Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- ws####.####.com
- vzb####.####.com
- g####.####.com
- imgc####.####.com
- 2####.####.147
- o####.####.com
- 1####.####.54:1863
- pfmv####.####.net
- o####.####.com:8080
- c####.####.com
- 2####.####.68
- 1####.####.72:1863
- w####.####.com
- 1####.####.71:1863
- 1####.####.225
- stra####.####.com
- sdkco####.####.com
- 1####.####.221
- mon####.####.com
Запросы HTTP GET:
- imgc####.####.com/fm/photo/album/rmid_album_240/V/S/001wCwdA0ylNVS.jpg?t...
- imgc####.####.com/fm/photo/album/rmid_album_240/b/X/0025JcxI292zbX.jpg?t...
- imgc####.####.com/fm/photo/album/rmid_album_240/j/B/0024hCIF3DFPjB.jpg?n...
- imgc####.####.com/fm/operation/330b5db0d90f10008003febeb7d285c4_720.jpg
- imgc####.####.com/fm/operation/304a3db6d90f10008022febeb7d285c4_120.PNG?...
- imgc####.####.com/fm/operation/9846054695a311e697a70013724f5fd9_240.jpg?...
- imgc####.####.com/fm/operation/ccab48ccd90f10008001febeb7d285c4_120.PNG?...
- imgc####.####.com/fm/operation/9619325a394211e7896e5254008192e3_240.jpg?...
- imgc####.####.com/fm/operation/6dfac1d6d90f1000800bfebeb7d285c4_120.PNG?...
- imgc####.####.com/fm/operation/39a19fb2d90f10008028febeb7d285c4_120.PNG?...
- imgc####.####.com/fm/operation/e20f67d03f9e11e78fbd5254008192e3_720.jpg?...
- imgc####.####.com/fm/photo/album/rmid_album_240/m/z/001CotXH1i2Emz.jpg?n...
- imgc####.####.com/fm/operation/dad1f4ae3c5311e7a6315254008192e3_720.jpg?...
- imgc####.####.com/fm/photo/album/rmid_album_240/4/D/0049yEKe2ZFX4D.jpg?t...
- pfmv####.####.net/xNewMonitor?cmd=####&buname=####&size=####
- imgc####.####.com/fm/operation/272085f2d90f10008005febeb7d285c4_720.jpg
- 1####.####.54:1863/vzbfm.tc.qq.com/xNewMonitor?cmd=####
- sdkco####.####.com/getmfomat?platform=####&cpufreq=####&qqlog=####&model...
- imgc####.####.com/fm/operation/font/showposterdefaultfont.TTF
- imgc####.####.com/fm/operation/a7154cf0394311e78e285254008192e3_240.jpg?...
- 1####.####.72:1863/vzbfm.tc.qq.com/xNewMonitor?cmd=####
- 2####.####.147/afmugc.tc.qq.com/RA1032765000000000.m4a?fromtag=####
- imgc####.####.com/fm/operation/872e4c4a317b11e79fc85254008192e3_120.png?...
- imgc####.####.com/fm/operation/9413b94695a311e697a70013724f5fd9_240.jpg?...
- 2####.####.68/vfm.tc.qq.com/RA1032765000000000.m4a?fromtag=####
- imgc####.####.com/fm/operation/c8e5c2d6950811e6ad6b0013724f5fd9_240.jpg?...
- imgc####.####.com/fm/photo/album/rmid_album_240/K/7/000I0CQS3yMnK7.jpg?t...
- w####.####.com/C100003mAan70zUy5O.m4a?fromtag=####
- imgc####.####.com/fm/operation/8f63c7c23ece11e79a305254008192e3_720.jpg?...
- imgc####.####.com/fm/photo/album/rmid_album_240/a/2/003CCC8Z2gnaa2.jpg?n...
- 1####.####.71:1863/vzbfm.tc.qq.com/xNewMonitor?cmd=####
- imgc####.####.com/fm/operation/343151fe267711e788535254008192e3_120.png?...
- w####.####.com/RA1032765000000000.m4a?fromtag=####
- imgc####.####.com/fm/operation/2d1439eed90f10008020febeb7d285c4_120.PNG?...
- imgc####.####.com/fm/operation/7b2b461216ca11e7aa365254008192e3_240.jpg?...
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- c####.####.com/RA1032765000000000.m4a?fromtag=####
- imgc####.####.com/zljk/one.png
- imgc####.####.com/fm/photo/singer/rmid_singer_240/f/l/002pHtTR0o9Ufl.jpg...
- imgc####.####.com/fm/operation/d601d310950811e6ad6b0013724f5fd9_240.jpg?...
- imgc####.####.com/fm/operation/2ee11eaed90f1000801bfebeb7d285c4_120.PNG?...
- s####.####.com/cr/sdk/170417/des_V17041703Aj1so32.zip
- vzb####.####.com/pfmvod-a.akamaihd.net/xNewMonitor?cmd=####&buname=####&...
- imgc####.####.com/fm/photo/album/rmid_album_720/4/D/0049yEKe2ZFX4D.jpg?t...
- imgc####.####.com/fm/photo/album/rmid_album_240/K/4/003dp8fM1Hq5K4.jpg?t...
- c####.####.com/C100003mAan70zUy5O.m4a?fromtag=####
- imgc####.####.com/fm/wordpng/pay1.png
- imgc####.####.com/fm/photo/programe/rmid_programe_240/m/2/000QgDoH36Q9m2...
- imgc####.####.com/fm/wordpng/pay3.png
- g####.####.com/cr/sv/getGoFile?name=####
- imgc####.####.com/fm/operation/77aa3fd0d90f10008023febeb7d285c4_240.jpg?...
- imgc####.####.com/fm/photo/album/rmid_album_240/j/0/001bOtsp4UVvj0.jpg?t...
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
Запросы HTTP POST:
- o####.####.com/analytics/upload
- 1####.####.225/dreport
- o####.####.com:8080/analytics/upload
- o####.####.com:8080/analytics/upload?rid=####
- g####.####.com/cr/sv/getEPList
- 1####.####.221/upload
- stra####.####.com/analytics/upload
- ws####.####.com/w.cgi
- o####.####.com/analytics/upload?rid=####
- mon####.####.com/analytics/rqdsync
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes2007890837.zip
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-385755838.zip
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/ReadyHost.txt
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1542642610.zip
Другие:
Запускает следующие shell-скрипты:
- getenforce
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- /system/bin/sh -c getprop ro.build.fingerprint
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm -f <Package Folder>/files/hftJcw46N.dex
- /system/bin/sh -c getprop ro.board.platform
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- cat /proc/meminfo
- rm <Package Folder>/files/hftJcw46N.jar
- top -t -s cpu -n 1 -m 20
- chmod 0771 /data/data/####/.syslib-
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- /system/bin/cat /proc/cpuinfo
- getprop ro.board.platform
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- <error:2>
- getprop net.dns1
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- rm <Package Folder>/files/hftJcw46N.dex
- getprop net.dns2
- chmod 0771 <Package Folder>/.syslib-
- <dexopt>
Может автоматически отправлять СМС-сообщения.
