Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- a####.####.com
- d####.####.com
- e####.####.com
- h####.####.com
- i####.####.com
- k####.####.com
- m####.####.com
Запросы HTTP GET:
- a####.####.com/adnativeindex/?req=####&version=####&mtj_cuid=####&mtj_ti...
- d####.####.com/f/3z6w.png
- e####.####.com/video/pic/item/b3119313b07eca80e70cd74a9b2397dda1448316.jpg
- k####.####.com/f/3z6z.jpg
Запросы HTTP POST:
- h####.####.com/app.gif
- i####.####.com/r?qt=####&ap=####&os=####&ak=####
- m####.####.com/open/iasdk?cuid=####&cua=####&cut=####&sdfrom=####&lcid=#...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/E_ID<IMEI>.db
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/bdplayer_database-journal
- <Package Folder>/databases/db_d.db
- <Package Folder>/databases/db_d.db-journal
- <Package Folder>/files/14962152833540.jar
- <Package Folder>/files/14962152839429.jar
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/md5.tmp
- <Package Folder>/files/splash.tmp
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/application.xml
- <Package Folder>/shared_prefs/bdvideo.xml
- <Package Folder>/shared_prefs/bdvideo.xml.bak
- <Package Folder>/shared_prefs/bids.xml
- <Package Folder>/shared_prefs/coni_io_<IMEI>.xml
- <Package Folder>/shared_prefs/coni_io_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fac_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_finfo_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak (deleted)
- <Package Folder>/shared_prefs/iac_io_<IMEI>.xml
- <Package Folder>/shared_prefs/iappInfo_io_<IMEI>.xml
- <Package Folder>/shared_prefs/iappInfo_io_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/iinfo_io_<IMEI>.xml
- <Package Folder>/shared_prefs/itrategy_io_<IMEI>.xml
- <Package Folder>/shared_prefs/pst.xml
- <SD-Card>/Download/####/3z6w.png.dat
- <SD-Card>/Download/####/3z6z.jpg.dat
- <SD-Card>/Download/####/g_3zds.apk.tmp
- <SD-Card>/baidu/####/.nomedia
- <SD-Card>/baidu/####/2i5nyr81u7ullj64f2qdm1sh7
- <SD-Card>/baidu/####/40ceynymu7s9tepkqhvjkxe3b
- <SD-Card>/baidu/####/4h5nwi58eb6gvkm4npiy5xczf
- <SD-Card>/baidu/####/4l60r3be9vnz2uum4ukhpmc45
- <SD-Card>/baidu/####/5qgut1b5m9pflwmxdxszqmgtx
- <SD-Card>/baidu/####/5trhsxbafbuw256j67mnehc2e
- <SD-Card>/baidu/####/5vayy2hn5vs2mjl24ta6bq8h5
- <SD-Card>/baidu/####/6c0ep5d22r1rysrfmkxowi40r
- <SD-Card>/baidu/####/6g8goz3jaajniccggttuwibr4
- <SD-Card>/baidu/####/6y1kg56de04pvq7po5a8vu26
- <SD-Card>/baidu/.cuid
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- mount
