Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
- Android.DownLoader.502.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.455.origin
- Android.DownLoader.502.origin
Сетевая активность:
Подключается к:
- 1####.####.195:1028
- a####.####.com
- api####.####.com
- f####.####.com
- h####.####.cn
- m####.####.com
- o####.####.com
- p####.####.cn
- res####.####.com
Запросы HTTP GET:
- f####.####.com/f/3y9x.apk
- h####.####.cn/launchconfig?t=####&p=####
- m####.####.com/amapsrv/MPS?t=####&cp=####&mesh=####
- p####.####.cn/gdt/0/DAAOBceAUAALQABgBZUTAKAvCiCFmX.jpg/0?ck=####
Запросы HTTP POST:
- 1####.####.195:1028/msp.do
- a####.####.com/app_logs
- a####.####.com/fetchAds
- api####.####.com/v3/log/init
- o####.####.com/v2/get_update_time
- res####.####.com/v3/config/resource
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_AdServer/AdServer_asset.apk
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/a1.db
- <Package Folder>/databases/a1.db-journal
- <Package Folder>/databases/daohang-journal
- <Package Folder>/databases/logdb.db
- <Package Folder>/databases/logdb.db-journal
- <Package Folder>/files/####/journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/014962318532471.jar
- <Package Folder>/files/1496231853609a.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/a1.xml
- <Package Folder>/shared_prefs/a1<IMEI>.xml
- <Package Folder>/shared_prefs/a1<IMEI>.xml.bak
- <Package Folder>/shared_prefs/apkloader.xml
- <Package Folder>/shared_prefs/apkloader.xml.bak
- <Package Folder>/shared_prefs/apkloader.xml.bak (deleted)
- <Package Folder>/shared_prefs/b1<IMEI>.xml
- <Package Folder>/shared_prefs/b1<IMEI>.xml.bak
- <Package Folder>/shared_prefs/c1<IMEI>.xml
- <Package Folder>/shared_prefs/c1<IMEI>.xml.bak
- <Package Folder>/shared_prefs/com.iflytek.msc.xml
- <Package Folder>/shared_prefs/d1<IMEI>.xml
- <Package Folder>/shared_prefs/f1<IMEI>.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/ifly_launch_lib.xml
- <Package Folder>/shared_prefs/ifly_launch_lib.xml.bak
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/moduleupdater.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/####/a_3y9x.apk.b
- <SD-Card>/Download/####/jrtt8.jpg.data
- <SD-Card>/amap/####/100.dat
- <SD-Card>/amap/####/100.ind
- <SD-Card>/amap/####/101.dat
- <SD-Card>/amap/####/101.ind
- <SD-Card>/amap/####/102.dat
- <SD-Card>/amap/####/102.ind
- <SD-Card>/amap/####/103.dat
- <SD-Card>/amap/####/103.ind
- <SD-Card>/amap/####/110.dat
- <SD-Card>/amap/####/110.ind
- <SD-Card>/amap/####/112.dat
- <SD-Card>/amap/####/112.ind
- <SD-Card>/amap/####/120.dat
- <SD-Card>/amap/####/120.ind
- <SD-Card>/amap/####/121.dat
- <SD-Card>/amap/####/121.ind
- <SD-Card>/amap/####/122.dat
- <SD-Card>/amap/####/122.ind
- <SD-Card>/amap/####/123.dat
- <SD-Card>/amap/####/123.ind
- <SD-Card>/amap/####/130.dat
- <SD-Card>/amap/####/130.ind
- <SD-Card>/amap/####/132.dat
- <SD-Card>/amap/####/132.ind
- <SD-Card>/amap/####/hd.dat
- <SD-Card>/amap/####/hd.ind
- <SD-Card>/freedaohang/icon.png
- <SD-Card>/iflyworkdir_test
- <SD-Card>/miad/####/3951658708
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
