Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
- Android.Mixi.32.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) rt.hm####.com:80
- TCP(HTTP/1.1) gp.lik####.com:80
- TCP(HTTP/1.1) pm.zhuo####.com:80
- TCP(HTTP/1.1) api.zhuo####.com:80
- TCP(HTTP/1.1) gpup####.b0.a####.com:80
- TCP(HTTP/1.1) gp.miaoxi####.com:80
- TCP(HTTP/1.1) gpup####.min####.com:80
- TCP(HTTP/1.1) down####.zhuo####.com:80
Запросы DNS:
- api.a####.z####.com
- api.zhuo####.com
- c-h####.g####.com
- down####.zhuo####.com
- gp.lik####.com
- gp.miaoxi####.com
- gpup####.min####.com
- h####.b####.com
- newswif####.dftou####.com
- pm.zhuo####.com
- rt.hm####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sh.penc####.com
- v####.dn####.top
Запросы HTTP GET:
- api.zhuo####.com/Api/UnifiedAccess?PBindKey=####&data=ey####
- gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
- gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
Запросы HTTP POST:
- gp.lik####.com/cr/sv/getEPList
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_mdex/abc.zip
- <Package Folder>/app_mdex/classes.dex
- <Package Folder>/app_process_lock/25577954.9127063
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/files/####/.md
- <Package Folder>/files/####/5horsebrowser1012<System Property>46
- <Package Folder>/files/####/<Package>12<System Property>2
- <Package Folder>/files/####/C18AFF9E39574FE2E0A3220A8CD5BC12
- <Package Folder>/files/####/E04D09FBB9D7D7208CF16653768CC163
- <Package Folder>/files/####/gpdu
- <Package Folder>/files/####/ntmp21882205
- <Package Folder>/files/####/ntmp25032549
- <Package Folder>/files/####/test
- <Package Folder>/files/1512539338421_libneo32.so
- <Package Folder>/files/1512539385942_libneo32.so
- <Package Folder>/files/610.jar
- <Package Folder>/files/617.jar
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1512539328424
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/HETEENHAPPYFAMILYDATA.xml
- <Package Folder>/shared_prefs/V3.1.2.xml
- <Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/getui_sp.xml
- <Package Folder>/shared_prefs/vbz.xml
- <SD-Card>/Android/####/0bd7b256cdb4760f744e52ffc70d3e32.0
- <SD-Card>/Android/####/115209b1d9cd8bbc265614752eedf918.0
- <SD-Card>/Android/####/1842f8447dce6403e50333d9b8010c42.0
- <SD-Card>/Android/####/186720b7e185c98d6db079bc21150898.0
- <SD-Card>/Android/####/2305ebd88044053666658b09defea14f.0
- <SD-Card>/Android/####/286607a7ec722362d50233ea993fbc09.0
- <SD-Card>/Android/####/34a56288ed2d17f7d82ee9889163c1ab.0.tmp
- <SD-Card>/Android/####/35861167d6e329ac5ad7d950abb301a3.0
- <SD-Card>/Android/####/3cb5250ea30f410c3eef93a7be8b4c74.0
- <SD-Card>/Android/####/62093f0f99ff46308735a3690079e272.0
- <SD-Card>/Android/####/6fdaa731b0b007a125dde442da541dac.0
- <SD-Card>/Android/####/79d36e686ca63e8ca1ee390aacba6320.0.tmp
- <SD-Card>/Android/####/7b3e2183137e93c72360db87527fa2e2.0
- <SD-Card>/Android/####/9ce9b69045fa41d0607c997719db041d.0
- <SD-Card>/Android/####/a097b9f86508a7c6a08c87ace293362e.0
- <SD-Card>/Android/####/a47f4e6c25671a100fb8597eafc7acd2.0
- <SD-Card>/Android/####/b2bff5d3fa8a1356dce3f775e52e2932.0.tmp
- <SD-Card>/Android/####/b6a93820f5feac92d963847bd1bd1e12.0
- <SD-Card>/Android/####/bfdd661f3243a35c910e26da82000ab3.0
- <SD-Card>/Android/####/c25539480f28031ea8385aa7db9fc559.0
- <SD-Card>/Android/####/c4ccc109e14ff712e65694089832bc16.0.tmp
- <SD-Card>/Android/####/cf3c3f1dbab77b3842c0f49569adbe7e.0.tmp
- <SD-Card>/Android/####/cf857690b646b46a65eef96bec26597e.0
- <SD-Card>/Android/####/d78014cac44e7d8ce6ce3da45103e66e.0
- <SD-Card>/Android/####/ebc8dbc392c66f1b42f5cdbdfbd43346.0
- <SD-Card>/Android/####/ed470b5fd8ed7940a5baa133aab2c4a4.0
- <SD-Card>/Android/####/f729ea46142986758c8d2e2e997dced2.0
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/llc/####/20171206AdRequest
- <SD-Card>/system/724be9461f0780fcce00c5be5d3622cd.apk.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25761 300 0
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25761 300 0
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
Загружает динамические библиотеки:
- 1512539338421_libneo32
- 1512539385942_libneo32
- com_zhuoyian_horsebrowser101
- getuiext2
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
