Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- l####.####.cn
- c####.####.cn
Запросы HTTP GET:
- c####.####.cn/sfile/201705/17/all/cp_V2.7.4.1.txt
- c####.####.cn/upload/201704/19/app/20170419164327750.apk
- c####.####.cn/upload/201607/12/img/20160712113200038.png
- c####.####.cn/upload/201705/20/app/20170520010732548.apk
- c####.####.cn/upload/201705/22/img/20170522095608430.png
Запросы HTTP POST:
- l####.####.cn/hadat/gnwmk/s
- l####.####.cn/hadat/asdp/s
- l####.####.cn/hadat/jrwsy/uo
- l####.####.cn/hadat/nve/adw
- l####.####.cn/hadat/a/ytea
- l####.####.cn/hadat/qvjgz/leru
- l####.####.cn/jzbdt/s/cxc/f
- l####.####.cn/jzbdt/juhts/uxxs
- l####.####.cn/jzbdt/wu/vzw
- l####.####.cn/hadat/p/mp
- l####.####.cn/jzbdt/kh/tquqx
- l####.####.cn/hadat/cw/bf
- l####.####.cn/hadat/vb/qjw
- l####.####.cn/jzbdt/zzaj/z
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/sfe.xml
- /data/anr/traces.txt
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/com.fotoable.photocollage.android.photocollageSetting.xml
- <Package Folder>/shared_prefs/com.google.android.gcm.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4BeginSession.cls_temp
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.u.xml
- <Package Folder>/shared_prefs/FotoCustomReportSet.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;com.a.a.a.a.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/files/cg.jar
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsData_Q8DHK2CBZXR864JMY5S8_170
- <Package Folder>/files/wi.jar
- <Package Folder>/shared_prefs/sysconfig.xml
- <Package Folder>/files/.flurrydatasenderblock.6cf782aa-b99b-478a-9881-87c4aed54ce4
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/files/.flurryagent.27eb79d7
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4SessionOS.cls_temp
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/ax.jar
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/sysconfig.xml.bak
- <Package Folder>/files/.flurrydatasenderblock.29538d84-ebde-43c6-bfb6-12b9c5c8134b
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_e65fe066-0a16-48ee-bfee-fbb7694c55bf_1495016992580.tap
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4SessionApp.cls_temp
- <Package Folder>/files/we.jar
- <Package Folder>/shared_prefs/FotoAdStrategy.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4SessionDevice.cls_temp
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4SessionEvent0000000000.cls_temp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591C261F01B8-0001-0845-2E89AFF2BBD4SessionEvent0000000001.cls_temp
- <Package Folder>/files/.flurrydatasenderblock.4a628a70-c457-440c-a9cb-e53919ca9a94
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/signOfIcon.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/752a1231157cd33f50651581ad071ea6.apk
- chmod 777 /storage/emulated/0/Android/data/####/files/Download/Android/azb/752a1231157cd33f50651581ad071ea6.apk
Может автоматически отправлять СМС-сообщения.
