Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.554.origin
Сетевая активность:
Подключается к:
- a####.####.hk:9006
- e####.####.sg:9100
- a####.####.hk
Запросы HTTP GET:
- a####.####.hk/files/upload/apk/module/1493089778147.yy
- a####.####.hk/files/upload/apk/module/1495418534200.yy
Запросы HTTP POST:
- a####.####.hk/hwsdk/ul/update
- e####.####.sg:9100/waplink/update
- a####.####.hk:9006/hwsdk/ul/domain
- a####.####.hk/hwsdk/ul/task
- a####.####.hk/hwsdk/ul/domain
- a####.####.hk/hwsdk/ul/sales
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/ad_db
- <Package Folder>/files/advertise/adv_global.bin
- <Package Folder>/files/startpage/start_page1_en.html
- <Package Folder>/files/advertise/adv_title.txt
- <Package Folder>/shared_prefs/brow_simple_cfg.xml
- <Package Folder>/shared_prefs/brow_simple_cfg.xml.bak
- <Package Folder>/files/advertise/adv_title.bin
- <Package Folder>/databases/bookmarks.db-journal
- <Package Folder>/app_databases/localstorage/https_m.youtube.com_0.localstorage-journal
- <Package Folder>/app_geolocation/GeolocationPermissions.db-journal
- <Package Folder>/files/fjlo
- <Package Folder>/files/startpage/start_baidu_files/promlink.js
- <Package Folder>/shared_prefs/hoscfg.xml
- <Package Folder>/files/qwcs
- <Package Folder>/files/advertise/adv_sql.bin
- <Package Folder>/databases/adrlt.db-journal
- <Package Folder>/files/advertise/rep_key.txt
- <Package Folder>/databases/bookmarks.db
- <Package Folder>/files/cnm.apk
- <Package Folder>/databases/webview.db
- <Package Folder>/files/startpage/start_baidu_files/logo_index2.png
- <Package Folder>/files/e486e407_8f7931439490f5876d22e03fad2f1541_3yy
- <Package Folder>/files/cjl.jar
- <Package Folder>/databases/dom.db-journal
- <Package Folder>/shared_prefs/wula.xml
- <Package Folder>/shared_prefs/anlth.xml
- <Package Folder>/files/startpage/Google_files/rs=AItRSTM0lWIIl2p8A2AiFP_2BbARZIsc2g
- <Package Folder>/files/startpage/start_page1_ch.html
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/down.db-journal
- <Package Folder>/shared_prefs/isPower.xml
- <Package Folder>/files/startpage/start_baidu_files/hot.gif
- <Package Folder>/files/startpage/Google_files/world-cup-2014-14-4668630004400128.2-ig.png
- <Package Folder>/files/lkie
- <Package Folder>/files/advertise/rep_key.bin
- <Package Folder>/files/cfg/hdk_dynRecvCfg.xml
- <Package Folder>/databases/autofill.db
- <Package Folder>/databases/autofill.db-journal
- <Package Folder>/files/startpage/start_baidu_files/baisou_iphone.png
- <Package Folder>/databases/ad_db-journal
- <Package Folder>/files/wo.jar
- <Package Folder>/databases/dla.db-journal
- <Package Folder>/files/lamr
- <Package Folder>/databases/dla.db
- <Package Folder>/files/2ea09ba0_5ae138058b73744611a803e1aa7acbeb_1yy
- <Package Folder>/app_databases/localstorage/https_www.google.nl_0.localstorage-journal
- <Package Folder>/databases/dom.db
- <Package Folder>/databases/adrlt.db
- <Package Folder>/files/advertise/adv_hot.bin
- <Package Folder>/files/iyup.jar
- <Package Folder>/files/nhl.jar
- <Package Folder>/files/startpage/Google_files/rs=AItRSTM0lWIIl2p8A2AiFP_2BbARZIsc2g(1)
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/down.db
- <Package Folder>/files/startpage/images/gsa_ios_close_ios7.png
- <Package Folder>/app_icons/WebpageIcons.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/savedata.db-journal
- <Package Folder>/shared_prefs/wula.xml.bak
- <Package Folder>/files/startpage/images/world-cup-2014-14-4668630004400128-mbl.png
- <Package Folder>/shared_prefs/UrlMes.xml
- <Package Folder>/databases/savedata.db
- <Package Folder>/files/startpage/images/nav_logo176.png
- <Package Folder>/app_appcache/ApplicationCache.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
