Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.348.origin
- Android.DownLoader.396.origin
- Android.DownLoader.414.origin
- Android.DownLoader.455.origin
- Android.DownLoader.576.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.348.origin
- Android.DownLoader.396.origin
- Android.DownLoader.414.origin
- Android.DownLoader.455.origin
- Android.DownLoader.576.origin
Сетевая активность:
Подключается к:
- a####.####.com
Запросы HTTP POST:
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/1<IMEI>1.db-journal
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/po_download.db-journal
- <Package Folder>/databases/qui_download.db-journal
- <Package Folder>/databases/yop_download.db-journal
- <Package Folder>/files/14962152696450.jar
- <Package Folder>/files/14962152700799.jar
- <Package Folder>/files/1496215270231.jar
- <Package Folder>/files/1496215270329.jar
- <Package Folder>/files/1496215270431.jar
- <Package Folder>/files/1496215270533.jar
- <Package Folder>/files/1496215270543.jar
- <Package Folder>/files/14962152706700.jar
- <Package Folder>/files/14962152708289.jar
- <Package Folder>/files/14962152709580.jar
- <Package Folder>/files/14962152710639.jar
- <Package Folder>/shared_prefs/MyPrefsFile.xml
- <Package Folder>/shared_prefs/bah.xml
- <Package Folder>/shared_prefs/baj.xml
- <Package Folder>/shared_prefs/bak.xml
- <Package Folder>/shared_prefs/bid.xml
- <Package Folder>/shared_prefs/bim.xml
- <Package Folder>/shared_prefs/cfb.xml
- <Package Folder>/shared_prefs/cfj.xml
- <Package Folder>/shared_prefs/cft.xml
- <Package Folder>/shared_prefs/cix.xml
- <Package Folder>/shared_prefs/cn.jpush.serverconfig.xml
- <Package Folder>/shared_prefs/eid.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/fcut_appInfo_pre.xml
- <Package Folder>/shared_prefs/fcut_appInfo_pre.xml.bak
- <Package Folder>/shared_prefs/fcut_conf_pre.xml
- <Package Folder>/shared_prefs/fcut_conf_pre.xml.bak
- <Package Folder>/shared_prefs/fcut_info_pre.xml
- <Package Folder>/shared_prefs/fcut_trategy_pre.xml
- <Package Folder>/shared_prefs/ftime.xml
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/pid.xml
- <Package Folder>/shared_prefs/pim.xml
- <Package Folder>/shared_prefs/sid.xml
- <Package Folder>/shared_prefs/ybappInfo_pre.xml
- <Package Folder>/shared_prefs/ybappInfo_pre.xml.bak
- <Package Folder>/shared_prefs/ybconf_pre.xml
- <Package Folder>/shared_prefs/yo_fconf_pre.xml
- <Package Folder>/shared_prefs/yo_fconf_pre.xml.bak
- <Package Folder>/shared_prefs/yoappInfo_pre.xml
- <Package Folder>/shared_prefs/yoappInfo_pre.xml.bak
- <Package Folder>/shared_prefs/yoconf_pre.xml
- <Package Folder>/shared_prefs/yoconf_pre.xml.bak
- <Package Folder>/shared_prefs/yotrategy_pre.xml
- <SD-Card>/1496215271199u.jar
- <SD-Card>/1496215271360q.jar
- <SD-Card>/1496215271543u.jar
- <SD-Card>/1496215276182b.jar
- <SD-Card>/Android/####/MID.DAT
- <SD-Card>/Download/####/share.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
