Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.10.origin
- Android.Loki.15.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Loki.10.origin
- Android.Loki.15.origin
Сетевая активность:
Подключается к:
- 0043####.####.click
- 1####.####.140
- a####.####.org
- a####.####.tech
- adse####.####.mobi
- apirepo####.####.com
- b####.com
- c####.####.com
- c####.####.net
- f####.####.gdn
- fl####.com
- hy####.com
- j####.####.com:8888
- mobilem####.me
- p####.####.com
- real####.####.org
- ret####.com
- s####.####.com
- s####.####.net
- st####.####.ly
- t####.####.com
- t####.####.info
- t####.####.net
- tra####.####.com
- trac####.####.com
Запросы HTTP GET:
- 0043####.####.click/29A667/FtsN/AthB/BtVQv_8/VJAE7a3J-yPqSE00OV8-8_fyvGo...
- 1####.####.140/ma/z.php?c=####&n=####&subid=####&siteid=####
- a####.####.org/op?platform=####&os_version=####&package_name=####&app_ve...
- a####.####.tech/common/notification/v1?ai=####&lo=####&mi=####&vc=####&l...
- adse####.####.mobi/tracker/click.php?link=####&id_pub=####&click_id=####
- apirepo####.####.com/apiClick?cidRev=####&ts=####&ifa=####&an=####&click...
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- c####.####.com/?a=####&c=####&E=####&s1=####&s2=####
- c####.####.com/c/a5a2b7d0919aed13?click_id=####&install=####&pub=####&ga...
- c####.####.com/click?transaction_id=####&aff_sub=####&aff_sub2=####&aff_...
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=...
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- f####.####.gdn/?v=####&s1=####&kw=####
- fl####.com/rc/0219fa04c8?affclick=####&pubid=####
- hy####.com/33E10/a7_DDw/f7yG/e7GXXqk/KfTABPVZILc47Xpo0kEwNmJSBjQJU4RGMDt...
- j####.####.com:8888/rule?p=####
- mobilem####.me/r/a1a07ac8-668f-11e7-8135-114194060020/0/
- p####.####.com/?m=####&offer_key=####&a=####
- real####.####.org/realtime?platform=####&os_version=####&package_name=##...
- ret####.com/redirect.php?demand=####&offer=####&id=####&aff=####&aff_sub...
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- s####.####.net/log?partner_id=####&p_name=####&aid=####&local=####×...
- st####.####.ly/themes/metronic3/assets/frontend/site/index/prod/20151027...
- t####.####.com/c/hULpoE3lEq5kYzr3QknyB4Sl-YlPpVwunpa2H3G4F1w/CF?subid1=#...
- t####.####.info/click?_type=####&sdk_redir=####&campid=####&sub_channel=...
- t####.####.net/click/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####...
- tra####.####.com/?p=####&media_type=####&click_id=####&pi=####
- trac####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/index
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/arrkii.native.sdk.db-journal
- <Package Folder>/databases/cleanup_apps.db-journal
- <Package Folder>/databases/sun_statistics.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/ISDZcyNXkTzQhwxvstub.jar
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1496213208922
- <Package Folder>/files/ahMZjZIyWHhwDbejdaemon.so
- <Package Folder>/files/feRrQMsTOymdlgJdsa.jar
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/librzKXgueSDvKSXJOpbootstrap.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/_has_set_default_values.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml.bak
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
- <Package Folder>/shared_prefs/clean_us.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/sharedpreferences_sunmobi_settings.xml
- <Package Folder>/shared_prefs/trigsdk.xml
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.salvia/tick
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
