Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.451.origin
Изменения в файловой системе:
Создает следующие файлы:
- /anr/traces.txt (deleted)
- /data/<Package>/####/classes.dex (deleted)
- /data/<Package>/####/libsdkpaplat.sinfo (deleted)
- /data/<Package>/####/sdkpaplugin.jar.lock
- /data/<Package>/####/tmp-427146966tmp (deleted)
- /data/<Package>/####/tmp1253341761tmp (deleted)
- /data/<Package>/####/tmp1434223337tmp (deleted)
- /data/anr/traces.txt (deleted)
- <Package Folder>/.platformcache/####/classes.dex
- <Package Folder>/.platformcache/####/classes.dex (deleted)
- <Package Folder>/.platformcache/####/libapmeplt.so
- <Package Folder>/.platformcache/####/libapmeplt.so (deleted)
- <Package Folder>/.platformcache/####/libsdkpaplat.sinfo
- <Package Folder>/.platformcache/####/libsdkpaplat.sinfo (deleted)
- <Package Folder>/.platformcache/####/libsdkpaplat.so
- <Package Folder>/.platformcache/####/libsdkpaplat.so (deleted)
- <Package Folder>/.platformcache/####/tmp-2029331322tmp (deleted)
- <Package Folder>/.platformcache/####/tmp-427146966tmp (deleted)
- <Package Folder>/.platformcache/####/tmp-951552233tmp (deleted)
- <Package Folder>/.platformcache/####/tmp.Ap3366
- <Package Folder>/.platformcache/####/tmp.Kh3214
- <Package Folder>/.platformcache/####/tmp.gv3321
- <Package Folder>/.platformcache/####/tmp.jE3309
- <Package Folder>/.platformcache/####/tmp.xz3269
- <Package Folder>/.platformcache/####/tmp1080419470tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1253341761tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1308047112tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1373531668tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1434223337tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1624900267tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1749822304tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1795156664tmp (deleted)
- <Package Folder>/.platformcache/####/tmp180976846tmp (deleted)
- <Package Folder>/.platformcache/####/tmp1983392859tmp (deleted)
- <Package Folder>/.platformcache/####/tmp2010859316tmp (deleted)
- <Package Folder>/.platformcache/main.jar
- <Package Folder>/.platformcache/sdkpaplugin.jar.lock
- <Package Folder>/shared_prefs/platform.xml
- <Package Folder>/shared_prefs/platform.xml.bak
- <SD-Card>/.<Package>/####/compVersion
- <SD-Card>/.<Package>/####/verinfo.cfg
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.platformcache/main.jar
- chmod 755 <Package Folder>/.platformcache/sdkpaplugin.jar
Загружает динамические библиотеки:
- libsdkpaplat
