Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
- Android.DownLoader.533.origin
- Android.Loki.10.origin
Сетевая активность:
Подключается к:
- fk-gray####.####.com
- lo####.####.net
- g####.cn
- a####.####.com:8011
- aexcep####.####.com:8012
- analy####.####.com
- a####.####.net
- p####.####.com
- aexcep####.####.com
- set####.####.com
- and####.####.com
- cdn####.####.com
- p####.####.com:3090
- n####.####.com
- a####.####.com
Запросы HTTP GET:
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/15/58c6552562afd.png
- n####.####.com/impression?k=####&p=####&q=####&x=####
- n####.####.com/onlyImpression?k=####&p=####
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- cdn####.####.com/cdn-adn/dmp/17/03/30/22/02/58dd0ffd787b7.JPEG
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
- n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os...
- a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=...
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c65482b410d.png
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c6548a0fd68.png
- cdn####.####.com/cdn-adn/dmp/17/03/30/22/04/58dd1058430ab.JPEG
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- fk-gray####.####.com/impression?k=####&p=####&q=####&x=####
- cdn####.####.com/cdn-adn/html/common/2016/02/23/00/08/es.socialpoint.Mon...
- a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=#...
- cdn####.####.com/cdn-adn/offersync/17/03/28/18/30/58da3b5f853e1.jpg
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- fk-gray####.####.com/onlyImpression?k=####&p=####
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
- a####.####.net/get_country
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
Запросы HTTP POST:
- a####.####.com/app_logs
- g####.cn/
- analy####.####.com/
- and####.####.com/rqd/async
- p####.####.com:3090/PlutoServer/app/appinit/
- lo####.####.net/debug/v2/android
- p####.####.com/PlutoServer/app/getplugin/
- a####.####.com:8011/rqd/async
- aexcep####.####.com/rqd/async
- aexcep####.####.com:8012/rqd/async
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/tx_shell/libufix.so
- /data/data/####/app_indicators/indicator_p
- /data/data/####/files/RfkmuJfBXinLQYAgzxc.jar
- /data/data/####/shared_prefs/timestamp.xml
- /data/data/####/shared_prefs/update_check.xml
- /sdcard/.mobvista700/download/2082986419
- /sdcard/.mobvista700/download/965947873
- /data/data/####/mix.dex
- /data/data/####/shared_prefs/share_date.xml.bak
- /data/data/####/shared_prefs/postTime.xml
- /data/data/####/shared_prefs/TOKEN.xml
- /data/data/####/files/device_type_info.db-journal
- /data/data/####/files/mljfqgy/libONFskLKydMoxwGhxbt.so
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/GOPowerMaster/.nomedia
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/shared_prefs/is_first_use.xml
- /data/data/####/files/jJdUnvEqlmqxwUZddaemon.so
- /data/data/####/files/.pluto_lib/22d962cce7a97667b7ef4da78cd0b001/pluto.apk
- /data/data/####/shared_prefs/share_date.xml
- /data/data/####/databases/sp_db-journal
- /sdcard/air/as/statistics/deviceId.txt
- /data/data/####/shared_prefs/sys_configuration.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/qJLkRjYvImNmbdVMlala.jar
- /data/data/####/shared_prefs/IMDPREF.xml.bak
- /data/data/####/data-app/Y29tLnNicHAuYnR0LmFzX3BheTE
- /sdcard/.goproduct/goid
- /sdcard/.mobvista700/download/-1670272049.temp
- /data/data/####/files/ONFskLKydMoxwGhxbt.dex
- /data/data/####/files/tyljVHYmxseqkTXrdynamicloader.jar
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/go_static_id####.xml
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/shared_prefs/IMDPREF.xml
- /data/data/####/shared_prefs/commerce_ad_phead_share.xml
- /sdcard/.mobvista700/download/-386055148.temp
- /data/data/####/shared_prefs/ct_default.xml
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/files/mljfqgy/libqJLkRjYvImNmbdVMlala.so
- /data/data/####/files/ONFskLKydMoxwGhxbt.jar
- /data/data/####/files/.imprint
- /data/data/####/databases/gostatistics_sdk.db-journal
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/log/agent_log
- /sdcard/.mobvista700/download/-1377858248
- /data/data/####/files/device_type_info.db
- /sdcard/.mobvista700/download/-1015052616
- /data/data/####/shared_prefs/purchase_request_detail.xml
- /sdcard/.mobvista700/download/-1174155579
- /sdcard/.mobvista700/download/-98113556
- /data/data/####/files/libIBfirGFNXAGlAQdybootstrap.so
- /data/data/####/files/mljfqgy/libRfkmuJfBXinLQYAgzxc.so
- /data/data/####/app_bin/daemon
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/cpu_freqs_pref.xml
- /data/data/####/shared_prefs/ctrl_sp_####.xml
- /data/data/####/files/security_info
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/shared_prefs/####.setting.xml
- /sdcard/.pluto_data/22d962cce7a97667b7ef4da78cd0b001/client.id
- /data/data/####/databases/ad_sdk.db-journal
- /data/data/####/files/mljfqgy/libtyljVHYmxseqkTXrdynamicloader.so
- /data/data/####/databases/BatteryBooster.db-journal
- /data/data/####/shared_prefs/randomdeviceid.xml
- /data/data/####/files/local_crash_lock
- /data/data/####/files/log/crash_log
- /data/data/####/files/native_record_lock
- /data/data/####/shared_prefs/share_for_goluncher_preference.xml
- /sdcard/GoAdSdk/config/user
- /data/data/####/app_indicators/indicator_d
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libufix.so
- /data/data/####/app_bin/daemon
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/tx_shell/libnfix.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.build.rom.id
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
