Android.Packed.21023

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.248.origin
Android.Triada.226.origin

Сетевая активность:

Подключается к:

statis####.####.com
mo####.####.com
i####.####.com
o####.####.com
6####.####.140
r####.####.com
mobads-####.####.com
a####.####.com

Запросы HTTP GET:

r####.####.com/res/qclx/upload/theme/1431682554451..jpg
r####.####.com/res/qclx/upload/theme/1423822635084..zip
mo####.####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=##...
r####.####.com/res/qclx/upload/theme/1412250535632..jpg
6####.####.140/ando/i/mon?k=####&d=####
r####.####.com/res/qclx/upload/theme/1438591925655..jpg
r####.####.com/res/qclx/upload/theme/1421138618872..jpg
r####.####.com/adsw/qclx.html
r####.####.com/res/qclx/upload/theme/1423813837383..jpg
mo####.####.com/ads/pa/8/__xadsdk__remote__8.53.jar
r####.####.com/res/qclx/upload/theme/1423556874348..jpg
i####.####.com/ando-res/ads/18/19/da964672-e0f2-4f69-a63b-cea979b9a721/7...
r####.####.com/res/qclx/upload/theme/1426056237191..jpg
r####.####.com/adsw/adimg/duibasplash.webp
mo####.####.com/cpro/ui/mads.php?code2=####
r####.####.com/res/qclx/upload/theme/1427873805802..jpg
r####.####.com/res/qclx/upload/theme/1412729631026..jpg
i####.####.com/ando-res/ads/4/5/d73ab4a4-4c75-43a7-a3c9-5bdabd9437c8/c21...

Запросы HTTP POST:

statis####.####.com/statistics/init.json
statis####.####.com/statistics/config.json
statis####.####.com/statistics/pv_uv.json
r####.####.com/doc/service/down/user_info.json
r####.####.com/doc/service/down/vip_list.json
o####.####.com/check_config_update
r####.####.com/doc/service/down/loading_page.json
mobads-####.####.com/brwhis.log
r####.####.com/doc/service/up/init.json
6####.####.140/ando/x/liv?app_id=####&r=####
r####.####.com/doc/service/down/advertInfo.json
6####.####.140/ando/x/req?app_id=####&r=####
statis####.####.com/statistics/oprdetail.json
6####.####.140/ando/x/lis?app_id=####&r=####
r####.####.com/doc/service/down/notify.json
r####.####.com/doc/service/down/lazy_suit_list.json
a####.####.com/app_logs
a####.####.com/ad-service/ad/mark
r####.####.com/doc/service/down/theme_list_new.json
r####.####.com/doc/service/down/audit.json
statis####.####.com/statistics/event.json

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/databases/call_desk.db-journal
/sdcard/syezon/qclx/show/list/cache/14f0bd847dde4d38fa02d5bbab6aa7e8
/data/data/####/shared_prefs/com.baidu.mobads.loader.xml
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/KuUrKglHyPRFlOKIVAu4xQDRqPm96fpA.new
/sdcard/syezon/qclx/show/v_cache/-495963660-286469699
/sdcard/syezon/qclx/show/v_cache/-506908304-1614137658
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/r8Q4jxQLd7p9lOs1gqSe_A==
/data/data/####/shared_prefs/period_time.xml.bak
/data/data/####/style/preview/res/drawable/01_02.png
/data/data/####/style/preview/res/drawable/star11.png
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/FQwqL4xk5_UcL3tE7t6UZONOXkpdJSVVqa4fog==.new
/data/data/####/shared_prefs/jg_app_update_settings_random.xml
/sdcard/syezon/qclx/show/v_cache/-495963660-102581025
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/syezon/call_plug/callshow/ringing/previewres/raw/theme_ring.mp3
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/DHtV4J6m6bXFSs4rguM9mGBAJNYn0FgSjlXjpA==.new
/sdcard/syezon/qclx/show/v_cache/-200175017105419172
/sdcard/.env/.uunique.new
/data/data/####/style/preview/res/drawable/blank.png
/data/data/####/style/preview/res/drawable/bg02.jpg
/data/data/####/style/preview/res/drawable/answer01.png
/data/data/####/style/preview/res/drawable/Keyboard02.png
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/shared_prefs/syezon_agent_online_setting_####.xml.bak
/data/data/####/style/preview/res/drawable/bottom_change01.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/YFLRZH_5nQ_rgGHq/an0aUgdurzLlym5t/60f106a7-f583-45bd-9726-c2f5c2d89bd2.res.temp
/sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/sePnQs3vQhANLAgTDz_2iILcqdBwXoZIRjE8VA==.new
/data/data/####/style/preview/res/drawable/star02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/ge_b7L0H94y13gPwo0FnlQ9oZ3bECn34T9J8vg9RVG4=.new
/data/data/####/style/preview/res/drawable/Keyboard01.png
/data/data/####/code-1715589/jlcIfpLXdLIaGGCv/KJkRQ2-iAKY=.jar
/data/data/####/app_jgls/.log.ls
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/N3XvJ0v409BnUEHd/OPZaWUWUlf75LzwH5qNLRBy1fBdEq1HN.new
/data/data/####/cache/image_manager_disk_cache/984b4e0391e9031a2d6ba925693ef9af2a8eee7ffc9c41d3224b619a70bcebf7.0.tmp
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/sdcard/syezon/qclx/show/v_cache/-495963660203585586
/sdcard/syezon/qclx/show/list/cache/1ede5169866a6322fa23055b23373e19
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/nGMDYrS0vppI9iOj5hguoA==/5wHj_EBYcPAQJj7ss4dXYQ==
/data/data/####/style/preview/res/drawable/mid01_02.png
/data/data/####/style/preview/res/drawable/mid01_01.png
/data/data/####/style/preview/res/drawable/answer02.png
/data/data/####/fileCache/vip_info_list.dat
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/zsWbJAsADar8cwia2uT4AQ==
/data/data/####/style/preview/res/drawable/02_01.png
/data/data/####/shared_prefs/__xadsdk_downloaded__version__.xml
/data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
/sdcard/syezon/qclx/show/list/cache/33deb1efc35d093734863a0622343e20
/sdcard/.armsd/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/3eb630c5-ec54-49b2-8df9-89a5725f3202.res
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/LetWdPQlwP2ZV03PP3hSFg==.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/N3XvJ0v409BnUEHd/OPZaWUWUlf75LzwH5qNLRBy1fBdEq1HN
/sdcard/.android/mobclick_agent_cache/####/detail
/data/data/####/style/preview/res/drawable/bottom_change03.png
/data/data/####/files/heeivw_d/heeivw_f.zip
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/r8Q4jxQLd7p9lOs1gqSe_A==.new
/data/data/####/shared_prefs/__x_adsdk_agent_header__.xml
/sdcard/syezon/qclx/show/list/cache/.nomedia
/sdcard/syezon/qclx/show/v_cache/-495963660213707036
/sdcard/syezon/qclx/show/list/cache/96edb042af1365791739f207a9068c42
/data/data/####/shared_prefs/call_config.xml
/sdcard/.armsd/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
/data/data/####/shared_prefs/com.baidu.mobads.loader.xml.bak
/data/data/####/style/preview/heart.jar
/data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__3fc6e122-35b7-40a1-855b-e943dc53b463.jar
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_OfpShTc5lBr0EFbr
/data/data/####/style/preview/res/drawable/01_01.png
/data/data/####/style/preview/res/drawable/bg01.jpg
/data/data/####/files/umeng_it.cache
/sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_dffbU7BBoT2ZnuH4u8zmiMRhka4=
/data/data/####/files/.jglogs/.jg.ic
/sdcard/.armsd/alLbon3AuQynvtpS/MP8MtaBuguN9jnuSwtN1kQ==
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/qPmBfF-79gMgn2lm0y13q-oOf5E=
/data/data/####/style/preview/res/drawable/ending01.png
/data/data/####/style/preview/res/drawable/ending02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/qPmBfF-79gMgn2lm0y13q-oOf5E=.new
/data/data/####/style/preview/res/drawable/Speaker02.png
/data/data/####/style/preview/res/drawable/left02_02.png
/data/data/####/style/preview/res/drawable/bottom_change04.png
/data/data/####/style/preview/res/drawable/bottom_change02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/4LiUT3m_yRc_XTnP9sj8Q_IZQ8ihMEda.new
/data/data/####/style/preview/res/drawable/left01_01.png
/sdcard/.android/mobclick_agent_cache/####/flowadd
/data/data/####/style/preview/res/drawable/refusal02.png
/sdcard/.armsd/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/UDLaFSBgoAYZk8s3XSYx9g==/ff490237-f7e7-48c0-9cf5-7777460c85a0.res
/data/data/####/.jiagu/libjiagu.so
/data/data/####/files/voaRc3bJyeqn-4amrc7QUw==/7Wb4wMRtYZ44NtF0u64xh7lqXkg=
/data/data/####/shared_prefs/period_time.xml
/data/data/####/style/preview/res/drawable/right01_02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/EyJCezFMcuvf-HCx/6Doq3LzmhsqsqQIf.new
/data/data/####/style/preview/res/drawable/star12.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/YFLRZH_5nQ_rgGHq/an0aUgdurzLlym5t/06e33630-fe5d-435e-8f07-fda4ebb4170d.res.temp
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/zG4cdwQmhCWVWJ2gEmTfVg==/runner_info.prop
/data/data/####/style/preview/res/drawable/mid02_02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/in95fWOFr9cvq9nTWxJInoJXvjQTLlNiIoYPN4Ld_hY=.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/vskgc4azCsu1VjZ9g_o8rmCMS-k=
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_OfpShTc5lBr0EFbr-journal
/data/data/####/style/preview/res/drawable/left02_01.png
/data/data/####/style/preview/res/drawable/mid02_01.png
/data/data/####/cache/volley/-1177802923-2134083281
/sdcard/.android/mobclick_agent_cache/####/event
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/nGMDYrS0vppI9iOj5hguoA==/0PVHNe90w5d1Mmih
/data/data/####/app_jgls/.log.lock
/data/data/####/style/preview/res/drawable/02_02.png
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/D29cSrKA7abygKwLRdO3M56dHO-13lva.new
/sdcard/syezon/qclx/show/list/cache/238f8ba01df6f07df549db46e8e6adfc
/sdcard/syezon/qclx/show/list/cache/a7293682c59d4fd488ec23baf94395cc
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/zG4cdwQmhCWVWJ2gEmTfVg==/runner_info.prop.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/YFLRZH_5nQ_rgGHq/an0aUgdurzLlym5t/6a13e1de-210c-4139-8cd2-f46b051b077e.res.temp
/data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
/data/data/####/code-1715589/MY6zVk6Xr3IkfcWA
/data/data/####/style/preview/res/drawable/Speaker01.png
/sdcard/syezon/qclx/show/style/1423822635084..zip
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/zsWbJAsADar8cwia2uT4AQ==.new
/data/data/####/files/rdata_comhongdaccd.new
/data/data/####/style/preview/res/drawable/refusal01.png
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/RGhKu3ChPZPK2LtrpFSizw==/data.dat.tmp
/data/data/####/shared_prefs/####_preferences.xml
/sdcard/syezon/qclx/show/v_cache/-495963660230059175
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/qPmBfF-79gMgn2lm0y13q-oOf5E=.old
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_-N73xnUKmig5v_GRzHhV2Q==-journal
/data/data/####/files/mobclick_agent_cached_####220
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/E7zODdlH8TYjPm8M_f8aHvvoEW60nzhU.new
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/wtj-R6fQrhF-6b7NkyClWw==.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/vskgc4azCsu1VjZ9g_o8rmCMS-k=.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/qO67WjnpNgcDoZZGZDyKfxEO_Es=.new
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/EyoY4V8sMNszemmubYq4nL9l_GCwI_J3.new
/sdcard/syezon/qclx/show/list/cache/9a4a106e1aa0b373b1edb4baafbf136f
/sdcard/syezon/launcher/.nomedia
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/Tj7-gp4e3zC4Rw7C-WTgwQ_UAXJ_GLEy.new
/sdcard/syezon/qclx/show/.nomedia
/sdcard/.armsd/alLbon3AuQynvtpS/r_pkDgN4OhnkSa0D
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/N3XvJ0v409BnUEHd/OPZaWUWUlf75LzwH5qNLRBy1fBdEq1HN.old
/data/data/####/files/.imprint
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/5gC9KifjKRe-b4uGpBqcVd2D_RE=.new
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_kEPjNu2rS53YQ_YyZdU2cA==-journal
/data/data/####/style/preview/res/drawable/star01.png
/sdcard/syezon/qclx/show/v_cache/-495963660-2090435956
/sdcard/syezon/qclx/show/list/cache/b0b2f391e7faf447832c4c3a0da9c953
/sdcard/syezon/qclx/show/v_cache/-495963660-1305326981
/data/data/####/cache/image_manager_disk_cache/journal.tmp
/data/data/####/shared_prefs/syezon_agent_online_setting_####.xml
/sdcard/syezon/qclx/show/v_cache/-4959636601266024713
/data/data/####/style/preview/res/drawable/right01_01.png
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/n5hoTu1xHLqzIE_GlgmdvLELnCh8crDMbIhmy3EBFIg=.new
/data/data/####/databases/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_dffbU7BBoT2ZnuH4u8zmiMRhka4=-journal
/data/data/####/style/preview/res/drawable/left01_02.png
/data/data/####/databases/webview.db-journal
/data/data/####/style/preview/res/drawable/right02_02.png
/data/data/####/style/preview/res/drawable/right02_01.png
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/syezon/qclx/show/v_cache/-495963660-1756166818
/data/data/####/files/PL6hWbcERdPuEkqsA8nC3e1y1uVQdimd_files/RVIpSzgb5l7Fjqjw9u5qNg==/r8Q4jxQLd7p9lOs1gqSe_A==.old
/data/data/####/shared_prefs/call_config.xml.bak
/sdcard/syezon/qclx/show/list/cache/45710d46713c51e6ebfd07b8ca4ebccf
/data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/TcTIzTZYNzXkql3sFwm1Ew==/u7OcHHD36uitpoeA.zip

Присваивает атрибут 'исполняемый' для следующих файлов:

/data/data/####/code-1715589/MY6zVk6Xr3IkfcWA

Другие:

Запускает следующие shell-скрипты:

/system/bin/dexopt --dex 27 100 40 209220 /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar 1224107626 -615094944 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fra
/system/bin/dexopt --dex 27 70 40 100844 /data/data/####/files/heeivw_d/heeivw_f.zip 1248677352 -1455368258 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/frame
sh /data/data/####/code-1715589/MY6zVk6Xr3IkfcWA -p #### -c ####.bqxvg.a.a.c.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
/system/bin/dexopt --dex 27 111 40 51084 /data/data/####/style/preview/heart.jar 1179488393 962000800 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
chmod 755 /data/data/####/.jiagu/libjiagu.so
/data/data/####/code-1715589/MY6zVk6Xr3IkfcWA -p #### -c ####.bqxvg.a.a.c.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
/system/bin/dexopt --dex 27 75 40 616244 /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/TcTIzTZYNzXkql3sFwm1Ew==/u7OcHHD36uitpoeA.zip 1244425418 1506019620 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/
/system/bin/dexopt --dex 27 129 40 29472 /data/data/####/code-1715589/jlcIfpLXdLIaGGCv/KJkRQ2-iAKY=.jar 1228112486 341356622 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.

Использует специальную библиотеку для скрытия исполняемого байткода.

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней