Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.11.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.84
Сетевая активность:
Подключается к:
- s####.####.com
- ena####.####.com
- 1####.####.171:9081
- s####.####.com:9081
- 7j####.####.com
- o####.####.com
- p####.####.com
- enapps####.####.com
- ym####.####.com
- gl####.####.net
- s####.####.net
- c-h####.####.com
- 1####.####.171
- a####.####.com
Запросы HTTP GET:
- ena####.####.com/app_theme/26/pic/9351793961342670pic.png?id=####
- ena####.####.com/app/2002367/icon/802547124651766icon.png?id=####
- enapps####.####.com//app_theme/24/pic/356955977556996pic.png
- enapps####.####.com//app/3159162/icon/7109247599847784icon.png
- s####.####.net/stat/aos/v3/init?s=####
- 1####.####.171/micfile/upload/SDK/OldEy/ojs2.png
- enapps####.####.com//app_theme/26/pic/9351793961342670pic.png
- gl####.####.net/interstitial/aos/v1/req?s=####
- ena####.####.com/app/3159162/icon/7109247599847784icon.png?id=####
- enapps####.####.com//app_theme/27/pic/9351809766447210pic.png
- 7j####.####.com/tdata_HLl944
- ena####.####.com/app/2002359/icon/702683201284463icon.png?id=####
- ena####.####.com/app_theme/24/pic/356955977556996pic.png?id=####
- enapps####.####.com//app/3159163/icon/7109549184254306icon.png
- p####.####.com/t018902e953e3ee9df4.png
- enapps####.####.com//app_theme/48/pic/362585698350087pic.png
- p####.####.com/t014704a1feae3bea37.png
- p####.####.com/t01d5328682bf301b68.png
- enapps####.####.com/appStoreApi?method=####&mac=####&ver=####&batchId=##...
- enapps####.####.com//app/2002321/icon/14597771486820629icon.png
- enapps####.####.com//app/2002367/icon/802547124651766icon.png
- enapps####.####.com//app/2012045/icon/8208310828620516icon.png
- ena####.####.com/app/2002294/icon/9944044262389349icon.jpg?id=####
- ena####.####.com/app/2002321/icon/14597771486820629icon.png?id=####
- enapps####.####.com/appStoreApi?categoryId=####&method=####&pageSize=###...
- enapps####.####.com//app/3159159/icon/5444044223134575icon.png
- p####.####.com/t010490b78b0ec26eee.jpg
- p####.####.com/t0127f29291d7a04642.png
- ena####.####.com/app/2005998/icon/1563309552930715icon.png?id=####
- enapps####.####.com//app/2005998/icon/1563309552930715icon.png
- enapps####.####.com//app/2006004/icon/2674480560739625icon.png
- p####.####.com/t01e4686c6c326048d4.png
- ena####.####.com/app/2002310/icon/14086934490891910icon.png?id=####
- s####.####.com/config/hz-hzv3.conf
- ena####.####.com/app_theme/21/pic/10528660363535363pic.jpg?id=####
- enapps####.####.com/appStoreApi?method=####&type=####&mac=####&ver=####&...
- enapps####.####.com//app_theme/21/pic/10528660363535363pic.jpg
- 7j####.####.com/tdata_XEV804
- enapps####.####.com/appStoreApi?method=####&pageNo=####&pageSize=####&ma...
- enapps####.####.com/appStoreApi?method=####&appVer=####&appId=####&pageN...
- gl####.####.net/stat/aos/v3/pns?s=####
- p####.####.com/t010ed085996a183381.png
- ena####.####.com/app/3159159/icon/5444044223134575icon.png?id=####
- p####.####.com/t01a8e305024b3fff57.png
- ena####.####.com/app/3159163/icon/7109549184254306icon.png?id=####
- 7j####.####.com/tdata_ibT567
- 1####.####.171/micfile/upload/SDK/OldEy/oas5.png
- 1####.####.171/micfile/upload/SDK/OldEy/ors5.png
- p####.####.com/t015b813cede0904e4d.png
- p####.####.com/t013f9f27a5bf43f492.png
- enapps####.####.com//app_theme/46/pic/354940204750662pic.png
- enapps####.####.com/appStoreApi?method=####&mac=####&androidId=####&devi...
- ena####.####.com/app/2006004/icon/2674480560739625icon.png?id=####
- ena####.####.com/app/2002283/icon/9857315932064103icon.png?id=####
- ena####.####.com/app/2002315/icon/14092602590838817icon.png?id=####
- enapps####.####.com//app/2002310/icon/14086934490891910icon.png
- enapps####.####.com//app/2002359/icon/702683201284463icon.png
- enapps####.####.com//downloadPic.htm?picUrl=####
- ena####.####.com/app_theme/27/pic/9351809766447210pic.png?id=####
- ena####.####.com/app_theme/48/pic/362585698350087pic.png?id=####
- p####.####.com/t01bb94dc9376b91838.png
- enapps####.####.com//app/2002294/icon/9944044262389349icon.jpg
- enapps####.####.com/appStoreApi?method=####&type=####&pageSize=####&page...
- ym####.####.com/AppStore_20161219094205209_M100109_update_5.1.1_20170323...
- ena####.####.com/app/2012045/icon/8208310828620516icon.png?id=####
- p####.####.com/t011c91b5deba37ddf7.png
- ena####.####.com/app_theme/46/pic/354940204750662pic.png?id=####
- enapps####.####.com//app/2002283/icon/9857315932064103icon.png
- enapps####.####.com//app/2002315/icon/14092602590838817icon.png
- p####.####.com/t011dd400dfbbc5f4ec.png
Запросы HTTP POST:
- s####.####.com/mic/customer/reg.do
- enapps####.####.com/appStoreApi?method=####&path=####&mac=####&ver=####&...
- o####.####.com/v2/get_update_time
- enapps####.####.com/appStoreApi?/egameapi?ver=####&sdkAppId=####&method=...
- s####.####.com:9081//mic/customer/heartBeat2.do
- o####.####.com/v2/check_config_update
- a####.####.com/app_logs
- 1####.####.171:9081/mic/cp/a.do
- c-h####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/app_plugin_dir/com.ss.a.as/5_5/com.ss.a.as.apk
- /data/data/####/files/init.pid
- /sdcard/Android/data/####/cache/xBitmapCache/945e4695ee18c49c648baf70e5208cb3.0
- /data/data/####/files/tmp/oas5.png
- /sdcard/Android/data/####/cache/xBitmapCache/4645083237896d1d1e4f67c3800e0a13.0
- /sdcard/Android/data/####/cache/xBitmapCache/8a89fdc017278565e648711e51ea55e1.0
- /sdcard/Android/data/####/cache/xBitmapCache/6d82fc73457ec07e4ecd49887fe0365c.0
- /data/data/####/files/tdata_HLl944.jar
- /sdcard/Android/data/.dataycache/i42d45df023jnkdd93la483f9xGFKXI
- /data/data/####/shared_prefs/com.ss.a.as_sp_mic.xml
- /sdcard/Android/data/####/cache/xBitmapCache/3feaf4b4d5fa2ff50c6607c3528e5758.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- /sdcard/Android/data/####/cache/xBitmapCache/df5765f612f20413c9c3e46ec39c4c93.0
- /sdcard/Android/data/syspatch/pl/oas5.png.tmp
- /data/data/####/files/tmp/ojs2.png
- /sdcard/Android/data/####/cache/xBitmapCache/e0bf8abce8172482da13788e7f6c9a8e.0
- /data/data/####/databases/galhttprequest_database
- /sdcard/libs/####.db
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/xBitmapCache/f94061679d5fd2a7fe5c59921699dd49.0
- /sdcard/Android/data/syspatch/pl/ojs2.png
- /sdcard/Android/data/####/cache/xBitmapCache/5e3839b742bb10cb321dd66c854a4893.0
- /sdcard/Android/data/####/cache/xBitmapCache/adf1b7430b5e0d5abc8439314674357e.0
- /sdcard/Android/data/####/cache/xBitmapCache/0c7892477777d535d17078790644fd8e.0.tmp
- /data/data/####/databases/XKwVoK0huy3R
- /data/data/####/files/tdata_HLl944.tmp
- /data/data/####/databases/increment.db-journal
- /sdcard/Android/data/####/cache/xBitmapCache/5fbc1cd6765aab3b4f99f6175580c2e9.0
- /data/data/####/files/run.pid
- /sdcard/Android/data/####/cache/xBitmapCache/e8168f318625f023606632a49275b327.0
- /sdcard/Android/data/####/cache/xBitmapCache/7a8c673891e42d56923fd77e94b09bb7.0
- /sdcard/Android/data/####/cache/99708291b5dbfba1cefaac4dbd05d77f
- /data/data/####/databases/P15pKIjsm64m-journal
- /sdcard/Android/data/####/cache/xBitmapCache/7cc7b9fb7202c01a9c6b6e41e6453c86.0
- /sdcard/Android/data/####/cache/xBitmapCache/ab36a594e893978edd4dbd953d6d419e.0.tmp
- /sdcard/Android/data/syspatch/pl/ors5.png.tmp
- /data/data/####/files/tmp/ors5.png
- /data/data/####/files/img/ojs2.png
- /sdcard/Android/data/syspatch/pl/ojs2.png.tmp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/.egame/updateApk/AppStoreUpdate.apk
- /data/data/####/files/img/ors5.png
- /data/data/####/cache/1493729926442.jpg
- /data/data/####/databases/wIU6pTyUBYWX-journal
- /sdcard/Android/data/####/cache/xBitmapCache/e233b9452c2b0d87ad1e105617aef754.0
- /data/data/####/databases/dabfeb6fe256a23f83ee0653c0596bcd
- /data/data/####/databases/pushgdm.db-journal
- /sdcard/Android/data/####/cache/xBitmapCache/dacccdf189bcbbd4e4cfa671ca269363.0
- /data/data/####/cache/volley/2108415148-1651482769
- /data/data/####/databases/jqIqJYOT3JpT
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/wsUL1uCdKvjD
- /data/data/####/syspatch/data/id
- /data/data/####/app_plugin_dir/com.ss.a.js/2_2/com.ss.a.js.apk
- /sdcard/Android/data/####/cache/xBitmapCache/803d85090f5de0f190e2d810b6ed8d1d.0
- /sdcard/Android/data/####/cache/xBitmapCache/19a8585b5acd901fd5df7b4be5c5de91.0
- /data/data/####/app_plugin_dir/com.ss.a.rs/5_5/com.ss.a.rs.apk
- /data/data/####/files/push.pid
- /data/data/####/databases/pushsdk.db-journal
- /data/data/####/databases/XKwVoK0huy3R-journal
- /sdcard/Android/data/####/cache/xBitmapCache/fd38a0f50a75e8aeabe071451b0ed2be.0
- /data/data/####/defPhoneState/defesresult
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /sdcard/Android/data/.dataycache/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
- /sdcard/Android/data/.nomedia
- /data/data/####/cache/1493729925691.jpg
- /data/data/####/databases/T1oX0rhhuXWt-journal
- /sdcard/Android/data/####/cache/xBitmapCache/852d9e20223ab124818bcc27ba433bfd.0
- /sdcard/Android/data/####/cache/xBitmapCache/3b5d97e08725ade7b97236d759047ab3.0
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/files/img/oas5.png
- /data/data/####/databases/T1oX0rhhuXWt
- /sdcard/Android/data/####/cache/xBitmapCache/2bd08e388db3a86e41abe848558767da.0
- /data/data/####/databases/e46d14adca3baafb79861b6a2aa1edd8-journal
- /sdcard/system/tmp/local/tdata_HLl944
- /sdcard/Android/data/####/cache/xBitmapCache/047f844bba3d74855a5a08258e63b96e.0.tmp
- /sdcard/Android/data/####/cache/xBitmapCache/3fa25fa4f573542088dad5302065b7a3.0.tmp
- /sdcard/Android/data/####/cache/xBitmapCache/093d4f6795bcc5cdd028902774d5e31d.0
- /sdcard/Android/data/####/cache/xBitmapCache/5038a0d5701bd736f12373f4db762294.0
- /sdcard/Android/data/####/cache/xBitmapCache/9099bae4b468a40bb4c8345c574ee836.0
- /data/data/####/databases/com.ss.a.as_mic.db-journal
- /data/data/####/cache/1493729924197.jpg
- /sdcard/Android/data/####/cache/xBitmapCache/0251f64c9caacaf66f87b681efee76ef.0.tmp
- /sdcard/Android/data/syspatch/pl/oas5.png
- /data/data/####/databases/dabfeb6fe256a23f83ee0653c0596bcd-journal
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/databases/wIU6pTyUBYWX
- /data/data/####/databases/wsUL1uCdKvjD-journal
- /data/data/####/files/.imprint
- /data/data/####/databases/jqIqJYOT3JpT-journal
- /sdcard/Android/data/####/cache/xBitmapCache/9dac1f36245653aa18f60c6cfd74cdf9.0
- /sdcard/Android/data/####/cache/xBitmapCache/7a8c673891e42d56923fd77e94b09bb7.0.tmp
- /data/data/####/databases/P15pKIjsm64m
- /sdcard/Android/data/####/cache/xBitmapCache/cd9462275532be09bc3841c8276eb32e.0
- /data/data/####/databases/galhttprequest_database-journal
- /sdcard/Android/data/####/cache/xBitmapCache/839cc859d3e746e748600200c5081f76.0
- /data/data/####/shared_prefs/com.ss.a.as_sp_mic.xml.bak
- /sdcard/libs/app.db
- /data/data/####/databases/xUtils.db-journal
- /data/data/####/shared_prefs/appstore_preference.xml
- /sdcard/Android/data/####/cache/xBitmapCache/1257cf14737c26eed6ebcc361d7247ee.0
- /data/data/####/cache/volley/-6696573171900173771
- /sdcard/Android/data/####/cache/xBitmapCache/62a8dcb4073eb8b6334e555bffe221be.0
- /data/data/####/databases/3d547e00da0f36ce043868a3d6fc0df9-journal
- /data/data/####/databases/3d547e00da0f36ce043868a3d6fc0df9
- /sdcard/Android/data/####/cache/xBitmapCache/ae47fe81db9304903e8a44242f537742.0.tmp
- /sdcard/Android/data/####/cache/xBitmapCache/journal.tmp
- /sdcard/Android/data/####/cache/xBitmapCache/f2be58932ad47f6fd80a7273e963c542.0
- /sdcard/Android/data/####/cache/xBitmapCache/cba3a565e61ee162e714f0979ce0d58d.0
- /sdcard/Android/data/####/cache/xBitmapCache/f86cb8f30645bf6d8d146bb4644a14ee.0
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 57 40 68008 /data/data/####/files/tdata_HLl944.jar 1249270266 2051700060 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 81 40 39380 /data/data/####/app_plugin_dir/com.ss.a.rs/5_5/com.ss.a.rs.apk 1235052978 -937492062 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
- cat /proc/version
- /system/bin/dexopt --dex 27 77 40 4050912 /data/data/####/app_plugin_dir/com.ss.a.as/5_5/com.ss.a.as.apk 1235052972 1802364504 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fra
- getprop ro.build.description
- /system/bin/dexopt --dex 27 84 40 7648 /data/data/####/app_plugin_dir/com.ss.a.js/2_2/com.ss.a.js.apk 1235052975 -1959236549 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
Может автоматически отправлять СМС-сообщения.
