Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.533.origin
Сетевая активность:
Подключается к:
- re####.####.com
- n####.####.com
- o####.####.com
- a####.####.com
Запросы HTTP GET:
- n####.####.com/setting?app_id=####&sign=####
- re####.####.com/ad/find?platform=####&os_version=####&package_name=####&...
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/cmd.xml
- /data/data/####/app_indicators/indicator_p
- /data/data/####/shared_prefs/cleansdk_main_preferences.xml
- /data/data/####/files/mobclick_agent_cached_####4030808
- /data/data/####/shared_prefs/Settings.xml
- /data/data/####/files/MZfzkEYwvyoaOcGPlala.jar
- /data/data/####/databases/scanresult_writer.db-journal
- /data/data/####/files/yjkagei/libMZfzkEYwvyoaOcGPlala.so
- /data/data/####/files/QTaquPqNieotuXwJbt.jar
- /data/data/####/databases/scanresult_writer.db
- /data/data/####/files/yjkagei/libcaOtOdBlIzgQbPjIdynamicloader.so
- /sdcard/SHAREit/.caches/.log/.nomedia
- /data/data/####/databases/InnerClean.db
- /data/data/####/databases/history.db-journal
- /data/data/####/shared_prefs/Settings.xml.bak
- /data/data/####/files/PwNmXPNarmqXeiJqzxc.jar
- /data/data/####/shared_prefs/cmd.xml.bak
- /sdcard/SHAREit/.caches/.cloudthumbs/.nomedia
- /data/data/####/databases/sp_db-journal
- /data/data/####/shared_prefs/beyla_settings.xml.bak
- /data/data/####/files/caOtOdBlIzgQbPjIdynamicloader.dex
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/share_zone.db-journal
- /data/data/####/files/caOtOdBlIzgQbPjIdynamicloader.jar
- /data/data/####/shared_prefs/feed.xml.bak
- /data/data/####/files/log/agent_log
- /data/data/####/databases/scanresult_reader.db
- /data/data/####/files/.imprint
- /sdcard/SHAREit/.caches/.cache/.nomedia
- /data/data/####/databases/beyla.db-journal
- /data/data/####/files/YQWxaKQsPuBiZEYhdaemon.so
- /data/data/####/shared_prefs/clean_sdk_main_preferences.xml
- /sdcard/.sysAndroid/sys
- /data/data/####/databases/scanresult_writer.db-wal
- /data/data/####/databases/cmd.db-journal
- /sdcard/.googlex9/.xamdecoq0962
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/files/yjkagei/libQTaquPqNieotuXwJbt.so
- /data/data/####/files/QTaquPqNieotuXwJbt.dex
- /data/data/####/databases/webview.db-journal
- /sdcard/SHAREit/.caches/.tmp/.nomedia
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/com.nativedroid.module.offerprobe.xml
- /data/data/####/shared_prefs/feed.xml
- /data/data/####/files/yjkagei/libPwNmXPNarmqXeiJqzxc.so
- /data/data/####/databases/account.db-journal
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/mediafile.db-journal
- /data/data/####/databases/scanresult_reader.db-wal
- /data/data/####/databases/scanresult_reader.db-journal
- /data/data/####/databases/scanresult_reader.db-shm
- /data/data/####/databases/mediafile.db
- /data/data/####/files/cmd/permission_105809
- /data/data/####/shared_prefs/beyla_settings.xml
- /sdcard/Android/data/####/StorageVolumeHelper.tmp
- /sdcard/SHAREit/.thumbnails/.nomedia
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/files/log/crash_log
- /data/data/####/shared_prefs/SsidHistory.xml
- /sdcard/StorageVolumeHelper.tmp
- /data/data/####/shared_prefs/sdk_scl_pid_config.xml
- /data/data/####/databases/scanresult_writer.db-shm
- /data/data/####/app_indicators/indicator_d
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 50 40 828844 /data/data/####/files/MZfzkEYwvyoaOcGPlala.jar 1252295610 142907197 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sy
- getprop ro.miui.ui.version.code
- /system/bin/dexopt --dex 27 49 40 30568 /data/data/####/files/caOtOdBlIzgQbPjIdynamicloader.jar 1252295594 -132004956 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ex
- /system/bin/dexopt --dex 27 49 40 1220 /data/data/####/files/PwNmXPNarmqXeiJqzxc.jar 1252295611 -2089476600 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 50 40 35056 /data/data/####/files/QTaquPqNieotuXwJbt.jar 1250721955 -1090894027 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
Может автоматически отправлять СМС-сообщения.
