Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.226.origin
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.com
- a####.####.com
- sdk####.####.com
Запросы HTTP GET:
- s####.####.com/config/hz-hzv3.conf
- a####.####.com/v2/config/funclist?cid=####
- a####.####.com/v1/card/gettime/
Запросы HTTP POST:
- s####.####.com/api.php?format=####&t=####
- a####.####.com/v1/api
- d####.####.com/bos/api/v1/ai?from=####&mid=####&afid=####
- sdk####.####.com/log/eventLog.htm
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/LqToPe6H0Q9MfUQUZYrs3Q==.new
- /data/data/####/files/push.pid
- /data/data/####/files/init.pid
- /data/data/####/files/run.pid
- /data/data/####/files/mobclick_agent_cached_####1610211203
- /data/data/####/shared_prefs/disguise_packages_sp.xml
- /data/data/####/databases/log-journal
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/oZUjjHkRfx9nk6Zv6Bdqrw==.new
- /data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._.DS_Store
- /data/data/####/databases/cc/cc.db
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/vRSvKcT5Z3GUUJTHb6XnVA==/data.dat.tmp
- /data/data/####/shared_prefs/com.klauncher.kinflow.common.utils.CommonShareData.xml.bak
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/ZYeDS2v5hjmrqtcLCCo8jg==/cpi_IYUusxwRqyOy.zip
- /data/data/####/shared_prefs/DefaultPage.xml
- /data/data/####/shared_prefs/biddingos.pkg.xml
- /data/data/####/files/themefolder/res.zip
- /data/data/####/databases/pushsdk.db-journal
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/getShortCut.xml
- /data/data/####/shared_prefs/install.app.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/themefolder/res/drawable-xxhdpi/com_ucmobile__icon.png
- /data/data/####/files/stats.log.tmp
- /data/data/####/shared_prefs/theme_preferences.xml
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/v4ddUZr6rsdPoUTVigCZkQ==/bvpazi17ujzKmzQa9bpHuA==
- /data/data/####/shared_prefs/biddingos.events.xml
- /data/data/####/files/themefolder/res/drawable-xxhdpi/com_miguan_market__ic_launcher.png
- /sdcard/ktheme/default.ktm
- /data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_chinamobile_mcloud__icon.png
- /sdcard/.IdeaDesktop/.backup/.localbackup/vibeui_backup.lbk
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/v4ddUZr6rsdPoUTVigCZkQ==/Er17fD7enG0H040Y
- /data/data/####/databases/notifier.db-journal
- /data/data/####/files/themefolder/res/.DS_Store
- /data/data/####/shared_prefs/com.android.launcher3.prefs.xml
- /sdcard/libs/app.db
- /data/data/####/databases/launcher.db-journal
- /data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_moji_mjweather__icon.png
- /data/data/####/shared_prefs/ping.xml
- /data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_miguan_market__ic_launcher.png
- /data/data/####/cache/widgetpreviews.db-journal
- /data/data/####/shared_prefs/com.klauncher.kinflow.common.utils.CommonShareData.xml
- /data/data/####/files/themefolder/__MACOSX/res/._.DS_Store
- /data/data/####/files/themefolder/res/drawable-xxhdpi/.DS_Store
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/libs/####.db
- /data/data/####/files/rdata_comklaunchercplauncher
- /data/data/####/files/txddvg_d/txddvg_f.zip
- /sdcard/.IdeaDesktop/.backup/.localbackup/.temp/desc.xml
- /data/data/####/databases/increment.db-journal
- /data/data/####/files/launcher.preferences
- /data/data/####/files/init_c.pid
- /data/data/####/shared_prefs/trebuchet_preferences.xml
- /data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/LqToPe6H0Q9MfUQUZYrs3Q==
- /data/data/####/files/themefolder/res/drawable-xxhdpi/com_tencent_android_qqdownloader__ic_launcher.png
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25441 300 0
- chmod 700 /data/data/####/files/gdaemon_20161017
Может автоматически отправлять СМС-сообщения.
