Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.190:8088
- 1####.####.1:8088
- 1####.####.88
- 1####.####.88:8999
- 6####.####.140
- a####.####.com
- i####.####.com
- l####.####.com
- res####.####.com
Запросы HTTP GET:
- 1####.####.190:8088/sdkserver/adData/adInfo/sdk/1501432303194.jar
- 1####.####.88/catServer/
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
- res####.####.com/v3/ip?key=####
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/advertisment
- 1####.####.1:8088/sdkserver/v2/addSdk
- 1####.####.88:8999/catServer/recommend!status.action
- a####.####.com/app_logs
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/0198ef931e4cbbec5503fed39a0e45d99cfbcc62cb88d686c53b71e8f509ae0e.0.tmp
- <Package Folder>/cache/####/33d313a572292914eb27ce30619da3655efd40b472fbba4b5b8cea56640eac81.0.tmp
- <Package Folder>/cache/####/4228adcc2d091c535ca782a799357b73dbed66113a1151d7e93f62a85252a69b.0.tmp
- <Package Folder>/cache/####/9952852a4f66a704f41ad49dcc8e0a547dff49987f8bfcef2dd43ca3841041ed.0.tmp
- <Package Folder>/cache/####/cb2eb9eb88a0d7a7b3b85f9849af3f9ab700ff97a3d5c836dc2bc797b4a7ecb2.0.tmp
- <Package Folder>/cache/####/d140901f83e97c15c517cb7e878ee28111683ae0a6ca71abb130b4e7266ace75.0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/dd3c871538a919a5b7f69e0394963edd1691c7f1cfe88d5f38b4af0d30398897.0.tmp
- <Package Folder>/cache/####/dd7f4153437aa5a62c8483d14ccd7a823938798424f5c6e662567903b43e1d99.0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code-4698540/ozAdBFKFN7brtoje
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_7YFGgwlqo27UmA7mqrac-Q==
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_7YFGgwlqo27UmA7mqrac-Q==-journal
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_9y9oUG2UK15KS3CWs7Mv7GJg9bQ=
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_9y9oUG2UK15KS3CWs7Mv7GJg9bQ=-journal
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_UBBIvhUAWrc=-journal
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_eqAwosIOdNKjSusbZ2TiGw==
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_eqAwosIOdNKjSusbZ2TiGw==-journal
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_vlkoZzCEA-9FSiT8
- <Package Folder>/databases/ILpLIYmDRg0nP_UG15erQVZywPfriLWt4_CV1wXCk7A=_vlkoZzCEA-9FSiT8-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/download.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/--wraaRVNBHQJukUUgiyMtI6yeo=
- <Package Folder>/files/####/0aad3fca-76ac-4608-9cda-867a65fdfec5.pic.temp
- <Package Folder>/files/####/13b6b2ec-73f6-4eab-b62d-d19b55954e5b.pic.temp
- <Package Folder>/files/####/3ZlskeadDYbHGvltyMb5ZcvPFMXdiBxjwfKTmla97Ak=.new
- <Package Folder>/files/####/401BGov8WSmt4-t9lwfqHdQaSRM=.new
- <Package Folder>/files/####/4d84584d-a5a0-4ab8-92f2-bcd4ce1607d3.pic
- <Package Folder>/files/####/58a8630a-01e3-4929-9c9f-2dd42eadf664.pic.temp
- <Package Folder>/files/####/5abcb5fc-d74a-4dca-8bd9-ed03cd655ffe.pic.temp
- <Package Folder>/files/####/6OqcUxMk7tqr-cOKL5pyLYPZZ4I=.new
- <Package Folder>/files/####/7ab2284e-05b8-4237-8c15-0cafbda1952a.pic.temp
- <Package Folder>/files/####/83ddc55f-137d-4c8d-a11b-f6360cf74cb7.pic.temp
- <Package Folder>/files/####/BCgZwFbNWZ_ojp-OfJXJsv4Z5M8we9sZ.new
- <Package Folder>/files/####/CL7x7zjQDmjzGBDcTElXgg==
- <Package Folder>/files/####/CL7x7zjQDmjzGBDcTElXgg==.new
- <Package Folder>/files/####/GRa_qfZhFrSEc8c5kE_0Nx8xkn9uFhEJ.new
- <Package Folder>/files/####/Igp1k5H38DncCnfWhk0QgyEqV3-tcwQy.new
- <Package Folder>/files/####/JQ3YIXaE5vxjMUPxOecbOQ==
- <Package Folder>/files/####/JQ3YIXaE5vxjMUPxOecbOQ==.new
- <Package Folder>/files/####/KBgSucSFokRQJ8xTLNVPTUNZ2DQZFoax.new
- <Package Folder>/files/####/L3e-KerD5F6xTnDyPQ33Ow==
- <Package Folder>/files/####/QzMcaOBXqtCbHpYe2vCkxw==
- <Package Folder>/files/####/RKO8Bjnkmall_CAdGfZUQfgQitE=
- <Package Folder>/files/####/SQg4qAsfKnU1Or20SVziW5XzXy4_yjyFxAMBlA==.new
- <Package Folder>/files/####/SwWcHuCcsBQXSx9P
- <Package Folder>/files/####/X9h_IFbyCbegse6WjWZHHGEo-xC0hsao.new
- <Package Folder>/files/####/YNqPJEWfu0JlkuknA23Y3C4IOzNhS4uq.new
- <Package Folder>/files/####/e4c49f4a-9ff6-411c-bde8-3ffae00fdcd9.pic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/fDY_ngU_wOTdzWL2V5_bYMqo8E5ugrszS7YUG8XFN0A=.new
- <Package Folder>/files/####/fg8MwTPhF2_v5KoTSzRYaWE6Da83V4Q92EqyZw==.new
- <Package Folder>/files/####/hEPW3KpCXAbA1NRcgbZaBQ7sJUk=.new
- <Package Folder>/files/####/iLCM60XPh9tsTpXxdObnR4mP6cXVj3TOPrek6g==.new
- <Package Folder>/files/####/lXIh2kA6tGd4yBrlxftHmg==.new
- <Package Folder>/files/####/lhi-Me-WmzLqAzsq.zip
- <Package Folder>/files/####/ojMd8B4Z20prHn3qlVF9PobKMSaLnj1R
- <Package Folder>/files/####/ojMd8B4Z20prHn3qlVF9PobKMSaLnj1R.new
- <Package Folder>/files/####/ojMd8B4Z20prHn3qlVF9PobKMSaLnj1R.old (deleted)
- <Package Folder>/files/####/p_M-xTcGjIQFix2qjI9avzDirjQ=.new
- <Package Folder>/files/####/qcWa_LJ7MPxwSty25cN86HTiD82hrz3FQQTi2x-qyS8=.new
- <Package Folder>/files/####/rK6ztxgpK4aZB-QVzkr-H3I6aHrxA_mzmUe0PWMtSRU=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/tCPswRfbxlILJkEEMDHTLBAweOTMRpd7.new
- <Package Folder>/files/####/txdcxq_f.zip
- <Package Folder>/files/####/v6wMHW1J236f72tt.new
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comandroidsupport.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.armsd/####/0eec7caa-46a1-49ee-887d-341ca96d72b2.res
- <SD-Card>/.armsd/####/292bf776-b292-45a0-9533-5c04112e55b5.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/87648a65-a50b-46a7-88eb-16af65e244d8.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.osdnf.odwt.osahe222/code-4698540/ozAdBFKFN7brtoje -p com.osdnf.odwt.osahe222 -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- sh <Package Folder>/code-4698540/ozAdBFKFN7brtoje -p <Package> -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
