Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.395.origin
- Android.Click.136.origin
- Android.Exploit.52
- Android.DownLoader.441.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.440.origin
- Android.Click.136.origin
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.net:8080
- a####.####.org:8900
- p####.####.com:8066
- l####.####.cn:88
- r####.####.net
- l####.####.cn
- d####.####.net
- up####.####.net:6020
- a####.####.org
- up####.####.net
Запросы HTTP GET:
- d####.####.net/file/2
- s####.####.com/vdcd/enc?dpi=####&android_id=####&cid=####&networkType=##...
- d####.####.net:8080/app/com.google.andriod.app.settings_1030_20160803160...
- r####.####.net/update/7.2.0
- s####.####.com/vdcd/req?count=####&ext=####&cid=####&charset=####&posh=#...
Запросы HTTP POST:
- p####.####.com:8066/s/
- a####.####.org:8900/ad-mis-light/otherSdkConfig
- up####.####.net/
- up####.####.net:6020/
- l####.####.cn/i/lv/v1/7543984630522476601?t=####
- l####.####.cn:88/i/nu/v1/7543984630522476601?t=####
- l####.####.cn/i/ls/v1/7543984630522476601?t=####
- a####.####.org/ad-mis-light/getFiles
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/session.xml
- <Package Folder>/shared_prefs/Y_D.xml
- <Package Folder>/files/test4
- <Package Folder>/files/2.tmp
- <Package Folder>/shared_prefs/ocean_primary_ad_sp.xml
- <Package Folder>/files/GhWKln
- <Package Folder>/shared_prefs/loader_st.xml
- <Package Folder>/databases/OcSDK_statistics_prom-journal
- <Package Folder>/shared_prefs/appStatus.xml
- <Package Folder>/.wn/shared_prefs/extra
- <Package Folder>/files/.wn_data/.f5.g6.zip
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/databases/DATA_DB-journal
- <Package Folder>/app_cache/res.zip
- <Package Folder>/files/3
- <Package Folder>/files/rootDe
- <Package Folder>/files/flag_file1
- <Package Folder>/files/flag_file2
- <Package Folder>/files/.wn_data/.f5.g6.zip.temp
- <Package Folder>/files/fuck4
- <Package Folder>/.wn/shared_prefs/sconfig.bak
- <Package Folder>/files/41baef7db5bb605057587da2159c5c4c/90a677df-7b9b-4014-baf5-ff3ab6bfa373.zip
- <Package Folder>/.wn/shared_prefs/lconfig
- <Package Folder>/files/dwyqug
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/.wn/shared_prefs/sconfig
- <Package Folder>/files/41baef7db5bb605057587da2159c5c4c/2439f865-1c38-4042-b145-46290f693513.zip
- <Package Folder>/files/cflag_x86
- <Package Folder>/files/2915270c010c1844200582.jar
- <Package Folder>/.wn/shared_prefs/lconfig.bak
- <Package Folder>/files/y.db
- <Package Folder>/.wn/shared_prefs/locconfig
Другие:
Запускает следующие shell-скрипты:
- rm -r <Package Folder>/files/test5
- rm -r <Package Folder>/files/su
- chmod 755 <Package Folder>/files/test4
- chmod 755 <Package Folder>/files/rootDe
- rm -r <Package Folder>/files/test2
- sh <Package Folder>/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh <Package Folder>/files/test15
- chmod 755 /data/data/####/files/rootDe
- chmod 755 <Package Folder>/files/mydb.db
- rm -r <Package Folder>/files/rootDe
- rm -r /data/data/####/files/test5
- chmod 755 /data/data/####/files/test5
- chmod 755 /data/data/####/files/test4
- chmod 755 /data/data/####/files/test2
- chmod 755 /data/data/####/files/test1
- rm -r /data/data/####/files/test2
- rm -r <Package Folder>/files/.romaster_root
- chmod 755 /data/data/####/files/3
- /data/data/####/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh /data/data/####/files/test5
- rm -r /data/data/####/files/mydb.db
- /data/data/####/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh /data/data/####/files/test2
- ping -c 2 -w 5 s####.####.com
- chmod 755 /data/data/####/files/.romaster_root
- rm -r /data/data/####/files/writeAddr
- rm -r /data/data/####/files/3
- /data/data/####/files/test4 /data/data/####/files/fuck4
- chmod 755 /data/data/####/files/writeAddr
- rm -r /data/data/####/files/test15
- chmod 755 /data/data/####/files/mydb.db
- chmod 755 <Package Folder>/files/writeAddr
- sh <Package Folder>/files/test4 <Package Folder>/files/fuck4
- chmod 755 <Package Folder>/files/test15
- chmod 755 /data/data/####/files/su
- /data/data/####/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh /data/data/####/files/test15
- chmod 755 <Package Folder>/files/su
- sh <Package Folder>/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh <Package Folder>/files/test2
- rm -r <Package Folder>/files/mydb.db
- sh <Package Folder>/files/.romaster_root 2O3V5tDh1VayObnatRegrrMkQfYT4lwhVvU= /system/bin/sh <Package Folder>/files/test5
- chmod 755 <Package Folder>/files/.romaster_root
- rm -r <Package Folder>/files/3
- chmod 755 <Package Folder>/files/3
- chmod 755 /data/data/####/files/test15
- rm -r <Package Folder>/files/test15
- chmod 755 <Package Folder>/files/test5
- rm -r /data/data/####/files/rootDe
- chmod 755 <Package Folder>/files/test2
- rm -r <Package Folder>/files/writeAddr
- cat /proc/2077/cmdline
- rm -r /data/data/####/files/.romaster_root
- <dexopt>
- rm -r /data/data/####/files/su
Может автоматически отправлять СМС-сообщения.
