Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.204.origin
- Android.DownLoader.205.origin
- Android.DownLoader.205.origin
- Android.DownLoader.205.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.204.origin
- Android.DownLoader.205.origin
- Android.DownLoader.205.origin
- Android.DownLoader.205.origin
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.com:38080
- ad####.####.cn
- c####.####.net
- ce####.####.com
- k####.####.cn
- o####.####.com
- s####.####.cn
Запросы HTTP GET:
- ad####.####.cn/sdk/hlpt/lib_v1.0.36.zip
Запросы HTTP POST:
- a####.####.com/70F5024058DC2E24DFD61302050EEED3
- a####.####.com/app_logs
- a####.####.com:38080/F24303512B08C2D0918EAC8F8649AC2C
- c####.####.net/config/update
- ce####.####.com/cmge_server/activationCheck
- k####.####.cn/702619E220213D3BFE64AC4C86FBECF1
- o####.####.com/v2/check_config_update
- s####.####.cn/70F5024058DC2E24DFD61302050EEED3
- s####.####.cn/F6EA80A604B90C1AFFF602C719787160
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/ads1069955533.jar
- <Package Folder>/databases/ab_new.db
- <Package Folder>/databases/ab_new.db-journal
- <Package Folder>/databases/ab_old.db
- <Package Folder>/databases/ab_old.db-journal
- <Package Folder>/databases/bb_new.db
- <Package Folder>/databases/bb_new.db-journal
- <Package Folder>/databases/bb_old.db
- <Package Folder>/databases/bb_old.db-journal
- <Package Folder>/databases/dataeye_database_90533B4958145246844EE2CB41F927DA.db
- <Package Folder>/databases/dataeye_database_90533B4958145246844EE2CB41F927DA.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/JARD_-1294049763.zip
- <Package Folder>/files/JARD_-1466550168.zip
- <Package Folder>/files/JARD_1028287481.zip
- <Package Folder>/files/JARD_1268371403.zip
- <Package Folder>/files/JNID_-1471352373.so
- <Package Folder>/files/JNID_-1780621403.so
- <Package Folder>/files/JNID_31734466.so
- <Package Folder>/files/JNID_971903631.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/admainlib.xml
- <Package Folder>/shared_prefs/admainlib.xml.bak
- <Package Folder>/shared_prefs/admainlib_new.xml
- <Package Folder>/shared_prefs/admainlib_new.xml.bak
- <Package Folder>/shared_prefs/dc.90533B4958145246844EE2CB41F927DA.preferences.xml
- <Package Folder>/shared_prefs/lib_names.xml
- <Package Folder>/shared_prefs/lib_names_new.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/shared_data.xml
- <Package Folder>/shared_prefs/shared_data.xml.bak
- <Package Folder>/shared_prefs/shared_data.xml.bak (deleted)
- <Package Folder>/shared_prefs/shared_lib_info.xml
- <Package Folder>/shared_prefs/shared_lib_info.xml.bak
- <Package Folder>/shared_prefs/shared_lib_info_new.xml
- <Package Folder>/shared_prefs/shared_lib_info_new.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.SystemService/####/2D7F07BB6125DEB407E92A22DC4AC550
- <SD-Card>/.SystemService/####/uid
- <SD-Card>/lysy/####/<Package>.ini
- <SD-Card>/lysy/####/config.ini
- <SD-Card>/lysy/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh
- <dexopt>
- getprop ro.build.version.release
- getprop ro.build.version.sdk
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
Использует специальную библиотеку для скрытия исполняемого байткода.
