Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.226.origin
- Android.Triada.248.origin
- Android.Xiny.122.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.226.origin
- Android.Triada.248.origin
- Android.Xiny.122.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- a####.####.cn:5284
- i####.####.com
- p####.####.cn
- p####.####.cn:8002
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
Запросы HTTP POST:
- a####.####.cn:5284/android.frontserver/pcsvc
- p####.####.cn/pps
- p####.####.cn:8002/pps
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_mmnwgame/kb_idle.ini
- <Package Folder>/code-1530978/####/qnZKwB9y6Xw=.jar
- <Package Folder>/code-1530978/9SK355H3jtcjK1hX
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_-3AFxtizgxBGxM_oZaYLRg==-journal
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_TppJgtRomSq293BUamhbVw==-journal
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_v7k6wJURujJRcCJt
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_v7k6wJURujJRcCJt-journal
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_zWTguyq3RwW075fPAn08u936Zd4=
- <Package Folder>/databases/7BWv0mVr5HS954LCGslkK-1W_LnCsDRN_zWTguyq3RwW075fPAn08u936Zd4=-journal
- <Package Folder>/files/####/05k_oc6Fce4L9_sNlLLE0toDQL93f6Pk.new
- <Package Folder>/files/####/0fb00ea3-3b03-4bd8-bd6c-2d079d5b727e.res.temp
- <Package Folder>/files/####/271QJ8vTY_hcvadKgqv1kzfjwH1xY_N-k0mqRw==.new
- <Package Folder>/files/####/4b7cd3d7-49c1-47ff-abe6-ba73cceb5607.res.temp
- <Package Folder>/files/####/5bIiUJvqxyv1C-haCHOvoAMZYzo=.new
- <Package Folder>/files/####/7ohKFWDwVkXhNj3XTYMCGQ==.new
- <Package Folder>/files/####/941a15cf-5302-46e0-be6e-f5be81b23123.res.temp
- <Package Folder>/files/####/9Y9vT_naCfQftGMR.zip
- <Package Folder>/files/####/9bfe7e19-6d4a-4e11-966b-75ad7a6ceb83.res
- <Package Folder>/files/####/Dn9310gLwYjyNkn5SOelV32ZBQMxIkpB2jzGzw==.new
- <Package Folder>/files/####/ECd-KktK28FNw9_Kh6aaHFkoOvo_0EMdxAT1Z75q2QM=.new
- <Package Folder>/files/####/FEnOVsHwB0vqVnjnxYPx7gJidoPHlxbG.new
- <Package Folder>/files/####/GQ248wkegV-VeQpc.new
- <Package Folder>/files/####/IgNeBZ_zBoqdOEedTL0V9uExR9Q=
- <Package Folder>/files/####/THpSgp2EhTh-fznHIa-CHSFGDU2fPt3DOXYGIlR_3DM=.new
- <Package Folder>/files/####/TgGoGmsMrsPmU5qkLVNuXWa3imo=.new
- <Package Folder>/files/####/Tx9j0eN4aCzvV6t2gjq1m11Q41l7Scav.new
- <Package Folder>/files/####/UjXk9sR-U9awmEdqRq1CiA==.new
- <Package Folder>/files/####/UoowYrcKScIGwYspqN7H-w==.new
- <Package Folder>/files/####/VpDXJEdop7rnZAn8Jtpr8A==.new
- <Package Folder>/files/####/X-GxCkhTkUHwJsAgTU-chUj0kinVquJ23ydE_fpp2OY=.new
- <Package Folder>/files/####/YQPBBupsR01N2LP7h1D-4cHqEIOEJe8r4mz6jA==.new
- <Package Folder>/files/####/ZZ1PxkBmymMlFuK7fG-J9fkCamG8i9A0.new
- <Package Folder>/files/####/_JcJYJS1KMMCzaRcUPN8d6kRis4lxxRS.new
- <Package Folder>/files/####/aCusq3hmV033vtI8o9UAoBmAkM8uc255.new
- <Package Folder>/files/####/asHfLVWz3mjx9bfp
- <Package Folder>/files/####/b20d315c-e7eb-4ec0-bb40-927ac1e0a863.res
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/hKLtIBpTf-NCHYw3J4TnYukwI38=.new
- <Package Folder>/files/####/jRYlwIbusax-1UuEk5hjOw==
- <Package Folder>/files/####/nzrd6SRzgmr1OGouqUzVoE-AVPo=.new
- <Package Folder>/files/####/qBsWFa9ukN00rSWx2iSRVdJ09vWbnuiG.new
- <Package Folder>/files/####/quwibg_f.zip
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/rdata_comsczaszop
- <Package Folder>/files/rdata_comsczaszop.new
- <Package Folder>/shared_prefs/mm_nw_app.xml
- <Package Folder>/shared_prefs/mm_nw_app.xml.bak
- <Package Folder>/shared_prefs/mmnwgame_data_s.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/mmnwgame/1B3A2967E5FD862EFD957606C65C8122
- <SD-Card>/mmnwgame/30592A6B8B0C769E3F7FDE6E1A033DF5
- <SD-Card>/mmnwgame/kb_idle.ini
- <SD-Card>/mmnwgame/kb_sn.ini
- <SD-Card>/mmnwgame/mmnwgame.jaru
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.game.syf.zhidian11205/code-1530978/9SK355H3jtcjK1hX -p com.game.syf.zhidian11205 -c com.scza.szop.wlkxbw.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- sh <Package Folder>/code-1530978/9SK355H3jtcjK1hX -p <Package> -c com.scza.szop.wlkxbw.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
