Android.Packed.23071

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Moplus.1

Загружает из Интернета следующие детектируемые угрозы:

Android.Moplus.1

Сетевая активность:

Подключается к:

a####.####.com
cn-n1-c####.####.cn:6779
m####.####.com
ro####.####.com
u####.####.com
z####.####.com

Запросы HTTP GET:

cn-n1-c####.####.cn:6779/
ro####.####.com/v1/route?appId=####&installationId=####
u####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&app...
u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...

Запросы HTTP POST:

a####.####.com/api/check_app_update
a####.####.com/app_logs
a####.####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&sv=#...
m####.####.com/v2/register
m####.####.com/xcloudboss?r=####&type=####
z####.####.com/zpapi/sale/initSpecialList.json?

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/UmengLocalNotificationStore.db-journal
<Package Folder>/databases/moplus_server_config.db-journal
<Package Folder>/files/.imprint
<Package Folder>/files/.lostjiagu
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/installation
<Package Folder>/files/libjiagu.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>.push_sync.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/AGOO_CONNECT.xml
<Package Folder>/shared_prefs/AGOO_HOST.xml
<Package Folder>/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
<Package Folder>/shared_prefs/AV_PUSH_SERVICE_APP_DATA.xml
<Package Folder>/shared_prefs/AV_PUSH_SERVICE_SETTINGS_KEY.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/AppStore.xml.bak
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/PhoneUtil.xml
<Package Folder>/shared_prefs/UTMCBase.xml
<Package Folder>/shared_prefs/UTMCConf1056553855.xml
<Package Folder>/shared_prefs/UTMCLog1056553855.xml
<Package Folder>/shared_prefs/avoscloud_server_host_zone.xml
<Package Folder>/shared_prefs/com.avos.push.router.server.cache0ko3irhwo5kde96kc4yroks89pulf4isjs2mki35zei1y7cr.xml
<Package Folder>/shared_prefs/count.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/moplus_psetting.xml
<Package Folder>/shared_prefs/moplus_psetting.xml.bak
<Package Folder>/shared_prefs/pst.xml
<Package Folder>/shared_prefs/s_update.xml
<Package Folder>/shared_prefs/tj.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/umeng_message_state.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/baidu/.cuid

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A54dc6d33fd98c566da000d3e%22%2C%22utdid%22%3A%22WS5lk%2B2DYcMDAGdzx1GP2ezQ%22%2C%22sdkVersion%22%3A%2220150515%22%7D -I 100.69.168.33 -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
sh

Использует специальную библиотеку для скрытия исполняемого байткода.