Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.266.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) c.m.1####.com:80
- TCP(HTTP/1.1) ptmgtd0####.wsclou####.com:80
Запросы DNS:
- b####.52####.com
- c.m.1####.com
- cms-bu####.n####.127.net
- ksf.sd####.com
- kso.sd####.com
- mt####.go####.com
Запросы HTTP GET:
- ptmgtd0####.wsclou####.com/008cda7f8b4b4e4e9f33578b510e9eca2017091017561...
- ptmgtd0####.wsclou####.com/06338b366f7d4c88920d941a559f4b0e2017091219074...
- ptmgtd0####.wsclou####.com/21b8445c5e044deb85bd995a4414d3c82017091115472...
- ptmgtd0####.wsclou####.com/2895735806fb4574be3ae68bd13523c92017091215001...
- ptmgtd0####.wsclou####.com/3276f9cc928349fc934aef726f3285cd2017091118394...
- ptmgtd0####.wsclou####.com/3c37f7e943d949a6b936f6460c3896452017091215583...
- ptmgtd0####.wsclou####.com/4336dde0ff7f492d8374508bbfcd0fae2017091115045...
- ptmgtd0####.wsclou####.com/45858bd3576f411a8f1a7b01c0c8ecc72017091215274...
- ptmgtd0####.wsclou####.com/58356c44c6d84eb8866876ecafcb10452017091216045...
- ptmgtd0####.wsclou####.com/7338ea1badf34f3987345e4dbed8c4a22017091216082...
- ptmgtd0####.wsclou####.com/7899955365804f858bc0e7bb749ff7e82017091211192...
- ptmgtd0####.wsclou####.com/7a8a68a9cc56462f9aba4b0b54a827c32017083010474...
- ptmgtd0####.wsclou####.com/886960926a444bcfbab5ab90ae8c50062017091213070...
- ptmgtd0####.wsclou####.com/a0376baccf2c4629afd624b8334c63112017091219195...
- ptmgtd0####.wsclou####.com/a80c8781ec364ff08233d0c1386be77d2017091207392...
- ptmgtd0####.wsclou####.com/b2ab69d5a5604ffab1d4a176fedabb342017091216065...
- ptmgtd0####.wsclou####.com/baed37d12744446886dc7106e849e6bb2017090919251...
- ptmgtd0####.wsclou####.com/d5c3dedd59bb42f098240e6792a4ee742017091213352...
- ptmgtd0####.wsclou####.com/d74d56820a294484ae0626e794d855d42017091121570...
- ptmgtd0####.wsclou####.com/edf7c64fbdb44210847e25c3dc7a359b2017091116441...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/008a60d95be87a3dc793824095231595914....0.tmp
- <Package Folder>/cache/####/2024f542cef686ddc2d11722c3e3455c924....0.tmp
- <Package Folder>/cache/####/23315401ed3f9d8dc5cdb1c296a514dc022....0.tmp
- <Package Folder>/cache/####/3638394c43756cb2e1b021e1a59e99f199c....0.tmp
- <Package Folder>/cache/####/37383fd27c8c3300e9781ee9290f4179344....0.tmp
- <Package Folder>/cache/####/4aa30da9fd3f595a6fc032b74e00237bf0b....0.tmp
- <Package Folder>/cache/####/4cd9fb3a64cd1195d7d71672eb870f474d0....0.tmp
- <Package Folder>/cache/####/525918d5489cf7d92aee05498248f4ebdf2....0.tmp
- <Package Folder>/cache/####/56faf03bacfdc445bd61ae16330d55eca0d....0.tmp
- <Package Folder>/cache/####/583b3d11ed29d20e50becdfee88f37aa793....0.tmp
- <Package Folder>/cache/####/6a18bcf82ea59fe9d128c6bd768574e4a92....0.tmp
- <Package Folder>/cache/####/7b39dc4bced83185fb60b9bc0f25c8f460b....0.tmp
- <Package Folder>/cache/####/8303e6137c40a1f5c15ee3c323a9b021515....0.tmp
- <Package Folder>/cache/####/a18749f99888d5b7032ef5a5bd4d228eb2e....0.tmp
- <Package Folder>/cache/####/ac4be81d896dced1c6ef339964d71c6757f....0.tmp
- <Package Folder>/cache/####/bfb8ac1d14f137fadc958a5545eaa16fade....0.tmp
- <Package Folder>/cache/####/dc9a6e489801f75c7b232ad933c307e4ca5....0.tmp
- <Package Folder>/cache/####/e4b8617c5027f0773cdc9c570027a50c533....0.tmp
- <Package Folder>/cache/####/ed50261a93c1689af35cd07e2fe984385e6....0.tmp
- <Package Folder>/cache/####/ff564df93a2f31c28bfa9df97f7106592ab....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/files/hgrf
- <Package Folder>/files/hgrf.jar
- <Package Folder>/files/mzqz.png
- <Package Folder>/files/ru
- <Package Folder>/files/ru.apk
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xapcinfo.xml
Другие:
Запускает следующие shell-скрипты:
- conbb od2gf04pd9
- cufsdosck ac554db364f
- cufsmgr eb47495f7bb
- service call appops 0 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 1 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 10 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 11 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 12 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 13 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 14 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 15 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 16 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 17 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 18 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 19 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 2 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 3 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 4 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 5 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 6 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 7 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 8 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 9 i32 15 i32 10044 s16 <Package> i32 0
- sh
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
