Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34
- 1####.####.57
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57/v1/order/get?phone=####&imei=####&sdk_version=####&callbac...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.com/ando-res/ads/black/640x270.png
Запросы HTTP POST:
- 1####.####.34/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-5885807/cVfa0ufZ5NPdlhmu
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_7VyBslP2geggaLWh6X4y1w==
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_7VyBslP2geggaLWh6X4y1w==-journal
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_FZvuysvnTDw=-journal
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_JtEqSNffGr29FIUhEX6emg==
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_JtEqSNffGr29FIUhEX6emg==-journal
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_RR18janjdEYguSsvTTosgUi1flc=
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_RR18janjdEYguSsvTTosgUi1flc=-journal
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_Y7CiVSdKEh6nXxUU
- <Package Folder>/databases/UTQsk2uFtpB5Xt-eLs6mPVsqc1DXWBQB_Y7CiVSdKEh6nXxUU-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/-VmdP6kYefhrDg-ezVPxCg33Xoc=.new
- <Package Folder>/files/####/2a25b4f2-01b1-48c7-bf53-e2da6bb7acaa.pic.temp
- <Package Folder>/files/####/3N99kaAozSuED5jQU2jLagEzVUY=.new
- <Package Folder>/files/####/3eIBEUl2k5hxQqLXuBa8X4_VPtU=
- <Package Folder>/files/####/3fxfkvsROYXZTLjfc0QiEWJAS18NgukszKmcPw==.new
- <Package Folder>/files/####/42a1870c-d864-4236-b52c-7fc63a64bedc.pic
- <Package Folder>/files/####/4ba490b1-c2b2-41f9-af93-4172ddd13469.pic.temp
- <Package Folder>/files/####/663e4750-36f5-4564-8b84-86543bbcd975.pic.temp
- <Package Folder>/files/####/66979eae-f7d8-40c8-b4e7-b8aa4dc8ed57.pic.temp
- <Package Folder>/files/####/6ea0970c-5365-44ae-8ed9-2363f4e25b56.pic
- <Package Folder>/files/####/EV6nLGcbJIhCtQqtTS4yz7wx8xQCxqbW.new
- <Package Folder>/files/####/FVyX6mU9aSTMYBr7.new
- <Package Folder>/files/####/GWtE1iSndfNKBmNiQmodlEi4YL4RD9Xs.new
- <Package Folder>/files/####/I8o14pP_oigGVdBj0AEgbbw0eGQZm3Bp.new
- <Package Folder>/files/####/LlbrZW4NGHaYcz-KoQY5zdEbz5tzaeNKV9upPCqV88g=.new
- <Package Folder>/files/####/M4kqHuJnBf8E83acNjbDCVfyWosua8P7.new
- <Package Folder>/files/####/N8Plc2jcxuoPTwYQEdTy8Q==
- <Package Folder>/files/####/N8Plc2jcxuoPTwYQEdTy8Q==.new
- <Package Folder>/files/####/OM1nq0-N-Mta9axvdL3lSxY3Oqs=.new
- <Package Folder>/files/####/OiwxOpsqdxQvGzBD5w6pJX_z1RQ=
- <Package Folder>/files/####/P5c08Qfs3AK_XjCJZeINTGukASe6QbwuG3gnQFzgO4g=.new
- <Package Folder>/files/####/ZoEoHtkvRubgU4aAzK3c2-W1qmFidBincvvypg==.new
- <Package Folder>/files/####/azBXeRy2sWgX3KyU
- <Package Folder>/files/####/ba31a5c2-5b53-4382-960a-3c3322acddaf.pic.temp
- <Package Folder>/files/####/d5ca9b47-745d-469d-85bd-c0f73d3e1a94.pic.temp
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/iyT6rOhqLq8ZcXwZ.zip
- <Package Folder>/files/####/kI7oSdW0miJZlPRCvqVZZ8y3Gtqo-um8RzOrYg==.new
- <Package Folder>/files/####/kcw893Cpa5SB8UpplYl2x7Wxla8iiu8x
- <Package Folder>/files/####/kcw893Cpa5SB8UpplYl2x7Wxla8iiu8x.new
- <Package Folder>/files/####/kmMgaSgOMgVoIIzn0yABqPVBkkk=.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/mRoA4M5HC6avkxRCLe8jbg==
- <Package Folder>/files/####/mfJQsLvHk8pi04tIInjLVA==.new
- <Package Folder>/files/####/mj7OGRPWxZU0MfRwtyUEIPKqB3JzdURQ.new
- <Package Folder>/files/####/ncXepbzjlhRv6WqyOUMDjQ==.new
- <Package Folder>/files/####/o-itoVsUkNNjSQRQvDu48PcIOgHztDb_O12pQ3sNTqk=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/s1kH9fFMpTQfustiTFe4ljSnJHDCQT0L.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/usf7xbSJqWPCB47zZYRZcXZJIJro0wr5.new
- <Package Folder>/files/####/vfN30evMZ9K3Kf7LoftFNhSSCbSO85nql7HPDyViYjs=.new
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/twj.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/2210b00c-c907-46ed-b091-8798b22caeb9.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/9df92230-f95a-4211-8485-7be8fe8b2aaa.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/cdace914-1920-4367-aa94-c8202b1256e8.res
- <SD-Card>/.armsd/####/f396b6e5-1255-4d05-a713-72f0cfe0fbeb.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/tcnmzbxy.qfux.pwux.zyxhtyaz/code-5885807/cVfa0ufZ5NPdlhmu -p tcnmzbxy.qfux.pwux.zyxhtyaz -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- <error:2>
- sh <Package Folder>/code-5885807/cVfa0ufZ5NPdlhmu -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
