Техническая информация
Вредоносные функции:
Загружает из Интернета следующие детектируемые угрозы:
- Android.Packed.19209
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- b####.####.net
- d####.####.net:8080
- mo####.####.com
- dynami####.####.com
- col####.####.com
- d####.####.net
- 1####.####.com
- vide####.####.cn
- d####.####.net:6677
- a####.####.com
- cdn####.####.com:8080
- a####.####.com:8700
- i####.####.cn
- b####.####.net:5050
- mmy####.####.com
- collec####.####.com
- priceru####.####.com
Запросы HTTP GET:
- vide####.####.cn/maolijianpdsmtj14.jpg
- 1####.####.com/ic.asp
- mmy####.####.com/mmys-cps/bannerInfo.service?showStyle=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&a...
- mmy####.####.com/mmys-cps/adVideo.service?uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dcVersio...
- i####.####.cn/iplookup/iplookup.php?format=####
- mmy####.####.com/mmys-cps/styleTopChlVideo.service?pageNo=####&pageSize=####&showStyle=####&rv=####&uuid=####&imei=####&imsi=####&manufacturer=####&mo...
- vide####.####.cn/20170309/9e1b2291-c37e-455f-a4ac-35f846adc72a-aqsh00002jp-4.jpg
- d####.####.net:8080/appstore/pri/5403ddd6ecda4977b0ac92526095b12a.apk
- mmy####.####.com/mmys-cps/runInfo.service?uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dcVersio...
- vide####.####.cn/20170208/39c56c56-5190-4dd7-b998-f04abb50dbba-118gets00030jp-4.jpg
- vide####.####.cn/20170104/80749bd8-fb29-4082-befa-0250aba2b660-322.jpg
- vide####.####.cn/20170309/5ac3263f-44ca-42fc-bcb6-d7b0266c4a78-540wpe00062jp-3.jpg
- vide####.####.cn/20170208/7a3b24e2-0031-4832-b7bd-27f6ec00a21c-118har00057jp-7.jpg
- vide####.####.cn/20170208/8c2cc392-6b98-4665-a1d7-a8ec98331852-h_1133mcma00005jp-6.jpg
- vide####.####.cn/20170208/3a907eea-b6d6-458e-b6ad-784f3d81aabb-13gvg00434jp-15.jpg
- vide####.####.cn/20170309/d498add5-9b9f-4ec2-b2df-69460d670333-blk00305jp-5.jpg
- vide####.####.cn/FmqvYTmmNyg3G5c8XR17J0fsiUNy.jpg
- cdn####.####.com:8080/edt_r
- priceru####.####.com/price-rule-cmp/rule/matchRule?version=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=##...
- vide####.####.cn/20170208/a0763c67-908d-4e3f-b0ed-34a1eb38559b-1hbad00349jp-7.jpg
- vide####.####.cn/maolijianpdsmtj30.jpg
- vide####.####.cn/maolijianpdsmtj24.jpg
- vide####.####.cn/20170208/f597f12e-63ad-409c-81a1-27b828b0023c-juy00079jp-3.jpg
Запросы HTTP POST:
- a####.####.com/
- col####.####.com/stats.service
- b####.####.net:5050/
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
- mmy####.####.com/mmys-cps/userVisit.service?uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dcVers...
- d####.####.net/
- mo####.####.com/mobile-service/getImsiMobilePhone.json
- b####.####.net/
- mmy####.####.com/mmys-cps/lookVideoStat.service?videoId=####&isRmd=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&di...
- dynami####.####.com/dynamicpay//noteStats.json?
- d####.####.net:6677/
- collec####.####.com/pay-data-collect/collectAppBehavioralData.json
- mmy####.####.com/mmys-cps/userActivation.service?uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&d...
- collec####.####.com/sdk-update/sdkUpdateCdnUpload.json
- dynami####.####.com/dynamicpay//syPayInfo.json?
- a####.####.com:8700/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/global_count.xml.bak
- /data/data/####/cache/picasso-cache/7b28df8dc1c49ed4161f4791b0562e4b.1.tmp
- /data/data/####/cache/picasso-cache/7b28df8dc1c49ed4161f4791b0562e4b.0.tmp
- /sdcard/.5a4708d2c00324b9f216117c70233831
- /data/data/####/cache/picasso-cache/8ad60c81a23d5773a663e3c94e761777.1.tmp
- /data/data/####/cache/picasso-cache/320de372d221cb42b52fc7107f733332.1.tmp
- /data/data/####/cache/picasso-cache/3aa20c9a586b11a1219d471577340c24.1.tmp
- /data/data/####/shared_prefs/ADS_UNI_MAN_FN.xml.bak
- /data/data/####/shared_prefs/ADS_UNI_MAN_FN.xml
- /sdcard/.s_d_p/.im
- /data/data/####/cache/picasso-cache/a77fd25cb5e366f6de339be8a1c8875d.1.tmp
- /data/data/####/files/dlook
- /sdcard/.4d02db8e14eeb9f/1485417978991/abc/1485417978991_r1.tmp
- /data/data/####/shared_prefs/time.xml
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/shared_prefs/trigger_recorder.xml.bak
- /data/data/####/files/f6.c
- /data/data/####/files/b402bc82c687bc47/2f92b650-cde4-4f76-a71b-147efa7c21ed.zip
- /data/data/####/cache/picasso-cache/3aa20c9a586b11a1219d471577340c24.0.tmp
- /data/data/####/cache/picasso-cache/54a2270ff8fd9f8a95a38247316e5e06.0.tmp
- /data/data/####/cache/picasso-cache/11223d7e78db6d7671fa19d382e8ed1d.0.tmp
- /data/data/####/cache/picasso-cache/6b6919eee44b572045f355086af300d3.1.tmp
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/shared_prefs/pt.xml
- /data/data/####/files/arte
- /data/data/####/files/attd/loo/liblive.so
- /data/data/####/cache/picasso-cache/6afdea806f6d9a0709562326305122eb.0.tmp
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/shared_prefs/initdata_stats.xml.bak
- /data/data/####/files/attd/loo/arte
- /data/data/####/cache/picasso-cache/15a932c8dbfaab1d722a356027a13fc1.0.tmp
- /data/data/####/shared_prefs/global_count.xml
- /data/data/####/cache/picasso-cache/6afdea806f6d9a0709562326305122eb.1.tmp
- /data/data/####/shared_prefs/ADS_UNI_FN.xml.bak
- /data/data/####/cache/picasso-cache/9a4583b0a5afb62b583671e7c86ccded.0.tmp
- /sdcard/.s_d_p/.ual
- /data/data/####/files/1485417990755/1485417990755.zip
- /data/data/####/cache/picasso-cache/325ee10433ddfdc0653a37312e2cb9fb.1.tmp
- /data/data/####/cache/picasso-cache/e356f9a5fe61436ba5de85a92787d6b9.1.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/picasso-cache/571c0e50e3d4182a89a92208aa7d3486.1.tmp
- /data/data/####/databases/statistics_db-journal
- /data/data/####/files/dio.d
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /data/data/####/cache/picasso-cache/320de372d221cb42b52fc7107f733332.0.tmp
- /data/data/####/databases/recommend_app-journal
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/shared_prefs/initdata_stats.xml
- /data/data/####/databases/com_ex_ads.db-journal
- /data/data/####/cache/picasso-cache/54a2270ff8fd9f8a95a38247316e5e06.1.tmp
- /data/data/####/shared_prefs/trigger_recorder.xml
- /data/data/####/cache/picasso-cache/11223d7e78db6d7671fa19d382e8ed1d.1.tmp
- /data/data/####/cache/picasso-cache/15a932c8dbfaab1d722a356027a13fc1.1.tmp
- /data/data/####/cache/picasso-cache/9a4583b0a5afb62b583671e7c86ccded.1.tmp
- /data/data/####/files/gaClientId
- /data/data/####/databases/sy_video_data_cache-journal
- /data/data/####/cache/picasso-cache/6b6919eee44b572045f355086af300d3.0.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /sdcard/.4d02db8e14eeb9f/com.kert.porn/abc/com.kert.porn_r1.tmp
- /data/data/####/cache/picasso-cache/325ee10433ddfdc0653a37312e2cb9fb.0.tmp
- /data/data/####/databases/DATA_MF_CFG-journal
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/shared_prefs/ADS_UNI_FN.xml
- /data/data/####/cache/picasso-cache/e356f9a5fe61436ba5de85a92787d6b9.0.tmp
- /data/data/####/cache/picasso-cache/8ad60c81a23d5773a663e3c94e761777.0.tmp
- /data/data/####/cache/picasso-cache/571c0e50e3d4182a89a92208aa7d3486.0.tmp
- /data/data/####/shared_prefs/ad_config.xml
- /data/data/####/cache/picasso-cache/a77fd25cb5e366f6de339be8a1c8875d.0.tmp
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/arte
- /data/data/####/files/dio.d
- /data/data/####/files/f6.c
Другие:
Запускает следующие shell-скрипты:
- sh
- cat /proc/version
Может автоматически отправлять СМС-сообщения.
