Android.Packed.20938

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.SmsSend.1848.origin

Сетевая активность:

Подключается к:

gaand####.####.net
i####.####.net
6####.####.108
1####.####.56:9039
and####.####.com
d####.####.com
m####.com
1####.####.56
t####.####.cn
quanzh####.com:8088
a####.####.com
and####.####.com:8077

Запросы HTTP GET:

1####.####.56:9039/gamesit/jysdk/inix
1####.####.56/gamesit/jysdk/inix
1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=...
1####.####.56//gamesit/xysdk/init
6####.####.108/iad/db/2017225/apptype.db

Запросы HTTP POST:

d####.####.com/mmsdk/mmsdk?func=####&appkey=####&channel=####&code=####
i####.####.net/ps/userAppInfo.do
i####.####.net/ps/userSdkInfo.do
t####.####.cn/api/statis/3d227b84298f31549e95ecd70422f331d/game-D012C8C2...
quanzh####.com:8088/MakeJoyJson/JsonRead
i####.####.net/ps/platformStatConfirm.do
i####.####.net/ps/userMobileInfo.do
and####.####.com/record-plat/record/upload.do
i####.####.net/ps/newUserApp.do
i####.####.net/ps/getNAD.do
t####.####.cn/api/q/a/3d227b84298f31549e95ecd70422f331d
and####.####.com:8077/record-plat/seq/query.do
t####.####.cn/api/statis/3d227b84298f31549e95ecd70422f331d
i####.####.net/ps/getConfig.do
i####.####.net/ps/getAppType.do
a####.####.com/app_logs
i####.####.net/ps/active.do
i####.####.net/domain/domainConfig.do
t####.####.cn/api/collect/app/3d227b84298f31549e95ecd70422f331d
m####.com/sdk-selector/log/sdkPay
m####.com/sdk-selector/sdk/select
i####.####.net/ps/updatesdk.do
gaand####.####.net/g/d?crc=####
i####.####.net/ps/appShare.do
i####.####.net/ps/actionLog.do
i####.####.net/ps/platformStat.do

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/baea/tmb.jar
/data/data/####/files/platform/core/prop/config_notify.dat
/data/data/####/files/platform/core/prop/proc_ps
/data/data/####/files/platform/core/adStats/1493128224188
/data/data/####/files/platform/core/adStats/1493128225298
/data/data/####/files/platform/core/prop/proc_process
/data/data/####/files/platform/core/adStats/1493128224184
/data/data/####/files/platform/core/adStats/1493128225056
/data/data/####/files/platform/core/adStats/1493128224107
/data/data/####/shared_prefs/edition.xml
/data/data/####/files/platform/core/adStats/1493128225402
/data/data/####/files/platform/core/adStats/1493128224103
/data/data/####/files/platform/core/adStats/1493128223768
/data/data/####/shared_prefs/b_share.xml
/data/data/####/files/platform/frame/sdk/local/59713D21C6A0A50FC1909277B685C235.jar
/data/data/####/files/platform/core/adStats/1493128224732
/data/data/####/shared_prefs/shared_file.xml
/data/data/####/files/platform/core/adStats/1493128226864
/data/data/####/files/platform/core/adStats/1493128224024
/data/data/####/files/platform/core/adStats/1493128224727
/data/data/####/files/platform/core/adStats/1493128225393
/data/data/####/files/platform/frame/prop/app_caller
/data/data/####/files/platform/core/prop/service_info.dat
/data/data/####/files/platform/core/adStats/1493128225297
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/app_workbench39090/apk.zip
/data/data/####/files/platform/core/adStats/1493128224368
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/files/platform/core/adStats/1493128226553
/data/data/####/files/platform/core/adStats/1493128226551
/data/data/####/databases/bil_db-journal
/data/data/####/shared_prefs/3d227b84298f31549e95ecd70422f331d|account_file.xml
/data/data/####/files/platform/core/prop/config_channel.dat
/data/data/####/files/platform/core/adStats/1493128226718
/data/data/####/files/platform/core/adStats/1493128226360
/data/data/####/files/platform/core/prop/mutex.dat
/data/data/####/app_workbench55748/apk.zip
/data/data/####/databases/Data_sync.db-journal
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/files/platform/core/adStats/1493128224219
/data/data/####/app_workbench16760/apk.zip
/data/data/####/files/platform/core/adStats/1493128225405
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/platform/core/adStats/1493128224217
/data/data/####/databases/PlatformCore.db
/data/data/####/app_workbench66800/apk.zip
/data/data/####/files/platform/frame/prop/sdk_version.dat
/data/data/####/files/platform/core/adStats/1493128224297
/data/data/####/files/platform/core/adStats/1493128224295
/data/data/####/files/libabc
/data/data/####/files/platform/core/prop/proc_task
/data/data/####/files/actlxd5
/data/data/####/databases/MA_epay_db-journal
/data/data/####/databases/database-journal
/data/data/####/files/actlxd4
/data/data/####/app_workbench11314/apk.zip
/data/data/####/files/platform/core/prop/config_dsp.dat
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
/data/data/####/databases/PlatformCore.db-journal
/data/data/####/files/platform/core/adStats/1493128225586
/data/data/####/files/platform/core/adStats/1493128223676
/data/data/####/files/actlxd6
/data/data/####/files/platform/core/adStats/1493128224857
/data/data/####/files/platform/core/adStats/1493128224690
/data/data/####/files/platform/core/adStats/1493128225179
/data/data/####/files/platform/core/adStats/1493128225178
/data/data/####/files/platform/core/adStats/1493128225662
/data/data/####/files/platform/core/adStats/1493128224598
/data/data/####/files/platform/core/adStats/1493128224369
/data/data/####/files/platform/core/adStats/1493128223987
/data/data/####/files/platform/core/adStats/1493128226084
/data/data/####/shared_prefs/ma_data.xml
/data/data/####/files/platform/core/prop/app_init.dat
/data/data/####/files/platform/core/prop/app_type_task.dat
/data/data/####/files/platform/core/adStats/1493128225377
/data/data/####/app_workbench00262/apk.zip
/data/data/####/files/platform/core/adStats/1493128225467
/data/data/####/files/platform/core/adStats/1493128224513
/data/data/####/files/platform/core/adStats/1493128225504
/data/data/####/files/platform/core/adStats/1493128225378
/data/data/####/files/platform/core/adStats/1493128223766
/data/data/####/files/platform/core/adStats/1493128223855
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/files/platform/core/adStats/1493128223857
/data/data/####/files/mpush_version_preferences_file
/data/data/####/files/platform/core/adEvent/1493128193841
/sdcard/system_meta.config
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/files/platform/core/prop/update_script.dat
/data/data/####/files/platform/frame/prop/app_mid
/data/data/####/files/platform/core/adStats/1493128225867
/data/data/####/files/platform/core/adStats/1493128225866
/data/data/####/files/platform/core/prop/app_history.dat
/data/data/####/files/platform/core/adStats/1493128225862
/data/data/####/files/platform/core/adStats/1493128224686
/data/data/####/files/evnlxd1
/data/data/####/databases/mpush_game.db-journal
/data/data/####/files/actlxd0
/data/data/####/files/actlxd3
/data/data/####/files/syslxd2
/data/data/####/files/platform/core/adStats/1493128224968
/data/data/####/files/libexecmain.so
/data/data/####/files/platform/core/adStats/1493128225218
/data/data/####/app_workbench89050/apk.zip
/data/data/####/files/platform/core/adStats/1493128224564
/data/data/####/files/platform/core/adStats/1493128226456
/data/data/####/files/platform/core/adStats/1493128226317
/data/data/####/files/platform/frame/prop/action_stats.dat
/data/data/####/app_workbench33564/apk.zip
/data/data/####/files/mobclick_agent_cached_####41
/data/data/####/files/mj.dex
/sdcard/data/config.dat
/data/data/####/files/platform/core/prop/device_ip.dat
/data/data/####/files/platform/core/adStats/1493128223822
/data/data/####/files/platform/core/adStats/1493128224603
/data/data/####/files/platform/core/adStats/1493128225858
/data/data/####/files/platform/core/adStats/1493128225762
/data/data/####/files/platform/core/appType/.0e3b9e56ee5899ae34d0ef49b5163854
/data/data/####/shared_prefs/zhangpay_share.xml.bak
/data/data/####/files/platform/core/adStats/1493128226455
/data/data/####/shared_prefs/b_setting.xml
/data/data/####/shared_prefs/plugin_record_app_info.xml
/data/data/####/files/platform/core/adStats/1493128225087
/data/data/####/files/platform/core/adStats/1493128225086
/data/data/####/files/platform/core/adStats/1493128223900
/data/data/####/shared_prefs/lxdMoblieAgent_sys_config.xml.bak
/data/data/####/files/platform/core/adStats/1493128226187
/data/data/####/files/platform/core/adStats/1493128225975
/data/data/####/files/platform/core/adStats/1493128224970
/data/data/####/files/platform/core/adStats/1493128227195
/data/data/####/files/platform/core/adStats/1493128225395
/data/data/####/files/platform/core/adStats/1493128225400
/data/data/####/files/platform/core/adStats/1493128226217
/data/data/####/files/platform/core/adStats/1493128225396
/data/data/####/files/platform/core/adStats/1493128226066
/data/data/####/files/platform/core/adStats/1493128225404
/data/data/####/files/platform/core/trace/170208_20170425/flow/2
/data/data/####/files/platform/core/adStats/1493128227118
/sdcard/.android/system.dat
/data/data/####/files/platform/core/adStats/1493128225874
/data/data/####/files/platform/core/adStats/1493128225019
/data/data/####/files/platform/core/adStats/1493128224775
/data/data/####/files/platform/core/adStats/1493128226666
/data/data/####/files/platform/core/adStats/1493128226667
/data/data/####/files/platform/core/prop/active_init.dat
/data/data/####/files/libexec.so
/data/data/####/app_workbench33418/apk.zip
/sdcard/muse/36565deabc0d2931b608d9d81e45dacb
/data/data/####/shared_prefs/lxdMoblieAgent_config_####.xml
/sdcard/Android/data/.nomedia
/data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml
/data/data/####/shared_prefs/new_vvsion.xml
/data/data/####/files/platform/core/adStats/1493128225254
/data/data/####/files/platform/core/adStats/1493128225887
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/shared_prefs/nnt_data.xml
/data/data/####/files/platform/core/prop/sdk_init.dat
/data/data/####/files/platform/core/adStats/1493128224065
/data/data/####/files/platform/core/adStats/1493128224066
/data/data/####/files/platform/core/adStats/1493128223898
/data/data/####/files/platform/core/prop/config_active.dat
/data/data/####/files/platform/core/adStats/1493128226756
/data/data/####/files/platform/core/adStats/1493128224780
/data/data/####/app_workbench94576/apk.zip
/data/data/####/databases/Framework.db
/data/data/####/files/platform/core/adStats/1493128225709
/data/data/####/files/platform/core/adStats/1493128225864
/sdcard/.tcookieid
/data/data/####/files/platform/core/adStats/1493128226595
/sdcard/app_mutex.lock
/data/data/####/files/platform/core/prop/mobile_init.dat
/data/data/####/databases/PlatformDsp.db-journal
/data/data/####/files/platform/core/adStats/1493128225803
/data/data/####/databases/MA_epay_db
/data/data/####/files/platform/core/adStats/1493128224490
/data/data/####/shared_prefs/lxdMoblieAgent_state_####.xml
/data/data/####/databases/bil_db
/data/data/####/databases/PlatformDsp.db
/data/data/####/app_workbench72246/apk.zip
/data/data/####/databases/mydb-journal
/data/data/####/files/platform/core/adStats/1493128223731
/data/data/####/shared_prefs/lxdMoblieAgent_event_####.xml
/data/data/####/shared_prefs/td_pefercen_profile.xml
/data/data/####/files/platform/core/adStats/1493128227037
/data/data/####/files/platform/core/prop/float_info.dat
/data/data/####/files/platform/core/prop/config_js.dat
/data/data/####/files/platform/core/adStats/1493128224657
/data/data/####/files/platform/core/adStats/1493128224819
/data/data/####/files/platform/core/adStats/1493128227038
/data/data/####/app_workbench61194/apk.zip
/data/data/####/files/platform/core/adStats/1493128225137
/data/data/####/files/platform/core/appType/0e3b9e56ee5899ae34d0ef49b5163854.tmp
/data/data/####/files/platform/core/adStats/1493128224655
/data/data/####/files/platform/frame/prop/app_bid
/data/data/####/files/platform/core/adStats/1493128223956
/data/data/####/files/platform/core/adStats/1493128225139
/data/data/####/files/mj.apk
/data/data/####/files/platform/core/adStats/1493128224482
/data/data/####/shared_prefs/ma_call.xml
/data/data/####/files/platform/core/adStats/1493128224899
/data/data/####/files/platform/core/adStats/1493128226969
/data/data/####/files/platform/core/adStats/1493128224894
/data/data/####/databases/Framework.db-journal
/data/data/####/app_workbench61354/apk.zip
/data/data/####/app_workbench83604/apk.zip
/data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml.bak
/data/data/####/files/platform/core/adStats/1493128223729
/data/data/####/files/platform/core/adStats/1493128226809
/data/data/####/files/platform/core/adStats/1493128226806
/data/data/####/files/platform/core/prop/config_ad.dat
/data/data/####/files/.imprint
/data/data/####/files/platform/core/adStats/1493128225015
/data/data/####/shared_prefs/zhangpay_sms_info.xml
/data/data/####/files/platform/core/adStats/1493128224927
/data/data/####/files/platform/core/prop/config_black.dat
/data/data/####/app_workbench11234/apk.zip
/data/data/####/files/platform/core/adStats/1493128226634
/data/data/####/files/platform/core/adStats/1493128225535
/data/data/####/files/platform/core/adStats/1493128224253
/data/data/####/files/umeng_it.cache
/data/data/####/files/platform/core/adStats/1493128224433
/data/data/####/files/platform/core/adStats/1493128225945
/data/data/####/files/platform/core/adStats/1493128224414
/data/data/####/files/platform/core/adStats/1493128224338
/data/data/####/files/platform/core/adStats/1493128224137
/data/data/####/shared_prefs/pref_recomm.xml
/data/data/####/files/platform/core/trigger/20170425
/sdcard/config/setting.dat
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/files/platform/core/adStats/1493128224333
/data/data/####/files/platform/core/adStats/1493128225325
/data/data/####/app_workbench88904/apk.zip
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/shared_prefs/tdid.xml
/data/data/####/files/platform/core/adEvent/1493128209803
/data/data/####/baea/entrance.jar
/data/data/####/files/platform/core/adStats/1493128225616
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
/data/data/####/shared_prefs/lxdMoblieAgent_sys_config.xml
/data/data/####/shared_prefs/zhangpay_share.xml
/data/data/####/app_workbench33644/apk.zip
/data/data/####/files/platform/core/trace/170208_20170425/common
/data/data/####/shared_prefs/JunLinCacheData.xml

Другие:

Запускает следующие shell-скрипты:

ping -c 2 ic.ailife88.com
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
ls /sys/devices/system/cpu
ping -c 2 ia.37xh.cn
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
getprop ro.product.cpu.abi
getprop ro.yunos.version
getprop ro.miui.ui.version.name
ping -c 2 ic.yule37.cn
ping -c 2 ia.travel345.cn
cat /proc/meminfo
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data

Использует специальную библиотеку для скрытия исполняемого байткода.

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней