Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.13.origin
- Android.Triada.226.origin
- Android.Triada.151.origin
Сетевая активность:
Подключается к:
- v####.####.com
- i####.####.com
- w####.####.cn
- o####.####.com
- 6####.####.140
- d####.####.com
- f####.####.com
- g####.####.pw
- l####.####.com
- m####.####.com
- i####.####.cn
- g####.####.pw:6701
- a####.####.com
Запросы HTTP GET:
- l####.####.com/vd/n/channel/img/goto.effe49b4.png
- a####.####.com/album/s%3D1600%3Bq%3D90/sign=9e8aa7e3044f78f0840b9ef549013124/4a36acaf2edda3cc19be819706e93901213f922a.jpg
- l####.####.com/vd/n/channel/zepto.js
- a####.####.com/album/s%3D1600%3Bq%3D90/sign=486ec5ba77cf3bc7ec00c9eae13081d0/730e0cf3d7ca7bcb2521fe98b9096b63f624a82a.jpg
- f####.####.com/hunter/alog/alog.mobile.min.js?v=####
- d####.####.com/download/jmrx20161118.jar
- a####.####.com/album/s%3D900%3Bq%3D90/sign=1a0669bf0bd79123e4e098749d0f28bf/962bd40735fae6cdab0f92d608b30f2443a70fc9.jpg
- i####.####.com/ando-res/m/i0r*lg6v0h8-VWU1P*FQdeOi4Rt063q4kkFbwd7Db1IzyTD5msrpwg
- m####.####.com/static/searchbox/openjs/share.js?v=####
- l####.####.com/vd/??n/chann####
- l####.####.com/vd/n/channel/img/play.62151b63.png
- l####.####.com/vd/n/channel/img/iconfont.7c63475a.ttf
- l####.####.com/vd/n/channel/1.plugin.d403a6d7d174f48cea5d.js
- a####.####.com/album/s%3D1600%3Bq%3D90/sign=48ad776b53e736d15c13880eab6074b3/cefc1e178a82b901ba33fa84748da9773812efef.jpg
- v####.####.com/platapi/v2/video_list?from=####&rn=####&lid=####&cuid=####&tag=####&bid=55E####&cb_cursor=####&hot_cursor=####&offline_cursor=####&curs...
- v####.####.com/?from=####
Запросы HTTP POST:
- g####.####.pw/loadmain.aspx
- g####.####.pw/UploadReport.aspx
- 6####.####.140/ando/x/liv?app_id=####&r=####
- g####.####.pw:6701/loadmain.aspx
- w####.####.cn/ip.jsp
- o####.####.com/check_config_update
- i####.####.cn/iplookup/iplookup.php?format=####
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/sdtmp/id1c547004b-b630-40ef-bbbb-32fb01df58d0.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/4qIebFRxtN41O8K1
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/WW5hldVywL7xzBL3MK6MEw==/data.dat.tmp
- /sdcard/Android/data/####/cache/uil-images/1724992542.0.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/J-6IDe1fAhEonmxNaBG0rg==
- /data/data/####/files/####_cgr
- /sdcard/sdtmp/id289b6a1ae-89f8-4b19-9be7-dcfb2f7f0703.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/m9EggHdXLbT9qVaf
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/app_temp/id
- /data/data/####/files/rdata_comodpeqpxv
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6
- /sdcard/mmt/widegets/data/test.dat3b280fa9-b409-42a5-baca-905c55daf4d6.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/CEYJa1rHuZtUYn9ONqPXWA==
- /data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /sdcard/tmpsd11012/test.dat
- /data/data/####/cache/webviewCacheChromium/f_000001
- /sdcard/sdtmp/id2a86cc6f4-3060-4808-9989-3a07751e6bf5.tmp
- /sdcard/sdtmp/id287bfa7fd-402d-4854-bb72-b9ccb872f97c.tmp
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/sdtmp/id2b82cfa71-58e5-415d-8396-1e259a6d5139.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/4qIebFRxtN41O8K1.temp
- /sdcard/tmpsd11012/test.dat86da8494-c53b-41b5-a660-0e05459839c0.tmp
- /sdcard/Android/data/####/cache/uil-images/journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/mmt/widegets/data/test.dat53114dc0-4353-439f-a54e-2b951be970a3.tmp
- /sdcard/.env/.uunique.new
- /data/data/####/files/rdata_comodpeqpxv.new
- /data/data/####/files/.imprint
- /data/data/####/files/mobclick_agent_cached_####1
- /sdcard/mmt/widegets/data/test.dat9b24d8ab-6f3c-48de-b9b8-a487f453c7af.tmp
- /sdcard/mmt/widegets/data/test.dat923c81dd-dcbb-42f0-b6d0-bfee9879ed41.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/wOOURyGFNgWqPWyL2mNnIQ==/N4sO2AfzDI8HPVeF.zip
- /sdcard/mmt/widegets/data/test.dat0a37e09f-1933-4ae4-9b2f-9ae04105414c.tmp
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/T0ndw3lLBxvg1j7Of025Eg==
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/J-6IDe1fAhEonmxNaBG0rg==.new
- /sdcard/mmt/widegets/data/test.datcb7caa27-f9bb-4a10-9908-892236b2efd7.tmp
- /data/data/####/app_bload_lib/libhelper.so
- /sdcard/sdtmp/id114360fa0-aa95-44ee-94d7-21893c15eeb8.tmp
- /sdcard/sdtmp/id15c4e706f-cc9c-45a0-98be-fa5aa987675d.tmp
- /data/data/####/app_aload_odex/dload.inf
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/uil-images/-284444105.0.tmp
- /sdcard/mmt/widegets/data/droidinfo-journal
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /sdcard/mmt/widegets/data/test.dat16377b51-8207-4a98-811a-addec5d5060c.tmp
- /sdcard/.uct/uuid3bece4a7c-38d4-43da-894d-0c925615007d.tmp
- /sdcard/tmpsd11012/test.dat27ac8bb9-4888-43be-bfa2-52355b865815.tmp
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/database.xml
- /data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4
- /data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/files/huffbg_d/huffbg_f.zip
- /sdcard/tmpsd11012/test.date958d6e8-e75a-46fd-ad59-af8388e562c2.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/CEYJa1rHuZtUYn9ONqPXWA==.new
- /data/data/####/app_aload_odex/coad.apk
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/1485418556290_cgr.so
- /sdcard/sdtmp/id12bfcc360-b6e3-46f8-afeb-a31f15962d11.tmp
- /data/data/####/files/1485418570637_cgr.so
- /sdcard/.hand/developkey4ef30235-8e87-448e-b8a1-471797fdfdea.tmp
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/tmpsd11012/test.dat9fc64c53-ddb5-411c-8af8-dfee80eb2afb.tmp
- /data/data/####/files/P3UVtNomVTBmd6rRvjlPqw==/ro-r-2SJjrxowaI9zirj5e_DvNs=
- /data/data/####/app_res_out/Jres.apk
- /sdcard/mmt/widegets/data/test.datfd89532c-a9ab-463b-9591-5349efae474c.tmp
- /sdcard/Android/data/####/cache/uil-images/1307904639
- /sdcard/Android/data/####/cache/uil-images/1244065034.0.tmp
- /sdcard/mmt/widegets/data/droidinfo
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6
- /data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7
- /data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
- chmod 0771 /data/data/####/.syslib-
- /data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
- conbb od2gf04pd9
- /data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
- /system/bin/.nbwayxwzt
- cat /sys/class/net/wlan0/address
- /data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
- ls -l /system/bin/su
- /data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
Может автоматически отправлять СМС-сообщения.
