Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- 1####.####.57:10001
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/4/5/d73ab4a4-4c75-43a7-a3c9-5bdabd9437c8/d26...
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-8249050/a2OaPdhDT1nVh930
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_HMM1hK6LM5M=-journal
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_S-mWE1pgBDENW0355pmydhx9CPE=
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_S-mWE1pgBDENW0355pmydhx9CPE=-journal
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_eE-h65kLvDDbNfyKn5bAuA==
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_eE-h65kLvDDbNfyKn5bAuA==-journal
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_p7wJunBjp6vPepcQ
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_p7wJunBjp6vPepcQ-journal
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_wr2aDsEyCHjiCW73F-vhNA==
- <Package Folder>/databases/ASjq3iGstpp_dkCAoz0YFkNvsN8sAYNy_wr2aDsEyCHjiCW73F-vhNA==-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/-z1Sqj82gwq7uw3qmFeBPU0QRG9saU7b.new
- <Package Folder>/files/####/2Co1wygEsNj2DQFkZMdzUj_9gPPPndZ2
- <Package Folder>/files/####/2Co1wygEsNj2DQFkZMdzUj_9gPPPndZ2.new
- <Package Folder>/files/####/2Co1wygEsNj2DQFkZMdzUj_9gPPPndZ2.old (deleted)
- <Package Folder>/files/####/45afc157-f4ae-4313-99db-a223646c512b.pic.temp
- <Package Folder>/files/####/71a7bf54-e607-4bb7-80ef-af79d84110ea.pic.temp
- <Package Folder>/files/####/7ZJ0-fx0706ftgd16JD8sSNr-lE=.new
- <Package Folder>/files/####/7a5a785f-2833-4303-a18f-f75c99a9f911.pic.temp
- <Package Folder>/files/####/7qe7m0u-DUlcpJ58dHLyEllKbish6g2d.new
- <Package Folder>/files/####/84e3d466-a8e9-457c-95dd-b46a73dea87a.pic.temp
- <Package Folder>/files/####/8pevaMv1RDXCz3mun_i8EneOVu8=
- <Package Folder>/files/####/97361f60-27c8-49dc-a2da-3d223c8da2f0.pic
- <Package Folder>/files/####/D05se2p57lsN2lIxDl81QBCq6WipENX5BWF1Qt8T6ik=.new
- <Package Folder>/files/####/GI_CEztDcwSm5coB
- <Package Folder>/files/####/GI_CEztDcwSm5coB.new
- <Package Folder>/files/####/Gh63IcF9KW7MiMF86gljirL2vQOUkZlmp-7xJw==.new
- <Package Folder>/files/####/MOcMBPlqvBV1zh9l_lOzH3EKHxM=.new
- <Package Folder>/files/####/O4iIgvtl5tRvJTUtSaWOzQ==
- <Package Folder>/files/####/O4iIgvtl5tRvJTUtSaWOzQ==.new
- <Package Folder>/files/####/O4iIgvtl5tRvJTUtSaWOzQ==.old (deleted)
- <Package Folder>/files/####/Pu5cWfTVcrfgw26tKm5zQLoEL38=
- <Package Folder>/files/####/QbssHRSV5QRjqjhyfhziCQ==
- <Package Folder>/files/####/Rcr91vEn4w1598GWphKsnsabovh6AwX8AlMgpA==.new
- <Package Folder>/files/####/UjGMzZ6VqKxhsExDgZ0okt-Ilt0=.new
- <Package Folder>/files/####/VF6pN-9as5iJbJJi0Ptt1CVT2Ob0B_W2.new
- <Package Folder>/files/####/XS0DpB4SowHjFTzy.zip
- <Package Folder>/files/####/bjTIFANl0H9dlEKngBunTo2VF3H3yY2R.new
- <Package Folder>/files/####/c098ThekqT4WR9SJ7TzWxK3DLjvqeHu-ssLYEw==.new
- <Package Folder>/files/####/d08d88cd-1fea-481e-bcda-77d4e8ec36bd.pic.temp
- <Package Folder>/files/####/d770a39c-db87-46f4-a78f-e2c1882aa049.pic
- <Package Folder>/files/####/da24f8de-ccbe-41cd-9e9d-820cb8c1f320.pic.temp
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/iwIusriz7Wj4ihEQzBsSIfeOEeFTOh-XbKbltUJXaR8=.new
- <Package Folder>/files/####/jUPt7z19MQ_SYs8XzHSQeI-ApIV1-P-1.new
- <Package Folder>/files/####/lTdSAP8bN6lrLPXCQ6si035REl-5wkcg.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/pz6-5SC5EWPk6zMEqvUn85fQ1d55cIsu.new
- <Package Folder>/files/####/q8HQGNciaIALrtpGIVjwhUvQ6lBmffnbQokxeNnvV6s=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/tYU08VOn6l3OGdes
- <Package Folder>/files/####/u3zc3LNFvJ5aEm0BpBSkUA==.new
- <Package Folder>/files/####/vWyrIakCrIEyFgRlrYTU-w==.new
- <Package Folder>/files/####/yGmBtfs0OEFB0EORGQJ920UZf4hvtJG8VjwoK4CPKZk=.new
- <Package Folder>/files/####/zfhsAXLh6Jjp5-o5pnzR2YlTMJE=.new
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/02d36a65-37e8-4cf0-b813-5f2836301986.res
- <SD-Card>/.armsd/####/1cfd4ff4-302e-4315-b1cc-e9eccbce9e42.res
- <SD-Card>/.armsd/####/504e57ac-acc7-4093-80a5-a67d59af107b.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/917af257-7cd4-4bdc-a673-659141534324.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/tlcnz.qomcw.nbcb.nyinp/code-8249050/a2OaPdhDT1nVh930 -p tlcnz.qomcw.nbcb.nyinp -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- sh <Package Folder>/code-8249050/a2OaPdhDT1nVh930 -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
