...
- a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&adcat=####&screen_w=####&img_rule=####&icc=...
- d####.####.com/impression?k=####&p=####&q=####&x=####
- a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&adcat=####&screen_w=####&img_rule=####&icc=#...
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
Запросы HTTP POST:
- g####.cn/
- analy####.####.com/
- and####.####.com/rqd/async
- lo####.####.net/debug/v2/android
- p####.####.com:3090/PlutoServer/app/appinit/
- a####.####.com/app_logs
- p####.####.com/PlutoServer/app/getplugin/
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/.mobvista700/download/1880935128
- /data/data/####/tx_shell/libufix.so
- /data/anr/traces.txt
- /data/data/####/shared_prefs/timestamp.xml
- /data/data/####/shared_prefs/update_check.xml
- /sdcard/.mobvista700/download/2082986419
- /data/data/####/databases/sp_db-journal
- /data/data/####/files/eopcmjt/libqNiSBgujjBxAEiyqzxc.so
- /data/data/####/files/device_type_info.db.mirror
- /data/data/####/mix.dex
- /data/data/####/shared_prefs/share_date.xml.bak
- /data/data/####/files/AyuSnsgpJNCmGCZwdaemon.so
- /data/data/####/databases/BatteryBooster.db-journal
- /data/data/####/databases/BatteryBooster.db.mirror
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/webviewCookiesChromium.db.mirror
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/eopcmjt/libnYlYSMWbGsbTavdZlala.so
- /data/data/####/databases/webview.db.mirror
- /data/data/####/databases/gostatistics_sdk.db.mirror
- /sdcard/GOPowerMaster/.nomedia
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/files/eopcmjt/libHkvFXwaLTSDvKsFFbt.so
- /data/data/####/files/eopcmjt/libLXtzwvqtrxRlyavpdynamicloader.so
- /data/data/####/shared_prefs/share_date.xml
- /data/data/####/databases/mobvista.msdk.db.mirror
- /sdcard/air/as/statistics/deviceId.txt
- /data/data/####/files/qNiSBgujjBxAEiyqzxc.jar
- /data/data/####/shared_prefs/sys_configuration.xml
- /data/data/####/files/device_type_info.db-journal
- /data/data/####/files/.pluto_lib/e2927fc9b848eb68c4c76653fa09422d/pluto.apk
- /data/data/####/files/local_crash_lock
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/commerce_ad_phead_share.xml
- /data/data/####/shared_prefs/ct_default.xml
- /data/data/####/shared_prefs/ctrl_sp_####.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/log/agent_log
- /data/data/####/shared_prefs/go_static_id####.xml
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/shared_prefs/randomdeviceid.xml
- /sdcard/.pluto_data/e2927fc9b848eb68c4c76653fa09422d/client.id
- /data/data/####/shared_prefs/TOKEN.xml
- /data/data/####/shared_prefs/com.nativedroid.module.offerprobe.xml
- /sdcard/.googlex9/.xamdecoq0962
- /data/data/####/databases/sp_db.mirror
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/files/nYlYSMWbGsbTavdZlala.jar
- /sdcard/.sysAndroid/sys
- /sdcard/.mobvista700/download/-1670272049
- /sdcard/.mobvista700/download/1726843613
- /sdcard/.mobvista700/download/2015565676.temp
- /data/data/####/shared_prefs/mobvista.xml
- /sdcard/.mobvista700/download/-1331407292.temp
- /data/data/####/files/HkvFXwaLTSDvKsFFbt.dex
- /sdcard/GoAdSdk/config/user
- /data/data/####/files/device_type_info.db
- /data/data/####/shared_prefs/purchase_request_detail.xml
- /data/data/####/files/LXtzwvqtrxRlyavpdynamicloader.jar
- /data/data/####/shared_prefs/is_first_use.xml
- /data/data/####/app_bin/daemon
- /data/data/####/databases/gostatistics_sdk.db-journal
- /data/data/####/shared_prefs/cpu_freqs_pref.xml
- /data/data/####/files/security_info
- /sdcard/.mobvista700/download/-898324802
- /data/data/####/files/.legudb
- /data/data/####/shared_prefs/####.setting.xml
- /data/data/####/databases/bugly_db_legu.mirror
- /data/data/####/app_indicators/indicator_p
- /data/data/####/databases/ad_sdk.db-journal
- /data/data/####/databases/ad_sdk.db.mirror
- /data/data/####/shared_prefs/IMDPREF.xml
- /data/data/####/files/.imprint
- /data/data/####/databases/bugly_db_legu-journal
- /sdcard/.goproduct/goid
- /data/data/####/files/HkvFXwaLTSDvKsFFbt.jar
- /data/data/####/files/log/crash_log
- /data/data/####/files/native_record_lock
- /data/data/####/shared_prefs/share_for_goluncher_preference.xml
- /data/data/####/shared_prefs/sdk_scl_pid_config.xml
- /sdcard/.mobvista700/download/330775585
- /data/data/####/data-app/Y29tLnNhYXBwLmJhdHQubXNfcGF5MQ
- /data/data/####/app_indicators/indicator_d
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/app_bin/daemon
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/tx_shell/libufix.so
- /data/data/####/files/device_type_info.db.mirror
- /data/data/####/tx_shell/libnfix.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
