Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.258
- Android.Triada.266.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) c.m.1####.com:80
- TCP(HTTP/1.1) ptmgtd0####.wsclou####.com:80
Запросы DNS:
- b####.52####.com
- c.m.1####.com
- cms-bu####.n####.127.net
- mt####.go####.com
- wqt.wh####.com
Запросы HTTP GET:
- ptmgtd0####.wsclou####.com/005b64e3748d42c08aca2eb0f704fdd42017092208270...
- ptmgtd0####.wsclou####.com/00e2c7a2e98d4be3ad730cd73b7714df2017092210571...
- ptmgtd0####.wsclou####.com/0451257a71d843859f2babf0947262a32017092207514...
- ptmgtd0####.wsclou####.com/0cf7eccec8f04bbd8c9f23115bfc86f82017092209250...
- ptmgtd0####.wsclou####.com/0fc02aedbe9d4217bd02e4c05793cbcd2017092208293...
- ptmgtd0####.wsclou####.com/0fe7adfb56184bcaa92f86e7e5129cfc2017091915435...
- ptmgtd0####.wsclou####.com/1a8420e9bfba40fb9721eb076da3f1012016122322263...
- ptmgtd0####.wsclou####.com/1e27965cd01041cd89e1c00c8efb9e732017092210214...
- ptmgtd0####.wsclou####.com/2819266ef18945719330930b76c316682017091908104...
- ptmgtd0####.wsclou####.com/2f84f8d23fef4638ab0760f5c756dd332017092211043...
- ptmgtd0####.wsclou####.com/3207b1f00ff14e48a66ff2c5b83849cd2017092209332...
- ptmgtd0####.wsclou####.com/358f8fdc08924b039540d007e07856e42017092212571...
- ptmgtd0####.wsclou####.com/38aa93500abb46b98cef7535ac18147c2017092211193...
- ptmgtd0####.wsclou####.com/4132fd4907774d4fa88a8e860e09bbc72017092210024...
- ptmgtd0####.wsclou####.com/452b109079d44c4c8bf04ad08e56112e2017092211050...
- ptmgtd0####.wsclou####.com/4ee90f7286b1485ea43867b9621d51ab2017092207592...
- ptmgtd0####.wsclou####.com/590f8ebbe3a742a1b0746e41a549df9e2017092115191...
- ptmgtd0####.wsclou####.com/61d9330b4073435cbdb0b3b1109ed5f02017092213382...
- ptmgtd0####.wsclou####.com/67e9fb946ab54ba7a3846dae4ef3c5712017092207150...
- ptmgtd0####.wsclou####.com/755f590247ee4c4d9b0f4016b0657bc32017092015520...
- ptmgtd0####.wsclou####.com/7838485ac7cb4e4b81a35f514c0db6b72017092213034...
- ptmgtd0####.wsclou####.com/7d221e9ba6fb414f8555233d4bdc19f62017092207333...
- ptmgtd0####.wsclou####.com/8f2974f1cf0c433c8febfa494869e8032017092008130...
- ptmgtd0####.wsclou####.com/96ddf9238a0841339164d5a7305a92c52017092207551...
- ptmgtd0####.wsclou####.com/97e1432867064ce290b530adc68f4f0e2017091918003...
- ptmgtd0####.wsclou####.com/98499d3c9035408f8d7f9e134d83ed5a2017092207395...
- ptmgtd0####.wsclou####.com/a74944c7a06143d28f8a94d8454f65262017092208024...
- ptmgtd0####.wsclou####.com/ab4cd07dc6464371a807bcb78d042fd72017092111522...
- ptmgtd0####.wsclou####.com/bcc8ce5daa7346bfb5b798d5f30f814e2017092210571...
- ptmgtd0####.wsclou####.com/c74f1e464217459a8719fe1252821f202017092212074...
- ptmgtd0####.wsclou####.com/dd8abfb2d33e4eca8fddaf6bc54a6cba2017092019152...
- ptmgtd0####.wsclou####.com/e183d04034f94abc87dd75457fc8a0db2017092211313...
- ptmgtd0####.wsclou####.com/e54006aad1164cd8aa9d1dc24a0887ff2017092210064...
- ptmgtd0####.wsclou####.com/e58b5a05aec34b1db11caf7723e5c1262017092207352...
- ptmgtd0####.wsclou####.com/f4bc28eb1261448aafa00ed67d43d7002017092213333...
- ptmgtd0####.wsclou####.com/f8369ec213db4c5fa6589db4634729402017092021234...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/0665648e2c4964d537eb1626af0daa89612....0.tmp
- <Package Folder>/cache/####/0981ed959be60833a1158d7387f030d3ef7....0.tmp
- <Package Folder>/cache/####/0c9405d8fb192cbe115219720e839e48dbb....0.tmp
- <Package Folder>/cache/####/139accff0b26661b65490e6883a2fb2b778....0.tmp
- <Package Folder>/cache/####/14ea3b43c0200602a3d9d8db6b3ac0b68f1....0.tmp
- <Package Folder>/cache/####/15b1a990970dd423a3c24f40240c56e2c4e....0.tmp
- <Package Folder>/cache/####/194c667fd7749bcf768b3812df78bcaa0e9....0.tmp
- <Package Folder>/cache/####/1a6b45d296ffc8d5c5186c589c9528cd291....0.tmp
- <Package Folder>/cache/####/212065cf32bea70fba7bc9dbf04ea409e16....0.tmp
- <Package Folder>/cache/####/2208993e21a2bea17d4461a660336080fd6....0.tmp
- <Package Folder>/cache/####/23d33564df009b86ff221246d585a1d378c....0.tmp
- <Package Folder>/cache/####/286c0a1b8efe7454238b3712cf59cf65dad....0.tmp
- <Package Folder>/cache/####/34131e99e7fc165dd254d72799fec8d4373....0.tmp
- <Package Folder>/cache/####/3aebcec6e1d519fde252679d3fe38200037....0.tmp
- <Package Folder>/cache/####/3feb6be4e51a0de8d1a6a0283e4e86c94e3....0.tmp
- <Package Folder>/cache/####/41f7f815c358f727f48d1be1fda1569bc43....0.tmp
- <Package Folder>/cache/####/44ab70486aa8d680430a50d4d19245c2aa3....0.tmp
- <Package Folder>/cache/####/45e6d85754637f4c3b4d83bacb9c50e5b1d....0.tmp
- <Package Folder>/cache/####/4942ad26b52581c422a419b73967de42bde....0.tmp
- <Package Folder>/cache/####/4b3fc06ec2f4f73554b342e65fdc4e77050....0.tmp
- <Package Folder>/cache/####/4c90eb05f266b367e5637c044425388932e....0.tmp
- <Package Folder>/cache/####/4d0bf8521f05ad902bc27937f429b5131c7....0.tmp
- <Package Folder>/cache/####/5508aed06902ee4adae8b89a8a737649451....0.tmp
- <Package Folder>/cache/####/55362130831cd72ef49250837ee8f985ab9....0.tmp
- <Package Folder>/cache/####/6006aa85b9881bd8b33401c94f87fdb1043....0.tmp
- <Package Folder>/cache/####/671d157754c7724dbd908cca50eaad4714b....0.tmp
- <Package Folder>/cache/####/80cf5e4d41bf6b76ddd71f1a0810aa84954....0.tmp
- <Package Folder>/cache/####/88f0937e743fd17f07b67707b83678ad602....0.tmp
- <Package Folder>/cache/####/8d1ec7ec83242f6c5aa221cfb7cbb05f829....0.tmp
- <Package Folder>/cache/####/904f2b5fa7f57fef1482eaf82ac4b339eb2....0.tmp
- <Package Folder>/cache/####/97990c4c7a07ebead47d47bf812ef97a60a....0.tmp
- <Package Folder>/cache/####/a49656ca5522f5b4d521191ac0939353ac0....0.tmp
- <Package Folder>/cache/####/a63ec8f0da9271d47cda913ff64fdace87a....0.tmp
- <Package Folder>/cache/####/ab0625800e3e34dcd1ee111d9c8e129738f....0.tmp
- <Package Folder>/cache/####/abcca4fde470af9b2019d72f3892df0f454....0.tmp
- <Package Folder>/cache/####/b736ce9aa8296601d1fccc2dfb1009a6cdb....0.tmp
- <Package Folder>/cache/####/bae33abbb0a687d6945b9da152ae508d212....0.tmp
- <Package Folder>/cache/####/c5ab76d9b0a447050c1f50c83bb63b8bf6a....0.tmp
- <Package Folder>/cache/####/cb0204d46d3419b812e5e1a4a555086adc2....0.tmp
- <Package Folder>/cache/####/dbde2b6a4a29410b0018173de64beb01697....0.tmp
- <Package Folder>/cache/####/df2009e3db5dc5563784b5ea9ac03bc9aad....0.tmp
- <Package Folder>/cache/####/ef0f604e3d98b686976d4f632a0adc91459....0.tmp
- <Package Folder>/cache/####/efc4040e840f8e0a3b716da535d13e9c3da....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/files/cthy
- <Package Folder>/files/cthy.jar
- <Package Folder>/files/ru
- <Package Folder>/files/ru.apk
- <Package Folder>/files/saqn.png
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xapcinfo.xml
Другие:
Запускает следующие shell-скрипты:
- conbb od2gf04pd9
- cufsdosck ac554db364f
- cufsmgr eb47495f7bb
- service call appops 0 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 1 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 10 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 11 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 12 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 13 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 14 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 15 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 16 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 17 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 18 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 19 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 2 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 3 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 4 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 5 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 6 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 8 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 9 i32 15 i32 10044 s16 <Package> i32 0
- sh
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
