Android.Packed.32466

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Mixi.13.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) e.crashly####.com:443

Запросы DNS:

e.crashly####.com
mt####.go####.com
sett####.crashly####.com
ssl.google-####.com

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/databases/####/cc.db
<Package Folder>/databases/####/cc.db-journal
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/hufeng.db-journal
<Package Folder>/files/####/._rx_32.so
<Package Folder>/files/####/._rx_64.so
<Package Folder>/files/####/59E463FA00A5-0001-07FA-BD8DCA533874...on.cls
<Package Folder>/files/####/59E463FA00A5-0001-07FA-BD8DCA533874...s_temp
<Package Folder>/files/####/59E463FA012A-0001-080B-BD8DCA533874...s_temp
<Package Folder>/files/####/59E463FD003E-0001-0861-BD8DCA533874...leted)
<Package Folder>/files/####/59E463FD003E-0001-0861-BD8DCA533874...s_temp
<Package Folder>/files/####/59E463FD005F-0001-0876-BD8DCA533874...s_temp
<Package Folder>/files/####/[B@4a993d70
<Package Folder>/files/####/[B@4aae60c4
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/rx_32.so
<Package Folder>/files/####/rx_64.so
<Package Folder>/files/####/sa_1b98386e-2d3d-4d93-9d02-89bffdcc...56.tap
<Package Folder>/files/####/sa_70f668a4-f442-495b-a184-87969669...98.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap (deleted)
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/files/ZHTimeKey.KEY
<Package Folder>/files/gaClientId
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answe...rs.xml
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.f...ng.xml
<Package Folder>/shared_prefs/umeng_general_config.xml

Другие:

Запускает следующие shell-скрипты:

/system/bin/mksh
chmod 0777 <Package Folder>/files/soSave
chmod 0777 <Package Folder>/files/zhty_work
chmod 0777 <Package Folder>/files/zhty_work/soWork
chmod 644 <Package Folder>/files/zhty_work/soWork/rx_32.so
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -rf <Package Folder>/files/zhty_work/soWork/
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1