Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
- Android.Backdoor.336.origin
- Android.Xiny.90.origin
- Android.Loki.10.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.336.origin
Сетевая активность:
Подключается к:
- trac####.####.com
- m####.####.club
- instant####.club
- e####.####.com:9090
- ad####.####.net
- 2####.####.132
- analy####.####.com
- clinkad####.com
- and####.####.com
- a####.####.plus
- ip####.io
- trackme####.com
- apptr####.com
- s####.####.com
- a####.com
- u####.####.com
- cpact####.com
- t####.####.org
- d####.####.com
- prelan####.net
- t####.####.net
- p####.####.com
- aexcep####.####.com
- gl####.####.com
- m####.####.com
- re####.####.com
- c####.####.club
- a####.####.com:8011
- aexcep####.####.com:8012
- up####.####.com
- di####.com
- bestpho####.mobi
- cdn####.####.com
- g####.####.com
- p####.####.com:3090
- a####.####.com
- t####.####.com
- s####.####.li
- mobilep####.com
- j####.####.com
- l####.####.net
- c####.####.com
- rockt####.com
- e####.####.com
- face####.####.pw
- n####.####.com
Запросы HTTP GET:
- c####.####.com/tracking/adClick?d=####&ru=####&prod=####&segId=####&clickId=####&advId=####
- trac####.####.com/click?id=####&aff=####&click=####&aff_sub=####&gaid=####&android_id=####&idfa=####
- e####.####.com/thinking/group/test4
- p####.####.com/?m=####&a=####&pubid=####
- a####.####.com/pull/top_offer?gaid=####&id=####
- a####.####.com/link/buy/iphone/1071976327/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&andid=####&advid=####&chn=####
- t####.####.com/c/FgwITM4m4z300ka6Tk0y6KuVkHyPQRC0H2trp6gHwDY/CF?subid1=####&placement=####&m.gaid=####&m.idfa=####
- a####.####.com/link/buy/android/com.bol.shop/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- t####.####.com/agentapi/click?cid=####&aid=####&sub_id=####&postbac####
- e####.####.com/sdkcp/pushAdwap_new.jsp?uid=####&comptime=####&model=####&plugVersion=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&advid=####&...
- c####.####.com/index.php?o=####&p=####&s=####&s1=####&s2=####&clickid=####&GoogleAdID=####&placement=####&deviceid=####&vaultapi=####
- ip####.io/json
- u####.####.com/click?k=####&p=NjAyO####
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c65464b080a.png
- c####.####.com/click?campid=####&gid=####&imei=####&android=####&sub_channel=####&aff_sub=####
- e####.####.com/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&advid=####&chn=####
- instant####.club/?brand=####&model=####&browser=####&td=####&voluumdata=####&clickid=####&pub_id=####&_uu=####
- c####.####.com/tracking/index/58dc7c60397b9?gaid=####&idfa=####&andid=####&imei=####&aff_sub=####&sub_id=####
- e####.####.com/sdkcp/getWapSubLog.jsp?uid=####&plugVersion=####&imei=####&linkid=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- a####.####.com/api/imm.php?p=####
- cpact####.com/api/v1.0/clk/track/proxy?ad_id=####&site_id=####&response_id=####&s=####&subsite_id=####
- a####.com/c/155316/564op7or-5s44-66r0-n521-5pp92n99qonn/244qps17.html?clickid=####&source=####&source2=####
- a####.####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&clickid=####&affiliate_id=####&deviceid=####
- a####.####.com/link/buy/android/com.parkmobile/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.min.js
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.squishy.js
- n####.####.com/setting?app_id=####&sign=####
- t####.####.net/click?id=####&aff=####&click=####&aff_sub=####&gaid=####&idfa=####&android_id=####
- t####.####.org/tl?a=####&o=####&s1=####&s2=####
- m####.####.club/8041b016-8ede-42c5-bfef-05e3103eb343?clickid=####&pub_id=####&_uu=####
- d####.####.com/thinking/group/rtt0319_662.apk
- face####.####.pw/r/l/d89161c06f59d52640c1730ca14eb68a/?entrypop=####&voluum_cid=####&lang=####&cc=####&target=####&cn=####&model=####&brand=####&voluu...
- a####.####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- apptr####.com/dir/click?c=####&offerid=####&affid=####&affsub1=####&cid=####&uuid=####&ref=####
- e####.####.com/thinking/group/onemain/mainp.apk
- c####.####.club/static/gsubcountry/yes/NL/names.js
- u####.####.com/click?k=####&p=####
- apptr####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&affsub1=####
- di####.com/39B41/WhIb/VBYL/DFpY1F_WjfAtWYqwVQ0fo4AdFnImV45H3ek_AMXiagb7ZMtadKsg?Xhs=####&ext2=####
- a####.####.com/tracking/index/58de0806b1e27?gaid=####&idfa=####&andid=####&imei=####&aff_sub=####&sub_id=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/index.css
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- t####.####.com/?aff_id=####&offer_id=####&aff_sub=####&aff_sub2=####
- c####.####.com/jquery-1.11.1.min.js
- trackme####.com/r/c862de6e-15fc-11e7-ba70-1141978b2a38/0/
- j####.####.com/39B41/ThFe0A/WhIb/Xh8Khww/DFpY1F_WjfAtWYqwVQ0fo4AdFnImV45H3ek_AMXiagb7ZMtadKsg/CE8LgVWBlKJ_X97nXwhUrTpHsQMySzk?jch=####
- e####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&pubID=####
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gaid=####&aid=####
- e####.####.com/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&cpid=####&imsi=####&type=####&net=####&pjid=####&subid=####&
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/step1.html
- a####.####.com/link/buy/android/com.bigfishgames.fairwaysolitaireuniversalf2pgoogle/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&plac...
- e####.####.com/thinking/group/ym32
- ad####.####.net/index.php?m=####&p=####&app_id=####&offer_id=####&gaid=####&aff_sub=####&andid=####&idfa=####&appname=####&aff_sub=####&channel=####&a...
- c####.####.com/apk/portal/17/03/21/19/20/58d10c8ac69e7.apk?pp=inNP####&ttl=####&token=####
- apptr####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&data1=####&data2=####&data3=####&data4=####&affsub1=####&device_id=####&gaid=####&i...
- trackme####.com/r/c862de6e-15fc-11e7-ba70-1141978b2a38/1/
- s####.####.com/srv/click/?pid=####&p8=####&p2=####&p6=####&p1=####&p3=####&p4=####&p5=####&p7=####
- face####.####.pw/r/t?entrypop=####&voluum_cid=####&lang=####&cc=####&target=####&cn=####&model=####&brand=####&voluumdata=####&pubid=####&src=####&sub...
- a####.####.com/transaction/post_click?offer_id=####&aff_id=####&aff_sub=####&aff_sub6=####&aff_sub3=####
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&chn=####&idfa=####&advid=####&user_id=####
- a####.####.com/link/buy/android/com.gaijin.scm/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- 2####.####.132/tracking/adClick?d=####&ru=####&prod=####&segId=####&advId=####&clickId=####
- t####.####.net/click/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&affid=####&pn_u=####&pn_l=####&aff_sub2=####&pub_sub_id=####&gid=####
- a####.####.plus/api/getADConfig?app_key=####&duid=####&sdk_version=####&gaid=####&sub=####&vs=####
- t####.####.net/superlink?aff_id=####&source=####&aff_sub3=####&aff_sub4=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/logo_sm.png
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####
- rockt####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&source=####
- cpact####.com/api/v1.0/clk/track/proxy?click_id=####&site_id=####&ad_id=####&sub_id=####
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gaid=####
- bestpho####.mobi/?sl=####&data1=####&data3=####
- c####.####.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/script.js
- re####.####.com/ad/find?platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation=####&image_size=####&m...
- e####.####.com/sdkcp/ibsbill.php?pushId=####&lpId=####&linkId=####&imsi=####&subid=####&cpid=####&pjid=####&uid=####&net=####&linkid=####&leix=####&pl...
- a####.####.com/link/buy/android/nl.aegon.fitkroodle/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- e####.####.com/thinking/group/exp
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/apple-iphone7.png
- m####.####.club/29897cf3-9917-49f4-a93d-4195028b2b68?pubid=####&src=####&subid=####&clickid=####
- c####.####.club/static/sweep/global/zepto.min.js
- rockt####.com/d/15143458cac3ab0e1bc?source=####&sub=####
- s####.####.li/l/6vquqvb4/e83b75cb304cc368?p1=####&subid=####
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&advid=####&chn=####&andid=####
- apptr####.com/dir/click?c=####&device_id=####&data4=####&gaid=####&data3=####&data2=####&idfa=####&offerid=####&data1=####&affid=####&affsub1=####&cid...
- trac####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub2=####&aff_sub=####
- e####.####.com:9090/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&idfa=####&google_adv_id=####&aff_sub8=####&aff_sub7=####&aff_sub6=####
- analy####.####.com/requestv2?p=####
- a####.####.com/link/buy/android/yeay.tv.yeay/e1?clinkID=####&pubID=####&siteID=####&did.i=####&did.aa=####&placementID=####&trackingID=####
- s####.####.li/l/6vquqvb4/e83b75cb304cc368/?p1=####&subid=####
- ad####.####.net/index.php?m=####&p=####&app_id=####&offer_id=####&gaid=####&aff_sub=####&andid=####&idfa=####&appname=####&channel=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/loader.gif
Запросы HTTP POST:
- up####.####.com/fail_log?platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation=####&image_size=####&...
- p####.####.com:3090/PlutoServer/app/appinit/
- a####.####.com/offerview/info/920
- a####.####.com/rqd/async
- analy####.####.com/
- and####.####.com/rqd/async
- e####.####.com/sdkcp/app_log.php
- e####.####.com/sdkcp/geturlok.php?imsi=####&subid=####&pjid=####&net=####&linkid=####&uid=####&plugVersion=####
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- a####.####.com/api/imm_strategy.php?p=####
- a####.####.com/subscribe/api/1997
- l####.####.net/gkview/info/600
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- m####.####.com/errorview/api/601
- p####.####.com/PlutoServer/app/getplugin/
- a####.####.com:8011/rqd/async
- aexcep####.####.com:8012/rqd/async
- up####.####.com/upload_log?platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation=####&image_size=###...
- aexcep####.####.com/rqd/async
- n####.####.com/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/jymbkry/libBEeIkylSiomJCMMwdynamicloader.so
- /data/data/####/shared_prefs/SSPPrefe.xml
- /data/data/####/files/.snow/b.png
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /sdcard/.sysAndroid/download/246913260
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/.snow/myshell
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/.windy/65288c96bb8cefd3d531a278a6ac5862.tmp
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/shared_prefs/20160218.xml.bak
- /data/data/####/files/.work/postroot.sh
- /data/data/####/files/200/1001/110011Copy.data
- /sdcard/.sysAndroid/sys
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/com.nativedroid.module.offerprobe.xml
- /data/data/####/shared_prefs/META_INFO.xml.bak
- /data/data/####/files/.pluto_lib/f18934bba8b1e100dbe46a7cb0570b79/pluto.apk
- /data/data/####/shared_prefs/sdk_scl_pid_config.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/.snow/.dico.apk
- /data/data/####/app_indicators/indicator_p
- /data/data/####/files/.snow/checkFile13
- /sdcard/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.tmp
- /sdcard/.sysAndroid/system.android.db
- /data/data/####/files/83bf46f2b4e35a0f9c967cd01d154a8.data
- /data/data/####/files/.snow/ex0
- /data/data/####/files/.snow/.service
- /data/data/####/files/.snow/.e0.data
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.dat
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/checkFile9
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/.snow/checkFile7
- /data/data/####/files/.snow/checkFile5
- /data/data/####/files/.snow/checkFile3
- /data/data/####/files/.snow/checkFile0
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/files/BEeIkylSiomJCMMwdynamicloader.jar
- /data/data/####/databases/sp_db.mirror
- /sdcard/.sysAndroid/dbversion
- /data/data/####/databases/webviewCookiesChromium.db.mirror
- /data/data/####/files/.snow/.center.tapk
- /data/data/####/files/.snow/exp
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/qQCsEctjZlalDSKYzxc.jar
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/files/FpBekWFTKyFzEqgDdaemon.so
- /data/data/####/files/log/temp_log
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/security_info
- /data/data/####/files/.snow/.ukd
- /data/data/####/databases/bugly_db_legu.mirror
- /data/data/####/cache/a.log
- /data/data/####/files/local_crash_lock
- /data/data/####/files/log/crash_log
- /data/data/####/files/native_record_lock
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.tmp
- /data/data/####/files/.snow/.uks
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.snow/.dlsb.apk
- /data/data/####/files/.snow/.zip/ym
- /data/data/####/files/MutkgkxsohgXtLizbt.dex
- /data/data/####/files/jymbkry/libqQCsEctjZlalDSKYzxc.so
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/20160218.xml
- /sdcard/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.dat
- /data/data/####/files/.snow/.rshs
- /data/data/####/files/mo.apk
- /data/data/####/mix.dex
- /data/data/####/files/mobclick_agent_cached_####5
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/jymbkry/libfUxRhKvWaPpegEZElala.so
- /sdcard/.windy/49f19b1b089f018a1792a4c581f93d58.tmp
- /sdcard/.sysAndroid/system.android.db.mirror
- /data/data/####/databases/webview.db.mirror
- /data/data/####/files/.default/83bf46f2b4e35a0f9c967cd01d154a8.data.temp
- /data/data/####/files/.snow/a.xml
- /data/data/####/files/jymbkry/libMutkgkxsohgXtLizbt.so
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.zip/post.sh
- /data/data/####/app_indicators/indicator_d
- /data/data/####/tx_shell/libufix.so
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/databases/cc/cc.db
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/player
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.zip/boy
- /data/data/####/files/.snow/busybox
- /data/data/####/shared_prefs/SSPPrefe.xml.bak
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/files/.snow/.client
- /data/data/####/files/200/1001/170126093746764.apk
- /data/data/####/databases/cc/cc.db.mirror
- /data/data/####/databases/sp_db-journal
- /sdcard/.sysAndroid/cache/image/-590343731.temp
- /data/data/####/shared_prefs/IMDPREF.xml.bak
- /data/data/####/files/MutkgkxsohgXtLizbt.jar
- /data/data/####/shared_prefs/IMDPREF.xml
- /data/data/####/cache/b.log
- /sdcard/.googlex9/.xamdecoq0962
- /data/data/####/files/200/1001/2017030619911
- /data/data/####/files/.snow/.dlme.apk
- /sdcard/.pluto_data/f18934bba8b1e100dbe46a7cb0570b79/client.id
- /sdcard/.sysAndroid/system.android.db-journal
- /data/data/####/files/fUxRhKvWaPpegEZElala.jar
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/files/.snow/.uok
- /data/data/####/shared_prefs/META_INFO.xml
- /data/data/####/files/.snow/.zip/mkdevsh
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libufix.so
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.service
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/files/.snow/b.png
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/files/.snow/.client
- /data/data/####/files/.snow/.ir
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/files/.work/postroot.sh
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/.snow/exp
- /data/data/####/files/.snow/myshell
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.snow/a.xml
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/files/.snow/ex0
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.zip/post.sh
Другие:
Запускает следующие shell-скрипты:
- sh
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
