Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Сетевая активность:
Подключается к:
- t####.####.com
- u####.####.com
- g####.####.com
- h####.####.com
- p####.####.com
- wap####.####.com
- l####.####.com
- t####.####.cn
Запросы HTTP GET:
- wap####.####.com/static/appsapi/conf/config.txt?cdnversion=####&tpl=####...
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- u####.####.com/v1/root/ml?appkey=####×tamp=####&sign=####
- t####.####.cn/ggjc/update/20150803/1c2b85df63733ecb19c6babf674b4671-2015...
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- p####.####.com/antispam/1.0/scan_sms?auth_ver=####&appkey=####&nonce=###...
- u####.####.com/v1/root/slg?appkey=####×tamp=####&sign=####
- p####.####.com/api/tokens?tk=####&sv=####
- p####.####.com/api/data?token=####&tk=####&sv=####
- h####.####.com/app.gif
- l####.####.com/sdk.php
- t####.####.com/2.0/cu?auth_ver=####&appkey=####&nonce=####&model=####&is...
- u####.####.com/v1/report?appkey=####×tamp=####&sign=####&msg_id=####
- l####.####.com/offline_loc
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-546439907.zip
- /data/anr/traces.txt
- <Package Folder>/databases/z-journal
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/DianxinDXB.xml.bak
- <Package Folder>/databases/traffic_analyer.db-journal
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/PreExcuModsInfo.txt
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <Package Folder>/shared_prefs/traffic_analyer.xml.bak
- <Package Folder>/databases/app_control.db-journal
- <Package Folder>/shared_prefs/antispam_settings.xml
- <Package Folder>/ReadyHost.txt
- <Package Folder>/shared_prefs/authority.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/al_events.db-journal
- <Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe
- <Package Folder>/files/pub_lstime
- <Package Folder>/shared_prefs/rt.xml
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/shared_prefs/qbsdk_prefs.xml
- <Package Folder>/databases/appinfo.db-journal
- <Package Folder>/app_file_odex/MasterControl.dex
- <Package Folder>/databases/traffic_analyer.db
- <Package Folder>/shared_prefs/FirstInSP.xml
- <Package Folder>/shared_prefs/ye_db_configs.xml
- <Package Folder>/shared_prefs/zeuscfg.xml.bak
- <Package Folder>/shared_prefs/home_activity_prefs.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/nettimes.xml.bak
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes1808860731.zip
- <Package Folder>/files/1495006111925_cgr.so
- <Package Folder>/databases/message_box_list.db
- <Package Folder>/shared_prefs/card.xml
- <Package Folder>/shared_prefs/floatwindow.xml
- <Package Folder>/shared_prefs/diagnostic.xml.bak
- <Package Folder>/databases/root_unfinish_transaction.db
- <Package Folder>/databases/z
- <Package Folder>/shared_prefs/netflow_config.xml
- <Package Folder>/shared_prefs/FirstInSP.xml.bak
- <Package Folder>/files/CeEqXfp3u.jar
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/databases/al_events.db
- <Package Folder>/databases/antispam.db
- <Package Folder>/files/autocorrect.dat
- <Package Folder>/files/bp-4.0-arm.src
- <Package Folder>/shared_prefs/utils.xml
- <Package Folder>/databases/apkdownloader.db-journal
- <Package Folder>/databases/message_box_list.db-journal
- <Package Folder>/shared_prefs/nettimes.xml
- <Package Folder>/shared_prefs/safe_upgrade_prefs.xml
- <Package Folder>/files/traffic_analyer
- <Package Folder>/shared_prefs/relational_recom_prefs.xml
- <Package Folder>/shared_prefs/apkdownloaderlib.xml
- <Package Folder>/shared_prefs/DianxinDXB.xml
- <Package Folder>/shared_prefs/zeuscfg.xml
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/shared_prefs/home_activity_prefs.xml
- <Package Folder>/databases/app_control.db
- <Package Folder>/shared_prefs/imconfg.xml
- <Package Folder>/files/daemon
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/process_white_list.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/diagnostic.xml
- <Package Folder>/databases/antispam.db-journal
- <Package Folder>/databases/root_unfinish_transaction.db-journal
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes2.dex
- <Package Folder>/shared_prefs/paysecurity_prefs.xml
- <Package Folder>/shared_prefs/paysecurity_prefs.xml.bak
- <Package Folder>/shared_prefs/daemon.xml
- <Package Folder>/shared_prefs/ye_alarm_configs.xml
- <Package Folder>/shared_prefs/appmgr.xml
- <Package Folder>/shared_prefs/msg_pref.xml
- <Package Folder>/shared_prefs/appmgr_updates.xml
- <Package Folder>/files/1495006115627.jar
- <Package Folder>/shared_prefs/notification_mgr_config.xml
- <Package Folder>/shared_prefs/antispam_settings.xml.bak
- <Package Folder>/shared_prefs/traffic_analyer.xml
- <Package Folder>/files/bp10
- <Package Folder>/databases/apkdownloader.db
Другие:
Запускает следующие shell-скрипты:
- getenforce
- /system/bin/bp10 --check-version
- /data/data/####/files/us.T9956SiG7fmmmf8Tr93uW2ZFu9Tsf -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh <Package Folder>/files/us.PN1fU8GSNHq2u5c5bxT46crLenRwv -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- sh <Package Folder>/files/bp10 --check-version
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/CeEqXfp3u.dex > /dev/null 2>&1
- chmod 755 <Package Folder>/files/bp10
- su -v
- /system/bin/cat /sys/block/mmcblk3/device/cid
- /system/bin/cat /proc/meminfo
- /data/data/####/files/us.G1Icct2e3P9Z18J86Mpu25SKbzuum -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh <Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- sh <Package Folder>/files/us.2k067773g8d3vgFeimWJ3tWG5Y4FW -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- chmod 0771 /data/data/####/.syslib-
- /data/data/####/files/us.2k067773g8d3vgFeimWJ3tWG5Y4FW -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- /data/data/####/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- /data/data/####/files/us.PN1fU8GSNHq2u5c5bxT46crLenRwv -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- /system/bin/cat /sys/block/mmcblk2/device/cid
- sh <Package Folder>/files/us.L9tpKgam9zy6Sxyt3Lz2I87NOpvuf -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- /system/bin/cat /sys/block/mmcblk0/device/cid
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/CeEqXfp3u.jar > /dev/null 2>&1
- /system/bin/cat /sys/block/mmcblk1/device/cid
- chmod 755 /data/data/####/files/bp10
- daemon
- <error:2>
- /data/data/####/files/bp10 --check-version
- sh <Package Folder>/files/us.G1Icct2e3P9Z18J86Mpu25SKbzuum -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe > /dev/null 2>&1
- /data/data/####/files/us.L9tpKgam9zy6Sxyt3Lz2I87NOpvuf -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- <dexopt>
- sh <Package Folder>/files/us.T9956SiG7fmmmf8Tr93uW2ZFu9Tsf -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
Использует повышенные привилегии.
Может автоматически отправлять СМС-сообщения.
