Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.10.origin
- Android.Loki.15.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Loki.10.origin
- Android.Loki.15.origin
Сетевая активность:
Подключается к:
- a####.####.org
- j####.####.com:8888
- them####.####.com
Запросы HTTP GET:
- a####.####.org/op?platform=####&os_version=####&package_name=####&app_ve...
- j####.####.com:8888/rule?p=####
- them####.####.com/api/theme/hyperpush?e=####&clock=####&c=####&fish=####...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/cache/####/54bfad34aff8626c09183d5282732ad7.0.tmp
- <Package Folder>/cache/####/54bfad34aff8626c09183d5282732ad7.1
- <Package Folder>/cache/####/54bfad34aff8626c09183d5282732ad7.1.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/drawpathdebug.fp
- <Package Folder>/cache/drawpathdebug.vp
- <Package Folder>/cache/drawpathtrace.fp
- <Package Folder>/cache/drawpathtrace.vp
- <Package Folder>/cache/hpotter_convolution.fp
- <Package Folder>/cache/hpotter_convolution.vp
- <Package Folder>/cache/ppcopy.fp
- <Package Folder>/cache/ppcopyflip.vp
- <Package Folder>/cache/ppflip.fp
- <Package Folder>/cache/prelit.fp
- <Package Folder>/cache/prelit.vp
- <Package Folder>/cache/shader.fp
- <Package Folder>/cache/shader.vp
- <Package Folder>/cache/shader_blur.fp
- <Package Folder>/cache/shader_blur.vp
- <Package Folder>/cache/shader_color.fp
- <Package Folder>/cache/shader_color.vp
- <Package Folder>/cache/shader_texture.fp
- <Package Folder>/cache/shader_texture.vp
- <Package Folder>/cache/shader_texture_color.fp
- <Package Folder>/cache/shader_texture_color.vp
- <Package Folder>/cache/shader_texture_color_life.fp
- <Package Folder>/cache/shader_texture_life.fp
- <Package Folder>/cache/shader_texture_life.vp
- <Package Folder>/cache/shader_water.fp
- <Package Folder>/cache/shader_water.vp
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/evernote_jobs.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/1544803905.slideshow
- <Package Folder>/files/EGHLsNQoLMSzcubDstub.jar
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/fivWGWBmcLYoYQdtsa.jar
- <Package Folder>/files/librzKXgueSDvKSXJOpbootstrap.so
- <Package Folder>/files/slide_show.conf
- <Package Folder>/files/syErvTFYOoeGkNcSdaemon.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml.bak
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/evernote_jobs.xml
- <Package Folder>/shared_prefs/wallpaper_settings.xml
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.salvia/tick
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
