Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
- Android.DownLoader.502.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.455.origin
- Android.DownLoader.502.origin
Сетевая активность:
Подключается к:
- 2####.####.233:14000
- 2####.####.233:443
- a####.####.com
- f####.####.com
- o####.####.com
- s####.####.com
Запросы HTTP GET:
- a####.####.com/v1/talents?timestamp=####&os=####&per_page=####&topics=##...
- f####.####.com/f/jrtt8.jpg
- s####.####.com/2017/06/27/o_1bjjqibee1cr01bpaf5oa9q28abp25094.jpg?imageV...
Запросы HTTP POST:
- 2####.####.233:14000/
- 2####.####.233:443/
- a####.####.com/api/check_app_update
- a####.####.com/app_logs
- o####.####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/-12303491731612966901
- <Package Folder>/cache/####/115821658-732170415
- <Package Folder>/cache/####/1215708094-545497207
- <Package Folder>/cache/####/1811475533-1881595461
- <Package Folder>/cache/####/1811475533905820026
- <Package Folder>/cache/####/1935654014-426361783
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/index
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/a1.db
- <Package Folder>/databases/a1.db-journal
- <Package Folder>/databases/pri_tpush_tencent_analysis.db_<Package>;xg_service_v2-journal
- <Package Folder>/databases/tpush_tencent_analysis.db_<Package>;xg_service_v2-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/592E75E10135-0001-0832-7FCAAB970221BeginSession.cls_temp
- <Package Folder>/files/####/592E75E10135-0001-0832-7FCAAB970221SessionApp.cls_temp
- <Package Folder>/files/####/592E75E10135-0001-0832-7FCAAB970221SessionDevice.cls_temp
- <Package Folder>/files/####/592E75E10135-0001-0832-7FCAAB970221SessionOS.cls_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_9887086a-ee21-4d6c-8c10-1b2a40bdca1c_1496217059541.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/.imprint
- <Package Folder>/files/014962170573611.jar
- <Package Folder>/files/1496217057537a.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/.tpns.xml.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/a1.xml
- <Package Folder>/shared_prefs/a1<IMEI>.xml
- <Package Folder>/shared_prefs/a1<IMEI>.xml.bak
- <Package Folder>/shared_prefs/b1<IMEI>.xml
- <Package Folder>/shared_prefs/c1<IMEI>.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;com.crashlytics.android.answers.Answers.xml
- <Package Folder>/shared_prefs/d1<IMEI>.xml
- <Package Folder>/shared_prefs/device_id.xml
- <Package Folder>/shared_prefs/devices.xml
- <Package Folder>/shared_prefs/f1<IMEI>.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/update.xml
- <SD-Card>/Download/####/a_3y9x.apk.b
- <SD-Card>/Download/####/jrtt8.jpg.data
- <SD-Card>/com.meiyaapp.meiya/####/-1031962518.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-1086664893.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-1151267853.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-1190343645.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-1309191649.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-1473280013.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-68858186.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-803568116.tmp
- <SD-Card>/com.meiyaapp.meiya/####/-858774159.tmp
- <SD-Card>/com.meiyaapp.meiya/####/1036027770.tmp
- <SD-Card>/com.meiyaapp.meiya/####/1588483261.tmp
- <SD-Card>/com.meiyaapp.meiya/####/1810899381.tmp
- <SD-Card>/com.meiyaapp.meiya/####/2005603178.tmp
- <SD-Card>/com.meiyaapp.meiya/####/2074061395.tmp
- <SD-Card>/com.meiyaapp.meiya/####/236245635.tmp
- <SD-Card>/com.meiyaapp.meiya/####/324719804.tmp
- <SD-Card>/com.meiyaapp.meiya/####/487393414.tmp
- <SD-Card>/com.meiyaapp.meiya/####/593296630.tmp
- <SD-Card>/com.meiyaapp.meiya/####/948004391.tmp
- <SD-Card>/com.meiyaapp.meiya/####/982945737.tmp
- <SD-Card>/tencent/####/.mid.txt
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/lib/libtpnsWatchdog.so <Package>,2100084421; 55234 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.37 , mf : unknown , apn : %s }}] 0 18
- <dexopt>
