Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- i####.####.com
Запросы HTTP GET:
- i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/m/hQFsvuTOjQG2grLU8T2VCshw4jkuJadBny-GDQ
- i####.####.com/ando-res/m/pdEeeeSMxFc4Pj1c-bdIkZ0qk6HBiFe76oxdY-RIRAlRlR...
- i####.####.com/ando-res/ads/30/2/be3c8c5e-393d-4a34-bb98-c526a69eb12c/e2...
- i####.####.com/ando-res/ads/4/5/d73ab4a4-4c75-43a7-a3c9-5bdabd9437c8/c21...
Запросы HTTP POST:
- 6####.####.140/ando/x/req?app_id=####&r=####
- 6####.####.140/ando/x/liv?app_id=b6d99fa1-8a23-494a-88d4-34e035688565&r=...
- 6####.####.140/ando/x/lis?app_id=####&r=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/sB7UlVptqi7AR2qEZZz-NJhgkaFIND8CqAXitA==.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/CZNA2qWEAjNRD6agRyctzw==.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/353Ws6i4ZPDLrPvVKC0u90RjYTM=.new
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/8d5lDlKaqFlkvbhOeZhunA==/aH9Kx77_l5PQGawMOKcqJQ==
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/8b440047-ae8b-42e6-ba66-fb9e858feb86.res
- /sdcard/.system/alLbon3AuQynvtpS/r_pkDgN4OhnkSa0D
- /sdcard/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- /data/data/####/files/umh36Hx3ogkWnR7n34xTVg==/D6Sn7FgwZj5e3E91fNA9Aksc_Yw=
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/p6Yvfra-9KKGOWlLDG50YsrraEwJgW39.new
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/3nUeTMUswQ2q5OMeRV-AAQ==/JVI1KJzpFePt0AGf.zip
- /data/data/####/databases/cc/cc.db
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/px8Qx9i0SnHr7YgX/Cr9tmf9FaZfxchiZ/cf6aad9b-43dd-4e76-8df4-f172f42ebc62.res
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/qycKBr60wsVx94m4RULOTGjAN5Y=.new
- /sdcard/.env/.uunique.new
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/eLM4z32Jl8ItQS-cXPi9TA==/runner_info.prop
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/lFPH_PDzaDki4uOMcjXJGTtqzqU=
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/W2AOKjn334n2Jf9IsJw4vnF9zq-r4KIw.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/VV5ZbZk5MWFjmbHg8iPt_OlcKZdURPFn.new
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/IWFYCMCOljZ1oRHZXWEQT-1ozCbhpFHYVibb6wKxfZY=.new
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/databases/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_e4RG9WBaQT2Yp3q98pM8BA==-journal
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/uQ9PE69N5tai9_WGqWwDSw==.new
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/px8Qx9i0SnHr7YgX/Cr9tmf9FaZfxchiZ/f885d02e-4007-4dad-a5f1-76d2eeb2c49d.res
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/hyYHnaAGV9tDFEhcG0bHvA==/data.dat.tmp
- /sdcard/.system/alLbon3AuQynvtpS/MP8MtaBuguN9jnuSwtN1kQ==
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/U6l8nt9F4iqznmpimETcVLQegnc=.new
- /data/data/####/code-1924423/adTXDISiJDW1XlrG
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/D4TwCaHttXQU6krAnrPtyw==.new
- /data/data/####/databases/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_XztXEU3plnDoCrJm-journal
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/dN9yJxzaYii3DBWv/ZWzoNnSHtcToqVLPYE_xgJ8cl_CftIR3iezLrQe1Xu8=
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_wQWV-iKhekY29rym_app/J7UgBclIJNvf_9wprhG0Iw==/GTXu1xCoDreZmB2WObRVlB35MsNhIGU-.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/D71xE-WdxMoxWZaW/BZK7ajXNjeWqH8npeElnXaQEJ-g-6DEKpUesow==
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/xBx77CddGWgGiQnQuprSJSP-AQWhHgwtZXi7_g==.new
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/8d5lDlKaqFlkvbhOeZhunA==/P7gZChCJcToTQI3T
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/8d5lDlKaqFlkvbhOeZhunA==/3tABF8yWyAj4ULdZWlVlQIDtE24=
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/lFPH_PDzaDki4uOMcjXJGTtqzqU=.new
- /data/data/####/files/5kRS5oBmNFFJjXKCgB9AiAacJPf6IGInG349iw==/eMNhoRJfB6IyTRgX0uPgJg==.new
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/01aeb9b2-89bc-44bc-ad96-5fc2703a109f.res
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/XIk-TdUkJ1PxEgtAsyH3QdUeg9WyrK2_.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/-8i-5jqGAvhWDONqRBDP6Bx5MowbK38i.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/fTfOhB3aEqfxh_YkW3JqUn2J3e95KKEv4dX7Pw==.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/_Q4_iXyDernOQdb4/eUp1pAGncmvzJmtk.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/A7bBbEIJTqm1HIWIwU14ndHj9TCLYm8i.new
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/E0cNtMc3aO-4QlLW/iMyO5ilEOkU3eaoKmJAGbMhxancExEx2.new
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/2748fe79-28ae-49d9-902c-7cae285e8020.res
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/px8Qx9i0SnHr7YgX/Cr9tmf9FaZfxchiZ/ee49ec08-876b-4405-aaf9-bde433375914.res
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_0BL1dPbX7kQLBKlH-journal
- /data/data/####/databases/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_qxkM4lc0bD-FP6XxoMR1Vn61WTk=-journal
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/dN9yJxzaYii3DBWv/MmLOn99yI-WjyztGhbYHHPgXON4=.temp
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/L5mypP-WtUKtdv3Rh21TRrSTLKc=.new
- /sdcard/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- /data/data/####/files/txzdbw_d/txzdbw_f.zip
- /data/data/####/files/44Cm05MUmJ77zBvH3BxhZ2IL0Cx9lSRYvcBOiQ==_files/J7UgBclIJNvf_9wprhG0Iw==/t_Ew5qCLpEb6t2YCxoQdyT8fWm5ltWpLaVSHOJaDlK8=.new
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/code-1924423/adTXDISiJDW1XlrG
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/code-1924423/adTXDISiJDW1XlrG #### com.dongwenjie.apk.vancbg.a.a.c.b /storage/emulated/0/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
Может автоматически отправлять СМС-сообщения.
