Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
- Android.Xiny.73.origin
- Android.Xiny.90.origin
Сетевая активность:
Подключается к:
- we####.com:8081
- g####.####.com
- i####.####.com
- aexcep####.####.com:8012
- c####.####.net
- p####.####.com
- ip####.io
- woo####.com:7077
- offercr####.####.com
- a####.####.plus
- and####.####.com
- p####.####.com:3090
- l####.####.net
- aurora-####.####.com
- sm-camp####.####.com
- a####.####.com
- md-41####.####.org
Запросы HTTP GET:
- sm-camp####.####.com/resource/icons/source_1_prod_389_source_15_prod_401_c_2355025_94811_19.png
- a####.####.plus/api/getADConfig?app_key=####&duid=####&sdk_version=####&gaid=####&sub=####&vs=####
- c####.####.net/games/icons/001/014/980/dimension_150x150.jpg?2016120####
- aurora-####.####.com/resource/icons/source_1_prod_666_source_2_prod_704_b1d47e4984cc7f30a77cf433f1dd288e.png
- a####.####.com/pull/top_offer?gaid=####&id=####
- aurora-####.####.com/resource/icons/source_1_prod_200_source_2_prod_202_93f7ca818e8b5c8c6ccde361fb754720.png
- aurora-####.####.com/resource/icons/source_1_prod_76_source_2_prod_77_bcda7b08f0f32ce9c429af987f2b2bf7.png
- i####.####.com/tracking/adBulkImpression?d=####
- aurora-####.####.com/resource/icons/source_1_prod_62_source_2_prod_63_1464860481_931305.jpg
- sm-camp####.####.com/resource/icons/source_3_prod_70_51e8a151018aeb2ae4dbf0c8dc6d55ff.png
- md-41####.####.org/logo/41b3a41bc8bccc70524e8cf5502cdeed7f81a660.png
- aurora-####.####.com/resource/icons/source_1_prod_78_source_2_prod_79_8d4adbb873e0a8cdaf22ed3d80df8da4.png
- aurora-####.####.com/resource/icons/source_1_prod_395_source_2_prod_407_ee493f919c41e93d51063ab8cb460d7e.png
- sm-camp####.####.com/resource/icons/source_3_prod_56171_9c1a57b70dd501c1850bdbbcee7d957d.png
- md-41####.####.org/logo/40e36019379a277eec4bd4861ed3d05b1a335023.png
- ip####.io/json
- sm-camp####.####.com/resource/icons/source_1_prod_2149_source_17_prod_4063_jPOxzrRdlf-2nx1yfDAv7vDbuPml3Z76nIeQgwkjKAsjE4a_rESgj5HLyjpZ5lYSjr0%253Dw30...
- aurora-####.####.com/resource/icons/source_1_prod_745_source_2_prod_841_1727b375b628f088b19d820d0e93bd8b.png
- aurora-####.####.com/resource/icons/source_1_prod_26_source_2_prod_27_d2942aeb955653d8551911445614fd93.png
- sm-camp####.####.com/resource/icons/source_1_prod_1798_source_17_prod_2392_rKw2kHM19yItUtQJfWbG24qDMI1NubLdwvFk7Bw5cCrffOQKkNcURYpQyvfTkTufng%253Dw300...
- aurora-####.####.com/resource/icons/source_1_prod_10_source_2_prod_10_17f84c08a394b36e6949770fd6129ede.png
- c####.####.net/games/icons/001/009/820/dimension_150x150.jpg?2016120####
- sm-camp####.####.com/resource/icons/source_1_prod_1783_source_15_prod_2221_c_2716923_491_19.png
- sm-camp####.####.com/resource/icons/source_3_prod_84075_9fc028edfff65750eb9ba6929b543942.png
- aurora-####.####.com/resource/icons/source_1_prod_210_source_2_prod_212_6fa532fcd1c3b04af35f4f26650cb84b.png
- sm-camp####.####.com/resource/icons/source_1_prod_1788_source_15_prod_2303_c_1815905_99945_19.png
- offercr####.####.com/banner_icon/source_1_prod_395_source_2_prod_407_ee493f919c41e93d51063ab8cb460d7e.png
- sm-camp####.####.com/resource/icons/source_1_prod_2611_source_2_prod_4789_0e5446dfa04d48883a3e98bd80a45f3c.png
- aurora-####.####.com/resource/icons/source_1_prod_105_source_2_prod_106_86267c5b137d9d97ed362c4e02664f7a.png
- aurora-####.####.com/resource/icons/source_1_prod_1808_source_2_prod_2425_e7c6ebe4a714eae50dcc73e96f8a0312.png
- aurora-####.####.com/resource/icons/source_1_prod_20_source_2_prod_21_cvBWFUQavWhjNRJPthHH7uH8OGuoMnF15HktNjrbEj6VA56phkdYCdBSLIgpSVa8Fw%253Dw300-rw
Запросы HTTP POST:
- a####.####.com/offerview/info/920
- we####.com:8081/sm/sr/rt/ry
- and####.####.com/rqd/async
- woo####.com:7077/sdk/nsd.action?b=####
- g####.####.com/pilot/api/300102
- a####.####.com/subscribe/api/1997
- l####.####.net/gkview/info/600
- p####.####.com:3090/PlutoServer/app/getplugin/
- a####.####.com/app_logs
- p####.####.com/PlutoServer/app/appinit/
- aexcep####.####.com:8012/rqd/async
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/jymbkry/libBEeIkylSiomJCMMwdynamicloader.so
- /data/data/####/files/200/1001/170126080606127.apk
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/SSPPrefe.xml
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /sdcard/test
- /data/data/####/shared_prefs/20160121.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/66bcbf5cc7ab22173d9ff38ba911f60f
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/libZdbdnPOTIAnTJreGbootstrap.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/7da2ad537b755c5471a236f333a6846c
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/databases/ua.db.mirror
- /data/data/####/tx_shell/libshella-2.10.1.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/1a1e7ecd1b4d0d6a326a1c2312c44b5f
- /data/data/####/shared_prefs/20160218.xml.bak
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/files/exid.dat
- /data/data/####/databases/webview.db-journal
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/92f47de20aaac2c921aa1fb0fcf426e5
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/META_INFO.xml.bak
- /data/data/####/shared_prefs/au.xml
- /data/data/####/shared_prefs/ContextData.xml
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/d2c1eb7e7cc4dc6a8a2dcbced2e7719c
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/125a97a3c9710f8c5ad4fec054d5c362.tmp
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/f5c51fb8096b0f473d9ae6da8437855c
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/f3bd42ac30b93943b7617f5863309899
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/cache/tomb.zip
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/files/.pluto_lib/a5065d9725435eca9b04c5fa7adf906c/pluto.apk
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/5d52fecd738e35dcdae03b9418816e48
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/52ff6974518c97083b737304351c8aba
- /data/data/####/databases/webviewCookiesChromium.db.mirror
- /data/data/####/shared_prefs/20160121.xml
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/425bb09a42b2a6c65a55ff376ba8222a
- /data/data/####/files/umeng_it.cache
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/8352fd113125b1f8d5c4052d12ac0032
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/3e5e82530ee9bad9d6c9730de9d569bd
- /data/data/####/files/security_info
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/f963e1fb17a26fd622d5a9d592813582
- /data/data/####/databases/bugly_db_legu.mirror
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/3686e124bd2590e737c0ec2328dcaf19
- /data/data/####/shared_prefs/META_INFO.xml
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/28c2c011a32d93fb0bf25dcb77944f7f
- /data/data/####/databases/ua.db
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/client.id
- /data/data/####/files/BEeIkylSiomJCMMwdynamicloader.jar
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/bd3b841267edaeae2e62e63dcc07d00c
- /data/data/####/files/jymbkry/libqQCsEctjZlalDSKYzxc.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/f16b3cb4abeca3f8231dba00f2bebe55
- /data/data/####/shared_prefs/20160218.xml
- /data/data/####/databases/swith1014.db.mirror
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/547508683985fc839398a5c142d454fc
- /data/data/####/files/200/1001/2017032117911
- /data/data/####/app_bugly/tomb_1485417972863.txt
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/3e4c73fa708f9dee6b9ef5e4a8d36731
- /data/data/####/files/native_service
- /data/data/####/files/jymbkry/libfUxRhKvWaPpegEZElala.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/4e1385246e626193ee6a736ad3a854cf
- /data/data/####/databases/webview.db.mirror
- /data/data/####/databases/ReminderDatabase-journal
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/1b97f653cdc797f80e6d46b858633b96
- /data/data/####/files/jymbkry/libMutkgkxsohgXtLizbt.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/3b9b028de7e75e613bf542ad41aa6189
- /data/data/####/tx_shell/libufix.so
- /data/data/####/databases/ReminderDatabase.mirror
- /data/data/####/mix.dex
- /data/data/####/app_bugly/tomb_148541799457.txt
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/147690f9ca51a273161af4b74eecef10
- /data/data/####/databases/ua.db-journal
- /data/data/####/tx_shell/libnfix.so
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/09fffacf8b34bdfe82b51aa9c251180b
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/28b03fc4dcb9fea065e0d4776e6cdf85
- /data/data/####/files/200/1001/110011Copy.data
- /data/data/####/files/.imprint
- /data/data/####/databases/bdownloaders.db.mirror
- /data/data/####/shared_prefs/IMDPREF.xml
- /data/data/####/databases/bdownloaders.db-journal
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/939790314b84fe89788c321de988a4d9
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/shared_prefs/duspf6030945.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/100/1001/1485417980725.apk
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/163881f3e8fe796f182b68ddea55e106
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/39ad2d3eff75116299bf808f9d2ddc9b
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/bugly_db_legu-journal
- /sdcard/.pluto_data/a5065d9725435eca9b04c5fa7adf906c/images/78ed0d8b650b5b08e4bf27b19b97e152
- /data/data/####/databases/cc.db.mirror
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libufix.so
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/files/native_service
- /data/data/####/app_bugly/tomb_148541799457.txt
- /data/data/####/app_bugly/tomb_1485417972863.txt
- /data/data/####/tx_shell/libshella-2.10.1.so
Другие:
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
