Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- a####.####.com
- c####.####.com
- chototg####.com
- cp####.####.com
- d####.####.com
- dress####.com
- f####.####.com
- g####.####.com
- ilv####.com
- ip####.io
- jum####.mobi
- m####.####.com
- mobi####.org
- namet####.com
- p####.####.com
- pag####.####.com
- pha####.info
- pixp####.com
- prscr####.com
- serv####.####.com
- t####.####.com
- technol####.net
- tra####.####.com
- zigzag####.com
Запросы HTTP GET:
- a####.####.com/pull/top_offer?gaid=####&id=####
- c####.####.com/?a=####&c=####&p=####&dip=####&E=####&s2=####&s3=####
- chototg####.com/ads/inc/style.css
- cp####.####.com/click?aid=####&linkid=####&s1=####&s2=####
- d####.####.com/thinking/group/rtt_0613_663.apk
- dress####.com/women-s-shoes-b-81.html?lkid=####
- f####.####.com/?utm_medium=####&utm_campaign=####
- f####.####.com/css?family=####&ver=####
- f####.####.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-BxWgZ...
- ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVctnNBljUY2ZjZvt5uc5cevNAQ--Z-gEfe8T...
- ip####.io/json
- jum####.mobi/redirect/action/3JmAyMCc3LiU2dHQoNCRhbG5kY3c_eQ_Uyi?uc=####...
- mobi####.org/?
- namet####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sou...
- p####.####.com/red/?code=####&a=####&pubid=####
- pag####.####.com/pagead/js/adsbygoogle.js
- pha####.info/redirect?tid=####&ref=####&subid=####&q=####
- pixp####.com/?id=####&to=####&ta=####
- prscr####.com/pub.js
- serv####.####.com/119987?t=####&ref=####&lu=####
- t####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####
- t####.####.com/click?cid=####
- technol####.net/wp-includes/js/jquery/jquery.js?ver=####
- tra####.####.com/?p=####&media_type=####&click_id=####&sub_id=####
- zigzag####.com/NL/1096305406?trackid=####&transactionid=####&pubid=####&...
Запросы HTTP POST:
- a####.####.com/app_logs
- a####.####.com/subscribe/api/1110
- g####.####.com/pilot/api/300102
- m####.####.com/gcview/info/600
- p####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- t####.####.com/ggview/rsddateindex
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/47b8d61b7651f3d6b7a80a2b810f8c3b.data.temp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/libIQPFsmOUChmkwhbDdynamicloader.so
- <Package Folder>/files/####/libKueWuLGqMMnRgVVgbt.so
- <Package Folder>/files/####/libRppEcpLJpRVcTveVlala.so
- <Package Folder>/files/####/libhMEnYimzyYJbxvhuzxc.so
- <Package Folder>/files/.imprint
- <Package Folder>/files/47b8d61b7651f3d6b7a80a2b810f8c3b.data
- <Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
- <Package Folder>/files/exid.dat
- <Package Folder>/files/hello.apk
- <Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
- <Package Folder>/files/source.apk
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml (deleted)
- <Package Folder>/shared_prefs/login_setting.xml
- <Package Folder>/shared_prefs/login_setting.xml.bak
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
