Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.190:8088
- 1####.####.1:8088
- 1####.####.88
- 1####.####.88:8999
- 6####.####.140
- i####.####.com
- l####.####.com
- res####.####.com
Запросы HTTP GET:
- 1####.####.190:8088/sdkserver/adData/adInfo/sdk/1501432303194.jar
- 1####.####.88/catServer/upload/images/b4cb02bb-60e4-4428-b2d8-ef0aaf2f76...
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/ads/0/9/837ec120-ccf8-4ad0-b6fd-1303ff645eca/773...
- res####.####.com/v3/ip?key=####
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/updateSdk
- 1####.####.1:8088/sdkserver/v2/appActive
- 1####.####.88:8999/catServer/recommend!status.action
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/0a6527013df727a1c60c80cc05665969030acfb0cbc4b38e3bbff4e45d01d164.0.tmp
- <Package Folder>/cache/####/16c59c26be623719f3f1f4f2e571e4af34ced2afd4df2ce372129b218e364d95.0.tmp
- <Package Folder>/cache/####/1799ad83db351a8de906409e322f6042224ad1b8df57698089377ed7fc318fe3.0.tmp
- <Package Folder>/cache/####/195145bc9e10b6807d312a1b386d880a28e414abaf69009b9c10afd4e5ee565d.0.tmp
- <Package Folder>/cache/####/7f9322b79c970cb7bae53e1b777567ba7fd9044bb8382a7318cc053d241dc23a.0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/fef49ede290bdb9454f5599bb5412c04e05ed6dffd41755a0186c00cc1698b3f.0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code-4247207/OV7My241398KFRlZ
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_34BSyZL39iGB9YYIwSscVcFKUJU=
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_34BSyZL39iGB9YYIwSscVcFKUJU=-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_6Kz-eE6d6l7kTdLgJ8r1TQ==
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_6Kz-eE6d6l7kTdLgJ8r1TQ==-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_E2UNg5g49J2xaFTKcqHe6A==
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_E2UNg5g49J2xaFTKcqHe6A==-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_eHMV8l3HPHA1CcKK
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_eHMV8l3HPHA1CcKK-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_qwpwLdwN1P0=-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/download.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/01qyeJCL7Avv2toPJA3ICjpPDPjUAp7J.new
- <Package Folder>/files/####/0WlhtfnjVgp2BSio.zip
- <Package Folder>/files/####/0xSKJUkgLwWLADxNUFbZjwHi4U-lCxW1.new
- <Package Folder>/files/####/358dcd1d-201c-4b76-8164-8287b7a7731e.pic
- <Package Folder>/files/####/3XHGhTVS_mfNuA9XJz9hswFJW_g=.new
- <Package Folder>/files/####/40CffEF8JfC5MJYwQDkAexF_-WatFdCO.new
- <Package Folder>/files/####/448b6d16-9220-4cf1-a4c3-fc9c94d2c4c0.pic
- <Package Folder>/files/####/4f2CdI-oIsKU5YuNMPXvg0m_0x4=.new
- <Package Folder>/files/####/5KuO6aP_t8wWBjdKl8zz_kduO5ylunJjt12rPg==.new
- <Package Folder>/files/####/5da14404-bf4a-45bb-8f59-168e06431c1a.pic.temp
- <Package Folder>/files/####/7616e045-bee9-4be0-b5ae-880e3414972a.pic.temp
- <Package Folder>/files/####/7RDDWfLNhpZNS_mx5tV0virxN71dBZGcAQzBLMmunJo=.new
- <Package Folder>/files/####/90_rpEvDvWqn7f_-
- <Package Folder>/files/####/90_rpEvDvWqn7f_-.new
- <Package Folder>/files/####/9fed6d23-d179-47d1-a146-8faba5e95fb0.pic.temp
- <Package Folder>/files/####/AVPBi795FYhmuVtM_CtGmg==.new
- <Package Folder>/files/####/D3pyU8EGr3ZePVpw
- <Package Folder>/files/####/D3pyU8EGr3ZePVpw.temp
- <Package Folder>/files/####/D4K8ZEUaVatPr353QE50EBsYO0501jwV.new
- <Package Folder>/files/####/G4hskoX5ZJ-SItFh3r82cb5jFj_6JpgJ.new
- <Package Folder>/files/####/HZK4AW_Fm96dngX1PsBYamfTwrQ=
- <Package Folder>/files/####/H_t4lqWxt2UHp1rwJJAJA29dB3xx3NtAKn5cUg==.new
- <Package Folder>/files/####/HonasbibWvgEwNERZzSI_tMtebXfo-jNHDnMVDyvMXA=.new
- <Package Folder>/files/####/UNPYuN5inVGlBkGUHqtaDg==
- <Package Folder>/files/####/UNPYuN5inVGlBkGUHqtaDg==.new
- <Package Folder>/files/####/Uj_hXDnBHAE64grrPaGfrGzUSmG46ktmOr3-HMeumNs=.new
- <Package Folder>/files/####/XsLCYPQZcxuKGoCc6Hs6SYKeTeA8O4ke.new
- <Package Folder>/files/####/ZOw7fflL91xopaQID6tcHJ-VWeo=
- <Package Folder>/files/####/ZOw7fflL91xopaQID6tcHJ-VWeo=.new
- <Package Folder>/files/####/e5a5ceda-0ad8-465e-b4b2-27433d4a98eb.pic.temp
- <Package Folder>/files/####/ec46dde9-6958-4e6c-b3a0-48d5116bfcb7.pic.temp
- <Package Folder>/files/####/eca8f135-d8b7-46ec-b4b4-4f00ace12522.pic.temp
- <Package Folder>/files/####/gr9Z-HG1eLAjzuwsSSbtv5vniwgfhl6g756-Mg==.new
- <Package Folder>/files/####/gvthDKzyQenis3up6W4zfCGPXJ7NsiDY.new
- <Package Folder>/files/####/he3EGGMU2qlPKce7THE039KdXRLqxX6ShqF2Rr-5eMI=.new
- <Package Folder>/files/####/j1CtV8k6BEaQwwud9Al5KcFoFY8YJG5I
- <Package Folder>/files/####/j1CtV8k6BEaQwwud9Al5KcFoFY8YJG5I.new
- <Package Folder>/files/####/jKGe5cnBoJmOsoBJ-UASrQ==
- <Package Folder>/files/####/lQv2yBYrdeb08-mZb6tAWg==
- <Package Folder>/files/####/lQv2yBYrdeb08-mZb6tAWg==.new
- <Package Folder>/files/####/lQv2yBYrdeb08-mZb6tAWg==.old (deleted)
- <Package Folder>/files/####/n0hfizZl3Lr2XqWzk6uYd95yS0g=.new
- <Package Folder>/files/####/qPs-iXdI-nwbP-z6XqUq5ZGN9OI=
- <Package Folder>/files/####/qPs-iXdI-nwbP-z6XqUq5ZGN9OI=.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/txdcxq_f.zip
- <Package Folder>/files/####/vrBbjE3UQq3hnpX75a2_iA==
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comandroidsupport.new
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.armsd/####/17201bf1-0cda-42f4-869e-3b179f23cef2.res
- <SD-Card>/.armsd/####/268f1139-e443-4163-b8b5-539ae5a00b2b.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/fb5d05bd-882f-4bb5-a8bb-621212562ab7.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-4247207/OV7My241398KFRlZ -p <Package> -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- sh <Package Folder>/code-4247207/OV7My241398KFRlZ -p <Package> -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
