Android.Packed.32905

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Loki.10.origin
Android.Loki.15.origin
Android.Mixi.16.origin
Android.Mixi.21.origin
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) d.billyaf####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) r####.adsb####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) m####.trk####.com:80
TCP(HTTP/1.1) char####.com:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) atracki####.appf####.com:80
TCP(HTTP/1.1) newrota####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) thiscli####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) mtrac####.com:80
TCP(HTTP/1.1) a####.bay####.com:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) i####.ki####.com:80
TCP(HTTP/1.1) c####.lab####.com:80
TCP(HTTP/1.1) hy####.com:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) tango####.com:80
TCP(HTTP/1.1) koolmed####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) c.secure####.com:80
TCP(HTTP/1.1) cpgnrot####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) billmsc####.com:443
TCP(TLS/1.0) p####.go####.com:443
TCP(TLS/1.0) pre####.com:443
TCP(TLS/1.0) sconten####.xx.f####.net:443

Запросы DNS:

a####.bay####.com
a####.w####.in
adser####.go####.com
adser####.go####.nl
ak.icec####.org
api.bi####.com
api.ki####.com
atracki####.appf####.com
billmsc####.com
c####.lab####.com
c.secure####.com
char####.com
cpgnrot####.com
d####.zhuo####.com
d.billyaf####.com
d3656q1####.cloudf####.net
down####.zhuo####.com
e####.w####.in
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
gp.lik####.com
gp.miaoxi####.com
h####.b####.com
hy####.com
i####.ki####.com
ilv####.com
j.bay####.com
koolmed####.com
l.a####.com
lh3.googleu####.com
m####.trk####.com
mtrac####.com
newrota####.com
p####.a####.com
p####.go####.com
pag####.googles####.com
pm.zhuo####.com
pre####.com
rt.hm####.com
s####.g.doublec####.net
sconten####.xx.f####.net
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
serv####.m####.com
sh.penc####.com
ssl.gst####.com
st####.xx.f####.net
tango####.com
thiscli####.com
tpc.googles####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com
www.koapk####.com
www.okyes####.com
www.technol####.co.uk
www.technol####.net
www.trac####.site

Запросы HTTP GET:

a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
char####.com/get/iad/1-4100-66772b841831f85bdc649f674c80e789?cl=####
d####.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=#...
d####.zhuo####.com/Api/getStartFigure?packId=####
d####.zhuo####.com/Api/playGift?titleId=####&packId=####
e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
f####.google####.com/css?family=####&ver=####
f####.gst####.com/s/lato/v14/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.b0.a####.com/cr/sdk/dynV17041701D/des_dyV17041701Dj1so32.zip
m####.trk####.com/?utm_medium=####&utm_campaign=####&1=####&cid=####
m####.trk####.com/?utm_term=####&clickverify=####&utm_content=####
m####.trk####.com/proc.php?76abcb4####
p####.a####.com/img/bdar40641.png
pag####.googles####.com/pagead/gen_204?id=####&c=####&wpc=####&warn=####...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171021/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171021/r20170110/show_ads_impl.js
r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
serv####.m####.com/119987?t=0.9669518489390612&ref=&lu=http://www.techno...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...

Запросы HTTP POST:

api.bi####.com/un
d####.zhuo####.com/Api/playDetail
e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
gp.lik####.com/cr/sv/getEPList
i####.ki####.com/express
i####.ki####.com/jar
i####.ki####.com/u
l.a####.com/pv.php
l.a####.com/sal.php
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_indicators/indicator_d
<Package Folder>/app_indicators/indicator_p
<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/cache/intel-1676682703.txt
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/mobikokdload.db
<Package Folder>/databases/mobikokdload.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/http_www.technologycraze.co.uk_0.lo...ournal
<Package Folder>/files/####/ntmp20722235
<Package Folder>/files/####/plug_2.jar
<Package Folder>/files/####/plug_3.jar
<Package Folder>/files/####/plug_3.jar (deleted)
<Package Folder>/files/####/test
<Package Folder>/files/1508932110892_dyV17041701Dj1so32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/IlvGNfLeLnXWQUZjdynamicloader.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1508932108480
<Package Folder>/files/bb.jar
<Package Folder>/files/bb.jar (deleted)
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/ehkdbiDtwbaGbOOydaemon.so
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/libiXCCVhYUvWYjNhMlbootstrap.so
<Package Folder>/files/mingsk
<Package Folder>/files/mobikokJarDecMd5File
<Package Folder>/files/mobikokJarEntityFile
<Package Folder>/files/pPSqBZtGDOsuTyItstub.jar
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail747.so
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/files/xnPqJGuLCADgDtbpsa.jar
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/MashupGroupSaleFile_Type_4.xml
<Package Folder>/shared_prefs/MobikokCache_Type_4.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml (deleted)
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml.bak
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml.bak (deleted)
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml.bak
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/userconfig.xml
<Package Folder>/shared_prefs/userconfig.xml.bak
<SD-Card>/.salvia/<Package>
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/APPMarket/####/5202496.apk
<SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/DownloadCache/mobikokCacheFileInfos
<SD-Card>/HorseBrowser/####/080A76A8AC157B637E27F549707A37CC.png
<SD-Card>/HorseBrowser/####/08DDFCD9AC157B63445C5E3411AC11EA.jpg
<SD-Card>/HorseBrowser/####/37D1AA67AC157B624B3C07D5765AC15A.png
<SD-Card>/HorseBrowser/####/64223430AC157B636AB78C4A8C5E0524.png
<SD-Card>/HorseBrowser/####/64281E4FAC157B635E90A00F61F29893.png
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE20B7F21F347FC3A40.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE2478DDE6AB87569BC.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE24BADFC0E453793AD.png
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE216F7E3BA539C33E5.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE2330525D994617330.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE26C87D41DE97A0573.jpeg
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/test1508932110666

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
app_process /system/bin com.android.commands.pm.Pm path com.dianxinos.dxbs
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0771 <Package Folder>/.syslib-
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Загружает динамические библиотеки:

1508932110892_dyV17041701Dj1so32
com_zhuoyian_youxizhongxing110
ehkdbiDtwbaGbOOydaemon
getuiext2
intel-1676682703
libiXCCVhYUvWYjNhMlbootstrap
libjni-comymrefpackagesjrrbaidu

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней