Android.Packed.25395

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Triada.155.origin
Android.Triada.178
Android.Triada.178
Android.Triada.248.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.Triada.155.origin
Android.Triada.178
Android.Triada.178
Android.Triada.248.origin

Предлагает установить сторонние приложения.

Сетевая активность:

Подключается к:

1####.####.34:19000
1####.####.57:10001
a####.####.com
d####.####.com
huangda####.com
i####.####.com
l####.####.com
m####.####.cn
m####.####.com
o####.####.com
p####.####.com
s####.####.com

Запросы HTTP GET:

1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
a####.####.com/ando/i/mon?k=####&d=####
d####.####.com/get_domains/v4/?ac=####&channel=####&aid=####&app_name=##...
huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
i####.####.com/2/user/info/?iid=####&device_id=####&ac=####&channel=####...
i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
i####.####.com/article/content/lite/13/1/6445038304659800333/64450542288...
l####.####.com/feedback/2/list/?appkey=####&count=####&iid=####&device_i...
m####.####.cn/r/MV8wXzkzNzc2NTVfMjJfMTUwMDYwMjYxMg==
m####.####.com/r/MV8wXzExMDEwOTM3XzEyNThfMTUwMDU1NjkyMA==
p####.####.com/list/190x124/30f000001c800d940b6f.webp
p####.####.com/list/640x360/2ec30003c9fdc5a79a73
s####.####.com/site/download/app/pl/news_lite/118/ss_plugin_config.json?...

Запросы HTTP POST:

1####.####.34:19000/v2/chis
a####.####.com/app_logs
l####.####.com/sdk.php
o####.####.com/v2/get_update_time

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.DS_Store
/data/data/####/.imprint
/data/data/####/75beafc7d2a0b13707873746fce0cf70.0.tmp (deleted)
/data/data/####/75beafc7d2a0b13707873746fce0cf70.1.tmp (deleted)
/data/data/####/add_all_dynamic@2x.png
/data/data/####/add_all_dynamic@3x.png
/data/data/####/all_newv@2x.png
/data/data/####/all_newv@3x.png
/data/data/####/all_newv_small@2x.png
/data/data/####/all_newv_small@3x.png
/data/data/####/android.css
/data/data/####/android.js
/data/data/####/android.js.dat
/data/data/####/app_log_encrypt_switch_count.xml
/data/data/####/app_log_encrypt_switch_count.xml.bak
/data/data/####/app_setting.xml
/data/data/####/app_setting.xml.bak
/data/data/####/app_track.xml
/data/data/####/applog_stats.xml
/data/data/####/ask_card_logo@2x.png
/data/data/####/ask_card_logo@3x.png
/data/data/####/ask_logo@2x.png
/data/data/####/ask_logo@3x.png
/data/data/####/c94f0576728d5d75b5327db5d728bbb3.0
/data/data/####/c94f0576728d5d75b5327db5d728bbb3.1
/data/data/####/chatroom_arrow@2x.png
/data/data/####/chatroom_arrow@3x.png
/data/data/####/chatroom_icon_picture1@2x.png
/data/data/####/chatroom_icon_picture1@3x.png
/data/data/####/chatroom_icon_video1@2x.png
/data/data/####/chatroom_icon_video1@3x.png
/data/data/####/com.ss.spipe_setting.xml
/data/data/####/custom_channels.xml
/data/data/####/details_add_icon@2x.png
/data/data/####/details_add_icon@3x.png
/data/data/####/details_add_icon_stock@2x.png
/data/data/####/details_add_icon_stock@3x.png
/data/data/####/details_admire_icon@2x.png
/data/data/####/details_admire_icon@3x.png
/data/data/####/details_attention_icon@2x.png
/data/data/####/details_attention_icon@3x.png
/data/data/####/details_delete_icon@2x.png
/data/data/####/details_delete_icon@3x.png
/data/data/####/details_ip_icon@2x.png
/data/data/####/details_ip_icon@3x.png
/data/data/####/details_like_icon@2x.png
/data/data/####/details_like_icon@3x.png
/data/data/####/details_like_icon_press@2x.png
/data/data/####/details_like_icon_press@3x.png
/data/data/####/details_report_icon@2x.png
/data/data/####/details_report_icon@3x.png
/data/data/####/feedback.db-journal
/data/data/####/film_stars_all@3x.png
/data/data/####/finance_call.png
/data/data/####/gificon_textpage@2x.png
/data/data/####/image_bg_click.png
/data/data/####/image_bg_loading.png
/data/data/####/journal
/data/data/####/lib.js
/data/data/####/lite_article.db
/data/data/####/lite_article.db-journal
/data/data/####/lite_plugin_update_info.xml
/data/data/####/main_app_settings.xml
/data/data/####/misc_config.xml
/data/data/####/mobclick_agent_cached_com.ss.android.article.lite600
/data/data/####/mobclick_agent_online_setting_com.ss.android.article.lite.xml
/data/data/####/multi_process_config.xml
/data/data/####/multi_process_config.xml.bak
/data/data/####/musicplayer_states@3x.png
/data/data/####/picture_details@2x.png
/data/data/####/play_fullscreen@2x.png
/data/data/####/play_fullscreen@3x.png
/data/data/####/play_fullscreen_press@2x.png
/data/data/####/play_fullscreen_press@3x.png
/data/data/####/playicon_video@3x.png
/data/data/####/right_arrow_icon@2x.png
/data/data/####/right_arrow_icon@3x.png
/data/data/####/seemore_all@2x.png
/data/data/####/seemore_all@3x.png
/data/data/####/seemore_all_press@2x.png
/data/data/####/seemore_all_press@3x.png
/data/data/####/snssdk_openudid.xml
/data/data/####/sp_lite_style_config.xml
/data/data/####/spinner.png
/data/data/####/ss_app_config.xml
/data/data/####/ss_app_log.db-journal
/data/data/####/ss_location.xml
/data/data/####/ss_plugin.json
/data/data/####/ss_refresh_ad.xml
/data/data/####/ss_refresh_ad.xml.bak
/data/data/####/ss_splash_ad.xml
/data/data/####/ss_webcb.js
/data/data/####/tempimage331728624.tmp
/data/data/####/toast_keywords_refresh@2x.png
/data/data/####/toast_keywords_refresh@3x.png
/data/data/####/ugc_feed_link@2x.png
/data/data/####/ugc_feed_link@3x.png
/data/data/####/ugc_feed_video@2x.png
/data/data/####/ugc_feed_video@3x.png
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/EOZTzhVG.jar
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/code-8820954/_FJHBSCV2Ct3-BFx
<Package Folder>/databases/####/cc.db
<Package Folder>/databases/####/cc.db-journal
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_8ObC7DHhPppasL4Kz7YiUdPW2TI=
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_8ObC7DHhPppasL4Kz7YiUdPW2TI=-journal
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_BL7TF704ZWFJTiql_CPBNw==
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_BL7TF704ZWFJTiql_CPBNw==-journal
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_FpGSAHoF810=-journal
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_PNW0dvoYZRP60txQ
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_PNW0dvoYZRP60txQ-journal
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_QCk1YVgapfIEIZuXVZd4Rg==
<Package Folder>/databases/Rnf-7aKKsCb8iy2N6QbrfYJ9MdpeG602_QCk1YVgapfIEIZuXVZd4Rg==-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/0cc45b37-4871-4cbd-96c9-34d49260c5f5.pic
<Package Folder>/files/####/11539f6e-b2d0-4ae4-8cfc-a4ee63b54454.pic.temp
<Package Folder>/files/####/23ZNXBlpo3aywNrYD2NhEETabcfXutOo.new
<Package Folder>/files/####/2d6ac937-5768-4b25-a3ac-680ef054ed82.pic.temp
<Package Folder>/files/####/368d057c-6ca8-4262-a570-e3538568c0d7.pic.temp
<Package Folder>/files/####/3f345552-d765-4812-9aa7-c96dd3ea7dd2.pic.temp
<Package Folder>/files/####/4b9f1b6f-2221-48e9-bbe6-cb5fe6b144ff.pic.temp
<Package Folder>/files/####/4ud324Pm8crEcJEryXG2e4o2WS6RmfH8.new
<Package Folder>/files/####/50d91128-f0ab-483a-990e-8fca549b2abd.pic.temp
<Package Folder>/files/####/5494QrPPVr6oj9fzWJ9n-o0xw1c=.new
<Package Folder>/files/####/5524fca6-7dbd-498c-919d-2674a8af58e8.pic.temp
<Package Folder>/files/####/5DEwnhAbybVjKnNf1Uz4t0URrdm6FvrZ.new
<Package Folder>/files/####/65999a78-f661-48dd-a29c-c975fb4c1dc8.pic
<Package Folder>/files/####/65c1464e-958c-4861-a558-a8d2c42b907c.pic.temp
<Package Folder>/files/####/65fc7d61-6659-4be0-b112-11456aa73b21.pic.temp
<Package Folder>/files/####/6tv_ndap9wmEY6T1zFsACOzwogfOpCp1.new
<Package Folder>/files/####/77u3Ls3PwCKNQEy2.zip
<Package Folder>/files/####/82b6e9b9-c5a8-44d1-801c-971116f96641.pic.temp
<Package Folder>/files/####/8YO4rI1rklioLR2lgKIaWyF0f_ItlLOa.new
<Package Folder>/files/####/94fQPmVBHL0QsSsBMVQlAAAyrYI=
<Package Folder>/files/####/Exw9dJBkHIT9VrFIhoSLwqu7xy8=.new
<Package Folder>/files/####/F_XreFljJsTOzssB3plLETcLn74YMVYTIULwr4hNLoE=.new
<Package Folder>/files/####/JpLIFiSxcXckjRWy
<Package Folder>/files/####/N1cySz7LpduccLRV0DkuF2kiXk8Jc8jT.new
<Package Folder>/files/####/Q3fYV_Urnbs5i6oI.new
<Package Folder>/files/####/RLds7P8NlWzhHyxPdTWpHJCgNFhiZeB2Jh_krSsYeRA=.new
<Package Folder>/files/####/WWvGkf2PDYs7mUrPqmRwvKCMAaVzGCK10patfIofxCo=.new
<Package Folder>/files/####/Yts3czt-ONVl_-rB1UwMyFCYTILdET-uJ0Upzg==.new
<Package Folder>/files/####/a8374a3f-9c91-4142-8380-4009fc38f813.pic.temp
<Package Folder>/files/####/b82a2111-6bf2-46be-85d0-2afac7973c7d.pic.temp
<Package Folder>/files/####/bBtwsAaVg3lAQ5GGjpXkCA==
<Package Folder>/files/####/bBtwsAaVg3lAQ5GGjpXkCA==.new
<Package Folder>/files/####/bacd3f39-b5bf-4ca8-9c60-0b9dacfbae94.pic.temp
<Package Folder>/files/####/bbd42c6e-1b28-4680-9285-917cfcac41e8.pic.temp
<Package Folder>/files/####/c318bffe-6525-4739-9cc1-db528aaaf152.pic.temp
<Package Folder>/files/####/ceb98580-cb3d-4121-bdb7-16cc8ec73741.pic.temp
<Package Folder>/files/####/data.dat.tmp
<Package Folder>/files/####/e09044f8-1223-4df0-9825-68293bf2d2b8.pic.temp
<Package Folder>/files/####/e49f8fd1-b984-4fa8-97f5-36b0ac9dff2c.pic.temp
<Package Folder>/files/####/e55dae75-f2a9-496a-b5ab-b8538c64f818.pic.temp
<Package Folder>/files/####/e6e6dbf9-1f78-4d6f-b63d-383098f4b558.pic.temp
<Package Folder>/files/####/f81c68e7-6afc-49c1-9b4b-1c74cd6c6649.pic
<Package Folder>/files/####/fIHNQnjyY9rpsay79QK2T9xV5YR3xc2z.new
<Package Folder>/files/####/fTTUszPmTU2ECSVVWVW8dl9m5zo=
<Package Folder>/files/####/j49HXaGckS4ABqCRA_LplbqQiROTEL153QZakw==.new
<Package Folder>/files/####/j6XglYqD3RaNWpAZ10g5tYafFLI=.new
<Package Folder>/files/####/k6z8GGCMVuaHrSbytYaa6ThEDuB86_amKAGDyg==.new
<Package Folder>/files/####/libus.so
<Package Folder>/files/####/mBpsxnb3AzR-v7lVVUWjuQ==
<Package Folder>/files/####/mBpsxnb3AzR-v7lVVUWjuQ==.new
<Package Folder>/files/####/qeQcOqtuHd14HZFDsDB1PgGKf0gW_Pq1.new
<Package Folder>/files/####/qfExEtvSYUMWaWGA7d16yQ==
<Package Folder>/files/####/runner_info.prop.new
<Package Folder>/files/####/sbcnua_f.zip
<Package Folder>/files/####/srdFDP1L5dt82FGTQbebbj4qdHE=.new
<Package Folder>/files/####/tihlzACWAao3vIZxMLYyZxh2vjEzxlapAeSG8vdG_6s=.new
<Package Folder>/files/####/vXakj36jOLWv8hSzKUFe-w==
<Package Folder>/files/####/vXakj36jOLWv8hSzKUFe-w==.new
<Package Folder>/files/mobclick_agent_cached_<Package>305
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/twj.xml
<Package Folder>/shared_prefs/twj.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.armsd/####/18c1bda1-d1cb-4c1d-99e4-24b5fc7d1d7b.res
<SD-Card>/.armsd/####/44f87546-4e24-441c-b531-eb583b95d268.res
<SD-Card>/.armsd/####/4cab8427-f2cc-4222-af9b-0a46712012df.res
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
<SD-Card>/.armsd/####/63e8a4e9-2525-4a81-b903-f177bc0572e6.res
<SD-Card>/.armsd/####/7d1dc329-d845-4e70-ac42-221ee82c8588.res
<SD-Card>/.armsd/####/93a81ce3-b2b4-464a-aec6-31a939f3a724.res
<SD-Card>/.armsd/####/9a33eb80-cbd6-400b-a51a-ac7129eb23ee.res
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
<SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
<SD-Card>/.armsd/####/aaab4384-6aff-4c16-9752-6fef2980c34e.res
<SD-Card>/.armsd/####/adb76491-24ee-4809-a84d-c4c9974d399a.res
<SD-Card>/.armsd/####/ae34d0dc-672f-4cfa-b26c-e0bf7eb0170b.res
<SD-Card>/.armsd/####/c36d3a22-520c-44ba-a1b4-86301f8a3a67.res
<SD-Card>/.armsd/####/c4373e8f-8286-48fc-967e-d3bd96947493.res
<SD-Card>/.armsd/####/d0ffd5f4-50e5-4ee7-8267-fdd3203f7354.res
<SD-Card>/.armsd/####/e1a4c364-f581-4d8c-8a9a-b6cb0f7f8970.res
<SD-Card>/.armsd/####/f6ae661e-74cc-4a38-82e7-119c4f614772.res
<SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
<SD-Card>/.env/.uunique.new
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/qshp_3002_2206.zip
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/020147c41e9fff14b6f1cdbc0c8f00aa.0
<SD-Card>/Android/####/80a592dad15f4f43373072ba02cb1ea6.0
<SD-Card>/Android/####/ca3c9a53a38c11d7344a90fb83398d37.0
<SD-Card>/Android/####/clientudid.dat
<SD-Card>/Android/####/device_id.dat
<SD-Card>/Android/####/e8ef64bcf4b3cc840a479f55aed524f2.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/Android/####/openudid.dat
<SD-Card>/Android/####/serial_number.dat
<SD-Card>/Android/####/sim_serial_number.dat
<SD-Card>/Android/####/udid.dat
<SD-Card>/Download/####/OZzbECpmnE9y6Ps4WPd0_CiiHgT00jb3tU7ORXVQ89sWQJYK-Qg061-k7a-CgBa8aJuSWal4zzBJ_KcM-dKSYmt35CBrotW-kmKKOFOGFVg1Y34WP2Bp2BjJK00_lCZ_.temp
<SD-Card>/Download/channel_conf
<SD-Card>/Download/channel_conf1
<SD-Card>/bytedance/clientudid.dat
<SD-Card>/bytedance/device_id.dat
<SD-Card>/bytedance/openudid.dat
<SD-Card>/bytedance/serial_number.dat
<SD-Card>/bytedance/sim_serial_number.dat
<SD-Card>/bytedance/udid.dat

Другие:

Запускает следующие shell-скрипты:

/data/data/bpwqil.evdxtcb.kyy.xwtxep/code-8820954/_FJHBSCV2Ct3-BFx -p bpwqil.evdxtcb.kyy.xwtxep -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
<dexopt>
getprop persist.vivo.multiwindow
getprop persist.vivo.multiwindow_active
getprop ro.build.version.emui
sh <Package Folder>/code-8820954/_FJHBSCV2Ct3-BFx -p <Package> -c com.hoxq.lpve.uwisuq.a.a.c.b -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней