Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.336.origin
Сетевая активность:
Подключается к:
- face####.com
- stat####.####.com
- r####.####.com
- st####.####.net
- pressro####.com
- 5####.####.65
- timesof####.####.com
- googlet####.com
- b####.####.com
- i####.####.com
- d####.####.com
- google-####.com
- d1l6p2s####.####.net
- ip####.io
- wi####.####.com
- f####.####.com
- fast####.####.com
- m####.####.com
- st####.####.com
- pag####.####.com
- 2####.####.127
- im####.####.com
- con####.####.net
- plat####.####.com
- ge####.####.com
- as####.####.com
- 1####.####.244
- d8rk54i####.####.net
- adserve####.####.com
- 1####.####.166
- a####.####.com
- t####.####.com
- rea####.####.com
- c####.####.com
- user####.####.com
- e####.####.com
- font####.com
Запросы HTTP GET:
- m####.####.com/ads_js_new2.cms?v=####&minify=####&msid=####&tn=####
- b####.####.com/45497392-636.js
- con####.####.net/en_US/fbevents.js
- f####.####.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- pag####.####.com/pagead/js/r20170412/r20170110/show_ads_impl.js
- m####.####.com/fonts/proximanova-semibold.ttf
- face####.com/plugins/like.php?href=####&w####&layout=####&action=####&sh...
- adserve####.####.com/pubapi/3.0/10323.1/3755285/0/0/ADTECH;v=2;cmd=bid;c...
- m####.####.com/india/articlelist/-2128936835.cms
- a####.####.com/libtrc/cpxi-pressroomvip/loader.js
- adserve####.####.com/pubapi/3.0/10323.1/3920648/0/0/ADTECH;v=2;cmd=bid;c...
- m####.####.com/social_js/minify-1,v-37.cms
- timesof####.####.com/breakingnews/mbreakingnewscd.html
- pag####.####.com/pagead/show_ads.js
- c####.####.com/wp-content/themes/pressroomvip/font/custom-icons.ttf?6727...
- ge####.####.com/?cb=####
- m####.####.com/india
- plat####.####.com/en_US/embeds.js
- c####.####.com/wp-content/plugins/cpxi-posttypes/js/frontend-script.js?v...
- a####.####.com/cpxi-pressroomvip/trc/3/json?tim=####&data=####
- ip####.io/json
- im####.####.com/js/sdkloader/ima3.js
- google-####.com/analytics.js
- adserve####.####.com/pubapi/3.0/10323.1/3920646/0/0/ADTECH;v=2;cmd=bid;c...
- c####.####.com/wp-content/plugins/cpx-advert/library/postscribe/postscri...
- stat####.####.com/connect/xd_arbiter/r/_dMxoUH0Bax.js?version=####
- m####.####.com/fonts/proxima_nova_light_1.ttf
- c####.####.com/wp-content/themes/pressroomvip/js/misc/dfp_data.js
- c####.####.com/wp-content/themes/pressroomvip/js/jquery/dist/jquery.min.js
- d8rk54i####.####.net/container.html?pid=####&iframe=####&title=####&url=...
- googlet####.com/tag/js/gpt.js
- c####.####.com/wp-content/themes/pressroomvip/js/misc/utm-persistency.js...
- t####.####.com/getjs.static.js
- a####.####.com/libtrc/cpxinteractive-sc/tfa.js
- d####.####.com/ping?vw=####&vh=####&dw=####&dh=####&st=####&sl=####&mst=...
- m####.####.com/wap_core_js.cms?minify=####&v=####&pagename=####
- pag####.####.com/pagead/osd.js
- f####.####.com/s/opensans/v13/DXI1ORHCpsQm3Vp6mXoaTZS3E-kSBmtLoNJPDtbj2P...
- a####.####.com/cdn-cgi/nexp/dok3v=905ca5bd16/cloudflare.min.js
- m####.####.com/cityweather_js_v2.cms?v=####
- c####.####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
- c####.####.com/wp-content/plugins/contact-form-7/includes/js/jquery.form...
- a####.####.com/ad/commons/js/colombia_v2.js
- c####.####.com/wp-content/plugins/cpx-advert/library/inject_vars.js?ver=...
- r####.####.com/delivery/rta/rta.js?netId=####&cookieName=####&rnd=####&v...
- c####.####.com/wp-content/themes/pressroomvip/js/misc/vote/vote.js
- c####.####.com/wp-content/plugins/contact-form-7/includes/css/styles.css...
- m####.####.com/merg_js.cms?minify=####&donotshowurl=####&template=####&v...
- 2####.####.127/x?pid=####&iframe=####&title=####&url=####&date=####&chan...
- m####.####.com/ads_js.cms?v=####&minify=####&msid=####&tn=####
- t####.####.com/safeframe/1-0-7/html/container.html?n=####
- e####.####.com/quant.js
- m####.####.com/commentsdata/58261258.cms?curpg=####&pcode=####&appkey=##...
- 5####.####.65/pv?cs=####&cd=####&la=####&sw=####&sh=####&dp=####&pu=####...
- a####.####.com/ase/2658/39/aa.js
- a####.####.com/libtrc/cpxi-pressroomvip-brazil-sc/tfa.js
- 2####.####.127/t?pid=####&iframe=####&title=####&url=####&date=####&chan...
- m####.####.com/toi_slikevp_js/minify-1,v-482.cms
- m####.####.com/
- 1####.####.166/header/tag?tagver=####&ca=####&cp=####&ct=####&cf=####&rq...
- m####.####.com/fonts/proxima_nova_extrabold_1.ttf
- c####.####.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?...
- d####.####.com/thinking/group/rtt0319_662.apk
- c####.####.com/wp-content/themes/pressroomvip/js/misc/prvip_advert.js
- m####.####.com/jsrender.cms?
- m####.####.com/toivp_css/v-20.cms
- a####.####.com/1.1/json/timesofindia-timesofindia/recommendations.notify...
- c####.####.com/wp-content/themes/pressroomvip/js/misc/purl.js?ver=####
- m####.####.com/fonts/proximanova-semibold.woff
- b####.####.com/beacon.js
- m####.####.com/login_js.cms?v=####&minify=####
- f####.####.com/s/opensans/v13/EInbV5DfGHOiMmvb1Xr-hpS3E-kSBmtLoNJPDtbj2P...
- b####.####.com/biddrplus-2.3.1.js
- m####.####.com/election2017_js/minify-1,v-18,pagename-assemblyelections2...
- wi####.####.com/cpxi-pressroomvip/load.js
- c####.####.com/wp-content/plugins/cpx-advert/library/postscribe/htmlPars...
- m####.####.com/videos/mobilelivetvloc.cms?callback=####
- c####.####.com/wp-content/themes/pressroomvip/js/modernizr/modernizr.min...
- c####.####.com/wp-content/themes/pressroomvip/js/app.js
- st####.####.net/js/ld/publishertag.js
- m####.####.com/indiatimesshoppingwdt_js/minify-1,v-15.cms
- t####.####.com/safeframe/1-0-7/html/container.html
- wi####.####.com/opt/tboptevent.html?v=####&a=####&d=####
- c####.####.com/wp-content/plugins/sranalytics_wordpress-0.1.5/javascript...
- im####.####.com/css?family=####
- r####.####.com/rules-p-bDyt5XZ5yC-sg.js
- c####.####.com/wp-content/plugins/cpx-advert/library/history.js/scripts/...
- a####.####.com/message?cid=####&val_101=####&val_102=####&val_120=####&v...
- timesof####.####.com/
- m####.####.com/requirejs.cms?minify=####
- m####.####.com/india/kulbhushan-jadhav-case-indian-envoy-gautam-bambawal...
- adserve####.####.com/pubapi/3.0/10323.1/4493574/0/0/ADTECH;v=2;cmd=bid;c...
- c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_event_tra...
- pag####.####.com/pagead/js/adsbygoogle.js
- i####.####.com/jpt?callback=####&callback_uid=####&psa=####&id=####&size...
- st####.####.com/js/chartbeat.js
- 1####.####.244/rtb/bid?callback=####&src=####&br=####
- m####.####.com/articleshow_js/minify-1,v-120,tn-articlestory.cms
- adserve####.####.com/pubapi/3.0/10323.1/3920650/0/0/ADTECH;v=2;cmd=bid;c...
- c####.####.com/highcharts.js
- c####.####.com/wp-includes/js/wp-embed.min.js?ver=####
- m####.####.com/mitr_trending_articleshow/minify-1,v-14,tn-articlestory.cms
- m####.####.com/ads.cms?msid=####&feedtype=####
- a####.####.com/ajax/libs/jquery/1.8.3/jquery.min.js
- wi####.####.com/cpxi-pressroomvip/pmk-201625015.4.js
- font####.com/d/js/webfonts.min.js
- adserve####.####.com/pubapi/3.0/10323.1/3773281/0/0/ADTECH;v=2;cmd=bid;c...
- m####.####.com/defaultinterstitial_js/minify-1.cms
- plat####.####.com/widgets.js
- m####.####.com/fonts/proxima_nova_regular_1.ttf
- a####.####.com/libtrc/impl.250-478-RELEASE.js
- as####.####.com/fonts/styles.css
- con####.####.net/en_US/sdk.js
- m####.####.com/personalisation_newhp.cms
- fast####.####.com/a/api/fastlane.json?account_id=####&site_id=####&zone_...
- m####.####.com/ads.cms?tn=####&msid=####&feedtype=####
- a####.####.com/cde/data/v4.htm?id=####&_v=####&auds=####&_u=####&_t=####...
- c####.####.com/wp-content/themes/pressroomvip/css/app.css
- c####.####.com/csi?v=####&s=####&action=####&it=####&srt=####&count_of_s...
- adserve####.####.com/pubapi/3.0/10323.1/3929222/0/0/ADTECH;v=2;cmd=bid;c...
- con####.####.net/en_US/all.js
- m####.####.com/techcomparison_js/minify-1,v-16.cms
- timesof####.####.com/videos/mobilelivetvloc.cms?callback=####
- timesof####.####.com/breakingnews/election2017_sphomepagewidgetfeed.htm
- e####.####.com/thinking/group/exp
- m####.####.com/combine_css.cms?v=####&template=####&merg=####
- pressro####.com/g/most-dangerous-dog-breeds-in-the-world/?ipp=####&utm_s...
- d8rk54i####.####.net/js/reach.js
- c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_styles.cs...
- as####.####.com/css/adstyles.css
- user####.####.com/userreco/v2/reco?domain=####&mediaType=####&callback=#...
- a####.####.com/evnt/click.htm?u=####&r=####&fpc=####&i=####&s=####
- i####.####.com/js/pgtrackingV8.js
- adserve####.####.com/pubapi/3.0/10323.1/3929223/0/0/ADTECH;v=2;cmd=bid;c...
- d1l6p2s####.####.net/tracker.js
- c####.####.com/wp-content/plugins/cpx-advert/library/cpxadvert_injection...
- c####.####.com/wp-content/themes/pressroomvip/js/misc/insert_interstitia...
- 2####.####.127/n?pid=####&iframe=####&title=####&url=####&date=####&chan...
- adserve####.####.com/pubapi/3.0/10323.1/3951088/0/0/ADTECH;v=2;cmd=bid;c...
- f####.####.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNSpS3E-kSBmtLoNJPDtbj2P...
- f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...
Запросы HTTP POST:
- rea####.####.com/biddr_update/
- a####.####.com/cpxi-pressroomvip/log/3/available
- t####.####.com/ggview/rsddateindex
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- a####.####.com/subscribe/api/1997
- m####.####.com/errorview/api/601
- a####.####.com/app_logs
- rea####.####.com/biddr/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/83bf46f2b4e35a0f9c967cd01d154a8.data
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/files/.snow/b.png
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/.snow/myshell
- /data/data/####/files/.work/postroot.sh
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/i.apk
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/app_jgls/.log.ls
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/files/.snow/.dico.apk
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/.snow/.service
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.dat
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/checkFile0
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/.snow/exp
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/files/.snow/.dlme.apk
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/files/.snow/.center.tapk
- /data/data/####/files/.snow/.ukd
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.tmp
- /data/data/####/files/.snow/.uks
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.snow/.dlsb.apk
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/files/i.apk.tmp
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/app_jgls/.log.lock
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/.default/83bf46f2b4e35a0f9c967cd01d154a8.data.temp
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.client
- /data/data/####/files/.snow/checkFile13
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/files/.snow/a.xml
- /data/data/####/files/.snow/.uok
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/files/.snow/.zip/mkdevsh
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.work/postroot.sh
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/files/.snow/b.png
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
- sh
- chmod 755 /data/data/####/.jiagu/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
