Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
Сетевая активность:
Подключается к:
- 1####.####.192
- 1####.####.238
- 1####.####.67
- 1####.####.80
- 1####.####.80:8000
- 2####.####.140
- 2####.####.140:8080
- d####.####.com
- g####.####.net
- g####.####.net:8080
- sd####.####.com
- unitedp####.####.com
- w####.####.com
- w####.####.com:7758
Запросы HTTP GET:
- 1####.####.192/helper/interface.html?action=####
- 1####.####.67/codex/version
- d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
- unitedp####.####.com/numberbank/interface?getInfo=####
Запросы HTTP POST:
- 1####.####.238/updata/interface.html
- 1####.####.80/intp/ded7060cd675907e7d5f6e59d91c966bddc5e587
- 1####.####.80:8000/intp/ded7060cd675907e7d5f6e59d91c966bddc5e587
- 2####.####.140/migusdk/tl/enclog
- 2####.####.140:8080/migusdk/tl/enclog
- g####.####.net/migusdk/verification/checkSdkUpdate
- g####.####.net:8080/migusdk/tl/tcttl
- sd####.####.com/behaviorLogging/eventLogging/accept?
- w####.####.com/normandie/QueryConfigPolicy
- w####.####.com:7758/normandie/QueryConfigPolicy
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/2100.dex
- <Package Folder>/2214.dex
- <Package Folder>/2315.dex
- <Package Folder>/app_cache/NXRx.dex
- <Package Folder>/app_lemuellabs_reserved/30ffeb5e889598d6.dex
- <Package Folder>/app_lemuellabs_reserved/30ffeb5e889598d6.jar
- <Package Folder>/app_lemuellabs_reserved/6c3f572c467e0eda.jar
- <Package Folder>/app_lemuellabs_reserved/c90cd17ab940c30c.dex
- <Package Folder>/app_lemuellabs_reserved/c90cd17ab940c30c.jar
- <Package Folder>/app_lemuellabs_reserved/codex.so
- <Package Folder>/app_lemuellabs_reserved_/b8c2989eb7473a8f.dex
- <Package Folder>/app_lemuellabs_reserved_/b8c2989eb7473a8f.jar
- <Package Folder>/app_lemuellabs_reserved_/bea749fbddae3001.dex
- <Package Folder>/app_lemuellabs_reserved_/bea749fbddae3001.jar
- <Package Folder>/app_lemuellabs_reserved_/codex_inner.so
- <Package Folder>/app_lemuellabs_reserved_/f3a6418a2ed503ee.jar
- <Package Folder>/app_lemuellabs_reserved_/lemuel_security_inner.so
- <Package Folder>/app_td-cache/td_database_push
- <Package Folder>/app_td-cache/tdandroidgame
- <Package Folder>/cache/2100.dex (deleted)
- <Package Folder>/cache/2214.dex (deleted)
- <Package Folder>/databases/mpush_game.db
- <Package Folder>/databases/mpush_game.db-journal
- <Package Folder>/files/####/gkbzvq_f.dex
- <Package Folder>/files/####/gkbzvq_f.zip
- <Package Folder>/files/####/libmiguED.so
- <Package Folder>/files/ED.ini
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.cod
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.dat
- <Package Folder>/files/NXRx
- <Package Folder>/files/NXRx.jar
- <Package Folder>/files/UNITEDPAYACTLIST_
- <Package Folder>/files/libmgRun_04.22.09_01.so
- <Package Folder>/files/mgAS.dat
- <Package Folder>/files/mgSS.dat
- <Package Folder>/files/mgid.dat
- <Package Folder>/files/mpush_gateway_preferences_file
- <Package Folder>/files/mpush_version_preferences_file
- <Package Folder>/files/sdk_prefs
- <Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/shared_prefs/pref_file.xml.bak
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.tcookieid
- <SD-Card>/Download/####/ShareData.txt
- <SD-Card>/Download/####/deviceId
- <SD-Card>/Download/####/miguLog_1499678088346
- <SD-Card>/Download/####/miguLog_1499678088367
- <SD-Card>/Download/####/miguLog_1499678088368
- <SD-Card>/Download/####/miguLog_1499678095886
- <SD-Card>/Download/####/miguLog_1499678095890
- <SD-Card>/Download/####/miguLog_1499678095898
- <SD-Card>/Download/####/sdk_prefs.txt
- <SD-Card>/cmgame/####/pushDB.txt
- <SD-Card>/cmgame/####/pushTime.txt
- <SD-Card>/cmgame/####/pushTotal.txt
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.bobon.tcs2017jd/code-3090598/zLj2EFKtFNENuRkX -p com.bobon.tcs2017jd -c com.chxh.ypfe.avvgva.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- <error:2>
- sh <Package Folder>/code-3090598/zLj2EFKtFNENuRkX -p <Package> -c com.chxh.ypfe.avvgva.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
