Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- 1####.####.57:10001
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.com/ando-res/ads/0/9/837ec120-ccf8-4ad0-b6fd-1303ff645eca/773...
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.dex (deleted)
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-8925766/j6Rb9kHYaeGXe8vh
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_-vXg97jH6HuGZH7e6c6fZxEmmCU=
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_-vXg97jH6HuGZH7e6c6fZxEmmCU=-journal
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_8Z56WXdWU2M=-journal
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_DTnLdF1QmvT_eI11
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_DTnLdF1QmvT_eI11-journal
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_RONP-fXLPGj-1nVVSVF7sQ==
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_RONP-fXLPGj-1nVVSVF7sQ==-journal
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_ac4vEvH6YP9tXuNxjy670w==
- <Package Folder>/databases/kKWySHsqZbT2Nep_dkiTD_Myq33cOAvk_ac4vEvH6YP9tXuNxjy670w==-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/1591fc5f-e306-4c51-9810-c8fe9784fc86.pic
- <Package Folder>/files/####/22e86172-267e-4fdc-a968-8dc112a26a41.pic.temp
- <Package Folder>/files/####/36r0-3XFjnw7S2jghDZ6qPfBDfkfcFta_KHdwQ==.new
- <Package Folder>/files/####/4zVEXLDLsxOLVsEMrv3CNOvjYxM=
- <Package Folder>/files/####/5SysSyCzJMbFedoTnpMyWJVx44XCKo40B5tElw==.new
- <Package Folder>/files/####/5be3a1fd-c536-4b44-8d6f-b958cd0daaa6.pic
- <Package Folder>/files/####/6d50ayVfUad4x_Bd9uMmyuBp0wmuKqaj.new
- <Package Folder>/files/####/7ebe53ca-9ab9-4eb8-a06b-00ddfbda9976.pic.temp
- <Package Folder>/files/####/8GMfz3uNEtZIhpf4TokUJS1CG1qoNOLL1_qIniLsk9c=.new
- <Package Folder>/files/####/8c2581e3-46ca-44fa-9cc5-3f8e03ce36d1.pic.temp
- <Package Folder>/files/####/8gYfMVtyhRABiKt9Qhj-nA==
- <Package Folder>/files/####/8gYfMVtyhRABiKt9Qhj-nA==.new
- <Package Folder>/files/####/HaVd9wbEHFrYd0Od0XsovA==
- <Package Folder>/files/####/HaVd9wbEHFrYd0Od0XsovA==.new
- <Package Folder>/files/####/L57_jKU0tyWN0z6NvLMXjGcYK-O87Ul_.new
- <Package Folder>/files/####/Mvrz9SxjOwM2HTGDaYiknGmZ4FgRjL05.new
- <Package Folder>/files/####/OhSbH0OR2-JJOCF3Aqau0SBt8nMEk66uW5B8ZA==.new
- <Package Folder>/files/####/PPO46bp4j7HPd2RyeImSZuaJWiPpQ6J4.new
- <Package Folder>/files/####/QsM_XgSgPILVMZVl4sp1NA==
- <Package Folder>/files/####/QsM_XgSgPILVMZVl4sp1NA==.new
- <Package Folder>/files/####/R3G6osYXbmWX_w6rnZhMGyap0xInl0Q3.new
- <Package Folder>/files/####/WwCyk42ZWl6AVIlahiL54kVx13w=.new
- <Package Folder>/files/####/Z2n2TjBzsvRyCZg-aBsA_XipptqcE9pRre-pyJqmXFY=.new
- <Package Folder>/files/####/akF2yOxEKmInPUAn4LRv80MH1DAsJLMB
- <Package Folder>/files/####/akF2yOxEKmInPUAn4LRv80MH1DAsJLMB.new
- <Package Folder>/files/####/b0b8dbef-b590-49a8-82b3-62c7dac94b2d.pic.temp
- <Package Folder>/files/####/bnd6UUwDLfgwO8Q0p1IpjVFvRRObHI4b.new
- <Package Folder>/files/####/brl5RRKy8_jlqWCD
- <Package Folder>/files/####/cb983412-cfe7-4125-b14e-6171f687adf2.pic.temp
- <Package Folder>/files/####/cpfpXVQBFOI2Hc9F_7G9mDZ-ZQpdVQFYQOCC-l-BGHA=.new
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/df67b53d-a37d-4818-b72d-0a2d99e89b0d.pic.temp
- <Package Folder>/files/####/fTTLWT2sUqekMviR.zip
- <Package Folder>/files/####/hXTRwSWRg5MfVxNkxLe2mQ==
- <Package Folder>/files/####/inII2po_iYuFCP5E6dNWkiq53gd_N-Zq.new
- <Package Folder>/files/####/kAK1h5qrP_ZXx2wdSmeP31PMspYDADpPS8IhWoEUl0w=.new
- <Package Folder>/files/####/kxl_9WuNtuYmoGwQ7wSAZsuYV2Q=.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/m6cMAisOurEvYYsI3iApLa2eGL4=
- <Package Folder>/files/####/qzrGcw_p0gzFVDJq.new
- <Package Folder>/files/####/rtAJwi5NMhEk1X0W0ymRLdDf1-U=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/wWCmbw8u9bETmL6zFInupZ--x7M=.new
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/1305c986-f9b0-413f-a97e-7fb7ac190bda.res
- <SD-Card>/.armsd/####/1f98a624-7ea9-407c-92b7-cd004ae46b8d.res
- <SD-Card>/.armsd/####/4040233d-05a7-4988-bb8d-1161bc9870f2.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/f3be344e-84c1-4fca-b555-735d37f7447f.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/bbtyniz.mbjqi.efryoamn.ecrxcr/code-8925766/j6Rb9kHYaeGXe8vh -p bbtyniz.mbjqi.efryoamn.ecrxcr -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- sh <Package Folder>/code-8925766/j6Rb9kHYaeGXe8vh -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
