Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.1:8088
- 6####.####.140
- a####.####.com
- l####.####.com
- mo####.####.com
- res####.####.com
Запросы HTTP GET:
- mo####.####.com/ads/pa/8/__xadsdk__remote__8.65.jar
- res####.####.com/v3/ip?key=####
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/appActive
- 1####.####.1:8088/sdkserver/v2/addSdk
- 6####.####.140/ando/v1/x/lv?app_id=####&r=####
- a####.####.com/app_logs
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__c6a321d7-2567-4053-8e36-19c34bd61842.jar
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__c6a321d7-2567-4053-8e36-19c34bd61842.jar (deleted)
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code-7954268/hATsPT9Zi17XDWAU
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_46Gd1IrsinK_eGu5Ye3wg7o1vP8=
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_46Gd1IrsinK_eGu5Ye3wg7o1vP8=-journal
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_AiWSPHqNAyHldsLPrUQxog==
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_AiWSPHqNAyHldsLPrUQxog==-journal
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_GOvw_Zq5bGFD2S5p
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_GOvw_Zq5bGFD2S5p-journal
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_TINOKA099-0=-journal
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_w9Xz7HTyIcFhKC7l57vsug==
- <Package Folder>/databases/MOV6PDgQUUuqneV48rGzDI0k2e_VobFBgsQKug==_w9Xz7HTyIcFhKC7l57vsug==-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/0DXbjQUFaOkEwbxTxKpQZA==
- <Package Folder>/files/####/0a_MzgNpxCoMqkI25-9P_Kw3mWGGgweG.new
- <Package Folder>/files/####/3TA_kP4rzFFyuGaUCjlXfT52IIk74jhiNuZtCw==.new
- <Package Folder>/files/####/4e4dvkK8mQDKtBZ1KsVnAjfXwAPJjCtDPYcydLF_SyI=.new
- <Package Folder>/files/####/4v0FKRTvdUOCMDdslonYnl3F4iI=
- <Package Folder>/files/####/5ze1P34QBw-r-8AIJRmP9A==.new
- <Package Folder>/files/####/ATtNFYbvZ0Rr_mHLMpq5unK-mIFsi_zWA0ZIT0P7iAw=.new
- <Package Folder>/files/####/FRxRGXiT-PBjlj5fTTE18g==.new
- <Package Folder>/files/####/NB5b5H1YA0FtgzY_ezVtTTyYAFQ=.new
- <Package Folder>/files/####/TdWO1f2VJ1n_gRVVonyYF0O5KRUG6zUs.new
- <Package Folder>/files/####/UvATpBVHB2njpgxldnUNWdNpvJ4=
- <Package Folder>/files/####/WpQHzFcUekZPCWdg.zip
- <Package Folder>/files/####/YQfBo8O7b0W-kdaWmIfs2HYHnFsxjlz1
- <Package Folder>/files/####/YQfBo8O7b0W-kdaWmIfs2HYHnFsxjlz1.new
- <Package Folder>/files/####/YQfBo8O7b0W-kdaWmIfs2HYHnFsxjlz1.old (deleted)
- <Package Folder>/files/####/aVCKx6XbCnDbuwPHoOEESu99ngqit_jF.new
- <Package Folder>/files/####/b43-KegmDlIYDls6s7yVHAxXQFTmEz33rJs_X-riHUk=.new
- <Package Folder>/files/####/bJJLY4hFiLudKflm
- <Package Folder>/files/####/c-ae5tFQbCSGAnAgezZQwIrw6M4=
- <Package Folder>/files/####/c-ae5tFQbCSGAnAgezZQwIrw6M4=.new
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/fN0ozEd3MYQl0P_Y0fGBiXoMF-wy8CHe.new
- <Package Folder>/files/####/gH0F1w9NDomwCJ5QdU7eAoc7-K0=.new
- <Package Folder>/files/####/guA9qTP1e3tA-6Xckh74Da1O_2ba2FP4.new
- <Package Folder>/files/####/hurbuw_f.zip
- <Package Folder>/files/####/hwhu_hygF6k1gS9kmL8GiTfLqao=.new
- <Package Folder>/files/####/iEMHSR-lBbntOqLeDusjrJuhucCKFZKLOf9hDw==.new
- <Package Folder>/files/####/o7QqwZ3hbtJ2MUbG4Bwp-M9qI01vAyml.new
- <Package Folder>/files/####/pTP8SrW8PqLgVejYMQgy8fYFWFYK_KMn3RtR4RoPGpI=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/saLrYBsgQyeonLMWW6fxZg==
- <Package Folder>/files/####/vN982ycPg0Nx6REuvqheTw==.new
- <Package Folder>/files/####/w7zjs7J7kH5pQJgH6SD64l4hycpr0e4VJ1xd6w==.new
- <Package Folder>/files/####/zy_BHmgaY5JkDSnZdJCVnyAvvrifKh5q.new
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comgithubclient.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.bwlb.xiadfc2zwb/code-7954268/hATsPT9Zi17XDWAU -p com.bwlb.xiadfc2zwb -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- sh <Package Folder>/code-7954268/hATsPT9Zi17XDWAU -p <Package> -c com.github.client.blfeug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
