Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- collec####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
- mobil####.####.com
- p####.####.com
- re####.####.com
- re####.####.com:10002
- sm####.####.com
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/m/A6EGb*Py4u1FtWQ3Rk0AdTbn3l2VkFbr8rEbwi8yQXTViC...
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
Запросы HTTP POST:
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- l####.####.com/sdk.php
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/lol.so
- <Package Folder>/app_apCoreplugn/map.apk
- <Package Folder>/app_apCoreplugn/sm.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/crash-1496212858352.log
- <Package Folder>/cache/####/crash-1496212871941.log
- <Package Folder>/cache/map.apk.apk
- <Package Folder>/cache/sm.apk.apk
- <Package Folder>/code-4794634/G0eS19hWQt70FWA4
- <Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_A2i1nHWN9A8=-journal
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_EhXnu8xzdXH3A58q
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_EhXnu8xzdXH3A58q-journal
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_O56-QxjZgWpp416G1cinGw==
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_O56-QxjZgWpp416G1cinGw==-journal
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_SLD6WgU9q8wtCN_r368uNg==
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_SLD6WgU9q8wtCN_r368uNg==-journal
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_Xw3jz6z2qBMeKbFyR73hb2W-SSE=
- <Package Folder>/databases/msyGcaofBJH-c95-SkhH2SvwPryuEv-j_Xw3jz6z2qBMeKbFyR73hb2W-SSE=-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/-kW1iQrX29iONmr_
- <Package Folder>/files/####/102c3ccc-361e-4e90-92d7-bc9a7879dc65.pic.temp
- <Package Folder>/files/####/1496212858205_2115
- <Package Folder>/files/####/1496212858246_2115
- <Package Folder>/files/####/1496212858509_2115
- <Package Folder>/files/####/1496212858725_2115
- <Package Folder>/files/####/1496212871903_2271
- <Package Folder>/files/####/1496212871985_2271
- <Package Folder>/files/####/1496212872095_2271
- <Package Folder>/files/####/1d5b2e63-78ce-4526-836f-403f44f6092e.pic.temp
- <Package Folder>/files/####/24b14681-1070-4a48-89c6-91b28c63292d.pic
- <Package Folder>/files/####/4YRmmmeQHdxLsdF1rSsUmcb3kABqKdzJ.new
- <Package Folder>/files/####/848gFXEZe4oGdmvNZcRa7r3NuCRl83J-.new
- <Package Folder>/files/####/9B4P2gqUV8pRsGZUhTU8iZCM14SLpCO0.new
- <Package Folder>/files/####/9b4ae47e-d3ff-4083-b233-d1e593fbc478.pic.temp
- <Package Folder>/files/####/9bc77dd6-2db6-47cc-a504-feb4405ed231.pic.temp
- <Package Folder>/files/####/9bd18126-de65-443d-a34a-a8b41d777e80.pic
- <Package Folder>/files/####/9fBbYKjIVi9vm26U_FBVz6HvbuCpLG18lPlEonysKgQ=.new
- <Package Folder>/files/####/BgTCGJ6SgWKxCf2tq9zs78Wp37wUqT_p.new
- <Package Folder>/files/####/BhuJlNdTD_GxPtiuBTTnyLGDHwCnZsTrZSTxTA==.new
- <Package Folder>/files/####/DBORNK3eCJt5i19Huq1kunGYtLq4BmRM.new
- <Package Folder>/files/####/GBdPBNU7Dw7AGiKkp5IA4KGgIgQ=
- <Package Folder>/files/####/GvYzoTtuLF66jeDWAF5YZpmBpdnZZnDl.new
- <Package Folder>/files/####/JnJF9HEeIrMUZe2NCStGgN-K3alrkRxk.new
- <Package Folder>/files/####/VV96md21qv-e5iO3heLZYBOeMto=.temp
- <Package Folder>/files/####/VmmOTw_N6V-tup1TNPXbMWi2cmk=.new
- <Package Folder>/files/####/W0hnFh5w87na23aZZwvamUwp-Sk=.new
- <Package Folder>/files/####/W1wDTVA--a0NMcBcf_yJ_2Zw3x1kQjqC2Ldr9A==.new
- <Package Folder>/files/####/XSHQcuDqCrEXI7MTQKcqTg==
- <Package Folder>/files/####/YnhMSiB0fcFIvqgQV0V7Mg==.new
- <Package Folder>/files/####/ZWPXIDDCQq5585BSNFP0-ar05wQ=.new
- <Package Folder>/files/####/aK15525Q91vGkcNC2pSIf0JfcHNhoGuvmhOMMraPj5Q=.new
- <Package Folder>/files/####/ad933430-6005-4e51-a447-ae285d725c42.pic.temp
- <Package Folder>/files/####/az4tmxM-JI5uf1TsRerXqQ==.new
- <Package Folder>/files/####/bXkFktUkz_GR2JeG.new
- <Package Folder>/files/####/e945581f-23ee-4fa0-a16f-8dd469f00815.pic.temp
- <Package Folder>/files/####/fJlsnjoa9tuKyG94BlEMA4il562s5x70.new
- <Package Folder>/files/####/hbipuw_f.zip
- <Package Folder>/files/####/igbwYoHHDjk_cS3O5CWFk1OsKJg=
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sn9CqCwFA4E5NbQ3.dex (deleted)
- <Package Folder>/files/####/sn9CqCwFA4E5NbQ3.zip
- <Package Folder>/files/####/ss6S_vhURf6ax6oyaq26xqGq44sYSQS7VdMI4Q==.new
- <Package Folder>/files/####/t_-Q4JSODS9l7qdOp_guO5JAidzK0nQ72W4TF6GA2uY=.new
- <Package Folder>/files/####/uEcRIyoA_phjtDMFFZSe5g==
- <Package Folder>/files/####/uH5EJ2dT74fu_o_Q_59c-OHEjBI=.new
- <Package Folder>/files/####/wOBQ9sl8qdUyqVZWvb_zaw==
- <Package Folder>/files/####/wOBQ9sl8qdUyqVZWvb_zaw==.new
- <Package Folder>/files/####/xgbpavzX57q6eTBx8GXhNqsQ1egEikP6B0wl5zzxw6c=.new
- <Package Folder>/files/####/y337_eAARwCVwZON47YXfBTMbJI=.temp
- <Package Folder>/files/rdata_comyvznyxpn.new
- <Package Folder>/shared_prefs/315432f0c34a6005ff1c18a57a27f742e|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_game.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/pretw.xml.bak
- <Package Folder>/shared_prefs/pretw.xml.bak (deleted)
- <Package Folder>/shared_prefs/sdk.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/38be57f3-a6c9-47e0-98f5-534eec45625b.res
- <SD-Card>/.armsd/####/4628a0ca-f048-4633-bc88-caaf29dad516.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/7c24766f-d8be-49f4-af96-f967912c1262.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/a7dfcc74-185a-4cdf-8747-451eeb5eda91.res
- <SD-Card>/.armsd/####/f03a33a0-9a16-47de-88b9-bd08001709b2.res
- <SD-Card>/.armsd/####/fb821b96-70d3-462a-a7b6-2bb39360a9bb.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/tkddbp_3001_2275.zip
- <SD-Card>/CrashLog/WyyyCrashLog_20170531064111_2271.log
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.aa.aa/code-4794634/G0eS19hWQt70FWA4 -p com.aa.aa -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
- sh <Package Folder>/code-4794634/G0eS19hWQt70FWA4 -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
