Android.Packed.35154

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.234
Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Loki.10.origin
Android.Loki.47.origin
Android.Mixi.16.origin
Android.Mixi.32.origin
Android.RemoteCode.88.origin
Android.Xiny.1.origin
Android.Xiny.237.origin
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) www.ret####.com:80
TCP(HTTP/1.1) l####.admobim####.com:80
TCP(HTTP/1.1) ads.dofun####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) trac####.le####.com:80
TCP(HTTP/1.1) appromo####.trac####.adnova####.com:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) got.pubna####.net:80
TCP(HTTP/1.1) clinkad####.com:80
TCP(HTTP/1.1) m.hxc####.com:80
TCP(HTTP/1.1) su####.icec####.org:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) gpup####.min####.com:80
TCP(HTTP/1.1) ru.playa####.in:80
TCP(HTTP/1.1) c####.trackac####.net:80
TCP(HTTP/1.1) advc####.weclou####.com:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) t####.click####.com:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) adn.vision-####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) www.recycl####.com:80
TCP(HTTP/1.1) api.ocea####.com:80
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) ads.digg####.com:80
TCP(HTTP/1.1) trk.gl####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) newt####.adc####.com:80
TCP(HTTP/1.1) t.mob####.net:80
TCP(HTTP/1.1) cl####.mob####.net:80
TCP(HTTP/1.1) c####.howdo####.net:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) a.n####.ren:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) trac####.c####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) c####.ads####.com:80
TCP(HTTP/1.1) t.api.y####.net:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) a####.pubna####.net:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(TLS/1.0) nazaraa####.b####.c####.####.net:443
TCP(TLS/1.0) gl####.ymtrac####.com:443
TCP(TLS/1.0) app.ad####.com:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) go1.mob####.xyz:443
TCP(TLS/1.0) app####.hs.l####.net:443
TCP(TLS/1.0) app.appsf####.com:443
TCP(TLS/1.0) lh5.g####.com:443
TCP(TLS/1.0) bris####.go2af####.com:443
TCP(TLS/1.0) a####.app####.com:443
TCP(TLS/1.0) smarto####.site:443

Запросы DNS:

a####.app####.com
a####.pubna####.net
a####.u####.com
a####.w####.in
a.n####.ren
activeo####.appromo####.com
adn.vision-####.com
ads.digg####.com
ads.dofun####.com
advc####.weclou####.com
akw.e####.space
ali.f####.cdn.####.com
api.mob####.b####.com
api.ocea####.com
app####.hs.l####.net
app.ad####.com
app.appsf####.com
aws.smarter####.net
bris####.go2af####.com
c####.ads####.com
c####.gowa####.com
c####.howdo####.net
c####.trackac####.net
c-h####.g####.com
c.s####.co
cl####.mob####.net
clinkad####.com
d####.zhuo####.com
d3656q1####.cloudf####.net
duc####.b####.com
e####.w####.in
e.hiph####.b####.com
ea.sno####.1####.com
en.sno####.1####.com
gl####.ymtrac####.com
go1.mob####.xyz
got.pubna####.net
gp.lik####.com
gp.miaoxi####.com
gpup####.min####.com
h####.b####.com
j.bay####.com
l####.admobim####.com
l.a####.com
lh3.googleu####.com
lh5.g####.com
m.hxc####.com
mo.freeind####.com
nazaraa####.b####.c####.####.net
newt####.adc####.com
oc.u####.co
oc.u####.com
p####.a####.com
p.g####.b####.com
pm.zhuo####.com
rt.hm####.com
ru.playa####.in
s####.mob####.b####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sh.penc####.com
smarto####.site
su####.icec####.org
t####.click####.com
t.api.y####.net
t.mob####.net
trac####.c####.com
trac####.le####.com
trac####.suma####.com
trk.gl####.com
www.admobim####.com
www.cu####.com
www.jp####.com
www.koapk####.com
www.mmmmmm####.com
www.okyes####.com
www.recycl####.com
www.ret####.com
www.zfr####.com

Запросы HTTP GET:

a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
adn.vision-####.com/API/Click.ashx?M=####&sid=####&idfa=####&gaid=####&a...
adn.vision-####.com/API/Click.ashx?M=MTA4N####&sid=####&idfa=####&gaid=#...
ads.digg####.com/acs.php?sid=####&adid=####&os=####&osv=####&udid=####&g...
ads.dofun####.com/acs.php?sid=####&adid=####&pb=####&os=####&osv=####&ga...
advc####.weclou####.com/advclick?advposid=####&mapid=####&aid=####&adid=...
api.mob####.b####.com/index.php?r=####
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
api.ocea####.com/tracking/index/s5a245173840b8?gaid=####&idfa=####&andid...
c####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&clic...
c####.gowa####.com/click?transaction_id=wadogo_WAdvAppthisNewAPI_304213_...
clinkad####.com/tracking?camp=####&pubid=####&sid=####&sid1=####&sid2=##...
duc####.b####.com/click/affClick?aff_id=####&offer_id=####&aff_sub3=####...
e####.w####.in/interface/mothdvista.php?subid=####&pjid=####&uid=####&Im...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
m.hxc####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=##...
newt####.adc####.com/aff_c?offer_id=####&aff_id=####&aff_sub3=####&aff_s...
p####.a####.com/img/bdar40641.png
ru.playa####.in/English/default.aspx?PId=####&OprId=####&Ctg=####&msisdn...
ru.playa####.in/css/demo.css
ru.playa####.in/css/font-awesome.css
ru.playa####.in/css/jquery.bxslider.css
ru.playa####.in/css/jquery.mmenu.css
ru.playa####.in/css/jquery.mmenu.dragopen.css
ru.playa####.in/getsubscribe.aspx?ctg=####&click_id=####&pubid=####
ru.playa####.in/images/bx_loader.gif
ru.playa####.in/images/left-7x40.png
ru.playa####.in/images/menu.png
ru.playa####.in/images/right-7x40.png
ru.playa####.in/images/russia_16.png
ru.playa####.in/js/jquery-2.2.0.js
ru.playa####.in/js/jquery.bxslider.js
ru.playa####.in/js/jquery.bxslider.min.js
ru.playa####.in/js/jquery.mmenu.dragopen.min.js
ru.playa####.in/js/jquery.mmenu.fixedelements.min.js
ru.playa####.in/js/jquery.mmenu.min.js
ru.playa####.in/js/modernizr.js
ru.playa####.in/js/parallax.js
t####.click####.com/v1/ad/click?pubid=####&campid=####&geo=####&aid=####...

Запросы HTTP POST:

e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/log/record
gp.lik####.com/cr/sv/getEPList
l####.admobim####.com/surl/api3_status.action
l.a####.com/pv.php
l.a####.com/sal.php
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
su####.icec####.org/offer
su####.icec####.org/setting
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.koapk####.com:8081/sm/sr/rt/ry
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/index
<Package Folder>/cache/intel-686467187.txt
<Package Folder>/cachemylibs/as.jar
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/http_ru.playalive.in_0.localstorage-journal
<Package Folder>/files/####/husky.tmp
<Package Folder>/files/####/husky_10804.dex
<Package Folder>/files/####/husky_10804.jar
<Package Folder>/files/####/ntmp20742290
<Package Folder>/files/####/sf_file_provider.dat
<Package Folder>/files/####/test
<Package Folder>/files/1513415547880_libneo32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<Package>.zip
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1513415540098
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/d.zip
<Package Folder>/files/dat.dat
<Package Folder>/files/dtemp.apk
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/google.db
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/lib.dat
<Package Folder>/files/libcuid.so
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/mingsk
<Package Folder>/files/ob1.zip
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail752.so
<Package Folder>/files/snowfox_mid.so
<Package Folder>/files/snowfox_sdk_so-v22c.jar
<Package Folder>/files/snowfox_v22c.jar
<Package Folder>/files/snowfox_v22c.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml (deleted)
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak (deleted)
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/cn_rs.xml.bak
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml.bak
<Package Folder>/shared_prefs/m_cfg.xml.bak (deleted)
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/sdk_scl_pid_config.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/settingsLog.xml.bak (deleted)
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml (deleted)
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/t_ini.xml.bak (deleted)
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/upgrade_config.xml
<Package Folder>/shared_prefs/userconfig.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.googlev7/.libx2coas
<SD-Card>/.salvia/####/-1248190381.temp
<SD-Card>/.salvia/####/-1486950981.temp
<SD-Card>/.salvia/####/-956010197.temp
<SD-Card>/.salvia/####/2043607122.temp
<SD-Card>/.salvia/<Package>
<SD-Card>/Android/####/dev_18b2e6ae.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/journal
<SD-Card>/LogG/####/sp
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
c201708041650.apk -p <Package> -c <Package>:baidu
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 0771 <Package Folder>/.syslib-
chmod 6777 <Package Folder>/files/c201708041650.apk
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Загружает динамические библиотеки:

1513415547880_libneo32
com_zhuoyian_youxizhongxing110
getuiext2
intel-686467187
libjni-comymrefpackagesjrrbaidu

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней