Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Spy.1674.origin
Детект на основе машинного обучения.
Сетевая активность:
Подключается к:
- TCP(???) www.datou####.com:443
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.datou####.com:443
- TCP(TLS/1.0) pss.bdst####.com.####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) www.datou####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) psst####.cdn.bc####.####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) opencdn####.jom####.com:443
- TCP(TLS/1.0) www.a.sh####.com:443
- TCP(TLS/1.0) content####.google####.com:443
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) openc####.jom####.com:443
Запросы DNS:
- api.tele####.org
- clients####.google####.com
- content####.google####.com
- ed####.me.g####.com
- openc####.jom####.com
- opencdn####.jom####.com
- pss.bdst####.com.####.com
- psst####.cdn.bc####.####.com
- up####.google####.com
- wap.n.sh####.com
- www.a.sh####.com
- www.datou####.com
Запросы HTTP GET:
- www.datou####.com:443/io1771/?cmode=####&EIO=####&transport=####&apkid=#...
- www.datou####.com:443/ws/binary-device?deviceId=####
Запросы HTTP POST:
- www.datou####.com:443/api/device_log
Изменения в файловой системе:
Создает следующие файлы:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /data/data/####/.org.chromium.Chromium.S2txW1
- /data/data/####/.org.chromium.Chromium.npvjmH
- /data/data/####/000001.dbtmp
- /data/data/####/005e9b517770e4fe_0
- /data/data/####/0666c5f2ea1f438d_0
- /data/data/####/0731b42ca98730a8_0
- /data/data/####/087c8870b4b1f676_0
- /data/data/####/09095521bf3c3813_0
- /data/data/####/137737668a91cf63_0
- /data/data/####/1a4cfbc356440fea_0
- /data/data/####/2c8d2110a018f853_0
- /data/data/####/313059071847fa5d_0
- /data/data/####/3dc2e8c190acc329_0
- /data/data/####/3e92c85b032b55ae_0
- /data/data/####/441a9b37d5af6ac4_0
- /data/data/####/481a394413ce7c68_0
- /data/data/####/4df86639a577c6a8_0
- /data/data/####/55fdbba002ef0755_0
- /data/data/####/5823e3ef165a3c0e_0
- /data/data/####/5924f3b3f0790ce5_0
- /data/data/####/5b6c2fa148e216b7_0
- /data/data/####/5bcd21ed896e97a9_0
- /data/data/####/7508f053480a9fd8_0
- /data/data/####/76fd52ab1251c99e_0
- /data/data/####/773d4cc5b7fac3db_0
- /data/data/####/81bf4c7ea5c561ea_0
- /data/data/####/81ee2b8cb8aa749c_0
- /data/data/####/8709d98d7f36915f_0
- /data/data/####/8711e26ea020b130_0
- /data/data/####/8812f1418ee416fc_0
- /data/data/####/970f3f0087442434_0
- /data/data/####/9a705bdaa451da1b_0
- /data/data/####/9b5c934fa58da19a_0
- /data/data/####/ALS.web
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a5406f1f0ce34900_0
- /data/data/####/a60243803df9812e_0
- /data/data/####/ae649de81ea5edd7_0
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/app_state.xml
- /data/data/####/b6961f83a65509a7_0
- /data/data/####/b99d263e2511433d_0
- /data/data/####/bat_unrestrict.xml
- /data/data/####/cc6bb23e38f4004c_0
- /data/data/####/config.xml
- /data/data/####/da9440d23c044113_0
- /data/data/####/da_activator.xml
- /data/data/####/daf3f77fe7c723a3_0
- /data/data/####/ddd286636c157a38_0
- /data/data/####/diag_log.xml
- /data/data/####/e3d70051bc6b8432_0
- /data/data/####/ee8aa4828783b50a_0
- /data/data/####/f49d5d9f9c277681_0
- /data/data/####/fea6a3deab41a38b_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/kl_store.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_07d0e4548a83269d_0_1 (deleted)
- /data/data/####/todelete_24216d82809b2e72_0_1 (deleted)
- /data/data/####/todelete_41dd65ef01c2eaad_0_1 (deleted)
- /data/data/####/todelete_63b7892b2764532b_0_1 (deleted)
- /data/data/####/todelete_9771d06c8a911ca7_0_1 (deleted)
- /data/data/####/todelete_aa5cb5c948b1b6da_0_1 (deleted)
- /data/data/####/todelete_cccf950eb4a8e42b_0_1 (deleted)
- /data/data/####/todelete_e283dd813b9930a8_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh /system/bin/settings put global pocket_mode 0
- /system/bin/sh /system/bin/settings put secure accidental_touch_protection 0
- /system/bin/sh /system/bin/settings put secure anti_mistouch 0
- /system/bin/sh /system/bin/settings put secure asus_pocket_mode 0
- /system/bin/sh /system/bin/settings put secure aware_lock_enabled 0
- /system/bin/sh /system/bin/settings put secure moto_touch_disable 0
- /system/bin/sh /system/bin/settings put secure pocket_detection 0
- /system/bin/sh /system/bin/settings put secure pocket_mode 0
- /system/bin/sh /system/bin/settings put secure pocket_mode_enabled 0
- /system/bin/sh /system/bin/settings put secure smart_cover_mode 0
- /system/bin/sh /system/bin/settings put secure sony_pocket_detection 0
- /system/bin/sh /system/bin/settings put secure touch_disable_mode 0
- /system/bin/sh /system/bin/settings put secure vivo_pocket_mode 0
- /system/bin/sh /system/bin/settings put secure zte_pocket_mode 0
- /system/bin/sh /system/bin/settings put system accidental_touch 0
- /system/bin/sh /system/bin/settings put system accidental_touch_protection 0
- /system/bin/sh /system/bin/settings put system anti_mistouch 0
- /system/bin/sh /system/bin/settings put system asus_pocket_mode 0
- /system/bin/sh /system/bin/settings put system lenovo_pocket_mode 0
- /system/bin/sh /system/bin/settings put system mistouch_prevention 0
- /system/bin/sh /system/bin/settings put system moto_touch_disable 0
- /system/bin/sh /system/bin/settings put system nothing_pocket_mode 0
- /system/bin/sh /system/bin/settings put system nubia_pocket_mode 0
- /system/bin/sh /system/bin/settings put system oplus_pocket_mode 0
- /system/bin/sh /system/bin/settings put system pocket_detection 0
- /system/bin/sh /system/bin/settings put system pocket_judge 0
- /system/bin/sh /system/bin/settings put system pocket_mistouch_prevention 0
- /system/bin/sh /system/bin/settings put system pocket_mode 0
- /system/bin/sh /system/bin/settings put system pocket_mode_enabled 0
- /system/bin/sh /system/bin/settings put system prevent_pocket_mode 0
- /system/bin/sh /system/bin/settings put system proximity_pocket_mode 0
- /system/bin/sh /system/bin/settings put system smart_cover_mode 0
- /system/bin/sh /system/bin/settings put system sony_pocket_detection 0
- /system/bin/sh /system/bin/settings put system tcl_pocket_mode 0
- /system/bin/sh /system/bin/settings put system touch_disable_mode 0
- /system/bin/sh /system/bin/settings put system vivo_pocket_mode 0
- /system/bin/sh /system/bin/settings put system zte_pocket_mode 0
- cmd settings put global pocket_mode 0
- cmd settings put secure accidental_touch_protection 0
- cmd settings put secure anti_mistouch 0
- cmd settings put secure asus_pocket_mode 0
- cmd settings put secure aware_lock_enabled 0
- cmd settings put secure moto_touch_disable 0
- cmd settings put secure pocket_detection 0
- cmd settings put secure pocket_mode 0
- cmd settings put secure pocket_mode_enabled 0
- cmd settings put secure smart_cover_mode 0
- cmd settings put secure sony_pocket_detection 0
- cmd settings put secure touch_disable_mode 0
- cmd settings put secure vivo_pocket_mode 0
- cmd settings put secure zte_pocket_mode 0
- cmd settings put system accidental_touch 0
- cmd settings put system accidental_touch_protection 0
- cmd settings put system anti_mistouch 0
- cmd settings put system asus_pocket_mode 0
- cmd settings put system lenovo_pocket_mode 0
- cmd settings put system mistouch_prevention 0
- cmd settings put system moto_touch_disable 0
- cmd settings put system nothing_pocket_mode 0
- cmd settings put system nubia_pocket_mode 0
- cmd settings put system oplus_pocket_mode 0
- cmd settings put system pocket_detection 0
- cmd settings put system pocket_judge 0
- cmd settings put system pocket_mistouch_prevention 0
- cmd settings put system pocket_mode 0
- cmd settings put system pocket_mode_enabled 0
- cmd settings put system prevent_pocket_mode 0
- cmd settings put system proximity_pocket_mode 0
- cmd settings put system smart_cover_mode 0
- cmd settings put system sony_pocket_detection 0
- cmd settings put system tcl_pocket_mode 0
- cmd settings put system touch_disable_mode 0
- cmd settings put system vivo_pocket_mode 0
- cmd settings put system zte_pocket_mode 0
- sh -c settings put system accidental_touch_protection 0;settings put secure accidental_touch_protection 0;settings put system pocket_mode_enabled 0;settings put secure pocket_mode_enabled 0;settings put system oplus_pocket_mode 0;settings put system pocket_mistouch_prevention 0;settings put system pocket_mode 0;settings put secure pocket_mode 0;settings put system moto_touch_disable 0;settings put secure moto_touch_disable 0;settings put system touch_disable_mode 0;settings put secure touch_disable_mode 0;settings put system smart_cover_mode 0;settings put secure smart_cover_mode 0;settings put system vivo_pocket_mode 0;settings put secure vivo_pocket_mode 0;settings put system zte_pocket_mode 0;settings put secure zte_pocket_mode 0;settings put system nubia_pocket_mode 0;settings put system asus_pocket_mode 0;settings put secure asus_pocket_mode 0;settings put system pocket_judge 0;settings put system lenovo_pocket_mode 0;settings put system sony_pocket_detection 0;settings put secure sony_pocket_detection 0;settings put system nothing_pocket_mode 0;settings put system tcl_pocket_mode 0;settings put secure aware_lock_enabled 0;settings put system proximity_pocket_mode 0;settings put system prevent_pocket_mode 0;settings put system pocket_detection 0;settings put secure pocket_detection 0;settings put system anti_mistouch 0;settings put secure anti_mistouch 0;settings put system mistouch_prevention 0;settings put system accidental_touch 0;settings put global pocket_mode 0
Использует права администратора.
Осуществляет доступ к интерфейсу камеры.
Получает информацию об активных администраторах устройства.
Получает информацию об установленных приложениях.
Получает информацию о привязанных к устройству аккаунтах.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Получает информацию об отправленых/принятых SMS.
Перехватывает уведомления.
Запрашивает разрешение на отображение системных уведомлений.
Имеет подозрительные повреждения, типичные для вредоносных файлов.
Пытается определить окружение песочницы.
