Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) hc.s####.top.####.com:80
- TCP(HTTP/1.1) hc.z####.today:8082
- TCP(HTTP/1.1) www.goo####.software:80
- TCP(HTTP/1.1) www.a.sh####.com:80
Запросы DNS:
- hc.s####.top
- hc.z####.today
- m.zong####.com
- www.b####.com
- www.goo####.software
Запросы HTTP GET:
- hc.s####.top.####.com/gpfile/pfiles/1500809497389.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809763387.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809811269.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809824846.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809904349.slz
- hc.s####.top.####.com/gpfile/pfiles/1500809930147.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810016794.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810035053.slz
- hc.s####.top.####.com/gpfile/pfiles/1500810168210.slz
- hc.s####.top.####.com/gpfile/pfiles/gofile/des_V17041702Aj1so32.zip
- hc.s####.top.####.com/gpfile/pfiles/gofile/goplaysdk_statistics_all.dat
- www.goo####.software/cr/sv/getGoFile?name=####
- www.goo####.software/cr/sv/getRecord?eids=####&appKey=####&flag=####
- www.goo####.software/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&p...
Запросы HTTP POST:
- hc.z####.today:8082/spdumread/service/rtLogRecord
- www.goo####.software/cr/sv/getEPList
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/com.yuedong.browser-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.md
- <Package Folder>/files/####/19F2B4B2FA301A3CFB7E741D005748C3
- <Package Folder>/files/####/205A25E1238A685685D825F50CDAF429
- <Package Folder>/files/####/5A2541C02892AEBACEF2265722A7FAA7
- <Package Folder>/files/####/5browser2<System Property>46
- <Package Folder>/files/####/74DAA7B3A68DDEE32F0155987AB1CB10
- <Package Folder>/files/####/<Package>12<System Property>2
- <Package Folder>/files/####/BE59BA3B5E925FF9AB6DF2E3865CE941
- <Package Folder>/files/####/D3DE5C52B17DF4ADCEE84073528A291D
- <Package Folder>/files/####/D74F9CAAF7BA1E36D6C1742AC67F6BC0
- <Package Folder>/files/####/E38251EE4C713166AD2CC462EC20CEC5
- <Package Folder>/files/####/FC2FA90346F5535477BBE8A9C4BD51A3
- <Package Folder>/files/####/gpdu
- <Package Folder>/files/####/test
- <Package Folder>/files/1509162817727_V17041702Aj1so32.so
- <Package Folder>/files/1805.jar
- <Package Folder>/files/408.jar
- <Package Folder>/files/421.jar
- <Package Folder>/files/430.jar
- <Package Folder>/files/610.jar
- <Package Folder>/files/611.jar
- <Package Folder>/files/617.jar
- <Package Folder>/files/640.jar
- <Package Folder>/files/806.jar
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/files/mobclick_agent_cached_<Package>
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.yuedong.browser.settings.xml
- <Package Folder>/shared_prefs/fm_pref_key.xml
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ c95ca17010ed8644566aac9d4403b707
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c95ca17010ed8644566aac9d4403b707 <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- logcat -c
- logcat -d -v raw -s AndroidRuntime:E -p <Package>
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ c95ca17010ed8644566aac9d4403b707
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c95ca17010ed8644566aac9d4403b707 <Package Folder>/.syslib-
Загружает динамические библиотеки:
- 1509162817727_V17041702Aj1so32
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
