Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.155.origin
- Android.Triada.178
- Android.Triada.178
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- 1####.####.57:10001
- a####.####.com
- huangda####.com
- i####.####.com
- l####.####.com
Запросы HTTP GET:
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- a####.####.com/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/3/2/eff3c843-7d88-43f5-8d7e-c94c4a29226a/e1c...
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-3924405/4DHwIuAFHScPN8Ib
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_TDIWU8KYls8=-journal
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_hu9xQDDMON7gWY6-YCfz5Q==
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_hu9xQDDMON7gWY6-YCfz5Q==-journal
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_k0xz0BdwYKpNREk9Np-wiKkUPLc=
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_k0xz0BdwYKpNREk9Np-wiKkUPLc=-journal
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_pqFdLtImKAtI6HZ9nrD9zQ==
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_pqFdLtImKAtI6HZ9nrD9zQ==-journal
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_uANhp3RNZgKYvtOm
- <Package Folder>/databases/Txz0d6i5IJ6JpPk5HfA0zh0lurBO6qRU_uANhp3RNZgKYvtOm-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/1TykJDA_W3aPcN81hmEUEJmlIVY=.new
- <Package Folder>/files/####/3f725551-82a4-4a14-b416-df1efad0a8ad.pic.temp
- <Package Folder>/files/####/6a90262e-e91d-425f-adb7-229cbf123abb.pic
- <Package Folder>/files/####/6ca9d9aa-bca4-4cdc-9b2e-225b41d39c27.pic.temp
- <Package Folder>/files/####/8116ab04-48c3-4c4f-a7b1-9d4e99ee4f20.pic
- <Package Folder>/files/####/8vFTTzmqlzyNYAIGnnsrQh0N9kl9fD8Z.new
- <Package Folder>/files/####/923e323f-2ab7-450c-a552-692368a31ddb.pic.temp
- <Package Folder>/files/####/C6247_RosluJmXuvloJ01Q==
- <Package Folder>/files/####/C6247_RosluJmXuvloJ01Q==.new
- <Package Folder>/files/####/F0JC-MQna1WlO5MwMON8HEWlDuTsVdms.new
- <Package Folder>/files/####/FqYxka56K8GwJzAsuoHqF9KOXIM_UulV.new
- <Package Folder>/files/####/JVEkRNelwXepdf9p-twNgG8SGbJX4XiS.new
- <Package Folder>/files/####/KipyzEXhAarsMu3s-o_lvA4vNV4xWG3y.new
- <Package Folder>/files/####/Pj_6kP3rC_c_yWOloxnkXrsCjUbmztts_2dtQEP8CdI=.new
- <Package Folder>/files/####/RZhxa3PQw9fsFaDb6ATFZ-bmsCA=.new
- <Package Folder>/files/####/Rqud2b39_FuGMax-Nn-jz_ZXjnKRYHTA.new
- <Package Folder>/files/####/SkjjsRINRfMv_8aOg2oXWJQ3NgmatHyY.new
- <Package Folder>/files/####/UJ-UgGAeuhfAiUxv
- <Package Folder>/files/####/UaOUeDI1GH3i5P-MhrJegODJKR8=.new
- <Package Folder>/files/####/VhFBx9QyahEi9GyMnWNSqzNf12DUFtNCT1yx1Q==.new
- <Package Folder>/files/####/YAwuJQyvmi4xiS4OnblPg9NcoDk=.new
- <Package Folder>/files/####/YHAgkeGRCwi6Ft_ebPPAsvAQ8dWsMxUY.new
- <Package Folder>/files/####/Z7gC8yPbqlGS4ndz.zip
- <Package Folder>/files/####/_ES4SUWm7cmpUOLMRyyt49ukQh8=
- <Package Folder>/files/####/a2d1a256-7c96-4398-8e32-540ed82e1a70.pic.temp
- <Package Folder>/files/####/acb2487f-f930-47bc-a4d0-67dc7317c535.pic.temp
- <Package Folder>/files/####/b31be5f9-c0e8-4589-a081-d22448ff7ce8.pic.temp
- <Package Folder>/files/####/bSGXTqRNRNmeEPXZ
- <Package Folder>/files/####/bSGXTqRNRNmeEPXZ.new
- <Package Folder>/files/####/dCcjtlbRpkDGQT-sPYb0v5NvMVQvsZB1ItLmgrNrCwQ=.new
- <Package Folder>/files/####/data.dat.tmp
- <Package Folder>/files/####/fP-IxIURqgpQCe0xv37v3Rim7Qra12oLAUn4_g==.new
- <Package Folder>/files/####/g_0X6sxuDwirJRugJPZEtQ==
- <Package Folder>/files/####/g_0X6sxuDwirJRugJPZEtQ==.new
- <Package Folder>/files/####/gjCSEOaQPnGJhNdrqINaYYk20tNy8TkyHOB4-Xm22UE=.new
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/qYHk_J9leMuL1t41aWlYWkcVqoWQ5jrskedIZOCsVUY=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sbcnua_f.zip
- <Package Folder>/files/####/v3ownr9ngisFSt37no03cQ==
- <Package Folder>/files/####/wXDxrY27mzXXcJXsGv3QMg==.new
- <Package Folder>/files/####/xaOcAGzQNdItUcQVauspx3VKRJhV-YKm7wU4YQ==.new
- <Package Folder>/files/####/ySzuP7IBqs61i5lFPPUMbFwItTE=
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/5405fdbb-2de0-470c-87e0-adc9bb077223.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/67d004ae-14b3-4b3f-899d-1f4ed50946e0.res
- <SD-Card>/.armsd/####/9877dc6e-cf46-41f7-bb61-f68f8accad3c.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/e3470bae-8dc7-48c3-9867-f08d1c0536ce.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3002_2206.zip
- <SD-Card>/Download/channel_conf
- <SD-Card>/Download/channel_conf1
Другие:
Запускает следующие shell-скрипты:
- /data/data/zbmavllb.cyuedx.xlmoehm.hvq/code-3924405/4DHwIuAFHScPN8Ib -p zbmavllb.cyuedx.xlmoehm.hvq -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- sh <Package Folder>/code-3924405/4DHwIuAFHScPN8Ib -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
