Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.178
- Android.Triada.258.origin
- Android.Triada.155.origin
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- huangda####.com
- 1####.####.34
- 1####.####.57:10001
- a####.####.com
- i####.####.com
Запросы HTTP GET:
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/m/fUuctJnkGSxsEOC6TaFXT4moCtSmKHc5drsBHRgzJD7z6Q...
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
Запросы HTTP POST:
- a####.####.com/ando/x/liv?app_id=f3208725-7012-4a02-b200-5313e98d60a0&r=...
- huangda####.com/shop/shop_upload_log
- 1####.####.34/v2/chis
- huangda####.com/mobilepay/v2/getPayInfoListX2.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_PVNxnjjGqzTVzeNFrw5-xTLrfHM=-journal
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/JRil533IgBtuTbd8bd8zRi2MslEH82vjeDPDaw==.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/eevMpCaOyIu9Jwiw8aMmS55h7TWqHdCW.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/mcGoC0WSE8Uy2e6bU2QKYQ==.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/5cacI_sS2Dfv2rBXdBo7keU9eAfCyf4vt2iVwr3jCkU=.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/Kg6p-7cchUpTtnyFv5pV36YMyJJxpzC_.new
- <Package Folder>/files/.ca/QYnIi.jar
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/G6owULhfPDvn3ZCcPxu1RNs_kINsr-nNnn7EV-eMrrc=.new
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/AXmcedtKpZONCjU_boho6g==/runner_info.prop
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/0SjPdzCHausI9fXD5pu1G_ukpVo=.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/Mmb0fACifrtUn5LZJGTtTQXhPhVwkBMO.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_aPTEw601MtXz1FZk_app/CJz8TQ0Dv8E_hWm9VGCWQQ==/emPx32byq72R3DCs54SC8Gtoi3boG-lG.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/fiUypoR8XqN6U3p_-uCHWagNwZ-0dkp9.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/ioOWV_nXNyVJdO-Igg1VYQ==.new
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/6KH-DzTIOiaYBDklzyS3zw==
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/q5mWP5wc_T7CT6kqDY8dkNIQuq9p0yo2xPCEVQ==.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/it0pRYK6xkVzjCKuiQPsQ6IOTvvNERQr.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/xBPgycSLcnwX059it_9nYNB9QSY=.new
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_t2brW6AZXESwl-u8-journal
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_yrTAzJXWwZ7DT3Rt
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/0SjPdzCHausI9fXD5pu1G_ukpVo=
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/7wXWnNV1tm64FV10/Nqrd4QdmS-cSfALH.new
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/BAJKPqmoftAQh_TzlIHeMz6NTIxXCmcOBNa8qA==.new
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/oZMSNLmAKAeEyFcZNf5aaw==/e9LToZhgyjYs_Svq-_JMnOiITzE=
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/aSG_7shKVjjataU9-y397A==
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/6KH-DzTIOiaYBDklzyS3zw==.new
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/hFfPBuoF-G3nwkGrkqJkfQ==/9G6MpX_S1_sBgXoJ
- <Package Folder>/code-5045360/cpYQVkUvBv54EoXF
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/aRLb940cVgq98MVELJgq8g==/data.dat.tmp
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_PVNxnjjGqzTVzeNFrw5-xTLrfHM=
- <Package Folder>/files/gfaug_d/gfaug_f.zip
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_sPVtT0szJIg3NU2h2hBJnQ==-journal
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/hFfPBuoF-G3nwkGrkqJkfQ==/6A9-vy062qnDAcjRpWwxBg==
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/rTOJ8cYIrHDmx7xTTNHe-g==/jPykRwHUMCjlFi0a.zip
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/xBPgycSLcnwX059it_9nYNB9QSY=
- <Package Folder>/shared_prefs/zzconfig.xml
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/GPIITyfyY62nVYHD/t7WTDOz_yKznSJuawbsAPger9_icB8HN71kQfQ==
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/C9dpVG9r33loshvZFURoLzp0x1U=.new
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/databases/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_yrTAzJXWwZ7DT3Rt-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/nLrBorGeqEgzelqFRoXKuUtQf4Suq-3M.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/CJz8TQ0Dv8E_hWm9VGCWQQ==/84ZUM-l6Gl38xRsOpXc_HAk0NwE=.new
- <Package Folder>/files/zGkHxRjoiyFzG-guYTojlnODDpFYmYW__VxIb_WF1WU=/Nqrd4QdmS-cSfALH.new
- <Package Folder>/files/a7ZRbDa-QuXNrftMoteXkZ4GhX64xsIU_files/kFp90ElHUxAA9DHiVmq12Q==/O1NZxT_YXldTfvJoPc4KG1sVjHKrbtEP.new
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- sh <Package Folder>/code-5045360/cpYQVkUvBv54EoXF <Package> com.xhoy.znhw.afrfuw.a.a.c.b /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
- /data/data/####/code-5045360/cpYQVkUvBv54EoXF #### com.xhoy.znhw.afrfuw.a.a.c.b /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
- <dexopt>
Может автоматически отправлять СМС-сообщения.
