Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Tool.SMSSend.76.origin
Сетевая активность:
Подключается к:
- s####.####.com
- t####.####.com
- h####.####.com
- c####.####.net
- p####.####.com
- c####.####.com
- e####.####.com
- w####.####.com
- a####.####.com:8081
- m####.####.com
- a####.####.com
Запросы HTTP GET:
- t####.####.com/it/u=1493946359,1972040935&fm=76
- m####.####.com/theme/mobile/images/navbg.png
- p####.####.com/copy/cms-bucket.nosdn.127.net/catchpic/e/e1/e19a20f48f5a5cfd6f8b783a90663a18.png?image####&thumbnail=####
- p####.####.com/copy/cms-bucket.nosdn.127.net/catchpic/d/d7/d79f68d8103f3940a0b44db49ac0474e.jpg?image####&thumbnail=####
- t####.####.com/it/u=1733051974,2487422848&fm=76
- t####.####.com/it/u=1148683420,1421724730&fm=76
- t####.####.com/it/u=470550266,3306690908&fm=76
- t####.####.com/it/u=602556223,3842938837&fm=76
- t####.####.com/it/u=477798467,3858181438&fm=76
- t####.####.com/it/u=393195800,618917987&fm=76
- w####.####.com/adx.php?c=####
- t####.####.com/it/u=102751051,1449718430&fm=76
- t####.####.com/it/u=575971645,3758866334&fm=76
- e####.####.com/public03/imageplus/m/common_loader.js?cache=####
- m####.####.com/js/common.js
- t####.####.com/it/u=1145801320,1185074761&fm=76
- t####.####.com/it/u=565992755,3430726461&fm=76
- t####.####.com/it/u=504881749,2188778889&fm=76
- t####.####.com/it/u=568443042,3682785536&fm=76
- t####.####.com/it/u=139971591,2361646727&fm=76
- t####.####.com/it/u=1636506246,1253228075&fm=76
- t####.####.com/it/u=198533933,1652176091&fm=76
- m####.####.com/theme/mobile/js/client_article_show.js
- t####.####.com/it/u=474262286,783872880&fm=76
- h####.####.com/hm.js?8a158d7####
- m####.####.com/theme/mobile/css/main.css
- p####.####.com/ycdm?sz=####&pdbid=####&orderid=####&odid=####&rtbid=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=###...
- p####.####.com/copy/
- t####.####.com/it/u=1039512663,1246807061&fm=76
- t####.####.com/it/u=101557736,330682971&fm=76
- t####.####.com/it/u=274997363,2211246779&fm=76
- p####.####.com/sync_pos.htm?cproid=####
- t####.####.com/it/u=714961855,787381951&fm=76
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&su=####&v=####&lv=####&...
- t####.####.com/it/u=3852733137,3822056871&fm=76
- t####.####.com/it/u=188024389,160764631&fm=76
- t####.####.com/it/u=1657329508,2196928098&fm=76
- s####.####.com/s.htm?cproid=####&t=####
- c####.####.com/gpixel?google_gid=####&google_cver=####
- t####.####.com/it/u=1088840888,1513437919&fm=76
- p####.####.com/ycdm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- p####.####.com/copy/cms-bucket.nosdn.127.net/catchpic/3/32/3266017b5c44a5ea3e0b267b6f480bed.jpg?image####&thumbnail=####
- m####.####.com/
- c####.####.com/sync.htm?cproid=####
- p####.####.com/copy/cms-bucket.nosdn.127.net/catchpic/5/56/5634f88959a6d4a243c773906726177d.png?image####&thumbnail=####
- t####.####.com/it/u=1909101152,2713517544&fm=76
- c####.####.com/youku?mzid=####
- p####.####.com/copy/p1.ifengimg.com/fck/2017_09/45ea84efdb82d9e_w250_h323.jpg
- t####.####.com/it/u=265350669,3351291075&fm=76
- p####.####.com/sync_pos.htm?cproid=####&t=####
- t####.####.com/it/u=1026614154,1394050842&fm=76
- t####.####.com/it/u=17636343,117910312&fm=76
- t####.####.com/it/u=4013553060,3919071717&fm=76
- m####.####.com/theme/mobile/css/for_article_show.css
- t####.####.com/it/u=1937121367,2654524142&fm=76
- t####.####.com/it/u=3506782259,667613260&fm=76
- t####.####.com/it/u=1970235052,2777946289&fm=76
- c####.####.com/cpro/ui/cm.js
- m####.####.com/news/1/140571.html
- t####.####.com/it/u=1563808938,2538214186&fm=76
- a####.####.com:8081/urlqushi.php
- t####.####.com/it/u=1391653371,2039401011&fm=76
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- t####.####.com/it/u=2072053922,934008649&fm=76
- c####.####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- t####.####.com/it/u=277845786,906179588&fm=76
- p####.####.com/ccgm?sz=####&pdbid=####&orderid=####&odid=####&rtbid=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=###...
- t####.####.com/it/u=1579353781,2238277217&fm=76
- c####.####.net/pixel?google_nid=####&googl####
- t####.####.com/it/u=3946572452,4091640842&fm=76
- t####.####.com/it/u=2315335287,2348299068&fm=76
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- p####.####.com/kcom?sz=####&pdbid=####&orderid=####&odid=####&rtbid=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=###...
- t####.####.com/it/u=1276042023,239641629&fm=76
- c####.####.com/cm.gif?dspid=####
- t####.####.com/it/u=707846342,3698315228&fm=76
- t####.####.com/it/u=3289064412,3826111348&fm=76
- t####.####.com/it/u=1818711425,2757131176&fm=76
- p####.####.com/kcom?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- a####.####.com/libs/jquery/2.1.1/jquery.min.js
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00002f
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000030
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/WebViewSettings.xml
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/files/dex/pks.jar
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
