Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- s####.####.com
- mobilep####.com
- prelan####.net
- p####.####.com
- 5####.####.105:61072
- a####.####.com
- trk####.mobi
- b####.####.com
- down####.####.com
- 00####.com:61070
Запросы HTTP GET:
- prelan####.net/adult/dating/hardcore/en/1/v1/css/app.css
- prelan####.net/adult/dating/hardcore/en/1/v1/images/logo.png
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_2.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.css
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/what-input/what-input.js
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.css
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.js
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.js
- down####.####.com/js/2016072.data
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/ajax-loader.gif
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_4.JPG
- trk####.mobi/offer/29247%7C11910?data3=####&data4=####&data5=####
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick-theme.css
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_1.jpg
- down####.####.com/js/2016071.data
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_3.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/js/app.js
- prelan####.net/adult/dating/hardcore/en/1/v1/step1.html
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/foundation-sites/dist/foundation.js
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/jquery/dist/jquery.js
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&pubID=####
Запросы HTTP POST:
- b####.####.com/jiagu/mark/upgrade
- s####.####.com/pkl16.html
- 00####.com:61070/wall/version_V2/version
- p####.####.com/jiagu/msgs
- b####.####.com/jiagu/t/infos
- 5####.####.105:61072/wall/report/report
- a####.####.com/app_logs
Другие:
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
