Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.72.origin
- Android.Xiny.165.origin
- Android.SmsSend.15976
- Android.Xiny.164.origin
- Android.Mixi.13.origin
- Android.Xiny.166.origin
Сетевая активность:
Подключается к:
- faceboo####.link
- we####.com
- show####.xyz
- s####.####.com
- 4####.####.176
- 4####.####.251
- woo####.com:7077
- 1####.####.184
- quede####.com
- statist####.com
- 4####.####.188
- 1####.####.85
- 1####.####.81
- 4####.####.161
- 4####.####.160
- 4####.####.163
- we####.com:8081
- g####.####.com
- 4####.####.240
- c####.####.com
- 1####.####.190
- 1####.####.198
Запросы HTTP GET:
- faceboo####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=####&s2=####&s3=####&s5=####
- c####.####.com/landings/87511/1489511222/js/showhide.js?148951####
- 4####.####.161/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- s####.####.com/rtf/61758845ff587a9ca72eec4a182a2db1.slze
- s####.####.com/rtf/6118b734c99b874ae095b036904bb948.slze
- s####.####.com/rtf/421086c2eddcc74d954cb7e9ec84d72a.slze
- faceboo####.link/c/da57dc555e50572d?s1=####&s2=####&s3=####&click_id=####
- 4####.####.176/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 1####.####.184/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- c####.####.com/landings/87511/1489511222/js/steps.js?148951####
- 1####.####.190/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 4####.####.160/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- quede####.com/99Q12/OjkYdA/Ljpd/KjdMJ2k/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L/fGdNITc1PgMo7FOv0_nIDCk-4G4TE5o?jch=####
- s####.####.com/rtf/43078249e02a6c5f401cd388aaf98eec.slze
- 4####.####.161/admin201506/uploadApkFile/rt/20170321/env201703211750.data
- c####.####.com/landings/87511/1489511222/css/styles.css?148951####
- s####.####.com/rtf/1805f9b499c8a466d9e51eed7db4bd109.slze
- s####.####.com/rtf/610fea5b886716cf60b0521639405d49.slze
- 1####.####.198/admin201506/uploadApkFile/rt/20170113/ge25.data
- 4####.####.161/admin201506/uploadApkFile/rt/20160406/ToolboxAndSupolicy.zip
- 1####.####.85/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- c####.####.com/landings/87511/1489511222/js/progressButton.js?148951####
- s####.####.com/rtf/40860393e1060fdd055a12956885d381.slze
- c####.####.com/landings/87511/1489511222/js/classie.js?148951####
- 1####.####.198/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 4####.####.240/admin201506/uploadApkFile/rt/20170113/ge23.data
- c####.####.com/landings/87511/1489511222/js/modernizer.js?148951####
- quede####.com/99Q12/Ljpd/ID5N/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L?KjM=####
- 4####.####.240/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 4####.####.161/admin201506/uploadApkFile/rt/20170113/rs40.data
- g####.####.com/cr/sdk/goplaysdk_statistics.dat
- 4####.####.251/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- c####.####.com/landings/87511/1489511222/css/button.css?148951####
- s####.####.com/rtf/806274507dde8d7f9651585a081b9bf1.slze
- show####.xyz/adult/_files/imgs/r_general1/img-4fuck.gif
- 1####.####.81/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 4####.####.163/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- s####.####.com/rtf/640cd07bae56fb884eb1264ece3adf87.slze
- 4####.####.188/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- 4####.####.161/admin201506/uploadApkFile/rt/20170316/elfm0.zip
- c####.####.com/landings/87511/1489511222/js/avsc2.js?148951####
- statist####.com/adv_pxl?pid=####&id=####
- g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=####&interval=####&v=####
- 1####.####.81/admin201506/uploadApkFile/rt/20170113/gp41.data
- c####.####.com/landings/87511/1489511222/css/bootstrap.css?148951####
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- we####.com/sm/sr/ku/ky
- we####.com:8081/sm/sr/rt/ry
- we####.com/sm/sr/run/hy
- woo####.com:7077/sdk/nsd.action?b=####
- we####.com/sm/sr/sp/py
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/p.gp41/files/408.jar
- /data/data/####/shared_prefs/20160121.xml
- /data/data/####/com.init.env/files/debuggerd_hulu
- /data/data/####/com.init.env/files/forever.sh
- /data/data/####/files/100/1003/env201703211750.data
- /data/data/####/app_DEX_OPT/70153606.dex
- /data/data/####/app_DEX_OPT/91169916.dex
- /data/data/####/databases/webview.db-journal
- /data/data/####/com.init.env/files/toolbox
- /sdcard/test
- /data/data/####/files/c201703312050.apk
- /data/data/####/com.init.env/files/kcol_ysy
- /data/data/####/files/100/1003/ge25.data
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/p.gp41/files/.S1CH1S/4AB712239B2BDBC7C0FFCE3039D3C027
- /data/data/####/p.gp41/files/forever.sh
- /data/data/####/databases/rtr.db-journal
- /data/data/####/p.gp41/files/.S1CH1S/9736F0C22830D365D59E26ABED4AF856
- /data/data/####/p.gp41/files/.S1CH1S/A148B677DB524630C21ECA13C2D9E225
- /data/data/####/p.gp41/files/1485418762213.jar
- /data/data/####/p.gp41/files/640.jar
- /data/data/####/files/100/1003/ge23.data
- /data/data/####/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
- /data/data/####/p.gp41/files/611.jar
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/app_DEX_OPT/72703871.dex
- /data/data/####/files/100/1003/gp41.data
- /data/data/####/p.gp41/files/617.jar
- /data/data/####/p.gp41/files/806.jar
- /data/data/####/files/100/1003/70153606.apk
- /data/data/####/com.init.env/files/install-recovery.sh
- /data/data/####/databases/rtr.db
- /data/data/####/shared_prefs/20160121.xml.bak
- /data/data/####/p.gp41/files/.gepd/gpdu
- /data/data/####/p.gp41/files/.S1CH1S/B11C222F5B18FADD2FFA4C70E35F4AC8
- /data/data/####/com.init.env/files/cdrom_msuf_stop
- /data/data/####/p.gp41/shared_prefs/p.gp41_preferences.xml
- /data/data/####/files/100/1003/78101468.apk
- /data/data/####/p.gp41/files/430.jar
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/201703312050.apk
- /data/data/####/com.init.env/files/elfm1485418754622.zip
- /data/data/####/files/100/1003/rs40.data
- /data/data/####/p.gp41/files/421.jar
- /data/data/####/shared_prefs/ar.xml
- /data/data/####/p.gp41/files/.S1CH1S/1489ACE5DD2C3FC346A4B1D3C2022642
- /data/data/####/com.init.env/files/toolbox1485418754736.zip
- /data/data/####/p.gp41/files/.S1CH1S/3C009D66CAABD433CCD1D841E6AF0BF3
- /data/data/####/files/100/1003/72703871.apk
- /data/data/####/p.gp41/shared_prefs/p.gp41_preferences.xml.bak
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/com.init.env/files/setsebool_sfum_usbcharger
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/com.init.env/files/supolicy
- /data/data/####/app_DEX_OPT/83464179.dex
- /data/data/####/p.gp41/files/.S1CH1S/E8EE0B0E8C98EFCC1566F520B5CF12B0
- /data/data/####/p.gp41/files/.play/.md
- /data/data/####/p.gp41/files/.S1CH1S/2A63DF2C983CE370A9205B913A7F4B45
- /data/data/####/com.init.env/files/elfm
- /data/data/####/app_DEX_OPT/78101468.dex
- /data/data/####/p.gp41/files/.S1CH1S/834C8EAFCA3DB238A4EF547DDC644C6B
- /data/data/####/databases/bdownloaders.db-journal
- /data/data/####/p.gp41/files/610.jar
- /data/data/####/files/100/1003/83464179.apk
- /data/data/####/p.gp41/files/.play/test
- /data/data/####/files/100/1003/91169916.apk
- /data/data/####/cache/webviewCacheChromium/index
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/com.init.env/files/toolbox
- /data/data/####/com.init.env/files/forever.sh
- /data/data/####/files/c201703312050.apk
- /data/data/####/p.gp41/files/.play/test
Другие:
Запускает следующие shell-скрипты:
- chmod 770 /data/data/####/p.gp41/files/.play/test
- getenforce
- cdrom_msuf_stop
- chmod 0771 /data/data/####/p.gp41/.syslib-
- syssp -h e4e9bd1629b64d73b7c51387df1e1406 /data/data/####/p.gp41/.syslib-
- c201703312050.apk
- .hulu
- logcat -d -v time
- .hulu -c id
- sh
- /data/data/####/p.gp41/files/.play/test /data/data/####/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
- cdrom_msuf_stop -c id
Может автоматически отправлять СМС-сообщения.
