Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.266.origin
- Android.Triada.38.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) c.m.1####.com:80
- TCP(HTTP/1.1) ptmgtd0####.wsclou####.com:80
Запросы DNS:
- b####.52####.com
- c.m.1####.com
- cms-bu####.n####.127.net
- wqf.wh####.com
Запросы HTTP GET:
- ptmgtd0####.wsclou####.com/0437dfd522fb45a5bbe2d121930e18302017090119140...
- ptmgtd0####.wsclou####.com/092cdce044874c39b8201c13dce74df12017090115582...
- ptmgtd0####.wsclou####.com/0dacbe0fba1a4ae1bf652794c0a1d4a32017083015455...
- ptmgtd0####.wsclou####.com/104c885eed304796ad1afd6c9fd2ef552017090223210...
- ptmgtd0####.wsclou####.com/28731424b5f14c8b9c52a536eb38a65b2017082918144...
- ptmgtd0####.wsclou####.com/2d8d9df1c19c4d05aa85afc51cfe28162017090212183...
- ptmgtd0####.wsclou####.com/3140a99705234086a679eec7867c526c2017090211263...
- ptmgtd0####.wsclou####.com/332cf114659949e1aa010981a96273082017082915561...
- ptmgtd0####.wsclou####.com/362af27362ff45029d3712cdacd8ed742017090207103...
- ptmgtd0####.wsclou####.com/39bba454d8734f15b74138cff55752622017090221574...
- ptmgtd0####.wsclou####.com/3fda3b752a1f4b1893130bd5ab1e4cfa2017090210485...
- ptmgtd0####.wsclou####.com/41b466bd8a284cd9a7cb1d365af130de2017090207075...
- ptmgtd0####.wsclou####.com/42f1bc4efa3447448fd306ceceb64a922017083117180...
- ptmgtd0####.wsclou####.com/481dd208054b439496732e8d5de5dbee2017090201482...
- ptmgtd0####.wsclou####.com/495503e4f36c4113bbf50941ced7b7732017090208583...
- ptmgtd0####.wsclou####.com/542a2f42efe24bd9bd1ae8f0206b08a62017090216301...
- ptmgtd0####.wsclou####.com/60ab5d4688d54867abfd691a88a20e692017090209434...
- ptmgtd0####.wsclou####.com/691789f91f1c4a3998cdd1a827feae852017083106455...
- ptmgtd0####.wsclou####.com/72082c4f232a465bad818569a05c9c132017090223583...
- ptmgtd0####.wsclou####.com/7d1db367855d43c19af4ecac140032222017090223004...
- ptmgtd0####.wsclou####.com/8068c43cf8224d3098510f5808970c122017090211325...
- ptmgtd0####.wsclou####.com/88764b1f23eb4d3693ebb1ac0b0b839b2017090211475...
- ptmgtd0####.wsclou####.com/8dadae2d67904669ae9f883f0a10cd8f2017090210451...
- ptmgtd0####.wsclou####.com/96c29003b94b4701827a6fe6dde6ed0c2017090200000...
- ptmgtd0####.wsclou####.com/9eeb530c544c4898977267c0ed84dd0f2017090208011...
- ptmgtd0####.wsclou####.com/a07dae3b68494b0db8cead65b39815d22017090207452...
- ptmgtd0####.wsclou####.com/a5472c7649ed4053ba1ec531bd9097042017090214194...
- ptmgtd0####.wsclou####.com/ab63c370d26d4f838f6cbf8e41135eb82017083019013...
- ptmgtd0####.wsclou####.com/ae0de0fc4ff643ebab76ce1ec5dae5c62017082417554...
- ptmgtd0####.wsclou####.com/b060ae64a4744700a378f34e4cb4f9ae2017082914495...
- ptmgtd0####.wsclou####.com/c9b1a47fde594028a325ecf50678abb72017090210055...
- ptmgtd0####.wsclou####.com/df23abdd3c294b9580956e519e40387c2017090219513...
- ptmgtd0####.wsclou####.com/ebf9612a71aa4889912934ccaf0606662017090211273...
- ptmgtd0####.wsclou####.com/f1d54d5a256f4c17aab40acf421ef1462017090220233...
- ptmgtd0####.wsclou####.com/f3e58a292f824ab8a3ce6398346cd0372017090212002...
- ptmgtd0####.wsclou####.com/f4b70122d9df4b5e9830fb787c527bd22017090222320...
- ptmgtd0####.wsclou####.com/f4f9f49389c54a1bb2c04012474a05432017090210341...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/00e4fa656cf80ce91009146c3504e460c90....0.tmp
- <Package Folder>/cache/####/0c00bea40e9c7960902d22fcec976675909....0.tmp
- <Package Folder>/cache/####/1934821080f9ace0e6ab0f255379db3ef9b....0.tmp
- <Package Folder>/cache/####/1fec7abd6e91b5c9cf2bff25233e5d00424....0.tmp
- <Package Folder>/cache/####/230041a5fd96edd82dfd90ac46cfbf9da78....0.tmp
- <Package Folder>/cache/####/256eb48f59fd1ec812d489c629bba41bf49....0.tmp
- <Package Folder>/cache/####/2a783481cd69a3ed7872e2f893189378693....0.tmp
- <Package Folder>/cache/####/2d8647a271a121b31afd41746b6c2623f1c....0.tmp
- <Package Folder>/cache/####/33aec35ae003e1b9a7e11c541885557ad5e....0.tmp
- <Package Folder>/cache/####/34181b936da5d5d413f90a2dd879ec64577....0.tmp
- <Package Folder>/cache/####/398380c149308610ec31e483966392bc878....0.tmp
- <Package Folder>/cache/####/3f542f48388d6d5702e88d5e6a0d2c0508e....0.tmp
- <Package Folder>/cache/####/40ecc6d6b359f8dd54cea932de0d7127891....0.tmp
- <Package Folder>/cache/####/462591d331c2e227566f8e53b9a9a0c4358....0.tmp
- <Package Folder>/cache/####/4854ae8897146bc52ae4bd2fe8b60d5f07f....0.tmp
- <Package Folder>/cache/####/4da588da3d086f8c7f0a3db6cfa6953340f....0.tmp
- <Package Folder>/cache/####/575f3b68361ccca866dbb43715340bbe747....0.tmp
- <Package Folder>/cache/####/670559694360c9da2fe5a58297684df9aab....0.tmp
- <Package Folder>/cache/####/6b177705a849f7563249c492ca9088d3a4b....0.tmp
- <Package Folder>/cache/####/6cf318d65ea3c59e053226c23666f23e1b2....0.tmp
- <Package Folder>/cache/####/783a5c175b5fa78b0a7c2a3cdae5ef707dd....0.tmp
- <Package Folder>/cache/####/7c3b59294f658a587eb694e8ee676f231f6....0.tmp
- <Package Folder>/cache/####/7dac8bf6d9d9f3f80048e9b6703a0a4727f....0.tmp
- <Package Folder>/cache/####/91ce3eb9155d1c4239d3a01741cce07dd5e....0.tmp
- <Package Folder>/cache/####/95d1bdad640b57b1358581dfdf08c281b2c....0.tmp
- <Package Folder>/cache/####/9dfd4d24e4426866788be5df8b2c7b20782....0.tmp
- <Package Folder>/cache/####/a823d93df1a4ca2ea48b17a064370487cee....0.tmp
- <Package Folder>/cache/####/b002a6f1bac5e63a1352e72469741f2404e....0.tmp
- <Package Folder>/cache/####/b18a2593f861ffa875202fffff451c94fe5....0.tmp
- <Package Folder>/cache/####/b90185d3b111a107cdc2190bee26d613ab3....0.tmp
- <Package Folder>/cache/####/ca16a2e09501763eb8170014e7d221b5390....0.tmp
- <Package Folder>/cache/####/d1303096411f4c70773fa74fed087bfc97e....0.tmp
- <Package Folder>/cache/####/d47e20e840487b9b7e692dbe34f86be0c06....0.tmp
- <Package Folder>/cache/####/d73f1040cb7a1d3b1b858a230962bcae29b....0.tmp
- <Package Folder>/cache/####/d7cd207e65046adab9f0e5b6a205eca2823....0.tmp
- <Package Folder>/cache/####/dab008a82177a40587b39a1f6ef0aa459e3....0.tmp
- <Package Folder>/cache/####/e507fa7a12098340857def66f9d53b6dc30....0.tmp
- <Package Folder>/cache/####/ebe0efd3e64abdb4eb6a9622580d1ae603f....0.tmp
- <Package Folder>/cache/####/ed4406d79b92d699f17e48d1c6fcf7086c2....0.tmp
- <Package Folder>/cache/####/ee4b95fceed1765580827b78e66cf64f85a....0.tmp
- <Package Folder>/cache/####/f2eda901ba053eaa5638072669be8cd5358....0.tmp
- <Package Folder>/cache/####/ff93ad32f3fb6b2e3aa25acf7d0c20bbf9a....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/files/fekm.png
- <Package Folder>/files/iacl
- <Package Folder>/files/iacl.jar
- <Package Folder>/files/ru
- <Package Folder>/files/ru.apk
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xapcinfo.xml
Другие:
Запускает следующие shell-скрипты:
- conbb od2gf04pd9
- cufsdosck ac554db364f
- cufsmgr eb47495f7bb
- service call appops 0 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 1 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 10 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 11 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 12 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 13 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 14 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 15 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 16 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 17 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 18 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 19 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 3 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 4 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 5 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 6 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 7 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 8 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 9 i32 15 i32 10044 s16 <Package> i32 0
- sh
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
