Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.164.origin
- Android.Xiny.165.origin
- Android.Xiny.166.origin
- Android.SmsSend.15976
- Android.Xiny.72.origin
Сетевая активность:
Подключается к:
- 1####.####.198
- 4####.####.160
- we####.com:8081
- 4####.####.251
- 1####.####.190
- 1####.####.85
- google-####.com
- woo####.com:7077
- 1####.####.184
- quede####.com
- woo####.com
- we####.com
- googlet####.com
- n####.####.com
Запросы HTTP GET:
- quede####.com/99Q12/OjkYdA/Ljpd/KjdMJ2k/eHIafDNiK1N-ulas0aXWWjGkEszX8e0B...
- 1####.####.198/admin201506/uploadApkFile/rt/20161119/dzxex2.zip
- 1####.####.190/admin201506/uploadApkFile/rt/20170113/ge51.data
- n####.####.com/fe/img/bitcoin_icon_small.png
- 1####.####.198/admin201506/uploadApkFile/rt/20170405/dz_868.zip
- n####.####.com/fe/img/logo-footer.png
- n####.####.com/fe/js/lazyLoad.min.js
- n####.####.com/fe/js/jquery-picture-min.js
- 4####.####.251/admin201506/uploadApkFile/rt/20170114/ge40.data
- n####.####.com/fe/css/style.css
- 1####.####.184/admin201506/uploadApkFile/rt/20170405/dz_p868.data
- n####.####.com/fe/img/foto.png
- n####.####.com/escorts/?&utm_source=####&utm_medium=####&utm_content=###...
- n####.####.com/fe/img/arrow-right.png
- n####.####.com/fe/img/arrow-top.png
- 1####.####.198/admin201506/uploadApkFile/rt/20161118/d1103z.zip
- n####.####.com/escorts?&utm_source=####&utm_medium=####&utm_content=####...
- n####.####.com/fe/img/body.png
- 1####.####.198/admin201506/uploadApkFile/rt/20170113/ge50.data
- 1####.####.184/admin201506/uploadApkFile/rt/20170113/p_dzsd45.data
- n####.####.com/fe/img/arrow-right-path.png
- 1####.####.190/admin201506/uploadApkFile/rt/20170113/ge30.data
- quede####.com/99Q12/Ljpd/ID5N/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRB...
- 1####.####.85/admin201506/uploadApkFile/rt/20170113/ge29.data
- n####.####.com/fe/img/open-white.png
- n####.####.com/fe/img/open-menu.png
- 1####.####.198/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
- n####.####.com/fe/img/flags_sprite_small.png
- n####.####.com/fe/img/paysite_icon_small.png
- google-####.com/analytics.js
- n####.####.com/fe/img/close.png
- n####.####.com/fe/inc/warning/avviso_categoriaminori18A_dut.php
- n####.####.com/fe/css/elenco-alternativo.css
- n####.####.com/fe/img/paysafe_icon_small.png
- n####.####.com/fe/img/placeholder.png
- n####.####.com/fe/js/jquery-ui-1.9.2.min.js
- n####.####.com/fe/css/reset.css
- n####.####.com/fe/img/registrati.png
- 1####.####.85/admin201506/uploadApkFile/rt/20170113/p_dzpg48.data
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&d...
- n####.####.com/fe/js/enscroll-0.6.0.min.js
- n####.####.com/fe/inc/warning/warning_annunci_dut.php
- n####.####.com/fe/img/logo/logo_big_skokka.com.png
- n####.####.com/fe/js/public.js?v=####
- n####.####.com/fe/js/jquery-1.9.1.min.js
- 1####.####.198/admin201506/uploadApkFile/rt/20170113/ge46.data
- googlet####.com/gtm.js?id=####
- 4####.####.160/admin201506/uploadApkFile/rt/20170408/rs40.data
- 1####.####.198/admin201506/uploadApkFile/rt/20161119/dz_sd32.zip
- 1####.####.198/admin201506/uploadApkFile/rt/20170412/elfm0.zip
- 1####.####.198/admin201506/uploadApkFile/rt/20170412/env201704121250.data
- 1####.####.184/admin201506/uploadApkFile/rt/20170113/ge31.data
- n####.####.com/fe/img/accedi.png
- n####.####.com/fe/css/style-additions.css
- n####.####.com/fe/img/footer-bg.png
- 1####.####.198/admin201506/uploadApkFile/rt/20160406/ToolboxAndSupolicy....
- n####.####.com/fe/img/home_skk/map_pin.png
- n####.####.com/fe/js/utility.js
- n####.####.com/fe/img/social/blog.png
Запросы HTTP POST:
- we####.com/sm/sr/sp/py
- woo####.com/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=####
- woo####.com:7077/sdk/nsd.action?b=####
- we####.com:8081/sm/sr/rt/ry
- we####.com/sm/sr/run/hy
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/com.init.env/files/debuggerd_hulu
- /sdcard/test
- /data/data/####/shared_prefs/20160121.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/100/1003/ge51.data
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/100/1003/ge50.data
- /data/data/####/shared_prefs/com.powerctl.superbattery.util.PreferenceUtil.xml
- /data/data/####/p.dzsd45/files/ZVhWdGFXVXpNZz09
- /data/data/####/p.dz868/files/ODY4X2V41485415323525.zip
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_DEX_OPT/83811987.dex
- /data/data/####/app_DEX_OPT/22696129.dex
- /data/data/####/app_DEX_OPT/56306149.dex
- /data/data/####/files/100/1003/33507287.apk
- /data/data/####/app_DEX_OPT/59473125.dex
- /data/data/####/files/100/1003/22696129.apk
- /data/data/####/com.init.env/files/elfm
- /data/data/####/files/100/1003/20711316.apk
- /data/data/####/p.sr40/files/cnVuc2hlbGwy1485415296896.zip
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/p.dzsd45/files/error
- /data/data/####/p.dz868/files/error
- /data/data/####/com.init.env/files/toolbox
- /data/data/####/com.init.env/files/kcol_ysy
- /data/data/####/files/100/1003/27657402.apk
- /data/data/####/files/100/1003/56306149.apk
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/com.init.env/files/uart_yble_stop
- /data/data/####/databases/rtr.db
- /data/data/####/files/100/1003/77696411.apk
- /data/data/####/p.sr40/files/cnVuc2hlbGwy
- /data/data/####/files/100/1003/ge30.data
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/shared_prefs/20160121.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/com.init.env/files/supolicy
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/100/1003/76929685.apk
- /data/data/####/p.dz868/files/ODY4X2V4
- /data/data/####/files/100/1003/83566004.apk
- /data/data/####/app_DEX_OPT/77696411.dex
- /data/data/####/app_DEX_OPT/33507287.dex
- /data/data/####/com.init.env/files/forever.sh
- /data/data/####/files/100/1003/dz_p868.data
- /data/data/####/app_DEX_OPT/56323099.dex
- /data/data/####/com.init.env/files/schedtop_bely_usbcharger
- /data/data/####/files/c201704171650.apk
- /data/data/####/files/100/1003/59473125.apk
- /data/data/####/databases/rtr.db-journal
- /data/data/####/files/100/1003/p_dzpg48.data
- /data/data/####/files/100/1003/ge40.data
- /data/data/####/com.init.env/files/elfm1485415294973.zip
- /data/data/####/files/100/1003/56323099.apk
- /data/data/####/files/100/1003/ge31.data
- /data/data/####/p.sr40/files/forever.sh
- /data/data/####/p.dzsd45/files/ZGV4ZXoy1485415310034.zip
- /data/data/####/app_DEX_OPT/27657402.dex
- /data/data/####/app_DEX_OPT/83566004.dex
- /data/data/####/app_DEX_OPT/86095433.dex
- /data/data/####/files/100/1003/83811987.apk
- /data/data/####/files/100/1003/ge46.data
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/p.dzsd45/files/ZVhWdGFXVXpNZz091485415311529.zip
- /data/data/####/files/201704171650.apk
- /data/data/####/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
- /data/data/####/app_DEX_OPT/20711316.dex
- /data/data/####/databases/bdownloaders.db-journal
- /data/data/####/files/100/1003/ge29.data
- /data/data/####/files/100/1003/rs40.data
- /data/data/####/p.dzsd45/files/ZGV4ZXoy
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/files/100/1003/86095433.apk
- /data/data/####/files/100/1003/env201704121250.data
- /data/data/####/com.init.env/files/install-recovery.sh
- /data/data/####/com.init.env/files/toolbox1485415295853.zip
- /data/data/####/app_DEX_OPT/76929685.dex
- /data/data/####/files/100/1003/p_dzsd45.data
- /data/data/####/shared_prefs/ar.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/com.init.env/files/forever.sh
- /data/data/####/p.dzsd45/files/ZGV4ZXoy
- /data/data/####/com.init.env/files/elfm
- /data/data/####/files/c201704171650.apk
- /data/data/####/com.init.env/files/toolbox
- /data/data/####/p.sr40/files/cnVuc2hlbGwy
Другие:
Запускает следующие shell-скрипты:
- uart_yble_stop
- uart_yble_stop -c id
- .hulu
- logcat -d -v time
- .hulu -c id
- sh
- c201704171650.apk -c ####:push
Может автоматически отправлять СМС-сообщения.
