Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.RemoteCode.93.origin
- Android.Xiny.232.origin
- Android.Xiny.233.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) premium####.com:80
- TCP(HTTP/1.1) d.billyaf####.com:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) ald####.com:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) s####.brv####.com:80
- TCP(HTTP/1.1) newrota####.com:80
- TCP(HTTP/1.1) api.inlabdi####.com:80
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) tra####.tc-cl####.com:80
- TCP(HTTP/1.1) beebeet####.com:80
- TCP(HTTP/1.1) trietha####.com:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) akw.e####.space:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) p####.le####.com:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) cpgnrot####.com:80
- TCP(TLS/1.0) p####.lead####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) normale####.com:443
- TCP(TLS/1.0) formula####.com:443
- TCP(TLS/1.0) 2####.58.212.238:443
- TCP(TLS/1.0) despite####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) billmsc####.com:443
Запросы DNS:
- akw.e####.space
- ald####.com
- api.inlabdi####.com
- api.mob####.b####.com
- beebeet####.com
- billmsc####.com
- celery####.com
- cpgnrot####.com
- d.billyaf####.com
- despite####.com
- f####.google####.com
- f####.gst####.com
- formula####.com
- hoodse####.com
- mo.freeind####.com
- newrota####.com
- normale####.com
- offer####.online
- p####.le####.com
- p####.lead####.com
- premium####.com
- s####.brv####.com
- s####.mob####.b####.com
- t####.bruce####.com
- tra####.tc-cl####.com
- www.admobim####.com
- www.cu####.com
- www.mmmmmm####.com
- www.zfr####.com
Запросы HTTP GET:
- akw.e####.space/index.php?r=####
- akw.e####.space/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&s...
- akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- ald####.com/ck_jump?id=cz02####&__if=####&__type=####&__ref=####
- api.inlabdi####.com/v1.0/track/703710d31c70324f465072720f2ac47dbf25464f?...
- s####.brv####.com/click/s/?id=####&aff_click_id=####&aff_sub_id=####&_uu...
- tretras####.com/19o18/kbzy/n7ji/x_S0TesPpQPjcwaQb-YoASVhslfsPULxExF_fWSD...
Запросы HTTP POST:
- mo.freeind####.com/detail/getOfferListNew?enc=####
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
- www.mmmmmm####.com/osp/oaen_reg.action
- www.zfr####.com/up.do?enc=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_lib/libyoxed.so
- <Package Folder>/cache/####/0390960c0f61719a311fe3c40f05a38453c....0.tmp
- <Package Folder>/cache/####/042dc50cc9c7bad580bbe3cd3983ab19a87....0.tmp
- <Package Folder>/cache/####/043c0edbd718618fc1f8d92f2ad641b2c3a....0.tmp
- <Package Folder>/cache/####/09be6f54b1a7b6e9fe0963646f748ab4f5f....0.tmp
- <Package Folder>/cache/####/0c472b7cd65a002b5328a366c9a174efecd....0.tmp
- <Package Folder>/cache/####/0d46ef9989f1338be5e873b057691cf0362....0.tmp
- <Package Folder>/cache/####/1bbd92deaeed87125af20e2e6644f956761....0.tmp
- <Package Folder>/cache/####/1f24767cb4c1a31f04251110d1e3a52d78e....0.tmp
- <Package Folder>/cache/####/219661b93657d055fdc44c8e82347b8807c....0.tmp
- <Package Folder>/cache/####/25dc6404147babfdcb5899a2a3ae9fac09b....0.tmp
- <Package Folder>/cache/####/2c817700283f3e77dcef004bbeaa8cec240....0.tmp
- <Package Folder>/cache/####/30098ec7fe4dbf34c02d835b12013145b6a....0.tmp
- <Package Folder>/cache/####/30ba3d1f1310c590f7ebfc721373967cf74....0.tmp
- <Package Folder>/cache/####/31363ca9dc87d9d39a2a9f5127819d8bc9e....0.tmp
- <Package Folder>/cache/####/372dbf1a5b0c1e944cb08e755d48346c0bf....0.tmp
- <Package Folder>/cache/####/397cfa7cc1dc86a03dad7dc32beb6fc8c9e....0.tmp
- <Package Folder>/cache/####/3c535b99eceec8f66d8841c7b2481db71ad....0.tmp
- <Package Folder>/cache/####/44e613db9dab42622c04140b64e43046eaa....0.tmp
- <Package Folder>/cache/####/4b7201e0121a1310e4ffa1ffa3e98fe503e....0.tmp
- <Package Folder>/cache/####/58ef1158ba6272effda19ab5c89ca581e93....0.tmp
- <Package Folder>/cache/####/5c3c883afab09c67a2afdeacb46561094da....0.tmp
- <Package Folder>/cache/####/60b91f53ce7f10cc33c5d0ffc0e8834e599....0.tmp
- <Package Folder>/cache/####/631d81d97513a4f6bacf081b2c92e329860....0.tmp
- <Package Folder>/cache/####/662997612ad8a2eba7632466ae05ffa95b6....0.tmp
- <Package Folder>/cache/####/732cd6685a857242d9b4d190d87a5167e01....0.tmp
- <Package Folder>/cache/####/81ec997f31c9fe99bd07ca27eb09ad5f516....0.tmp
- <Package Folder>/cache/####/832cfd0e9df57fed2d753ef193e8e6d9360....0.tmp
- <Package Folder>/cache/####/8640d8b94ee485b60e5629861e14cc04779....0.tmp
- <Package Folder>/cache/####/8c3832aefe31ba2b2717ed257807f04866f....0.tmp
- <Package Folder>/cache/####/96f7a9164ee5f686f2683025922b9431eae....0.tmp
- <Package Folder>/cache/####/9ffa777722f8f1581b0ed25f9327be3ea45....0.tmp
- <Package Folder>/cache/####/abba37b747e369ffbbad240bdad920d43f1....0.tmp
- <Package Folder>/cache/####/af42b078f7d0263b25fefdc52a8042640ad....0.tmp
- <Package Folder>/cache/####/b166b30c07bf5971dcc86a01af1c43d60b7....0.tmp
- <Package Folder>/cache/####/b1ac06a8f8ab415dbfdcc804f5ce2ef097f....0.tmp
- <Package Folder>/cache/####/bc4621e3b66af083cfb7cd4fd755f3f6285....0.tmp
- <Package Folder>/cache/####/bc664db51a2574ec3b3a6304ed4efb4c066....0.tmp
- <Package Folder>/cache/####/c2a1746ddbbe61a4211390890c3709f22df....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/ddc5950ee6ef024002842a27074d987f9dc....0.tmp
- <Package Folder>/cache/####/e3fd87db4ca8d66dfb3d18c49b776e28da9....0.tmp
- <Package Folder>/cache/####/e584a6ec328bc480b5b8aacdbcd9fe08538....0.tmp
- <Package Folder>/cache/####/e714afbe1cacaf6756a5a2779f597771c2c....0.tmp
- <Package Folder>/cache/####/edc2ca33f5fe60388cd01f0942bef05ad78....0.tmp
- <Package Folder>/cache/####/f0f62124c5220e46c895de01bca3472944f....0.tmp
- <Package Folder>/cache/####/f5b81cddbd9fb013ac268f1f6933fc810cd....0.tmp
- <Package Folder>/cache/####/f5c56e5b6de255898e58f83f8feec42f252....0.tmp
- <Package Folder>/cache/####/fb20ac83a6e71ed4ba7f7e2e260a103b7bc....0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code_cache/####/<Package>-1.apk.classes2.dex
- <Package Folder>/code_cache/####/<Package>-1.apk.classes867068438.zip
- <Package Folder>/databases/adblib.db
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/my.db
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/sample_selfie.png
- <Package Folder>/files/####/sample_sight.png
- <Package Folder>/files/d.dex
- <Package Folder>/files/d.dex (deleted)
- <Package Folder>/files/d.zip
- <Package Folder>/files/dtemp.apk
- <Package Folder>/files/f.dex
- <Package Folder>/files/f.zip
- <Package Folder>/files/google.db
- <Package Folder>/files/ob.dex
- <Package Folder>/files/ob.zip
- <Package Folder>/files/persisted_config
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/D824hunter_config.xml
- <Package Folder>/shared_prefs/D824other_config.xml
- <Package Folder>/shared_prefs/D824service_config.xml
- <Package Folder>/shared_prefs/D824sp_config.xml
- <Package Folder>/shared_prefs/D824upgrade_config.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/local_content.xml
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/s_lumera.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/Android/####/pid
- <SD-Card>/LogN/####/sp
- <SD-Card>/baidu/####/journal
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
Другие:
Запускает следующие shell-скрипты:
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.rmn.duy.Ew
- chmod 777 <Package Folder>/byoxed
- dd if=<Package Folder>/lib/libyoxed.so of=<Package Folder>/byoxed
- sh
Загружает динамические библиотеки:
- candy-library
- candy-library-es3
- libyoxed
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
