Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.248.origin
- Android.Triada.247.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- i####.####.com
Запросы HTTP GET:
- i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
- i####.####.com/ando-res/ads/5/16/987e9605-2203-44bd-b2be-b1b0c5661588/26...
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/m/C33lxVvC6ZtQDRJA5KeK2YsXyxkNOy4TcorkYcutfuAbsH...
Запросы HTTP POST:
- 6####.####.140/ando/x/req?app_id=####&r=####
- 6####.####.140/ando/x/liv?app_id=####&r=####
- 6####.####.140/ando/x/lis?app_id=####&r=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/iUmO_LyUrqphpSbFbm3XAi5spDM=
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/JEcdkv3KzIDeFFishoHZkg==.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/p_cbUA1xnMcmKocaX_9OTPij-ELP1irI4nQoOQ==.new
- <Package Folder>/code-1426921/kAwfW-RpvaJArvd7/2CYN-JDwj9o=.jar
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/1tfvewUK0smdpWGTYXWvcg==.new
- <Package Folder>/shared_prefs/SDK201710121005466fnawudddsb0z7x_video.xml
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/iUmO_LyUrqphpSbFbm3XAi5spDM=.new
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/files/account_hMG3zbtbnkmocvtfYQBalRPUP47GaGXN_21a5b0d5aac910daa16ee6daedcd34f5
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_sMW9A4kojiuuT5sESnIyTA==
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_FMFMYfO2mfOLpAlB
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/Er3fWuMkZWrgDF8O/YC4tG7uk8AqFfDdWToeZFTqu3wM=/001116b0-6a01-4688-a505-423ed06bda4f.res
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/t2dgWssNTSHXgFBIZtmSprtFQpQ=.new
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/Iw4LwN26GJwdg-xPSbEGTA==/BLc2ypBrc081HKyxN3OC6lpWyvM=.temp
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/zWak2kAxfte30lZWh9GvGftPWecOW78C.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/JEcdkv3KzIDeFFishoHZkg==.old
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/yD2ddbl6lBSIk1Ed/-wcFdlY-TZFx_wQavZwn69qEZSErf-Ns.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/WmkMWj31VkjC3utZjx_COyxa3pMo3N8c-9iGNu8OTko=.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/Y1snv7Dp3DuPexHGciD19ugD12nh2rDc-g-Lww==.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/t2dgWssNTSHXgFBIZtmSprtFQpQ=
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/7RIuoaDrK1GHZyK6A5KM9jpv7H3FJvzP.new
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/SDK201710121005466fnawudddsb0z7x_banner.xml
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_FMFMYfO2mfOLpAlB-journal
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/5f0YiYabfn_l3DVn/7uRNj3odQJmUzdvQ.new
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/hJuvkK8Z3Zg1jhh3SkRzfQ==/data.dat.tmp
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/Iw4LwN26GJwdg-xPSbEGTA==/vTWyoTeIhTxw0ld707mHpA==
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/9g2pyngDYHkQBWVhBwxfrvC3Ahs=.new
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/files/rdata_comreowrazc.new
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/h-8PilR3zdKz-61ymM9iOw==.new
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/SDK20170913090507kgu64e1aptkkgrh_banner.xml
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/csPba5GHJywD_mWs1lnFx5OTJf6esiaKqLbjCGxQAK0=.new
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_Ej7QrvnLEy9Nvu9CTUFBncaMp-8=
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_86yC1vOFgPqUUPf4cBNV-g==-journal
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/fdKcZe_nDi7J5daofzxXn1IJA70=.new
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_86yC1vOFgPqUUPf4cBNV-g==
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/SwLs5ETs3ptz0Tn1esKDh9L5fIvF6OS9.new
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/P6t0ecixn77aYH41DpxP6A==.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/t2dgWssNTSHXgFBIZtmSprtFQpQ=.old
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/Iw4LwN26GJwdg-xPSbEGTA==/YdSx38UTVhOo4Jie
- <Package Folder>/files/queoug_d/queoug_f.zip
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/xP5pgItJzo-2seOR/woO_VwFvpyiN8F5B-WuRJVxsuqQ=.temp
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/VaXqXu_mxvvTo9ulNBonVLghFYlLU74eX1hKukOS-MY=.new
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/JEcdkv3KzIDeFFishoHZkg==
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/Er3fWuMkZWrgDF8O/WgRvNnAIvZkcJcu_/5bb98659-faba-4064-81a2-dd697fc135aa.res.temp
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/Er3fWuMkZWrgDF8O/YC4tG7uk8AqFfDdWToeZFTqu3wM=/8a8e2221-5ee1-4fab-b9d5-e652d567b052.res
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/rHzxNMES5clgOjdKjZDMO3l9Adwoav5y.new
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/HhMitjmciOlVqmLRaWkCSw==/runner_info.prop
- <Package Folder>/files/ZBfdX97P0jeTT6SkiQS3jg==/54JZH1rl_S8dD71gn2M1TTWKlWQ=
- <Package Folder>/shared_prefs/SDK20170913090507kgu64e1aptkkgrh_instl.xml
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/TEphidMcyiiddUd9I3aC4EfC0FCSyCvi.new
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/Er3fWuMkZWrgDF8O/WgRvNnAIvZkcJcu_/cd0227be-6989-4756-ae30-9b54142b954f.res.temp
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/Er3fWuMkZWrgDF8O/WgRvNnAIvZkcJcu_/6ec317a7-4852-4004-a44d-08e5e25d888d.res.temp
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/ucE6enYfqYf4vuDYgdGypCW_GpOucFUrS_YiHg==.new
- <Package Folder>/files/hMG3zbtbnkmocvtfYQBalRPUP47GaGXN__local_stat_cache.json
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_sMW9A4kojiuuT5sESnIyTA==-journal
- <Package Folder>/files/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_files/kP55AGMqsX1eChc7YWw3Bg==/yW7FKEDcVdDkCqwB5Uhfwgi8A2cbexNC.new
- <Package Folder>/shared_prefs/SDK201710121005466fnawudddsb0z7x_instl.xml
- <Package Folder>/code-1426921/TWFxT1xb8_qThi1T
- <Package Folder>/databases/G2RFsGIL84El-SMvDFvFhie-971ANMVQ_Ej7QrvnLEy9Nvu9CTUFBncaMp-8=-journal
- <Package Folder>/files/FobiSDaunvO1f1fsszBAOPA4DmxD0vpg/P8l8x3rJWJHB561gglLcvg==/VipbsvRQ_do5ZzQV.zip
Другие:
Запускает следующие shell-скрипты:
- sh <Package Folder>/code-1426921/TWFxT1xb8_qThi1T -p <Package> -c com.reow.razc.wlqruw.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- /data/data/####/code-1426921/TWFxT1xb8_qThi1T -p #### -c com.reow.razc.wlqruw.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
