Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.78.origin
Сетевая активность:
Подключается к:
- a####.####.com
Запросы HTTP GET:
- a####.####.com/ad/20170317/201703171532622.png
- a####.####.com/ad/20170317/201703171532947.apk
- a####.####.com/ad/20161215/201612151630985.png
Запросы HTTP POST:
- a####.####.com/is/list.jsp
- a####.####.com/is/click.jsp
- a####.####.com/is/info.jsp
- a####.####.com/app/down.jsp
- a####.####.com/is/show.jsp
- a####.####.com/app_logs
- a####.####.com/is/init.jsp
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/cache/.spimg/blue
- /data/data/####/shared_prefs/ptf_gvzy.xml.bak
- /data/data/####/databases/gjappdl.db
- /data/data/####/files/tcom
- /data/data/####/shared_prefs/pref.xml
- /sdcard/Android/data/cache/.spimg/orange
- /data/data/####/files/ogewdewfwqf.jar
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /sdcard/Android/data/cache/.spimg/green
- /sdcard/Android/data/cache/.spimg/i
- /data/data/####/shared_prefs/ptf_gvzy.xml
- /sdcard/Android/data/cache/.spimg/ad
- /data/data/####/files/wogewdewfwqf.jar
- /data/data/####/files/ogewdewfwqf
- /sdcard/Android/data/cache/.spimg/ag
- /data/data/####/shared_prefs/fsnum.xml
- /sdcard/Android/data/cache/.spimg/af
- /data/data/####/files/mobclick_agent_cached_####
- /sdcard/Android/data/cache/log/####.ls
- /data/data/####/shared_prefs/pt_cfg_ps.xml.bak
- /sdcard/Android/data/cache/.spimg/aa
- /sdcard/Android/data/cache/comecapyddsadgrrsewcsxogewdewfwqf.bin
- /sdcard/Download/yfile/201703171532947.apk.tmp
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/shared_prefs/dsp_sh.xml.bak
- /sdcard/Android/data/cache/.spimg/o
- /sdcard/Android/data/.cache/201703171532622&png.tmp
- /sdcard/Android/data/cache/.spimg/ab
- /data/data/####/shared_prefs/dsp_sh.xml
- /sdcard/Android/data/cache/.spimg/q
- /sdcard/Android/data/cache/.spimg/p
- /sdcard/Android/data/cache/.spimg/s
- /sdcard/Android/data/cache/.spimg/r
- /sdcard/Android/data/cache/.spimg/u
- /sdcard/Android/data/cache/.spimg/t
- /sdcard/Android/data/cache/.spimg/w
- /sdcard/Android/data/cache/.spimg/v
- /sdcard/Android/data/cache/.spimg/x
- /sdcard/Android/data/cache/.spimg/z
- /sdcard/Android/data/cache/.spimg/yellow
- /sdcard/Android/data/.cache/run.pp
- /data/data/####/shared_prefs/ppadturn.xml
- /sdcard/Android/data/cache/.spimg/c
- /sdcard/Android/data/cache/.spimg/b
- /sdcard/Android/data/cache/.spimg/e
- /sdcard/Android/data/cache/.spimg/d
- /sdcard/Android/data/cache/.spimg/g
- /sdcard/Android/data/cache/.spimg/f
- /sdcard/Android/data/cache/.spimg/ae
- /sdcard/Android/data/cache/.spimg/h
- /sdcard/Android/data/cache/.spimg/k
- /sdcard/Android/data/cache/.spimg/j
- /sdcard/Android/data/cache/.spimg/m
- /sdcard/Android/data/cache/.spimg/l
- /sdcard/Android/data/cache/.spimg/ac
- /sdcard/Android/data/cache/.spimg/n
- /sdcard/Android/data/cache/.spimg/a
- /sdcard/Android/data/.cache/201612151630985&png.tmp
- /data/data/####/shared_prefs/pt_cfg_ps.xml
- /data/data/####/shared_prefs/mmst_share.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/databases/gjappdl.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /storage/emulated/0/download/yfile//201703171532947.apk.tmp
Может автоматически отправлять СМС-сообщения.
