Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.226.origin
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.226.origin
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- a####.####.com
- a####.####.com:12580
- i####.####.com
- m####.####.com
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- a####.####.com/log?c=####
- a####.####.com:12580/log?c=####
- i####.####.com/ando-res/ads/0/9/837ec120-ccf8-4ad0-b6fd-1303ff645eca/773...
- m####.####.com/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/index
- <Package Folder>/code-602916/####/hZnN3UHQCGFZBait.jar
- <Package Folder>/code-602916/soMAF_KM8xFXTNqb
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_5FMRqNOyWuhpEgRH6np2gQ==
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_5FMRqNOyWuhpEgRH6np2gQ==-journal
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_JS69zT1aAmFfQG8RDmdurA==
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_JS69zT1aAmFfQG8RDmdurA==-journal
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_KoaAJKgsEHZL1h7F
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_KoaAJKgsEHZL1h7F-journal
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_jWer8jEBeyk=
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_jWer8jEBeyk=-journal
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_tNpUylw7rso1qvoiX4ZpF_p00_U=
- <Package Folder>/databases/eDkQv04TSE6sowsEtlf8hIKlfp5YYvet_tNpUylw7rso1qvoiX4ZpF_p00_U=-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/198003b8-c9fc-4837-9024-4d5d15d58f8d.pic.temp
- <Package Folder>/files/####/26202375-e0ba-4400-ac87-f0176f56c054.pic.temp
- <Package Folder>/files/####/56f0bf0d-61ac-4588-9c91-d79cad309da2.pic.temp
- <Package Folder>/files/####/5wUjxMQK7dAh7yO3GiU4y_KnoaRA5l3i.new
- <Package Folder>/files/####/66YS5TzCUviYku9Iiad8Jn3cvJ1TnhIr.new
- <Package Folder>/files/####/67064223-1e80-4f17-baec-73b9c2a58942.pic.temp
- <Package Folder>/files/####/6pMzxI0CqMOyJHnBvHZugG2BVh86TwAM.new
- <Package Folder>/files/####/7e2321b7-e591-4699-b8ad-6b5e4408e796.pic.temp
- <Package Folder>/files/####/8yCFnixF2FXsaH6hO0efrd4e8PiYPF4lGV48PhS_RPc=.new
- <Package Folder>/files/####/9TjHeT1yoHT7AurYvBKhYA==
- <Package Folder>/files/####/B_qMgsTqmGiENuiITWfwrmV27tI=.new
- <Package Folder>/files/####/Dbo1ATa-VijDaVHULH2yrft8isAEcEmroFGYFYK95Bk=.new
- <Package Folder>/files/####/E1fFRLPJNsWRTAweuweWVml7Ca0=
- <Package Folder>/files/####/GwggiZp2N6Cty5oXd_u-5C5WDgaOHBiZ.new
- <Package Folder>/files/####/GzojX42a3t_CAgbb
- <Package Folder>/files/####/NLdsW_SG3JfFjdxL30aUKAmQAXg=.temp
- <Package Folder>/files/####/O7tGCB6zRSezS_7oJhc9k3jopzecya2aMo9FCw==.new
- <Package Folder>/files/####/OmgMlHj2VrXZmxSkuHN63TyboYcmDdyCW61dNw==.new
- <Package Folder>/files/####/TdW5RwdRGPpUqWLW.zip
- <Package Folder>/files/####/Wu5Dj0BmMoUMJxQFKgcPyAzqLZU=.new
- <Package Folder>/files/####/Z3hwcYipGJ01OZqLMkWDEfexuqgScyB8.new
- <Package Folder>/files/####/ZmafIwpBxunxeJvKAyyTLw==.new
- <Package Folder>/files/####/a-xaLLKNCUAABUOb.new
- <Package Folder>/files/####/b405f044-9ee6-4f1a-8946-d17d1b999a79.pic
- <Package Folder>/files/####/b783179d-c41a-4190-bf9b-ad4c202721dc.pic.temp
- <Package Folder>/files/####/cMj3vPAKTSx9WXds7rYDatx0pKQ=.new
- <Package Folder>/files/####/eWdLYHbEd3BcS6HZuvRzAQ==
- <Package Folder>/files/####/eWdLYHbEd3BcS6HZuvRzAQ==.new
- <Package Folder>/files/####/eWdLYHbEd3BcS6HZuvRzAQ==.old (deleted)
- <Package Folder>/files/####/f6c24935-55e4-440a-9db8-4e1dec59384d.pic
- <Package Folder>/files/####/gVW2Ul9Daan0LIhl1M13bj2R_HI=
- <Package Folder>/files/####/hjOfxAV050Bm51y6IHmOUuZz40U=.temp
- <Package Folder>/files/####/iUcD5bpFsJ8-j7X62rkAqiM88nE=
- <Package Folder>/files/####/iUcD5bpFsJ8-j7X62rkAqiM88nE=.new
- <Package Folder>/files/####/j4lXh0INZqa0n2uTDOVwoEDwDam-Yt7fPKNA4A==.new
- <Package Folder>/files/####/kNW_H1GfR9C0hz1HG2qgZvPMZxXPtW8V
- <Package Folder>/files/####/kNW_H1GfR9C0hz1HG2qgZvPMZxXPtW8V.new
- <Package Folder>/files/####/kNW_H1GfR9C0hz1HG2qgZvPMZxXPtW8V.old (deleted)
- <Package Folder>/files/####/pRkny_4jHhOBmuAKruYvAeugom5J9Q4o.new
- <Package Folder>/files/####/qeanuw_f.zip
- <Package Folder>/files/####/rjnb9mrx3g7vu9o0I678N6Wk-10eoqTL.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sXBi5ljoNsUNA-8nMNm65w==.new
- <Package Folder>/files/####/so78Fl_-JTHlDneRJVk9OnIg4G4KxtwQWdSWf7SknJ4=.new
- <Package Folder>/files/####/utupRMUS03Ui_0ZR9n4azYQSx3VW-SY_wVnvTLnybrg=.new
- <Package Folder>/files/####/ymuowHXhMvbbmG4Q8YuG0Q==
- <Package Folder>/files/rdata_comvnmrasdr
- <Package Folder>/shared_prefs/<Package>.xml
- <SD-Card>/.armsd/####/06d8259e-b23d-4f89-a4d9-31b3697f2e65.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/5e831bb7-7d07-426b-8e08-1294be0b0c2c.res
- <SD-Card>/.armsd/####/77b4cac0-9151-4655-8112-85c555a7338c.res
- <SD-Card>/.armsd/####/8b6c2b4f-2a07-41d7-9dc3-35431442cb2f.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/f5404f0e-a98e-4ac7-96ca-661f9f309099.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- /data/data/dswnm.etravjp.tyznomqeik.cplvitzx/code-602916/soMAF_KM8xFXTNqb -p dswnm.etravjp.tyznomqeik.cplvitzx -c com.vnmr.asdr.wusug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- /system/bin/netcfg
- <dexopt>
- sh <Package Folder>/code-602916/soMAF_KM8xFXTNqb -p <Package> -c com.vnmr.asdr.wusug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
