Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 6####.####.140
- a####.####.com
- c####.####.com
- i####.####.com
- l####.####.com
- m####.####.com
- push####.####.cn
- push####.####.cn:8400
Запросы HTTP GET:
- i####.####.com/ando-res/ads/black/640x270.png
- m####.####.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&ne...
Запросы HTTP POST:
- 6####.####.140/ando/v1/x/ap?app_id=####&r=####
- a####.####.com/conf5
- a####.####.com/errconf
- c####.####.com/v2/cdata
- l####.####.com/sdk.php
- push####.####.cn/
- push####.####.cn:8400/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/code-7249290/cAs0-q9Xh-xZX9Ns
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_U69hOH1hxbJBt2QctR0u2w==
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_U69hOH1hxbJBt2QctR0u2w==-journal
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4__8HksE6v__c=-journal
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_fcZxS7rc-GRAKIEL
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_fcZxS7rc-GRAKIEL-journal
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_kL4iTU1aGV1HKBYOZBqrDw==
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_kL4iTU1aGV1HKBYOZBqrDw==-journal
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_wJFZKvJx_OMy2xmbNkQVkiPq-Ps=
- <Package Folder>/databases/8Mj1NGiycEAPRJNl1nrzDrtgVTgTTcK4_wJFZKvJx_OMy2xmbNkQVkiPq-Ps=-journal
- <Package Folder>/databases/ZySDK_prom-journal
- <Package Folder>/databases/ZySDK_statistics_sale-journal
- <Package Folder>/databases/crashlog
- <Package Folder>/databases/crashlog-journal
- <Package Folder>/databases/dalog-journal
- <Package Folder>/databases/evenDB-journal
- <Package Folder>/databases/sharesdk.db-journal
- <Package Folder>/dcsdk/data.dat
- <Package Folder>/files/####/-mIF3UGodKvDssGMh8WpCg==
- <Package Folder>/files/####/-mIF3UGodKvDssGMh8WpCg==.new
- <Package Folder>/files/####/.mrlock
- <Package Folder>/files/####/1Z7gIXG-2_mpNYGulBad1b7TsqhwAWqVjWBBrg==.new
- <Package Folder>/files/####/1c393d48-7fe5-440e-8cf9-b7c7ebe3bf19.pic.temp
- <Package Folder>/files/####/30dbf491-1bc6-4748-8e5d-223a8ac12e8c.pic.temp
- <Package Folder>/files/####/3a857d04-e6bd-4683-bc70-1e4ad5fd671d.pic.temp
- <Package Folder>/files/####/4D5taTCv5u96uVnOI309Q_Wp45o4cyK9.new
- <Package Folder>/files/####/67E6jM3V_my-z-m6vx6HlsUcj1M=.new
- <Package Folder>/files/####/88lN8wRLuM7f8SeC.new
- <Package Folder>/files/####/9YF1hPU34gCTPoytbZMhfKrOiAlpsp0SnzdPbQ==.new
- <Package Folder>/files/####/9yEGVRkFGt16oMmZGQCuZA==
- <Package Folder>/files/####/9yEGVRkFGt16oMmZGQCuZA==.new
- <Package Folder>/files/####/9yEGVRkFGt16oMmZGQCuZA==.old (deleted)
- <Package Folder>/files/####/AqD3RJs4LT787uH8QxJw95gBPAocp4jg
- <Package Folder>/files/####/AqD3RJs4LT787uH8QxJw95gBPAocp4jg.new
- <Package Folder>/files/####/BuBy_J5SBHUwSTGqSCELiHiZG-xfL2-eDrHLQBAgGxA=.new
- <Package Folder>/files/####/EjN4VF9shRJxWTcgARM3lkI2zfNHMb2E.new
- <Package Folder>/files/####/EuihZB477LHKiZT_4aLhjH0ig1BGVjHIDWgUKne2hf0=.new
- <Package Folder>/files/####/IEvRua6o6PVZv_oLQFbvbVsTGYuXeVasTQekVqaEnvE=.new
- <Package Folder>/files/####/JD0U1GK8Myy_B2LBV-CUgYnnx45Y_s1N2SQn8jz9QdI=.new
- <Package Folder>/files/####/JnCbATraAMknvDkwFzliqNiz48M=.new
- <Package Folder>/files/####/LmRp5SlNVaeN6umzKQfikg==
- <Package Folder>/files/####/T8LcI_IfYLml1TWkwCpX5V5gRSTCi4J4.new
- <Package Folder>/files/####/a2d11fb5-4a22-4c2f-94ae-3c3d7faff55e.pic
- <Package Folder>/files/####/bx0hu3wU8qLnTaRdfSBTiQ==
- <Package Folder>/files/####/e2d960ab-7568-47c6-bec7-be24b44e8d4e.pic
- <Package Folder>/files/####/erR2EzwS0_FwhZ40orhxvVVeWyQ=
- <Package Folder>/files/####/erR2EzwS0_FwhZ40orhxvVVeWyQ=.new
- <Package Folder>/files/####/f5eSGizukp8RW2qF.zip
- <Package Folder>/files/####/f8b77107-833a-4a4a-9fa4-12e5bb097def.pic.temp
- <Package Folder>/files/####/fbtET7md27WiVApuw2d2gYo70qY=
- <Package Folder>/files/####/hed268tymT-dzIxa93jEDw==
- <Package Folder>/files/####/lLEOZfMaGiukZAEjVMrfxCJlcZ0ks4gg.new
- <Package Folder>/files/####/mJpJRFPRz4gv1yKvsm5sQxyiHz0=.new
- <Package Folder>/files/####/oH4spcMtRuYgk2tVrQirJzdtKoM=.new
- <Package Folder>/files/####/runner_info.prop
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/s0ElyXaBEi3J7wy07K77SzVdUurI9QlACOruEg==.new
- <Package Folder>/files/####/sfbbg_f.zip
- <Package Folder>/files/####/tttMOILae27kjwEdKLRmqw3SRkmz8AmJ.new
- <Package Folder>/files/####/vM-3zv4jhWnmYwma
- <Package Folder>/files/####/wxO8ktpc5bxQi2UJlrQRTY_2zU51jqiX.new
- <Package Folder>/files/####/wzPv_3V66md3oEX_V08WGrjzsvbByDzj.new
- <Package Folder>/files/.lock
- <Package Folder>/files/.mrecord
- <Package Folder>/files/.mrecord (deleted)
- <Package Folder>/files/.statistics
- <Package Folder>/files/droi.key
- <Package Folder>/files/rdata_comwogsnzhgr
- <Package Folder>/shared_prefs/Droi_SharedPref.xml
- <Package Folder>/shared_prefs/Droi_SharedPref.xml.bak
- <Package Folder>/shared_prefs/mob_commons_1.xml
- <Package Folder>/shared_prefs/mob_sdk_exception_1.xml
- <Package Folder>/shared_prefs/share_sdk_1.xml
- <Package Folder>/shared_prefs/share_sdk_1.xml.bak
- <SD-Card>/.armsd/####/130401a2-6b7f-4448-bb95-0ed182240974.res
- <SD-Card>/.armsd/####/40ffb8b8-4f13-4c5e-bca9-d3287918f8e2.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/89009bf0-d874-45ff-966e-1c0b9f2fd971.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/cafcfd19-fbb6-43a5-9b02-4889cae3a2da.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.droiAnalytics/OtherAppInfo.log
- <SD-Card>/.droiAnalytics/flag.dat
- <SD-Card>/.env/.uunique
- <SD-Card>/.env/.uunique.new
- <SD-Card>/Mob/####/.al
- <SD-Card>/Mob/####/.dh-journal
- <SD-Card>/Mob/####/.dhlock
- <SD-Card>/Mob/####/.dic_lock
- <SD-Card>/Mob/####/.duid
- <SD-Card>/Mob/####/.globalLock
- <SD-Card>/Mob/####/.nulal
- <SD-Card>/Mob/####/.nulplt
- <SD-Card>/Mob/####/.pkg_lock
- <SD-Card>/Mob/####/.rcTag
- <SD-Card>/Mob/####/.rc_lock
- <SD-Card>/Mob/.dk
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-7249290/cAs0-q9Xh-xZX9Ns -p <Package> -c com.wogs.nzhgr.ufrebw.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- app_process /system/bin com.android.commands.pm.Pm list packages
- ping -c 1 -w 100 www.baidu.com
- pm list packages
- sh
- sh <Package Folder>/code-7249290/cAs0-q9Xh-xZX9Ns -p <Package> -c com.wogs.nzhgr.ufrebw.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Загружает динамические библиотеки:
- TydEngine_mbed_jni
- neh
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS7Padding
- DES-ECB-NoPadding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-NoPadding
- DES-ECB-NoPadding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
