Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.332.origin
Сетевая активность:
Подключается к:
- s####.####.com
- 2####.####.123
- g####.####.net
- i####.####.com
- d####.####.com
- s####.####.com:9090
- 1####.####.174:8081
- g####.####.net:8080
- 1####.####.174
- 2####.####.123:95
- a####.####.com
Запросы HTTP GET:
- 1####.####.174/tone/6c88354a-2fe0-4bd8-9a3b-72c43f82a04c.jpg
- 1####.####.174/tone/f55308ed-a558-428e-a0eb-1cd86d2ac0f2.png
- 1####.####.174/tone/d71b0cdc-dd45-4cd2-81ca-3d69b0130134.jpg
- 1####.####.174/tone/d97cb99e-23c5-47eb-ad36-1699fe5a09f6.jpg
- 1####.####.174/tone/ef2f295d-b679-459c-94d2-9f4a678c0010.jpg
- 1####.####.174/tone/5b6fd49b-10c5-4804-a320-0762882e6f8f.jpg
- 1####.####.174/tone/3264e381-b51d-486a-a61c-cf8dbd0d8410.jpg
- 1####.####.174/tone/39cf3a13-d870-41e6-b3cd-11e30dd26700.jpg
- 1####.####.174/tone/6bdc4706-fb4e-4c00-b7c4-487d34b1d704.jpg
- 1####.####.174/tone/7d25e1f0-bcd7-4287-81b3-249ca0aaae05.jpg
- 1####.####.174/tone/18657545-3753-4895-a7e6-02d7cde12da1.jpg
- 1####.####.174/tone/c1eeff28-d7c5-450e-9aff-5ec81567cb46.apk
- 1####.####.174/tone/de7dc86b-18d6-4a97-ae3d-e42806eed8b1.jpg
- 1####.####.174/tone/7d3dcf2e-2536-4f6b-b8f8-6f946cbff139.jpg
Запросы HTTP POST:
- a####.####.com/errconf
- 2####.####.123/sdkServer/1.0/user/query
- d####.####.com/dsign
- 1####.####.174/home/dataList?ts=####&sig=NTI####
- 1####.####.174/Other/ApkUpd?ts=####&sig=NkU####
- 1####.####.174/Other/ApkUpd?ts=####&sig=ODk####
- 1####.####.174/home/banner?ts=####&sig=QTg####
- 2####.####.123/sdkServer/1.0/crbt/open/check
- s####.####.com/zfservices/advert/query
- 2####.####.123/sdkServer/1.0/cp/query
- 1####.####.174/home/BannerSitf?ts=####&sig=NjB####
- 1####.####.174/home/dataList?ts=####&sig=Q0M####
- 1####.####.174/home/BannerSitf?ts=####&sig=OTg####
- g####.####.net/migusdk/verification/checkSdkUpdate
- g####.####.net:8080/migusdk/tl/initcttl
- 1####.####.174/Other/Splash?ts=####&sig=QUI####
- 1####.####.174/Other/Splash?ts=####&sig=MTg####
- d####.####.com/dinfo
- 2####.####.123:95/sdkServer/checksmsinitreturn
- 1####.####.174/home/dataList?ts=####&sig=NTh####
- 2####.####.123/sdkServer/checksmsinitreturn
- g####.####.net/migusdk/tl/initcttl
- i####.####.com/sdk/init
- 1####.####.174:8081/User/AppActive?ts=####&sig=OTF####
- 1####.####.174/User/AppActive?ts=####&sig=OTE####
- s####.####.com:9090/fcc/ws
- 1####.####.174/home/banner?ts=####&sig=ODJ####
- s####.####.com/fcc/ws
- 1####.####.174/home/dataList?ts=####&sig=REY####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/JPushSA_Config.xml.bak
- /data/data/####/shared_prefs/SMSSDK_VCODE_1.xml
- /sdcard/Qxtimes/db/.QxTimes_ring.db
- /data/data/####/cache/volley/12014282981276488381
- /data/data/####/databases/####.Resident.db-journal
- /data/data/####/cache/volley/1807383986-1601639683
- /data/data/####/cache/volley/17827257532066940457
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Qxtimes/ring/volley/4bgwhvj9dnat6i3t1lu3akfnh
- /data/data/####/cache/picasso-cache/9b2afafb039e148d802c0c2c133b5a3c.1.tmp
- /data/data/####/cache/volley/17438726741550596426
- /data/data/####/cache/volley/113853199566350142
- /data/data/####/cache/volley/-1103588698299266771
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/volley/-110149242-1975084044
- /data/data/####/files/jacruntime.dex
- /data/data/####/shared_prefs/biosConfig.xml.bak
- /data/data/####/cache/picasso-cache/4e6f7a9c4c0c7201e800dab5ee5eaaf8.0.tmp
- /data/data/####/files/sdk_prefs
- /data/data/####/shared_prefs/com.qxtimes.library.music.tools.SharedPreferencesUtils.xml
- /sdcard/Qxtimes/app/3.1.9/c1eeff28-d7c5-450e-9aff-5ec81567cb46.apk.td
- /data/data/####/shared_prefs/biosConfig.xml
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/volley/-2134589363-620702299
- /sdcard/Mob/.duid
- /data/data/####/files/.lock
- /data/data/####/cache/volley/1782682850-1526861379
- /data/data/####/app_lib/libmiguED.so
- /data/data/####/cache/picasso-cache/eede301ee424e322461a7150c971b9aa.0.tmp
- /data/data/####/cache/picasso-cache/d84904333797845165c15dce289ed0f3.1.tmp
- /sdcard/storage/emulated/0null/63frthmzn1jsd6z3nfdgg5se9
- /data/data/####/databases/####.Resident.db
- /sdcard/Mob/.slock
- /data/data/####/cache/volley/1807387923-734633243
- /data/data/####/cache/volley/588186241-1640360890
- /data/data/####/shared_prefs/null.xml
- /sdcard/Qxtimes/ring/volley/4j62dl5y54p0tp2ojdmlccmli
- /data/data/####/shared_prefs/SMSSDK_2.xml
- /data/data/####/cache/picasso-cache/5bc08853dc100171f897ccb42ec54747.1.tmp
- /data/data/####/cache/volley/1782678446-1777522736
- /data/data/####/.rom1079422395.jar
- /data/data/####/cache/picasso-cache/d42a7df06fc7add9cd14c913762efbb1.0.tmp
- /data/data/####/cache/picasso-cache/4e6f7a9c4c0c7201e800dab5ee5eaaf8.1.tmp
- /data/data/####/cache/picasso-cache/9b2afafb039e148d802c0c2c133b5a3c.0.tmp
- /sdcard/Qxtimes/ring/volley/7j868uhqhkcte9rgm7t7r40yv
- /sdcard/Qxtimes/ring/volley/1gax0wc2ugkyywfg21be26rj1
- /data/data/####/files/appsdkmg0_.dex
- /data/data/####/10044/.rom823998910.dex
- /data/data/####/cache/volley/-2136639149621473400
- /data/data/####/databases/####.Resident2.db
- /data/data/####/.rom823998910.jar
- /data/data/####/cache/picasso-cache/5bc08853dc100171f897ccb42ec54747.0.tmp
- /data/data/####/.rom957217264.jar
- /data/data/####/files/MiguPay.Sdk20.Lib_12002100_DDF8C0A058919AC984E73F334438F269_AE200.dat
- /data/data/####/cache/picasso-cache/d42a7df06fc7add9cd14c913762efbb1.1.tmp
- /data/data/####/files/mobclick_agent_cached_####317
- /sdcard/Mob/####/cache/.ba
- /data/data/####/cache/picasso-cache/d84904333797845165c15dce289ed0f3.0.tmp
- /data/data/####/shared_prefs/mob_sdk_exception_1.xml
- /sdcard/Mob/.globalLock
- /sdcard/Qxtimes/app/3.1.9/c1eeff28-d7c5-450e-9aff-5ec81567cb46.apk.td.cfg
- /data/data/####/cache/volley/209779204-1273091633
- /data/data/####/cache/picasso-cache/96f762b3ac461b1435fb8e356e312531.1.tmp
- /data/data/####/shared_prefs/times.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/JPushSA_Config.xml
- /data/data/####/jacruntime.dex
- /data/data/####/cache/volley/1782725685-1761128686
- /data/data/####/files/mg20css.dat
- /data/data/####/shared_prefs/sms_sdk_0.xml
- /data/data/####/files/mg20irid.dat
- /data/data/####/cache/volley/-112889883-727084397
- /data/data/####/cache/picasso-cache/96f762b3ac461b1435fb8e356e312531.0.tmp
- /data/data/####/files/tmp/mg20dss.dat
- /data/data/####/cache/volley/1743869822237386824
- /data/data/####/cache/picasso-cache/b06e821f39c42e4e207c3418adcfc2d0.0.tmp
- /data/data/####/files/mg20dss.dat
- /data/data/####/files/appsdkmg0_.jar
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/volley/68625571-1510492308
- /data/data/####/files/tmp/mg20css.dat
- /data/data/####/files/tmp/MiguPay.Sdk20.Lib_12002100_DDF8C0A058919AC984E73F334438F269_AE200.dat
- /sdcard/Qxtimes/db/.QxTimes_ring.db-journal
- /data/data/####/cache/volley/35380768432964431
- /sdcard/Qxtimes/ring/volley/efideoxqkz5e3dnhkiq702iz
- /data/data/####/cache/picasso-cache/eede301ee424e322461a7150c971b9aa.1.tmp
- /data/data/####/cache/picasso-cache/b06e821f39c42e4e207c3418adcfc2d0.1.tmp
- /data/data/####/.rom546548981.jar
- /data/data/####/databases/####.Resident2.db-journal
- /data/data/####/cache/volley/1782678708-1933337143
- /data/data/####/shared_prefs/cn.jpush.preferences.v2.xml
- /data/data/####/databases/smssdk.db-journal
- /data/data/####/files/jpush_stat_cache.json
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 41 40 1541528 /data/data/####/.rom546548981.jar 1224104628 -859022099 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 48 40 1541528 /data/data/####/.rom1079422395.jar 1224104628 -859022099 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- /system/bin/dexopt --dex 27 43 40 1136 /data/data/####/jacruntime.dex 1493729924 -601703376 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 47 40 1136 /data/data/####/jacruntime.dex 1493729939 -601703376 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 47 40 321560 /data/data/####/files/appsdkmg0_.jar 1226016902 -1375529639 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 43 40 321560 /data/data/####/files/appsdkmg0_.jar 1226016902 -1375529639 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 43 40 1136 /data/data/####/jacruntime.dex 1493729986 -601703376 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 50 40 1541528 /data/data/####/.rom957217264.jar 1224104628 -859022099 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 49 40 1541528 /data/data/####/.rom823998910.jar 1224104628 -859022099 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
Может автоматически отправлять СМС-сообщения.
