Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- 1####.####.57:10001
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/27/1/a35bc83b-9bc9-40ec-ba09-35ad6fe13d58/5e...
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-5225608/9RiKx5Xinj5j-zyr
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_2mH9TvAbF9lkpC9uT0H3Sg==
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_2mH9TvAbF9lkpC9uT0H3Sg==-journal
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_ItCYOTQR9CU=-journal
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_aiFeu4MP56gXfgOagOENeg==
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_aiFeu4MP56gXfgOagOENeg==-journal
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_prw37Hbpqk_y6FKj
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_prw37Hbpqk_y6FKj-journal
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_u0nu-_m-sN8Ky-96wI4HgyBEUgA=
- <Package Folder>/databases/N79BzmY2TMTeO5id_k8XODTF0JlaI8RE_u0nu-_m-sN8Ky-96wI4HgyBEUgA=-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/-dksCqP3Otey8WAAVMPvgUheA6Y=
- <Package Folder>/files/####/10ff63f1-001e-4b01-9087-eddca1324f9a.pic.temp
- <Package Folder>/files/####/13ac990c-0093-441e-8173-bd6c5fba26e8.pic.temp
- <Package Folder>/files/####/2_hL-bD0E85jwHV064ESCgXWEDebXkUz
- <Package Folder>/files/####/2_hL-bD0E85jwHV064ESCgXWEDebXkUz.new
- <Package Folder>/files/####/2_hL-bD0E85jwHV064ESCgXWEDebXkUz.old (deleted)
- <Package Folder>/files/####/65ec9c61-4bab-4a0b-b3d4-9d7fee0d34b7.pic.temp
- <Package Folder>/files/####/68a044d4-4259-4c48-99d3-11ad200d1002.pic.temp
- <Package Folder>/files/####/7VDZk0koZseosDMB.zip
- <Package Folder>/files/####/8HUpI93LJNuQuOby2AggU0S1zvf73TCk.new
- <Package Folder>/files/####/8e11f105-38ef-4173-9879-5502cf036adf.pic.temp
- <Package Folder>/files/####/960527eb-23f8-4e4a-bbe0-acba49da92c7.pic.temp
- <Package Folder>/files/####/9fdb022a-d27f-4917-8dd1-fc050087ca41.pic
- <Package Folder>/files/####/A_k7ubGMsrJUsxyX9tnBZsvSasgTQx9wrV9t9Q==.new
- <Package Folder>/files/####/Ff9XJU7RcuIwDCu1W5hY3N_7d5gC6BrX.new
- <Package Folder>/files/####/GsHGttjIduSKwPsU4dbIXw==
- <Package Folder>/files/####/GsHGttjIduSKwPsU4dbIXw==.new
- <Package Folder>/files/####/IIQgpNkOulb4Y6dLStreeg==
- <Package Folder>/files/####/IIQgpNkOulb4Y6dLStreeg==.new
- <Package Folder>/files/####/JfItwa0QI6QSj950
- <Package Folder>/files/####/MB_wEiF1YFscGkckyS-W2e6ywqvf7aU5.new
- <Package Folder>/files/####/SNrU_sjxFiGAFUTn.new
- <Package Folder>/files/####/XB9rWoZ417Mv7HWKn4KSxIthM3-oB1Y6jM_ndzG5hWM=.new
- <Package Folder>/files/####/_KEn8MHMCtTNWulU4zLkK83PnLLs4Jyo.new
- <Package Folder>/files/####/_TLM_HgC6ZlEvAnEFKOhD9Jc89-8qcVL.new
- <Package Folder>/files/####/_fH_l5rL76S9Cx7wcJ8DHB_UCqZ9ofACa4CTPQ==.new
- <Package Folder>/files/####/c45bbcb8-ced0-499c-b327-c06a9e50fc08.pic
- <Package Folder>/files/####/d4JgeaVEmLBRk7hZjkdWM7mtt17R5cqzr_7yM5N3fjc=.new
- <Package Folder>/files/####/dBJbMwNJm7bdbirOR2jIQ5_yjc5_tIzxhjzVNPWl0u0=.new
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/do9z2jE1XgNuWf4iwMqpmPuiVcw=.new
- <Package Folder>/files/####/fwHpnncI89Nsauifd6EXb1kWIxeLWy6h.new
- <Package Folder>/files/####/gjlnKqWyJ92t2ITwfkD-vDQZfJY=.new
- <Package Folder>/files/####/gn_y8CNwL0KA00m9SXlJGUnOWUjpZtRRr1nlxAM4Rng=.new
- <Package Folder>/files/####/iTlSEnwsMjeoeaLzSwFnnddVC04=
- <Package Folder>/files/####/itBiiYKWtQTmlGLl3pSneA-ITg4=.new
- <Package Folder>/files/####/jylax5hzXATfWvBTT7X42p9l77Dv2xP6XdRCTQ==.new
- <Package Folder>/files/####/kiN2uT3xLI7rkacLPgL75Q==
- <Package Folder>/files/####/kiN2uT3xLI7rkacLPgL75Q==.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/w5sj-9XoPI1eJe8DMoO-gQ==
- <Package Folder>/files/####/xRxsGL0ouaf9nocpI8BfSVc1kwvhdNnd.new
- <Package Folder>/files/####/yq_XVsmskJbqXCZxa2xBDJ1rI2o=.new
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/45a02e8d-81e8-44b1-b29c-8961e81f2e0f.res
- <SD-Card>/.armsd/####/52599270-ef57-4c82-899c-d1eb7d08fc96.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/7762b3ce-e5de-48fe-8126-d3a878acaa39.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/e9c44f9f-edd1-4ce4-9e90-6aae2f88ff53.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/xeywavpj.jpxn.zizq.bpznw/code-5225608/9RiKx5Xinj5j-zyr -p xeywavpj.jpxn.zizq.bpznw -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- sh <Package Folder>/code-5225608/9RiKx5Xinj5j-zyr -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
