Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- d####.####.com
- f####.####.com
Запросы HTTP GET:
- d####.####.com/f/3yxq.jpg
- f####.####.com/f/3yxt.jpg
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_jp.co.johospace.core.store.SimpleStore/agreement_version
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1314855544.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1450638995.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1545453154.zip
- <Package Folder>/databases/0<IMEI>1.db-journal
- <Package Folder>/databases/E_ID<IMEI>.db
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/internal.db-journal
- <Package Folder>/databases/jorte.db-journal
- <Package Folder>/databases/jorte2.db-journal
- <Package Folder>/databases/jorte_diary.db-journal
- <Package Folder>/databases/jortesync_internal.db-journal
- <Package Folder>/files/####/black_style.txt
- <Package Folder>/files/####/default_style.txt
- <Package Folder>/files/####/green_style.txt
- <Package Folder>/files/####/ichigomilk_style.txt
- <Package Folder>/files/####/jobs.obj
- <Package Folder>/files/####/lemonchiffon_style.txt
- <Package Folder>/files/####/loging.ppdb
- <Package Folder>/files/####/loging.ppdb-journal
- <Package Folder>/files/####/pink_style.txt
- <Package Folder>/files/####/pplogger_cfg.ppdb
- <Package Folder>/files/####/pplogger_cfg.ppdb-journal
- <Package Folder>/files/####/sendLog.ppdb
- <Package Folder>/files/####/sendLog.ppdb-journal
- <Package Folder>/files/####/skyblue_style.txt
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_776F7S43BNKFDZM6P46V_226
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.yflurrydatasenderblock.e39f1dad-2b1e-4977-a251-db70164a0b96
- <Package Folder>/files/.yflurryreport.-5ef76cc7b0ee7466
- <Package Folder>/files/014962152866621.jar
- <Package Folder>/files/149621528680901496215286809.jar
- <Package Folder>/files/gaClientId
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>.rsid.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/alog.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/fac_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/finfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fac_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_finfo_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pp_batch_pref.xml
- <Package Folder>/shared_prefs/pp_common_data.xml
- <Package Folder>/shared_prefs/pp_common_data.xml.bak
- <Package Folder>/shared_prefs/pp_logs_data.xml
- <Package Folder>/shared_prefs/pp_logs_data.xml.bak
- <Package Folder>/shared_prefs/pp_permission_data.xml
- <Package Folder>/shared_prefs/pp_settings_data.xml
- <Package Folder>/shared_prefs/pp_user_segments.xml
- <Package Folder>/shared_prefs/tccm.cfg.xml
- <SD-Card>/Download/####/3yxq.jpg.dat
- <SD-Card>/ProfilePassport/<Package>_ppsdk.txt
- <SD-Card>/d/####/3yxt.jpg.dat
- <SD-Card>/d/####/_o.dat
- <SD-Card>/jorte/####/.jorte_external.db-journal
- <SD-Card>/jorte/####/BonvenoCF-Light.otf
- <SD-Card>/jorte/####/Damion-Regular.ttf
- <SD-Card>/jorte/####/Delius-Regular.ttf
- <SD-Card>/jorte/####/Junction02.otf
- <SD-Card>/jorte/####/cmunst.otf
- <SD-Card>/jorte/####/cmuntb.otf
- <SD-Card>/jorte/####/lists.csv
- <SD-Card>/jorte/####/readme.txt
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
