Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mobifun.11.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) st####.a####.com:80
- TCP(TLS/1.0) api.a####.com:443
Запросы DNS:
- api.a####.com
- st####.a####.com
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.gmpcache/gmpclasses.dex (deleted)
- <Package Folder>/.gmpcache/gmpclasses.jar
- <Package Folder>/.gmpcache/la.so
- <Package Folder>/cache/####/13a110aa_a7ee_41f0_ab00_09da552291b...leted)
- <Package Folder>/cache/####/13a110aa_a7ee_41f0_ab00_09da552291bc.jar
- <Package Folder>/cache/####/44614874_d763_453a_9fd9_b1380135790...leted)
- <Package Folder>/cache/####/44614874_d763_453a_9fd9_b13801357908.jar
- <Package Folder>/cache/####/84dced42_33ee_418c_8947_1f201028a9db.jar
- <Package Folder>/cache/####/9d5b1975_e421_4684_ac0d_5de6d80329b...leted)
- <Package Folder>/cache/####/9d5b1975_e421_4684_ac0d_5de6d80329bf.jar
- <Package Folder>/cache/####/e55b78d0_bea5_4481_936f_d338d83d8be...leted)
- <Package Folder>/cache/####/e55b78d0_bea5_4481_936f_d338d83d8bee.jar
- <Package Folder>/cache/####/gpay_jquery_6_1_classes.jar
- <Package Folder>/cache/####/gpay_pay_event_6_4_classes.jar
- <Package Folder>/cache/####/gpay_pay_sms_6_4_classes.jar
- <Package Folder>/cache/####/gpay_pay_uc_6_4_classes.jar
- <Package Folder>/cache/####/gpay_pay_wap_6_4_classes.jar
- <Package Folder>/cache/####/jquery_1_6.applet
- <Package Folder>/cache/####/jquery_1_7.applet
- <Package Folder>/cache/####/pay_event_4_6.applet
- <Package Folder>/cache/####/pay_event_7_7.applet
- <Package Folder>/cache/####/pay_method_card_1_7.applet
- <Package Folder>/cache/####/pay_method_mobile_1_7.applet
- <Package Folder>/cache/####/pay_sms_4_6.applet
- <Package Folder>/cache/####/pay_sms_5_7.applet
- <Package Folder>/cache/####/pay_uc_4_6.applet
- <Package Folder>/cache/####/pay_wap_4_6.applet
- <Package Folder>/cache/fe09f9fa-9642-4f14-aa9d-af04480ce9c9
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/snowplowEvents.sqlite
- <Package Folder>/databases/snowplowEvents.sqlite-journal
- <Package Folder>/databases/snowplowEvents.sqlite-shm (deleted)
- <Package Folder>/databases/snowplowEvents.sqlite-wal
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/api-plugin_1_105_.dex (deleted)
- <Package Folder>/files/####/api-plugin_1_105_.jar
- <Package Folder>/files/####/gpay_jquery_1_6.ap
- <Package Folder>/files/####/gpay_jquery_1_7.ap
- <Package Folder>/files/####/gpay_pay_event_4_6.ap
- <Package Folder>/files/####/gpay_pay_event_7_7.ap
- <Package Folder>/files/####/gpay_pay_method_card_1_7.ap
- <Package Folder>/files/####/gpay_pay_method_mobile_1_7.ap
- <Package Folder>/files/####/gpay_pay_sms_4_6.ap
- <Package Folder>/files/####/gpay_pay_sms_5_7.ap
- <Package Folder>/files/####/gpay_pay_uc_4_6.ap
- <Package Folder>/files/####/gpay_pay_wap_4_6.ap
- <Package Folder>/files/8c20f011-86c5-440e-8e33-6dae7de654eb
- <Package Folder>/files/unsent_requests
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/GAOYUANYUAN.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/c0004105.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
- <SD-Card>/Android/####/59afa94a89830.zip.tmp
- <SD-Card>/Android/####/GfeCzjufYHWLzc
Другие:
Запускает следующие shell-скрипты:
- cat /proc/cpuinfo
- grep <Package>
- grep u0_a43
- ps
- ps adbd
- ps logcat
- sh -c cat /proc/2487/cmdline
- sh -c ps | grep <Package>
- sh -c ps | grep u0_a43
Загружает динамические библиотеки:
- la
- pay
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
