Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.65.origin
Сетевая активность:
Подключается к:
- c####.####.com
- l####.####.cn
- i####.####.com
Запросы HTTP GET:
- c####.####.com/upload/img/7a595855-b0ee-4aa8-9805-dd4a577bd24b.jpg
- l####.####.cn/m/7vW52mta4PPv2SPsX1A8G-U73d0WMsNRVxPZJQ
- l####.####.cn/t?r=####&p=####
- i####.####.com/service/getIpInfo.php?ip=####
- c####.####.com/upload/img/55af2ab3-da10-47eb-8b61-6b77d2bf82af.jpg
- c####.####.com/upload/etookit/popupout/331.jar
- c####.####.com/upload/logo/f8e4eb0d-d841-412d-9247-58c41a455338.png
- c####.####.com/upload/logo/6748b26e-579d-4bc9-bdfd-0c09bd5ae127.png
Запросы HTTP POST:
- c####.####.com/rcv
- c####.####.com/sgp
- l####.####.cn/g?r=####
- c####.####.com/pop/gd
- c####.####.com/pop/up
- c####.####.com/pop/pd
- c####.####.com/mcs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/fconf_pre.xml
- <Package Folder>/shared_prefs/eck.xml
- <Package Folder>/.snail/shared_prefs/main.prefs
- <Package Folder>/databases/fp_download.db-journal
- <Package Folder>/shared_prefs/eck.xml.bak
- <Package Folder>/.snail/databases/apk_install_tip.db-journal
- <Package Folder>/.snail/databases/app_track.db-journal
- <Package Folder>/.update
- <Package Folder>/files/c
- <Package Folder>/shared_prefs/fstrategy_pre.xml
- <Package Folder>/.lock
- <Package Folder>/.snail/databases/app_stats.db-journal
- <Package Folder>/shared_prefs/rf.xml
- <Package Folder>/.snail/shared_prefs/common_rundata.prefs.bak
- <Package Folder>/databases/dls-journal
- <Package Folder>/shared_prefs/fconf_pre.xml.bak
- <Package Folder>/.snail/snail_lib/libsnail_a4_b2_zip.so
- <Package Folder>/shared_prefs/fsconf_pre.xml
- <Package Folder>/daemon
- <Package Folder>/shared_prefs/loader_snail.xml
- <Package Folder>/shared_prefs/vgp_id.xml
- <Package Folder>/.snail/shared_prefs/common_cfg.prefs
- <Package Folder>/shared_prefs/fsappnfo_pre.xml
- <Package Folder>/databases/fs_download.db-journal
- <Package Folder>/databases/iLog-journal
- <Package Folder>/shared_prefs/fsappnfo_pre.xml.bak
- <Package Folder>/shared_prefs/ki.xml
- <Package Folder>/app_r/c.jar
- <Package Folder>/.snail/databases/apk_install_sc_db-journal
- <Package Folder>/app_d/ec
- <Package Folder>/.snail/databases/statistics.db-journal
- <Package Folder>/.snail/databases/win_ad.db-journal
- <Package Folder>/databases/eca.db-journal
- <Package Folder>/.snail/databases/download.db-journal
- <Package Folder>/files/.snail_data/.a4.b2.zip
- <Package Folder>/shared_prefs/common_pre.xml
- <Package Folder>/shared_prefs/iConfig.xml
- <Package Folder>/shared_prefs/fsconf_pre.xml.bak
- <Package Folder>/app_r/t
- <Package Folder>/.snail/shared_prefs/common_rundata.prefs
- <Package Folder>/databases/iDownload-journal
- <Package Folder>/files/j.jar
- <Package Folder>/.snail/files/ad_temp/server_req_hb_response.gz
- <Package Folder>/app_l/n
- <Package Folder>/.snail/files/prop_file/phone_dataer.prop
- <Package Folder>/.snail/databases/log_index.db-journal
- <Package Folder>/.snail/databases/log_temp.db-journal
- <Package Folder>/.snail/files/ad_temp/run_status_hb_response.gz
- <Package Folder>/shared_prefs/vgp_id.xml.bak
- <Package Folder>/databases/cxcdownloads-journal
- <Package Folder>/.snail/files/ext4-snail-5
- <Package Folder>/.snail/files/ad_temp/run_status_hb_request.gz
- <Package Folder>/.snail/shared_prefs/exception
- <Package Folder>/databases/cxcdownloads
- <Package Folder>/.snail/shared_prefs/log_cfg.prefs
- <Package Folder>/.snail/shared_prefs/run_status.prefs
- <Package Folder>/.snail/files/ad_data/download_temp/247d5ca2-733c-47d1-a02b-a6ab37f0b155.a
Другие:
Запускает следующие shell-скрипты:
- chmod 777 <Package Folder>/daemon
- /data/data/####/.snail/files/ext4-snail-5
- <dexopt>
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- sh
- sh <Package Folder>/.snail/files/ext4-snail-5
Может автоматически отправлять СМС-сообщения.
