Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- a####.####.com
- danji-s####.####.cn:7780
- gam####.####.com
- h####.####.com
- i####.####.com
- l####.####.com
- wap####.####.com
Запросы HTTP GET:
- i####.####.com/mgame/pref/game-prefecture/9632378.png
- wap####.####.com/static/appsapi/conf/config.txt?tpl=####&app_version=###...
Запросы HTTP POST:
- 6####.####.140/ando/v1/x/ap?app_id=####&r=####
- a####.####.com/app_logs
- danji-s####.####.cn:7780/danjiservice/getSplashAdV301
- gam####.####.com/standalone/gameVersionUpdate
- h####.####.com/app.gif
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/code-7050739/2i52T8U8u1ol5uT0
- <Package Folder>/database/pushinfo.db
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_6VW9c-gikSU8ufkfEN6fPQ==
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_6VW9c-gikSU8ufkfEN6fPQ==-journal
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_GN2nfeOGX-xflZu2Seu6K9ctmyw=
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_GN2nfeOGX-xflZu2Seu6K9ctmyw=-journal
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_dNO3WHndmjg=-journal
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_qhcoxY-Hwslut_YU
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_qhcoxY-Hwslut_YU-journal
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_wFNc4jImfqy3QicWu7O0bQ==
- <Package Folder>/databases/G1WawKzKiYHv-ZZ5Yy0DTa2kqSZOlur5GZgTDg==_wFNc4jImfqy3QicWu7O0bQ==-journal
- <Package Folder>/databases/dk_thirdpay.db
- <Package Folder>/databases/dk_thirdpay.db-journal
- <Package Folder>/databases/gp_app.db-journal
- <Package Folder>/files/####/-4G-YQ4dO09GD4WGvtFbzA==.new
- <Package Folder>/files/####/1rTPIQH1cI-H0iJI2xSHGzavWrlhHtOt.new
- <Package Folder>/files/####/1zRVzJCCFYqbuY_atl2JpdVlFVUmcjBx.new
- <Package Folder>/files/####/3l1FN7z59danFIiXRsJX-63eiNFC00z0NoNTCfDvZl0=.new
- <Package Folder>/files/####/53-ft-lNTxwhRpTw4CZicbtTqiw=
- <Package Folder>/files/####/6JxcFmvlzgssJIOwfqJMrXswJKIxb9M6
- <Package Folder>/files/####/6JxcFmvlzgssJIOwfqJMrXswJKIxb9M6.new
- <Package Folder>/files/####/8KATmRM-Ch4CG3Yeo8mVv7nuVBnC3sxiDOnfdw==.new
- <Package Folder>/files/####/8v5d0mSofMHQTYhrOrO1Um5v8vYtQ2hc.new
- <Package Folder>/files/####/E7iIaFnmato6KG7P0Dhi56IUIOQ=.new
- <Package Folder>/files/####/GJ8c-klyV6z7uzMY2vYQ-g==
- <Package Folder>/files/####/H00UfElo5jtcT3zjnzy9wW1kY-0=.new
- <Package Folder>/files/####/IXqC0qoPRA1emBCJRq0sM962Ewh6lRMv.new
- <Package Folder>/files/####/MfI3eC9yg5dUJm5U
- <Package Folder>/files/####/SLcODI94vMD0GOBPc3bXgQ==
- <Package Folder>/files/####/SLcODI94vMD0GOBPc3bXgQ==.new
- <Package Folder>/files/####/Sozbm5-fB91yAlMiq9y9Hh5AAIE=.new
- <Package Folder>/files/####/TdxO42iTkqAtpLSYv92BXQ==.new
- <Package Folder>/files/####/UqDZ9azT2-fY8mRBsUY9F3m_5jW7FI7z.new
- <Package Folder>/files/####/XU1GXz5lpkQQy4DDPQcAok0J7g5nCN_qtg1g7dbwnaU=.new
- <Package Folder>/files/####/YFFkfZ7Wpi9_YAo8.zip
- <Package Folder>/files/####/YiliaYVz_gWVKcZrcCHmuu1WFnw=
- <Package Folder>/files/####/Zks1-RMU08JGWPEH77jFqOSoydhWuu3Rp2lBtVuiG6I=.new
- <Package Folder>/files/####/aDbMqwoyM7s6VEzTYVV9rcgiWMo0lcgYbfN3ew==.new
- <Package Folder>/files/####/flB4zAK43HHTQtEi3nonBA==
- <Package Folder>/files/####/hO4UKNndIZKF_SFnc23rdJFXBD4H9aFPc6NXdAv3Yfw=.new
- <Package Folder>/files/####/n0NK-88XHzpPBzzBc2g0QJwApDA=.new
- <Package Folder>/files/####/qcYsuk4wyFkHo7D8f7MX2syL8ieNH6Sb.new
- <Package Folder>/files/####/qujbxa_f.zip
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/tmrc1uo3r0JqNHPf.new
- <Package Folder>/files/####/uUZ_2v2LuCgLQfkqD8d37TUbYhG5M14g5bEDbQ==.new
- <Package Folder>/files/####/zcpwgl1sonc0QKMPPgw-D1PjAbsRWNW0.new
- <Package Folder>/files/.imprint
- <Package Folder>/files/2cb6687eb5__local_last_session.json
- <Package Folder>/files/2cb6687eb5__local_stat_cache.json
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/mdbX1hGc4tbMAeo2bPaG1mF7__local_last_session.json
- <Package Folder>/files/mdbX1hGc4tbMAeo2bPaG1mF7__local_stat_cache.json
- <Package Folder>/files/rdata_combowpqfnzort.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/wappass.baidu.com-passport-login.html
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/isShow.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.BD_SAPI_CACHE/####/login.html
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.config
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/duoku/####/-1041369351.tmp
- <SD-Card>/duoku/####/-1287550193.tmp
- <SD-Card>/duoku/####/-1346121095.tmp
- <SD-Card>/duoku/####/-2144305283.tmp
- <SD-Card>/duoku/####/-533388563.tmp
- <SD-Card>/duoku/####/-566860440.tmp
- <SD-Card>/duoku/####/1060587726.tmp
- <SD-Card>/duoku/####/323920263.tmp
- <SD-Card>/duoku/####/376054501.tmp
- <SD-Card>/duoku/####/705590393.tmp
- <SD-Card>/duoku/####/dklogodata
- <SD-Card>/duoku/####/suspensiondata
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.bf.game.doudizhu.baidu/code-7050739/2i52T8U8u1ol5uT0 -p com.bf.game.doudizhu.baidu -c com.bowpq.fnzort.wldexq.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- app_process /system/bin com.android.commands.pm.Pm list packages
- ls -l /system/bin/su
- pm list packages
- sh <Package Folder>/code-7050739/2i52T8U8u1ol5uT0 -p <Package> -c com.bowpq.fnzort.wldexq.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Может автоматически отправлять СМС-сообщения.
