Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- g####.####.com
- t####.####.net
- c####.####.net
- o####.####.com
- c####.####.cn
- a####.####.cn
- r####.####.com
- statson####.####.com
- a####.####.com
Запросы HTTP GET:
- a####.####.com/picture/2016-08-05/640-290.jpg
- a####.####.com//picture/2016-04-06/crshownextchests.jpg
- a####.####.com/script/androidXXTEngine.json
- c####.####.net/images/201510/052/ab03eb9d33996c2434e5ffaa56c9a025_100x10...
- a####.####.cn/script/checkXXMultiLaunch.php?appid=####&client_ver=####&t...
- a####.####.com//picture/2016-03-16/cocbanner.jpg
- a####.####.com//picture/2016-03-25/rootbanner3.jpg
- a####.####.com/picture/2016-11-22/640-290-1-TH_1.jpg
- a####.####.com/script/tengine/script_assets.1.0.3.zip
- a####.####.com/script/tengine/libtengine.1.0.3.so
- a####.####.com/picture/2016-08-08/640x290.jpg
- a####.####.com/checkXMGTengineVersion.php?productID=####&platformType=##...
- a####.####.com/ad_control/ADControl_New_Android_Channel_Default
- a####.####.com/xfc.json
- c####.####.cn/AndroidXXMultiLaunch.json
- c####.####.cn/xxApktool-release_1.0.1_100.apk
- a####.####.com/script/tengine/xx_script_sdk.1.0.3.dex
- a####.####.com/picture/2016-11-22/640-290-1-VN_1.jpg
- a####.####.com/picture/2016-09-08/XQY.jpg
- a####.####.com/a_control_d.php?pt=####&cid=####&isnew=####
Запросы HTTP POST:
- a####.####.com/XXBannerList.php
- o####.####.com/check_config_update
- a####.####.com/XXSplashAD.php
- t####.####.net/g/d
- statson####.####.com/pushlog_special
- a####.####.com/packagestatev2.php
- r####.####.com/rqd/sync
- a####.####.com/update.php
- a####.####.com/rest/2.0/channel/3953422103090412163
- a####.####.com/app_logs
- g####.####.com/xxad.php
- a####.####.com/XXMGActivityCenter.php
- a####.####.com/xmgapi
- a####.####.com/rest/2.0/channel/channel
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/lastupdatetime.xml
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_2V72P5B4FV7SK723S6SM_195
- <Package Folder>/float_config_download.json
- <Package Folder>/files/.yflurrydatasenderblock.d36fd063-1365-4a82-81a3-88d62105efa9
- <Package Folder>/tengine/xx_script_sdk.1.0.6.dex
- <Package Folder>/shared_prefs/lastupdatetime.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/activity_content
- <Package Folder>/files/.imprint
- <Package Folder>/cache/injecttest/oom_adj_mdf
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/extern_ad.xml
- <Package Folder>/tengine/assets/icon_radio_selected.png
- <Package Folder>/shared_prefs/CheckRemindShare.xml
- <Package Folder>/tengine/assets/icon_checkbox_selected.png
- <Package Folder>/tengine/assets/XXPayment_Connect_Fail@3x.png
- <Package Folder>/shared_prefs/bindcache.xml
- <Package Folder>/app_apktool/ apktool.tmp
- <Package Folder>/splash_info
- <Package Folder>/xx-filter/speed.conf
- <Package Folder>/files/td.lock
- <Package Folder>/cache/injecttest/injectso_21
- <Package Folder>/tengine/libtengine.1.0.6.so
- <Package Folder>/tengine/assets/XXPayment_Connect_Fail.png
- <Package Folder>/files/file
- <Package Folder>/tengine/assets/icon_arrow_up.png
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/tengine/assets/bg_editview.9.png
- <Package Folder>/tengine/assets/bg_cancel_btn.9.png
- <Package Folder>/shared_prefs/CheckRemindShare.xml.bak
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1069955533.zip
- <Package Folder>/shared_prefs/pst.xml.bak
- <Package Folder>/app_apktool/config.json
- <Package Folder>/shared_prefs/pref_longtime.xml.bak
- <Package Folder>/cache/injecttest/injectso
- <Package Folder>/tengine/assets/XXPayment_Connect_Fail@2x.png
- <Package Folder>/tengine/assets/icon_radio_normal.png
- <Package Folder>/tengine/assets/webview_close.png
- <Package Folder>/shared_prefs/pref_shorttime.xml.bak
- <Package Folder>/app_app_apk/xmodgame.dat.jar
- <Package Folder>/tengine/assets.1.0.6.zip
- <Package Folder>/tengine/xx_script_sdk.1.0.3.dex_tmp
- <Package Folder>/databases/pushstat_4.6.0.db-journal
- <Package Folder>/tengine/script_assets.1.0.3.zip_tmp
- <Package Folder>/databases/XXAssistantDB.db-journal
- <Package Folder>/shared_prefs/pref_shorttime.xml
- <Package Folder>/databases/bugly_db-journal
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/databases/pushstat_4.6.0.db
- <Package Folder>/shared_prefs/updatetime.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/setting.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/files/.yflurryreport.7b381a72951e61b1
- <Package Folder>/tengine/assets/icon_checkbox_normal.png
- <Package Folder>/tengine/libtengine.1.0.3.so_tmp
- <Package Folder>/tengine/assets/bg_ok_btn.9.png
- <Package Folder>/float_config.json
- <Package Folder>/shared_prefs/activity_info.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/tengine/assets/icon_arrow_down.png
- <Package Folder>/shared_prefs/pref_longtime.xml
- <Package Folder>/shared_prefs/update_config.xml
Другие:
Запускает следующие shell-скрипты:
- sh
- <dexopt>
- rm -r /data/local/tmp/mtplugin/
- chmod 777 <Package Folder>/lib/libbdpush_V2_5.so <Package Folder>/lib/libsubstrate.so <Package Folder>/lib/libutility.so <Package Folder>/lib/libxxAndroidLoader-international.so <Package Folder>/lib/libxxdvm.so <Package Folder>/lib/libxxghost-internationa
- <su-internal:request>
- <su-internal:result>
- rm -r /data/local/tmp/rhythmplugin/
- getprop ro.board.platform
- su
- /system/bin/sh -c getprop ro.board.platform
- rm -r /data/local/tmp/llplugin/
- rm -r /data/local/tmp/rgplugin/
- rm -r /data/local/tmp/pao/
Использует повышенные привилегии.
Может автоматически отправлять СМС-сообщения.
