Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.89.origin
- Android.Triada.1
- Android.Triada.186.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- a####.####.com:7901
- b####.####.net
- vi####.cn
- s####.####.com
- p####.####.com
- b####.####.com:9230
- c####.####.com
- d####.####.com
- c####.####.com:8080
- c####.####.com:8230
- w####.com
- a####.####.com
- b####.####.com
Запросы HTTP GET:
- vi####.cn/view/health/css.aili.com/appv3.css-v5.css
- vi####.cn/view/health/img7.aili.com/201602/23/1456194218_32427200_RsT_85...
- vi####.cn/view/health/js.aili.com/app/iscroll.js
- vi####.cn/view/health/img7.aili.com/201602/26/1456481582_55424400.jpg
- p####.####.com/rckm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- vi####.cn/view/health/img7.aili.com/201602/25/1456367527_18821900_RsT_85...
- vi####.cn/
- p####.####.com/bcdm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- vi####.cn/view/health/img6.aili.com/201602/22/1456107208_41660100_RsT_85...
- vi####.cn/view/health/img7.aili.com/201602/23/1456194934_21231400_RsT_85...
- vi####.cn/view/health/img7.aili.com/201602/26/1456481582_59897400.jpg
- vi####.cn/view/health/img6.aili.com/201602/26/1456481582_50583600.jpg
- c####.####.com:8080/ads/promotion/ee48e7cc-d841-4048-94a5-67fbb8dd1209.png
- vi####.cn/view/health/img6.aili.com/201602/26/1456481582_45993700.jpg
- p####.####.com/bcdm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- vi####.cn/view/health/img6.aili.com/201602/29/1456713084_75202800_RsT_85...
- p####.####.com/sync_pos.htm?cproid=####
- vi####.cn/view/health/img5.aili.com/201602/29/1456713420_22337600_RsT_85...
- vi####.cn/view/health/img7.aili.com/201602/19/1455849571_51231000_RsT_85...
- p####.####.com/rckm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- vi####.cn/view/health/img5.aili.com/201602/26/1456453187_36982300_RsT_85...
- vi####.cn/view/health/topic.aili.com/js/jquery.min-1.7.2.js
- vi####.cn/view/health/css.aili.com/reset_v4.css
- vi####.cn/view/health/img6.aili.com/201602/24/1456281684_86776500_RsT_85...
- vi####.cn/view/health/product.aili.com/statics/images/try_wap_img/top.png
- s####.####.com/s.htm?cproid=####&t=####
- w####.com/aj/static/sync.html?t=####
- vi####.cn/view/health/img5.aili.com/201602/25/1456367163_24318200_RsT_85...
- d####.####.com/tpl/ctm3.js
- vi####.cn/;jsessionid=3F119FDBF106C204A32ADBA3BEDB08CC
- c####.####.com/cpro/ui/cm.js
- vi####.cn/render
- vi####.cn/view/health/img5.aili.com/201602/22/1456107565_43227800_RsT_85...
- b####.####.net/bd/t.html?bid=####&t=####
- vi####.cn/view/health/js.aili.com/app/index.js
- vi####.cn/view/health/img7.aili.com/201602/26/1456481582_65076600.jpg
- c####.####.com/sync.htm?cproid=####
- vi####.cn/view/health/img7.aili.com/201602/26/1456452488_47821600_RsT_85...
- vi####.cn/view/health/js.aili.com/app/touchslider_1.js
Запросы HTTP POST:
- a####.####.com/
- a####.####.com:7901/
- b####.####.com/
- b####.####.com:9230/
- c####.####.com:8230/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/shell_flag.cache
- /data/data/####/shared_prefs/DataEvent.xml
- /data/data/####/shared_prefs/shared_pref.xml
- /data/data/####/cache/job2241.temp
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/files/0e03130308101100352734.jar
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/xapcinfo.xml
- /sdcard/.76761b91/eed88357/####/cache/image/http111cdn.abcdserver.com180801ads1promotion1ee48e7cc-d841-4048-94a5-67fbb8dd1209.png
- /data/data/####/shared_prefs/global.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/job1019_776961537.jar
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/yh.jar
- /data/data/####/files/work_check_flag.cache
- /data/data/####/files/sebu.db
- /data/data/####/files/0e03130308101583590622.jar
- /data/data/####/shared_prefs/global_timeout.xml.bak
- /data/data/####/cache/job2417.temp
- /data/data/####/cache/job2455.temp
- /data/data/####/cache/job2057.temp
- /data/data/####/cache/job2546.temp
- /data/data/####/shared_prefs/savedata.xml
- /data/data/####/shared_prefs/global_timeout.xml
- /data/data/####/cache/job1019_1711340196.jar
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/SqlDataContainer-journal
- /data/data/####/shared_prefs/DataEvent.xml.bak
- /data/data/####/cache/job2084.temp
- /data/data/####/databases/SqlDataContainer
- /data/data/####/cache/job2528.temp
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/silencedownLoad_1011.cache
- /data/data/####/cache/1880681921####.apk
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/JoyConfig.xml
- /data/data/####/cache/job1019_1684977703.jar
- /data/data/####/shared_prefs/global_timeouttimeoutlist.xml
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/shared_pref_strategy.xml
- /data/data/####/files/dexopt/job1019_776961537.dex
- /data/data/####/shared_prefs/shared_pref_strategy.xml.bak
- /data/data/####/files/srxbh.rc
- /sdcard/.76761b91/65f4d34/5d01a56ee61e5c3fb8941061de52e5a9_1019.5d
- /data/data/####/cache/job1019_800840753.jar
- /data/data/####/cache/job2225.temp
Другие:
Запускает следующие shell-скрипты:
- getprop
- configopb ebf05813c1
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n ####/com.decay.ContemporaryService
- /system/bin/dexopt --dex 27 42 40 305792 /data/data/####/cache/job1019_1829315113.jar 1198818011 1395316482 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/dexopt --dex 27 40 40 606288 /data/data/####/files/0e03130308101100352734.jar 1213631260 1728042434 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 42 40 305792 /data/data/####/cache/job1019_1684977703.jar 1198818011 1395316482 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- conbb od2gf04pd9
- /system/bin/dexopt --dex 27 44 40 56384 /data/data/####/files/yh.jar 1213370845 -896372357 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar
- /system/bin/dexopt --dex 27 40 40 606288 /data/data/####/files/0e03130308101583590622.jar 1213631260 1728042434 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 43 40 305792 /data/data/####/cache/job1019_776961537.jar 1198818011 1395316482 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 53 40 305792 /data/data/####/cache/job1019_800840753.jar 1198818011 1395316482 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 85 40 305792 /data/data/####/cache/job1019_1711340196.jar 1198818011 1395316482 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
Может автоматически отправлять СМС-сообщения.
