Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 4446: SHNMB 7533 SDK0085NG13805P923J046U919I####ED
Сетевая активность:
Подключается к:
- 5####.####.com
- ap####.mobi
- e####.####.com:9090
- b####.com
- p####.####.com
- e####.####.com
- v####.####.gdn
- trac####.####.biz
- a####.####.com
Запросы HTTP GET:
- b####.com/?id=####&ip=####&ua=####
- e####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&imei=#...
- e####.####.com/sdkcp/ibsbill.php?pushId=####&lpId=####&linkId=####&imsi=...
- 5####.####.com/?kw=####&s2=####
- e####.####.com:9090/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&im...
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- e####.####.com/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&imei=####...
- b####.com/rms/rms%20answers%20Identity%20Mobile$MobileSnrWindowsLiveConn...
- b####.com/rms/BingCore.Bundle/cj,nj/4ec5679f/05acd042.js?bu=####
- b####.com/az/hprichbg/rb/MVAU_ROW10497762037_320x240.jpg
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&imei=####...
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerIdentityUpdate/...
- v####.####.gdn/?sov=####&hid=####&&redid=####&gsid=####&campaign_id=####...
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- a####.####.com/fd/ls/l?IG=####&CID=####&TYPE=####&DATA=####
- b####.com/ImageResolution.aspx?w=####&h=####&hash=####&id=####&ip=####&u...
- b####.com/Identity/Hamburger?n=####&id=####&ip=####&ua=####&IID=####&IG=...
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- b####.com/sa/simg/anon_200px.png
- b####.com/rms/AutoSug/cj,nj/59cc1548/bd478095.js?bu=####
- ap####.mobi/red/8d121b23-b4a1-11e5-a414-0cc47a44dbaa/?alg=####&clickid=#...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- trac####.####.biz/tl?a=####&o=####&s1=####
- b####.com/hpmob?id=####&ip=####&ua=####&IG=####&IID=####
- b####.com/Passport.aspx?popup=####
- e####.####.com/sdkcp/sub_payquery.jsp?uid=####&sendtimes=####&model=####...
- b####.com/sa/simg/hamburger_icons_sprite2x_mysaves_1.png
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- e####.####.com/wapbill/Bfeecnf.jsp?dangwei=####&uid=####&imei=####&cpid=...
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- e####.####.com/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&...
- v####.####.gdn/TES672bingALL.html
- e####.####.com/sdkcp/pushAdwap_new.jsp?uid=####&comptime=####&model=####...
Запросы HTTP POST:
- b####.com/fd/ls/lsp.aspx?
- p####.####.com/api/q/a/35313985d3b9ccc38ab579d35065afe66
- b####.com/fd/ls/lsp.aspx
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/shared_prefs/35313985d3b9ccc38ab579d35065afe66|account_file.xml
- /data/data/####/files/playerData
- /data/data/####/databases/mpush_game.db-journal
- /data/data/####/files/mo.apk
- /data/data/####/cache/b.log
- /data/data/####/files/ow.apk
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
