Android.Packed.34238

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.164.origin
Android.Xiny.202.origin

Предлагает установить сторонние приложения.

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) gpup####.min####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080

Запросы DNS:

and####.b####.qq.com
c-h####.g####.com
d####.zhuo####.com
down####.zhuo####.com
gp.lik####.com
gp.miaoxi####.com
gpup####.min####.com
h####.b####.com
l.a####.com
pm.zhuo####.com
rt.hm####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sh.penc####.com
www.koapk####.com
www.okyes####.com

Запросы HTTP GET:

gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat

Запросы HTTP POST:

and####.b####.qq.com/rqd/async
gp.lik####.com/cr/sv/getEPList
l.a####.com/pv.php
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/run/hy
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####

Изменения в файловой системе:

Создает следующие файлы:

/data/.xbin/api
/data/.xbin/bkdumpstate_znmy_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/data/####/bugly_db_legu-journal
/data/data/####/libshella-2.7.2.0.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/security_info
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkmq_yzmn_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/dumpstate_znmy_radish
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/mq_yzmn_hd
/system/xbin/supolicy
<Package Folder>/app_DEX_OPT/03339012.dex
<Package Folder>/app_DEX_OPT/05183278.dex
<Package Folder>/app_DEX_OPT/05334619.dex
<Package Folder>/app_DEX_OPT/06424525.dex
<Package Folder>/app_DEX_OPT/23282308.dex
<Package Folder>/app_DEX_OPT/23689249.dex
<Package Folder>/app_DEX_OPT/34765202.dex
<Package Folder>/app_DEX_OPT/36236553.dex
<Package Folder>/app_DEX_OPT/42069573.dex
<Package Folder>/app_DEX_OPT/57742567.dex
<Package Folder>/app_DEX_OPT/91675457.dex
<Package Folder>/app_DEX_OPT/97036719.dex
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/dumpstate_znmy_radish
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510835719581.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/mq_yzmn_hd
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510835719692.zip
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/03339012.apk
<Package Folder>/files/####/05183278.apk
<Package Folder>/files/####/05334619.apk
<Package Folder>/files/####/06424525.apk
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/23282308.apk
<Package Folder>/files/####/23689249.apk
<Package Folder>/files/####/34765202.apk
<Package Folder>/files/####/36236553.apk
<Package Folder>/files/####/42069573.apk
<Package Folder>/files/####/57742567.apk
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/91675457.apk
<Package Folder>/files/####/97036719.apk
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/N2026.data
<Package Folder>/files/####/N2030.data
<Package Folder>/files/####/N2040.data
<Package Folder>/files/####/dk812.data
<Package Folder>/files/####/dk813.data
<Package Folder>/files/####/dk818.data
<Package Folder>/files/####/dk833.data
<Package Folder>/files/####/dk887.data
<Package Folder>/files/####/dk889.data
<Package Folder>/files/####/dz_p866.data
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/ja201711131150.data
<Package Folder>/files/####/ntmp20522113
<Package Folder>/files/####/p_dzwk44.data
<Package Folder>/files/####/test
<Package Folder>/files/1510835717504_libneo32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1510835716640
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/p.dk812/####/forever.sh
<Package Folder>/p.dk812/####/krcfg.txt
<Package Folder>/p.dk812/####/krmain
<Package Folder>/p.dk812/####/krmain1510835797653.zip
<Package Folder>/p.dk812/####/krsdk.cert
<Package Folder>/p.dk813/####/forever.sh
<Package Folder>/p.dk813/####/krcfg.txt
<Package Folder>/p.dk813/####/krmain
<Package Folder>/p.dk813/####/krmain1510835720283.zip
<Package Folder>/p.dk813/####/krsdk.cert
<Package Folder>/p.dk818/####/forever.sh
<Package Folder>/p.dk818/####/krcfg.txt
<Package Folder>/p.dk818/####/krmain
<Package Folder>/p.dk818/####/krmain1510835780007.zip
<Package Folder>/p.dk818/####/krsdk.cert
<Package Folder>/p.dk833/####/forever.sh
<Package Folder>/p.dk833/####/krcfg.txt
<Package Folder>/p.dk833/####/krmain
<Package Folder>/p.dk833/####/krmain1510835770424.zip
<Package Folder>/p.dk833/####/krsdk.cert
<Package Folder>/p.dk887/####/forever.sh
<Package Folder>/p.dk887/####/krcfg.txt
<Package Folder>/p.dk887/####/krmain
<Package Folder>/p.dk887/####/krmain1510835726624.zip
<Package Folder>/p.dk887/####/krsdk.cert
<Package Folder>/p.dk889/####/forever.sh
<Package Folder>/p.dk889/####/krcfg.txt
<Package Folder>/p.dk889/####/krmain
<Package Folder>/p.dk889/####/krmain1510835789844.zip
<Package Folder>/p.dk889/####/krsdk.cert
<Package Folder>/p.dz866/####/ODY2ZXhl
<Package Folder>/p.dz866/####/ODY2ZXhl1510835767544.zip
<Package Folder>/p.dz866/####/ZGV4ZXoy
<Package Folder>/p.dz866/####/ZGV4ZXoy1510835766828.zip
<Package Folder>/p.dz866/####/error
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk9
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk91510835787504.zip
<Package Folder>/p.dzwk44/####/error
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/settingsLog.xml
<SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE20B7F21F347FC3A40.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE2478DDE6AB87569BC.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE24BADFC0E453793AD.png
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE216F7E3BA539C33E5.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE2330525D994617330.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE26C87D41DE97A0573.jpeg
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/horsemarket/Alloy Plane.apk

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0755 <Package Folder>/com.init.env
chmod 0771 <Package Folder>/.syslib-
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk812/files/forever.sh
chmod 0777 <Package Folder>/p.dk813/files/forever.sh
chmod 0777 <Package Folder>/p.dk813/files/krmain
chmod 0777 <Package Folder>/p.dk813/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk818/files/forever.sh
chmod 0777 <Package Folder>/p.dk818/files/krmain
chmod 0777 <Package Folder>/p.dk833/files/forever.sh
chmod 0777 <Package Folder>/p.dk833/files/krmain
chmod 0777 <Package Folder>/p.dk887/files/forever.sh
chmod 0777 <Package Folder>/p.dk887/files/krmain
chmod 0777 <Package Folder>/p.dk889/files/forever.sh
chmod 0777 <Package Folder>/p.dk889/files/krmain
chmod 0777 <Package Folder>/p.dz866/files/ODY2ZXhl
chmod 0777 <Package Folder>/p.dz866/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz866/files/error
chmod 0777 <Package Folder>/p.dzwk44/files/ZDJsdWEyeGxNekk9
chmod 0777 <Package Folder>/p.dzwk44/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzwk44/files/error
chmod 700 /data/data/com.vemobi.herogo/tx_shell/libshella-2.7.2.0.so
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 770 <Package Folder>/files/.play/test
chmod 777 <Package Folder>/p.dk812/files/krcfg.txt
chmod 777 <Package Folder>/p.dk813/files/krcfg.txt
chmod 777 <Package Folder>/p.dk818/files/krcfg.txt
chmod 777 <Package Folder>/p.dk833/files/krcfg.txt
chmod 777 <Package Folder>/p.dk887/files/krcfg.txt
chmod 777 <Package Folder>/p.dk889/files/krcfg.txt
getenforce
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
id
logcat -d -v threadtime
logcat -d -v time
ls -l /system/bin/su
mq_yzmn_hd
mq_yzmn_hd -c id
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh /system/bin/mq_yzmn_hd
sh /system/bin/mq_yzmn_hd -c id
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
su
su -c id

Загружает динамические библиотеки:

1510835717504_libneo32
com_zhuoyian_youxizhongxing110
getuiext2
libjni-comymrefpackagesjrrbaidu

Использует повышенные привилегии.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней