Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
- Android.DownLoader.502.origin
Сетевая активность:
Подключается к:
- s####.####.com
- h####.####.com
- p####.####.com
- c####.####.com
- f####.####.com
- w####.####.com
- m####.####.cn
Запросы HTTP GET:
- p####.####.com/pcum?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=###...
- f####.####.com/it/u=1039512663,1246807061&fm=76
- m####.####.cn/lizhi/renshengganwu.html
- m####.####.cn/THEMES/shouji/TEMPLATE/js/mc.js
- f####.####.com/it/u=2594222363,3786436383&fm=76
- m####.####.cn/THEMES/shouji/TEMPLATE/images/action.png
- f####.####.com/it/u=1452018629,1881253633&fm=76
- p####.####.com/sync_pos.htm?cproid=####
- m####.####.cn/THEMES/shouji/TEMPLATE/images/backtop.png
- f####.####.com/it/u=195621614,907308084&fm=76
- m####.####.cn/
- h####.####.com/hm.js?20db5a7####
- m####.####.cn/THEMES/shouji/TEMPLATE/js/common.js
- c####.####.com/sync.htm?cproid=####
- m####.####.cn/THEMES/shouji/TEMPLATE/js/md.js
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- w####.####.com/adx.php?c=####
- m####.####.cn/THEMES/shouji/TEMPLATE/images/menu_ico.png
- m####.####.cn/THEMES/shouji/TEMPLATE/js/jquery.js
- m####.####.cn/THEMES/shouji/TEMPLATE/images/style.css
- f####.####.com/it/u=2383638222,3419487030&fm=76
- c####.####.com/cpro/ui/cm.js
- c####.####.com/cpro/ui/uijs.php?en=####&c=####&fv=####&kdi0=####&kdi1=####&kdi2=####&lukid=####&mscf=####&n=####&nttp=####&p=####&ssp2=####&swi=####&u...
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- p####.####.com/pcum?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=###...
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- s####.####.com/m/init.jsp
- c####.####.com/cpro/ui/uijs.php?rs=####&u=####&p=####&c=####&n=####&t=####&q=####&k=####&k0=####&kdi0=####&k1=####&kdi1=####&k2=####&kdi2=####&sid=###...
- m####.####.cn/THEMES/shouji/TEMPLATE/images/home_ico.png
Запросы HTTP POST:
- s####.####.com/m/a.jsp
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/a1356507059351895.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/app_settings
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/i.xml
- /data/data/####/files/1485417828534a.jar
- /data/data/####/files/app_new_conf
- /data/data/####/files/014854178283811.jar
- /data/data/####/databases/a1.db-journal
- /data/data/####/shared_prefs/c1356507059351895.xml
- /data/data/####/shared_prefs/b1356507059351895.xml
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/databases/webview.db-journal
- /sdcard/.mydata/.94631404c1179a8a
- /data/data/####/shared_prefs/a1356507059351895.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/a1.xml
- /sdcard/.mydata/.d40b7b8e2b735ccb
- /data/data/####/app_cache/ApplicationCache.db-journal
- /data/data/####/shared_prefs/c1356507059351895.xml.bak
- /data/data/####/files/ad_installed
- /data/data/####/files/init.conf
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
