Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.76.origin
Сетевая активность:
Подключается к:
- celery####.com
- 5####.####.com
- ap####.mobi
- b####.com
- datat####.com
- rockt####.com
- game-####.####.gdn
- v####.####.com
- u####.####.gdn
- a####.####.com
Запросы HTTP GET:
- b####.com/Identity/Hamburger?n=####&id=####&ip=####&ua=####&r=####&IID=#...
- u####.####.gdn/TES672bingALL.html
- game-####.####.gdn/TES672bingALL.html
- 5####.####.com/?kw=####&s2=####
- a####.####.com/fd/ls/l?IG=####&TYPE=####&DATA=####
- b####.com/hpmob?id=####&ip=####&ua=####&r=####&IG=####&IID=####
- datat####.com/d/15143458cac3ab0e1bc?source=####&sub=####&do=####&test=####
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- rockt####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sou...
- celery####.com/06m03/W5tP/VZ9f/DdMJHqXB8rLFl49sNPvmB4qYnN93rrteAqjg5iEQh...
- b####.com/rms/BingCore.Bundle/cj,nj/4ec5679f/05acd042.js?bu=####
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerIdentityUpdate/...
- rockt####.com/d/15143458cac3ab0e1bc?source=####&sub=####
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- a####.####.com/fd/ls/l?IG=####&CID=####&TYPE=####&DATA=####
- b####.com/AS/Suggestions?pt=####&mkt=####&qry=####&cp=####&css=####&cvid...
- b####.com/ImageResolution.aspx?w=####&h=####&hash=####&id=####&ip=####&u...
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- game-####.####.gdn/?sov=####&hid=####&&redid=####&gsid=####&campaign_id=...
- b####.com/sa/simg/hamburger_icons_sprite2x_mysaves_1_bf.png
- b####.com/sa/simg/anon_200px.png
- b####.com/rms/rms%20answers%20Identity%20Mobile$MobileSnrWindowsLiveConn...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/fd/s/a/sbbtn.png
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- b####.com/fd/ls/l?IG=####&Type=####&DATA=####&P=####&DA=####
- b####.com/?id=####&ip=####&ua=####&r=####
- u####.####.gdn/?sov=####&hid=####&&redid=####&gsid=####&campaign_id=####...
- b####.com/az/hprichbg/rb/SaronicGulf_ROW10552855196_320x240.jpg
- celery####.com/06m03/T5gKHQ/W5tP/X5ZeTvs/DdMJHqXB8rLFl49sNPvmB4qYnN93rrt...
- b####.com/Passport.aspx?popup=####
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- b####.com/az/hprichbg/rb/SaronicGulf_ROW10552855196_1024x768.jpg
- b####.com/fd/ls/GLinkPing.aspx?IG=####&ID=####
- ap####.mobi/red/e03f908b-9ce6-11e6-8b9b-0cc47a44dbaa/?alg=####&clickid=#...
- b####.com/rms/AutoSug/cj,nj/5d4a1743/724a3e06.js?bu=####
Запросы HTTP POST:
- celery####.com/06m03/W5tP/VZ9f/DdMJHqXB8rLFl49sNPvmB4qYnN93rrteAqjg5iEQh...
- b####.com/fd/ls/lsp.aspx
- v####.####.com/api/l
- v####.####.com/api/o
- b####.com/fd/ls/lsp.aspx?
- v####.####.com/api/u
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/SSPPrefe.xml
- /data/data/####/databases/easv.data-journal
- /data/data/####/shared_prefs/sp.xml
- /data/data/####/shared_prefs/promote.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/shared_prefs/SSPPrefe.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/WebViewSettings.xml
- /data/data/####/shared_prefs/data.xml
- /data/data/####/shared_prefs/sp.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/filedexs/kohuyo.jar
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
- /sdcard/filedexs/dekuyo.jar
- /data/data/####/shared_prefs/promote.xml
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 43 40 183416 /storage/emulated/0/filedexs/dekuyo.jar 1250333024 1993405541 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.
Может автоматически отправлять СМС-сообщения.
