Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- 1####.####.57:10001
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/27/1/a35bc83b-9bc9-40ec-ba09-35ad6fe13d58/5e...
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-2432790/Wk3gii9Lbss4eah-
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_1gBMhuukJa4=-journal
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_2fGA59aCDoygJKuU
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_2fGA59aCDoygJKuU-journal
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_99_ER9hgFEe9PBYAOPpRAmpYPh8=
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_99_ER9hgFEe9PBYAOPpRAmpYPh8=-journal
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_LSlxQTxHo88TF3BoX0B3mg==
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_LSlxQTxHo88TF3BoX0B3mg==-journal
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_qv07tuzCyW7pEb6yNqcQRw==
- <Package Folder>/databases/ge-OZClb107Bepno5ybRP1S-j11yvpPt_qv07tuzCyW7pEb6yNqcQRw==-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/1IvJMmDaBdRhhMa-MhQ18bEWEUtN2w_t.new
- <Package Folder>/files/####/4f2a4445-b879-4b81-b5f5-296194374e68.pic.temp
- <Package Folder>/files/####/5Q-ZiLqVm2UK0GZ0-ZLg9tDtaUw=
- <Package Folder>/files/####/5Q-ZiLqVm2UK0GZ0-ZLg9tDtaUw=.new
- <Package Folder>/files/####/71f4d1c8-40c9-4139-a8c8-983c63d9d5d5.pic
- <Package Folder>/files/####/78e95f3d-5cce-422c-8174-c6c08de649d0.pic.temp
- <Package Folder>/files/####/7c2fba39-1c8d-488c-8ce7-9929b4f42c78.pic
- <Package Folder>/files/####/8E0eUoScR4--MZ0KY9XaqdO94qPnnEeunHb9kID7zUY=.new
- <Package Folder>/files/####/906c0d7b-2e1f-4e77-a9dd-82e1a7accd68.pic.temp
- <Package Folder>/files/####/9eda1f03-fba1-4c9f-af8b-2f7b9d37873c.pic.temp
- <Package Folder>/files/####/AOnWF5jAsJt_IQAhax12GlEpaZo=
- <Package Folder>/files/####/E9OH9c6iKfVqBKbY6YwmPehOFZbu2oI8.new
- <Package Folder>/files/####/EuFp8PAj_4-24LQgi5eyovcjnxCY1_p8.new
- <Package Folder>/files/####/H9EhE4zZZvcxxYMa9reu1BM5c7pD9nYci68W3x9wmWw=.new
- <Package Folder>/files/####/Hy0WVFUkrGgDvt4ODpPV_BlzlWgfLBy_CIVupg==.new
- <Package Folder>/files/####/K47TZvJ0xrtbIVR31_yHIBC0ouM=.new
- <Package Folder>/files/####/LxJDWQ119q1CRyT13UTGtc2LHB0=
- <Package Folder>/files/####/QulTHP1SWPDyg6ZUwd615g==.new
- <Package Folder>/files/####/UjXkvo6I5SngW0Pc.zip
- <Package Folder>/files/####/VJMXv_WLHapcMRmK
- <Package Folder>/files/####/WGJU1cyzfEZTcxEuzqIjRw==
- <Package Folder>/files/####/WGJU1cyzfEZTcxEuzqIjRw==.new
- <Package Folder>/files/####/Wba2BW8rfe2TT5iG-UlRfTE7b3N_qsQg.new
- <Package Folder>/files/####/X198PQu9k9nLZi7SJneh5OsfPE8=.new
- <Package Folder>/files/####/ZScGmSfBE-ukaj7ZAbM83gQM1ZKpCE0gygkGeYbWCw8=.new
- <Package Folder>/files/####/_VWI23Njs60Fxszk3LxY7jiNpZI=.new
- <Package Folder>/files/####/dEkTxKPUVFYKZt8Q7tFaQmDHzG5COqBl.new
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/dee7249d-f3b4-49e7-8f8b-7f996c84c2d5.pic.temp
- <Package Folder>/files/####/f6f39b19-73c1-46e7-b2ca-4ddf6f3d11be.pic.temp
- <Package Folder>/files/####/iNaH8rZ4prDa6P3bOE87duG4T7HEHzMK.new
- <Package Folder>/files/####/kH3IOSw6oAIWWiVS.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/oa-b7trnqGAek5vT32P7ZqcgMg-mHGhn
- <Package Folder>/files/####/oa-b7trnqGAek5vT32P7ZqcgMg-mHGhn.new
- <Package Folder>/files/####/oa-b7trnqGAek5vT32P7ZqcgMg-mHGhn.old (deleted)
- <Package Folder>/files/####/pguAYyHg-lS_KucKH0V-dFF2frlGCyxNyrpnDA==.new
- <Package Folder>/files/####/qppNUO0dna2Qrn95LmvPXQ==
- <Package Folder>/files/####/qppNUO0dna2Qrn95LmvPXQ==.new
- <Package Folder>/files/####/rcrF7Kplp5IkT6UkkIisGCbzBGBZr08yzfMXBg==.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/vnaasc6oTiHLISTolZ8JWFl6uSZfjNjMpWeFAzNoScI=.new
- <Package Folder>/files/####/wEVMEtzzgiy-4enz1WR1vronuVRd2Nv_.new
- <Package Folder>/files/####/zLglnZoKUUnE5JqmVwNGtg==
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/twj.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/00d48651-698b-4ebc-82a1-a34206ebfa9b.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/6e3fa6f8-f15a-4405-a4f3-eb442c7803b0.res
- <SD-Card>/.armsd/####/84c29177-84e1-4d09-87ad-27bbc4767e91.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/dcdef81b-0444-4248-8492-0eaa8c3d10d6.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/mixoqm.aidofox.rrd.nhyjnpr/code-2432790/Wk3gii9Lbss4eah- -p mixoqm.aidofox.rrd.nhyjnpr -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- <error:2>
- sh <Package Folder>/code-2432790/Wk3gii9Lbss4eah- -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
