Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.336.origin
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.336.origin
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.pro
- al####.top
- c####.####.com
- celery####.com
- cp####.####.com
- d####.####.com
- e####.####.com
- g####.####.com
- il####.com
- ip####.io
- m####.####.com
- namet####.com
- o####.####.com
- p####.####.com
- pha####.info
- pixp####.com
- t####.####.com
- tra####.####.com
- u####.####.com
- zigzag####.com
Запросы HTTP GET:
- a####.####.com/pull/top_offer?gaid=####&id=####
- a####.####.pro/s2sInfo.php?a=####&ch=####&subid=####&pubid=####
- a####.####.pro/upload/newApp/GameMaster_2138_4753.apk
- al####.top/go.php?p=####&sub1=####&sub2=####
- c####.####.com/?a=####&c=####&p=####&dip=####&E=####&s2=####&s3=####
- c####.####.com/?a=####&c=####&p=####&dip=####&E=####&s2=####&s3=####&ckm...
- celery####.com/26C47/Jvug/KP-w/cLPt5w_7oFY940MonvsaKhaSbiRD8WcZTJpyI9Kk7...
- cp####.####.com/click?aid=####&linkid=####&s1=####&s2=####
- d####.####.com/thinking/group/rtt0612_663.apk
- e####.####.com/thinking/group/exp
- il####.com/path/lp.php?trvid=####&trvx=####&clickid=####&pubid=####
- ip####.io/json
- namet####.com/d/667035811db8203abd?sub=####&source=####
- o####.####.com/geo/preset?user_id=####&geo_id=####&min_payout=####&mi=##...
- p####.####.com/red/?code=####&a=####&pubid=####
- pha####.info/redirect?tid=####&ref=####&subid=####&q=####
- pixp####.com/?id=####&to=####&ta=####
- t####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####
- t####.####.com/ck.php?line_item_id=####&transaction_id=####&subid_spx=####
- t####.####.com/zp-redirect?target=####&caid=####&zpid=####&cid=####&rt=#...
- tra####.####.com/?p=####&media_type=####&click_id=####&sub_id=####
- u####.####.com/zcvisitor/1019668e-4f44-11e7-b82d-0a4a59dc7f4c?campaignid...
- zigzag####.com/pageAnalytics.js
Запросы HTTP POST:
- a####.####.com/app_logs
- a####.####.com/subscribe/api/1110
- g####.####.com/pilot/api/300102
- m####.####.com/gcview/info/600
- p####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- t####.####.com/ggview/rsddateindex
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.catr.apk
- <Package Folder>/files/####/.center.tapk
- <Package Folder>/files/####/.client
- <Package Folder>/files/####/.dg
- <Package Folder>/files/####/.dico.apk
- <Package Folder>/files/####/.dlme.apk
- <Package Folder>/files/####/.dlsb.apk
- <Package Folder>/files/####/.dsmt.apk
- <Package Folder>/files/####/.ir
- <Package Folder>/files/####/.p.apk
- <Package Folder>/files/####/.service
- <Package Folder>/files/####/.ukd
- <Package Folder>/files/####/.uks
- <Package Folder>/files/####/.uok
- <Package Folder>/files/####/a.xml
- <Package Folder>/files/####/b.png
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/checkFile0
- <Package Folder>/files/####/checkFile13
- <Package Folder>/files/####/ee2128c8a2751b62cb6b5f1df3f9834b.data.temp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/exp
- <Package Folder>/files/####/hello.dex
- <Package Folder>/files/####/libIQPFsmOUChmkwhbDdynamicloader.so
- <Package Folder>/files/####/libKueWuLGqMMnRgVVgbt.so
- <Package Folder>/files/####/libRppEcpLJpRVcTveVlala.so
- <Package Folder>/files/####/libhMEnYimzyYJbxvhuzxc.so
- <Package Folder>/files/####/mkdevsh
- <Package Folder>/files/####/myshell
- <Package Folder>/files/####/postroot.sh
- <Package Folder>/files/####/r1
- <Package Folder>/files/####/r2
- <Package Folder>/files/####/r3
- <Package Folder>/files/####/r4
- <Package Folder>/files/####/rsh
- <Package Folder>/files/####/rt8
- <Package Folder>/files/####/supolicy
- <Package Folder>/files/.imprint
- <Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
- <Package Folder>/files/ee2128c8a2751b62cb6b5f1df3f9834b.data
- <Package Folder>/files/exid.dat
- <Package Folder>/files/hello.apk
- <Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
- <Package Folder>/files/source.apk
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/login_setting.xml
- <Package Folder>/shared_prefs/login_setting.xml.bak
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.dat
- <SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.tmp
Другие:
Запускает следующие shell-скрипты:
- /data/data/j9c.ihk.kpy/files/.snow/exp /data/data/j9c.ihk.kpy/files/.snow /data/data/j9c.ihk.kpy/files/.work
- /system/bin/sh ./mkdevsh
- <dexopt>
- <error:2>
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm disable com.num.hum.kong.ui.op.er
- app_process /system/bin com.android.commands.pm.Pm disable com.qiu.qing.bing.shuo.tu
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm disable com.wo.ai.girl.huy.wp
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm enable com.num.hum.kong.ui.op.er
- app_process /system/bin com.android.commands.pm.Pm enable com.qiu.qing.bing.shuo.tu
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm enable com.wo.ai.girl.huy.wp
- chcon u:object_r:system_file:s0 /system/bin/.author
- chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- chmod 777 <Package Folder>/files/.snow/.client
- chmod 777 <Package Folder>/files/.snow/.dg
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.snow/.ukd
- chmod 777 <Package Folder>/files/.snow/.uks
- chmod 777 <Package Folder>/files/.snow/.uok
- chmod 777 <Package Folder>/files/.snow/.zip/
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chmod 777 <Package Folder>/files/.snow/a.xml
- chmod 777 <Package Folder>/files/.snow/b.png
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/exp
- chmod 777 <Package Folder>/files/.snow/myshell
- chmod 777 <Package Folder>/files/.snow/supolicy
- chmod 777 <Package Folder>/files/.work/postroot.sh
- chown 0.0 /system/app/LocalFacebook.apk
- chown 0.0 /system/bin/.author
- chown 0.0 /system/xbin/.ci.pm
- chown 0.0 /system/xbin/.cp
- chown 0:0 /data/local/tmp/.catr.apk
- chown 0:0 /data/local/tmp/busybox
- chown 0:0 /system/app/Dingps.apk
- chown 0:0 /system/app/Linkcai.apk
- chown 0:0 /system/app/LocalFacebook.apk
- chown 0:0 /system/app/Lowerp.apk
- chown 0:0 /system/app/RomterFacebook.apk
- chown 0:0 /system/app/oneshs.apk
- chown 0:0 /system/bin/.author
- chown 0:0 /system/bin/debuggerd
- chown 0:0 /system/lib/libsoon.so
- chown 0:0 /system/xbin/.ci.pm
- chown 0:0 /system/xbin/.cp
- chown 0:0 /system/xbin/.rainin
- chown 0:0 /system/xbin/supolicy
- df /system
- mount -o remount ro /system
- mount -o remount rw /system
- mount -o remount,ro /system
- mount -ro remount ro /system
- mount -ro remount,ro /system
- mount -wo remount rw /system
- mount -wo remount,rw /system
- sh
- sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
