Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Hmad.2
- Android.Loki.6.origin
- Android.Hmad.1.origin
Сетевая активность:
Подключается к:
- t####.####.net
- r####.####.com
- e####.####.com:8011
- ecup####.####.com:8013
- ecup####.####.com
- l####.####.io
- e####.####.com
- usdf####.com
- haha####.com
- usdf####.com:32090
- n####.####.com
- up####.####.net
Запросы HTTP GET:
- haha####.com/api/strategy.php?p=####
- n####.####.com/api/setting?app_id=####&sign=####
- up####.####.net/update?v=####&sdk=####&pkg=####&debug=####&aid=####&loca...
- up####.####.net/stylesdk/v1/config?token=####&channel=####&ua=####&net_n...
- haha####.com/api/download_list.php?p=####
- up####.####.net/update?sdk=####&v=####&pkg=####&debug=####&aid=####&loca...
- n####.####.com/request?p=####
Запросы HTTP POST:
- l####.####.io/common?funid=####&rd=####
- e####.####.com:8011/ugetad.do
- ecup####.####.com/pkup.do
- usdf####.com:32090/adroot/client
- t####.####.net/g/d
- usdf####.com/adroot/client
- r####.####.com/rqd/sync
- n####.####.com/
- e####.####.com/pgetad.do
- ecup####.####.com:8013/ukup.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/app_jc/tfx.jar
- /data/data/####/shared_prefs/uid####.xml
- /data/data/####/tx_shell/libshella-0.0.3.so
- /data/data/####/shared_prefs/bugly_data.xml
- /data/data/####/shared_prefs/pref_longtime.xml
- /data/data/####/shared_prefs/batmobi_install_apps.xml
- /data/data/####/databases/fxlock.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/pref_shorttime.xml
- /data/data/####/databases/nativedroid.asa.sdk.db-journal
- /data/data/####/databases/umplayer.db-journal
- /data/data/####/shared_prefs/intelligent.xml
- /sdcard/.batcloud/log/bat_log.txt
- /data/data/####/databases/fp.db-journal
- /data/data/####/files/td.lock
- /data/data/####/app_jc/dfx.jar
- /data/data/####/app_jc/tfp.jar
- /data/data/####/shared_prefs/fxkit.xml
- /data/data/####/files/plugin/plugin.jar
- /data/data/####/files/log/agent_log
- /data/data/####/app_jni/libskin
- /sdcard/.nativedroid/adc
- /sdcard/.batcloud/uid
- /data/data/####/shared_prefs/batcloud.xml
- /data/data/####/shared_prefs/batmobi_click.xml
- /data/data/####/shared_prefs/flowapp_shared.xml.xml
- /data/data/####/shared_prefs/batmobi_offer_cfg.xml
- /data/data/####/shared_prefs/fpksp.xml.bak
- /sdcard/.tcookieid
- /data/data/####/shared_prefs/hdplayer.xml
- /data/data/####/mix.dex
- /data/data/####/shared_prefs/fpssp.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/fpksp.xml
- /data/data/####/shared_prefs/TD_CHANNEL_ID.xml
- /data/data/####/app_jc/dfp.jar
- /sdcard/.nativedroid/tick
- /sdcard/.batcloud/log/XSCQ8IYHV4QV9HTKS2GLT9G3_log.txt
- /data/data/####/databases/fx_kit_unlock-journal
- /data/data/####/shared_prefs/umplayer_NewVerPrompt.xml.bak
- /data/data/####/files/TDtcagent.db
- /data/data/####/shared_prefs/pref_longtime.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/shared_prefs/com.nativedroid.sa.xml
- /data/data/####/databases/fpdown.db-journal
- /data/data/####/shared_prefs/fxssp.xml
- /sdcard/FP.txt
- /data/data/####/databases/usage.db-journal
- /sdcard/Android/data/shard/.UUID
- /data/data/####/er/cr.zip
- /data/data/####/files/log/crash_log
- /data/data/####/shared_prefs/umplayer_NewVerPrompt.xml
- /data/data/####/files/daemon
- /data/data/####/databases/bugly_db_lejiagu-journal
- /data/data/####/shared_prefs/batmobi_lib.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/daemon
- /data/data/####/er/cr.zip
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.meizu.product.model
- chmod 700 /data/data/####/tx_shell/libshella-0.0.3.so
- getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/dexopt --dex 27 52 40 279604 /data/data/####/files/plugin/plugin.jar 1201120086 -909843411 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
- logcat -d -v threadtime
- getprop ro.aa.romver
- sh /data/data/####/files/daemon --process_name #### --package_name #### --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.haha####.com/api/uninsta
- getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- getprop ro.build.version.sdk
- getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.board.platform
- getprop ro.build.nubia.rom.name
- /system/bin/dexopt --dex 27 54 40 292 /data/data/####/mix.dex 1493732202 -49011495 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- getprop ro.build.fingerprint
- /system/bin/dexopt --dex 27 57 40 58020 /data/data/####/er/cr.zip 1201443271 -257879848 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.aa.romver
- getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.version.opporom
- getprop ro.build.version.opporom
- getprop ro.meizu.product.model
- getprop ro.board.platform
- getprop ro.build.tyd.kbstyle_version
- /system/bin/dexopt --dex 27 74 40 130612 /data/data/####/app_jc/fp.jar 1199217453 52515220 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 72 40 249032 /data/data/####/app_jc/fx.jar 1200716949 -522154267 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- getprop ro.vivo.os.build.display.id
- /data/data/####/files/daemon --process_name #### --package_name #### --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.haha####.com/api/uninstall.
- getprop ro.build.version.release
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- chmod 775 /data/data/####/files/daemon
- getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.build.version.emui
- getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.miui.ui.version.name
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
