Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- i####.####.com
Запросы HTTP GET:
- i####.####.com/ando-res/m/pdEeeeSMxFc4Pj1c-bdIkZ0qk6HBiFe76oxdY-RIRAlRlR...
- i####.####.com/ando-res/m/hQFsvuTOjQG2grLU8T2VCshw4jkuJadBny-GDQ
- i####.####.com/ando-res/ads/18/19/da964672-e0f2-4f69-a63b-cea979b9a721/8...
- i####.####.com/ando-res/ads/4/5/d73ab4a4-4c75-43a7-a3c9-5bdabd9437c8/6ae...
Запросы HTTP POST:
- 6####.####.140/ando/x/req?app_id=####&r=####
- 6####.####.140/ando/x/liv?app_id=b6d99fa1-8a23-494a-88d4-34e035688565&r=...
- 6####.####.140/ando/x/lis?app_id=####&r=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/BC4kFlkpfGf1DQQnM79YTSWW-cFk8u_r9lkJ9A==.new
- /data/data/####/files/moyxuodMqCmehPN7PMcecw==/uXBI-AMsF5jvy1q4Pr0_IIJQT6U=
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/FXe8GQgAUI5WdVOw/WK_JyCOeQoZqH2wq.new
- /sdcard/.system/alLbon3AuQynvtpS/r_pkDgN4OhnkSa0D
- /sdcard/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/c60e5e40-c3c3-41e1-a7cc-3971db6c8317.res
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/9OPV4FBCtgGFPL76/KiYrMkpKQVCugt_H7htK9MMNKrVoisTD.new
- /data/data/####/databases/cc/cc.db
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/4XMQ-zPlYMcwhUayROHDxZZMpXU=.new
- /data/data/####/code-2689188/7_ghB8Qd5jY-5f8d
- /data/data/####/databases/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_TG0ZvQm70L_bu5adTQiyIU_hOHE=-journal
- /data/data/####/databases/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_g-499Fh1NF-OWJTOIAqLkQ==-journal
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/8BbJnBrChsAoi6Cq4i-pATLb5OUTMcLkyEFMgg==.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/U_4HjW1NAQTuRZx25QQBtx_keiI1uuGM.new
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/3R3IhUm5Uy_HoJAl6cgm6A==/data.dat.tmp
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/WHDuRbPZZCi626isvNKH2w==.new
- /data/data/####/files/txzdbw_d/txzdbw_f.zip
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/V9wKggnqcrxtohfpOXgWcbSZyEJq_af8.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/fLjzK7Fz2IN1k26-LLBYM1CY5gujt9D4x7FOYQ==.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/ris00SgrTD-BKnATXyNFEQ==.new
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/fAYP1Fpmw687PmJt/fK-ReXqTtlZzYlQ8YCp3W0aQdDKZgoipNMzLaG2Vhn4=
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_d-HmUKXBHFtoUxoM-journal
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/5cyT_BAHo5KaPNF4tnmSRN77zvEcZSgE6Asgg5Qrb1I=.new
- /data/data/####/databases/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_2lAfKVsuOi2aHLU2-journal
- /sdcard/.system/alLbon3AuQynvtpS/MP8MtaBuguN9jnuSwtN1kQ==
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/IEfemESNMrq44WcQ/ADO_lRmXnPQMbA6q/3415f994-2bc7-41b9-8db1-ff5b3bbfd038.res
- /sdcard/.env/.uunique.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/ZTxHie2xZ5YQ_Tg21d2FPuV0NCY=.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/rNNZjitJIum9XB-xuJnjVEth-NdwpAsm.new
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/sJB1PtFVAXjNLmSWc_xOcA==/runner_info.prop
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/6vYGdaCFQw9qWTZDIV4L9A==/x961wS3MglsJdsOd9g6tIA==
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/9XbQ3yAj7CS19QNwXXDnRAosJiw=.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/ZTxHie2xZ5YQ_Tg21d2FPuV0NCY=.old
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/fAYP1Fpmw687PmJt/V9bckLT0Hw67o_CVDb5UgYJhYXo=.temp
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_GD_uKpkDFs7cFGpp_app/PEYQIWxq9fcekbNk4LcISQ==/Uzm1ghAf-fmbGrVwyKw1E2JXDHwWs2U0.new
- /sdcard/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/do3N0OrUSHeJJSmf/OeuJp4cVSzE9IIU_t91YLcJlt-XdfPb6LKHGww==
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/sJB1PtFVAXjNLmSWc_xOcA==/runner_info.prop.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/ZTxHie2xZ5YQ_Tg21d2FPuV0NCY=
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/VyIPk96LtkRknUJIvvjj_xX6vC7KOWBN.new
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/R3DD8Jg1m2BLHoAIn9K8UA==/JRiQhnjqoZDOCHtn.zip
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/6vYGdaCFQw9qWTZDIV4L9A==/Vt3e0MiKhHAh8jLK
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/6vYGdaCFQw9qWTZDIV4L9A==/hpzc9yaJTuoi-wjRVsuhjeA7RIw=
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/323CRYi0Mzv2HCJQNHE3ulBKTwz3hYXsBg4FO8-iLXY=.new
- /data/data/####/files/6OYHoyi1oeA7jrSlBb4liPuxRL2oF2LFI3SVbg==/AySADIuYveCHDzgppkbPlw==.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/nzQWEl8quFrRN7SRpwpHZQ==.new
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/EjR3pU3EbBdEJY_gQEpM204Wv14HwA7C.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/IEfemESNMrq44WcQ/ADO_lRmXnPQMbA6q/5839647a-780c-45f5-8bd0-63b8b0a714c6.res
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/ILrexk04YQY2mipqbdaYAPw0ED8=.new
- /data/data/####/files/n9REhSbMPlWz_Z4rZurn7WE78Bsx474hfbl6RQ==_files/PEYQIWxq9fcekbNk4LcISQ==/xD70vAxXfFKHoOjzkRx4VPRF_bhXRVG7.new
- /sdcard/.system/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/a11b6603-ecec-4ba3-a8cd-25523ab33916.res
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/code-2689188/7_ghB8Qd5jY-5f8d #### com.dongwenjie.apk.vancbg.a.a.c.b /storage/emulated/0/.system/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
Может автоматически отправлять СМС-сообщения.
