Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.99.origin
- Android.Xiny.122.origin
- Android.DownLoader.441.origin
- Android.Xiny.115.origin
Сетевая активность:
Подключается к:
- 1####.####.198
- g####.####.com
- 1####.####.198:8088
- b####.####.com
Запросы HTTP GET:
- g####.####.com/game-log/api.do?op=####&ei=####&si=####&chn=####&ver=####...
Запросы HTTP POST:
- b####.####.com/billing/action.json
- b####.####.com/billing/action.json?checksum=####
- 1####.####.198:8088/charge/judgeIfBlack.htm
- 1####.####.198/charge/judgeIfBlack.htm
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/CommandCache/75fa4bdbf2c1284c6ce1a9057bcc2062
- /data/data/####/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml
- /data/data/####/0c071c180a0c270848786.dex
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- /data/data/####/databases/database-journal
- /data/data/####/cache/CommandCache/fbd52b3bd2bff43014d214c3c3e1c9e5
- /data/data/####/shared_prefs/yoypaysdk_pref.xml
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/shared_prefs/3051b094348b98ff9cdf9e83ea5a4d601|account_file.xml
- /data/data/####/databases/yoypaysdk.db
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/cache/Analysis/avoscloud-analysis
- /data/data/####/files/0c071c180a0c476182928.jar
- /data/data/####/files/0c071c180a0c220759443.jar
- /data/data/####/files/.yoypay/account/tourist.act
- /sdcard/.yoypay/account/tourist.act
- /sdcard/.tcookieid
- /data/data/####/databases/yoypaysdk.db-journal
- /data/data/####/files/installation
- /data/data/####/files/mj.dex
- /data/data/####/0909181a13010f141319236830.dex
- /data/data/####/files/0c071c180a0c980993444.jar
- /sdcard/Sonnenblume/res.apk.u
- /data/data/####/shared_prefs/com.freepay.sdk.a.xml.bak
- /data/data/####/files/0c071c180a0c270848786.jar
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/cache/CommandCache/bcb757498a149a1f5bcd968582129c4c
- /data/data/####/files/0909181a13010f141319236830.jar
- /sdcard/Sonnenblume/4A72F2DFFDBD84EB0C5C797BB76AFC44
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/cache/CommandCache/8c296e8cea027e52e238853c5c8d404d
- /data/data/####/shared_prefs/com.freepay.sdk.a.xml
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/shared_prefs/AVOSCloud-SDK.xml
- /sdcard/Sonnenblume/EE53AF5B170264468E95E783E26D76C2
Другие:
Запускает следующие shell-скрипты:
- dumpsys meminfo 2268
- dumpsys meminfo 2071
- /system/bin/dexopt --dex 27 87 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- /system/bin/dexopt --dex 27 55 40 747688 /data/data/####/app_dex/tmp.apk 1217570341 -728224948 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framewor
- /system/bin/dexopt --dex 27 70 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- cat /proc/meminfo
- dumpsys meminfo 2436
- /system/bin/dexopt --dex 27 82 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- /system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c220759443.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c1535893303.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 80 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- cat /proc/cpuinfo
- /system/bin/dexopt --dex 27 87 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- /system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c980993444.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 92 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- /system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c270848786.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 45 40 158684 /data/data/####/files/0909181a13010f141319236830.jar 1200268050 -1513649776 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 81 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
- /system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c476182928.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 86 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
