Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.519.origin
Сетевая активность:
Подключается к:
- m####.####.net
- r####.####.com:81
- r####.####.com
- i####.####.net
- n####.net
Запросы HTTP GET:
- i####.####.net/h5/201605/26/6a0b99ebc3.jpg
- i####.####.net/h5/201605/26/e89f74219e.jpg
- n####.net/h5/css/h5game.css?v=####
- i####.####.net/h5/201605/26/e08910b12d.jpg
- i####.####.net/h5/201605/26/1b91064d3f.jpg
- i####.####.net/h5/201703/14/7e6924d86a.jpg
- i####.####.net/h5/201605/26/a70bafb6ae.jpg
- i####.####.net/h5/201605/26/815eb244af.png
- i####.####.net/tag/201701/17/d1cd7c2b76.gif
- i####.####.net/h5/201605/26/e1f73a64ab.png
- n####.net/v2/mobile/images/morejt.png
- i####.####.net/tag/201701/11/34cc4da111.jpg
- i####.####.net/h5/201605/26/ba027bf174.jpg
- i####.####.net/h5/201605/26/a25585e895.jpg
- i####.####.net/h5/201605/26/5746f172e1.jpg
- i####.####.net/h5/201605/26/192287c2fe.jpg
- i####.####.net/h5/201605/26/65d5df0604.jpg
- i####.####.net/h5/201605/26/31cab7e786.jpg
- i####.####.net/h5/201605/26/5112f74bdd.jpg
- i####.####.net/h5/201605/26/be73e38c57.jpg
- i####.####.net/h5/201605/26/2a3e6187e0.jpg
- n####.net/v2/mobile/css/h5.css?v=####
- i####.####.net/h5/201605/26/9fbea8975b.jpg
- i####.####.net/h5/201605/26/6e95c84850.jpg
- i####.####.net/h5/201605/26/1e276ddd8d.jpg
- i####.####.net/h5/201605/26/11237480c7.jpg
- i####.####.net/h5/201605/26/5ecfd417a8.jpg
- i####.####.net/h5/201605/26/35cc25346f.jpg
- i####.####.net/h5/201605/26/c68a7fdf08.jpg
- i####.####.net/h5/201605/26/aa28d8084a.jpg
- i####.####.net/h5/201605/26/1c5b110e04.jpg
- i####.####.net/h5/201605/26/997b22ee91.jpg
- i####.####.net/h5/201605/26/b7eda9e551.jpg
- i####.####.net/h5/201605/26/0c69554c3a.jpg
- i####.####.net/h5/201605/26/f082df68ce.jpg
- i####.####.net/h5/201605/26/77f7bd68b6.jpg
- i####.####.net/h5/201605/26/dafa555fc2.jpg
- i####.####.net/tag/201701/11/abc33481fb.jpg
- i####.####.net/h5/201605/26/aff7b9df6b.jpg
- i####.####.net/h5/201605/26/ba631f0768.jpg
- i####.####.net/h5/201605/26/6a297b50c1.jpg
- n####.net/v2/mobile/js/h5.js?v=####
- i####.####.net/h5/201605/26/2f388d9acf.jpg
- i####.####.net/h5/201605/26/702b465312.jpg
- i####.####.net/h5/201605/26/6a7fb6c123.jpg
- i####.####.net/h5/201605/26/465f76f03b.jpg
- i####.####.net/h5/201605/26/068b5ba780.jpg
- i####.####.net/h5/201605/26/746eb5009f.jpg
- i####.####.net/h5/201605/26/271d2e2b24.jpg
- i####.####.net/h5/201605/26/1859e7e09e.jpg
- i####.####.net/h5/201605/26/b9ffcc9fdf.jpg
- i####.####.net/h5/201605/26/7e37753830.png
- i####.####.net/h5/201605/26/45bd583fdd.jpg
- i####.####.net/h5/201605/26/f83cbba2b3.jpg
- n####.net/h5/
- i####.####.net/h5/201605/26/9838af569c.jpg
- i####.####.net/h5/201605/26/25bf3a7b31.jpg
- i####.####.net/h5/201605/26/dac1bf9fa2.jpg
- i####.####.net/h5/201605/26/fd9f9b72f7.jpg
- i####.####.net/h5/201605/26/02c1334132.jpg
- i####.####.net/h5/201605/26/c14e14f018.jpg
- i####.####.net/h5/201605/26/83302690d7.jpg
- i####.####.net/h5/201605/26/e7346b79f4.jpg
- i####.####.net/h5/201605/26/1ca3cfd52f.jpg
- i####.####.net/h5/201605/26/36c8309776.jpg
- i####.####.net/h5/201605/26/f2680b9868.png
- i####.####.net/tag/201701/13/b19cffe427.jpg
- i####.####.net/h5/201605/26/f402aec714.png
- i####.####.net/tag/201606/07/313eb3f943.jpg
- i####.####.net/h5/201605/26/0ba69f3087.jpg
- i####.####.net/h5/201605/26/c4dab5f8a0.jpg
- i####.####.net/h5/201605/26/d5e42547b5.jpg
- m####.####.net/h5/
- i####.####.net/h5/201605/26/0cf19bfaf8.jpg
- i####.####.net/h5/201605/26/e02812b91c.jpg
- n####.net/js/jquery.SuperSlide.js?v=####
- i####.####.net/h5/201605/26/a036bb9cf4.jpg
- i####.####.net/h5/201605/26/6b97f315d2.jpg
- i####.####.net/h5/201605/26/acb2a16e09.jpg
- i####.####.net/h5/201605/26/7b557658ec.jpg
- i####.####.net/h5/201605/26/6996f6fe3f.png
- i####.####.net/h5/201704/11/8f0a865883.png
- i####.####.net/h5/201605/26/b445beac2b.jpg
- i####.####.net/h5/201605/26/589517d379.jpg
- i####.####.net/h5/201605/26/83a6c4be25.png
- i####.####.net/h5/201605/26/82e10201d7.jpg
- i####.####.net/h5/201606/04/c1fcdf4746.jpg
- i####.####.net/h5/201605/26/42e26a462d.png
- i####.####.net/h5/201605/26/1948a424d2.jpg
- i####.####.net/tag/201701/11/093b35ab62.jpg
- i####.####.net/h5/201605/26/4ee41a9a5b.jpg
- i####.####.net/h5/201605/26/31df4f68e7.jpg
- i####.####.net/h5/201605/26/a488d7250b.jpg
- i####.####.net/h5/201605/26/0726b498c2.png
- i####.####.net/h5/201605/26/89505c233d.png
- i####.####.net/h5/201605/26/c4616c6f97.jpg
- i####.####.net/h5/201605/26/dbed38dda9.jpg
- i####.####.net/h5/201605/26/fa59657f6a.jpg
- i####.####.net/h5/201605/26/ae854657f0.jpg
- i####.####.net/h5/201703/21/260b3daf97.png
- i####.####.net/h5/201605/26/fac7d838d9.jpg
- i####.####.net/h5/201605/26/5d919b0b02.png
- i####.####.net/h5/201605/26/2149a687a4.jpg
- i####.####.net/h5/201605/26/d13bb32809.jpg
- i####.####.net/h5/201605/26/31920afad5.jpg
- i####.####.net/h5/201605/26/a30ce1c094.jpg
- i####.####.net/h5/201605/26/08a46c783b.jpg
- i####.####.net/h5/201605/26/cb220b70e4.jpg
- i####.####.net/h5/201605/26/33b19b19a6.jpg
- i####.####.net/h5/201704/11/78f34cd9c3.png
- i####.####.net/h5/201605/26/4febe93073.png
- n####.net/v2/mobile/images/h5/h5logo.png
- i####.####.net/h5/201605/26/46881f1e0d.png
- i####.####.net/h5/201605/26/fb4e7a8f70.png
- i####.####.net/h5/201605/26/34d31a2ce5.jpg
- m####.####.net/h5/hot/
- i####.####.net/h5/201605/26/34e0f43e8d.jpg
- i####.####.net/h5/201605/26/e458b94889.jpg
- i####.####.net/h5/201605/26/27997a230b.jpg
- i####.####.net/h5/201605/26/a79e618b77.png
- i####.####.net/h5/201605/26/4060af6995.jpg
- i####.####.net/h5/201605/26/510b5023e3.jpg
- i####.####.net/h5/201605/26/e553618e6d.jpg
- i####.####.net/h5/201605/26/57a834e11b.jpg
- i####.####.net/h5/201605/26/a3b2ee2ca4.jpg
- i####.####.net/h5/201605/26/ce9aaea0c9.jpg
- i####.####.net/h5/201605/26/a95bcf5fef.png
- i####.####.net/h5/201605/26/10dabf0472.jpg
- i####.####.net/h5/201605/26/e9aa104e33.jpg
- i####.####.net/h5/201605/26/4468dd3b55.jpg
- i####.####.net/tag/201606/03/40b4e44ef9.jpg
- i####.####.net/h5/201605/26/b3ed2f3d16.jpg
- i####.####.net/tag/201606/04/5a9f271009.jpg
- i####.####.net/h5/201605/26/f9c50a8ca3.jpg
- i####.####.net/h5/201605/26/d0da3a7f39.jpg
- i####.####.net/h5/201605/26/dd05044cce.jpg
- i####.####.net/h5/201605/26/2d0c1c5a14.jpg
- i####.####.net/tag/201606/06/d9cd97b779.jpg
- i####.####.net/h5/201605/26/71a85a61ed.jpg
- i####.####.net/h5/201605/26/3d1db063f0.jpg
- i####.####.net/h5/201605/26/51e110c13f.png
- i####.####.net/h5/201605/26/9a5945d6f8.jpg
- i####.####.net/h5/201605/26/b471c92629.jpg
- i####.####.net/h5/201605/26/3411a1d065.jpg
- i####.####.net/h5/201605/26/8a7b28f10d.jpg
- i####.####.net/h5/201605/26/a0f855563c.jpg
- i####.####.net/h5/201605/26/c04f7b522b.jpg
- i####.####.net/h5/201605/26/4acab2153d.jpg
- i####.####.net/h5/201605/26/a3c70a8bb8.jpg
- i####.####.net/h5/201605/26/e2d92c10f8.jpg
- i####.####.net/h5/201605/26/5dd2e263ff.jpg
- i####.####.net/h5/201605/26/a6b672dec0.jpg
- i####.####.net/h5/201605/26/9665dbc337.jpg
- i####.####.net/h5/201605/26/47b0e1d903.jpg
- m####.####.net/h5/fengkuang.html
- i####.####.net/h5/201605/26/852dde218f.jpg
- i####.####.net/h5/201605/26/c2448f89e5.jpg
- i####.####.net/h5/201605/26/6869cc7876.jpg
- i####.####.net/h5/201605/26/4e064ced5d.jpg
- i####.####.net/h5/201605/26/1a6146161f.jpg
- n####.net/js/jquery.lazyload.min.js?v=####
- i####.####.net/h5/201605/26/a336b5c616.jpg
- i####.####.net/h5/201605/26/da8235e2d1.jpg
- i####.####.net/tag/201701/11/4225d23676.jpg
- i####.####.net/h5/201605/26/17bf0df111.jpg
- i####.####.net/h5/201605/26/1c525a5e2b.jpg
- i####.####.net/h5/201605/26/5206506e1c.jpg
- i####.####.net/h5/201605/26/dc528bbdf0.jpg
- i####.####.net/h5/201605/26/ffe9c1c4f7.jpg
- i####.####.net/h5/201605/26/10dcb12632.jpg
- i####.####.net/h5/201605/26/fbc8b3808f.jpg
- i####.####.net/h5/201605/26/a5f4e1772e.jpg
- i####.####.net/h5/201605/26/6909c14c89.jpg
- i####.####.net/h5/201605/26/5f76bff49e.jpg
- i####.####.net/h5/201605/26/3427da871f.jpg
- i####.####.net/h5/201605/26/88154aa661.jpg
- i####.####.net/h5/201605/26/029969d3fb.jpg
- i####.####.net/h5/201605/26/8d22b4d2c9.jpg
- i####.####.net/h5/201605/26/c427a4e271.jpg
- i####.####.net/h5/201605/26/d54c0ce609.jpg
- i####.####.net/h5/201605/26/95c1469800.jpg
- i####.####.net/h5/201605/26/9cbb9249c7.jpg
- i####.####.net/h5/201605/26/32055311af.jpg
- m####.####.net/h5/fanyingli.html
- i####.####.net/h5/201605/26/ef3ce38322.jpg
- i####.####.net/h5/201605/26/a3a84946af.jpg
- i####.####.net/h5/201605/26/54f70b6130.jpg
- i####.####.net/h5/201605/26/9edcaba3a3.jpg
- i####.####.net/h5/201605/26/e923ca8f3c.jpg
- i####.####.net/h5/201605/26/ad469e7dd3.jpg
- i####.####.net/h5/201605/26/fe4ef7e770.jpg
- i####.####.net/h5/201605/26/53a5a53a40.jpg
- i####.####.net/h5/201605/26/19a2cc11b7.jpg
- i####.####.net/h5/201605/26/b3221f2ee0.jpg
- i####.####.net/h5/201605/26/5914e34475.jpg
- i####.####.net/h5/201605/26/74a79db2e2.jpg
- n####.net/js/uaredirect.js?v=####
- i####.####.net/h5/201605/26/e216c3c1d0.jpg
- i####.####.net/h5/201605/26/41bb928298.jpg
- i####.####.net/h5/201605/26/22f3c869c1.jpg
- i####.####.net/h5/201605/26/058d8d91ac.jpg
- i####.####.net/h5/201605/26/1ffda42fcc.jpg
- i####.####.net/h5/201605/26/543ab03a36.jpg
- i####.####.net/h5/201605/26/ec1cdbc568.jpg
- i####.####.net/h5/201605/26/2ca10f474c.jpg
- n####.net/h5/css/global.css?v=####
- m####.####.net/h5/tag/
- i####.####.net/h5/201605/26/0ca7d723f6.jpg
- i####.####.net/tag/201606/06/34b3d6c5bb.jpg
- i####.####.net/tj/201606/07/8964bcf486.jpg
- i####.####.net/h5/201605/26/6fc30b7c5d.jpg
- i####.####.net/h5/201605/26/31d656ef4b.jpg
- i####.####.net/h5/201605/26/bef7af3bd3.jpg
- i####.####.net/h5/201605/26/c13d62dce0.jpg
- n####.net/v2/mobile/images/h5sprite.png?v=####
- i####.####.net/h5/201605/26/0235d484bc.jpg
- i####.####.net/h5/201605/26/e3bc34522f.jpg
- i####.####.net/h5/201605/26/58a2321494.jpg
- n####.net/v2/mobile/js/swiper-2.0.min.js?v=####
- i####.####.net/h5/201605/26/b5fe4fda4d.jpg
- i####.####.net/h5/201605/26/f87edd983d.jpg
- i####.####.net/h5/201605/26/677071f50f.jpg
- i####.####.net/tj/201606/07/d25dce2ffd.jpg
- i####.####.net/h5/201605/26/2e68fa7b9c.jpg
- i####.####.net/h5/201605/26/33f87387f5.jpg
- i####.####.net/h5/201605/26/739e17c7eb.jpg
- i####.####.net/h5/201605/26/df62693170.jpg
- i####.####.net/h5/201605/26/1e5f929c6a.png
- i####.####.net/h5/201605/26/eae77761fc.jpg
- i####.####.net/h5/201605/26/c8a9b3871b.jpg
- i####.####.net/h5/201605/26/622fc4d963.jpg
- i####.####.net/h5/201605/26/bd1521fc4d.png
- i####.####.net/tag/201701/11/fe3a27b10f.jpg
- n####.net/js/jquery.tab.js?v=####
- n####.net/js/common.js?v=####
- i####.####.net/h5/201605/26/1f78477552.jpg
- i####.####.net/h5/201605/26/57a87bc108.jpg
- i####.####.net/h5/201605/26/db5c9a1f2b.png
- i####.####.net/h5/201605/26/e37d950cd8.jpg
- i####.####.net/h5/201605/26/d7d421aa69.jpg
- i####.####.net/h5/201605/26/a3e6a82529.png
- i####.####.net/h5/201605/26/ceb3e9b123.jpg
- i####.####.net/h5/201605/26/a7ffc37100.jpg
- i####.####.net/h5/201605/26/95ff685a40.jpg
- i####.####.net/h5/201605/26/adacd7ed47.jpg
- i####.####.net/h5/201605/26/113fbc0770.jpg
- i####.####.net/h5/201605/26/f493de1ea2.jpg
- i####.####.net/h5/201605/26/788665925d.jpg
- i####.####.net/h5/201605/26/25fce9073c.jpg
- i####.####.net/h5/201605/26/7e02808ee3.png
- i####.####.net/h5/201605/26/51b3f064f9.jpg
- i####.####.net/h5/201605/26/68dc0433af.jpg
- i####.####.net/h5/201605/26/e3c94493e5.jpg
- i####.####.net/h5/201605/26/d01ae735a6.jpg
- i####.####.net/h5/201605/26/f8a77c7f86.jpg
- n####.net/v2/mobile/js/jquery.truncatable.js?v=####
- i####.####.net/tj/201606/07/066e607ab0.jpg
- i####.####.net/h5/201605/26/fe70c18e32.jpg
- i####.####.net/h5/201605/26/510186bd41.jpg
- i####.####.net/h5/201703/14/51351d8e11.jpg
- i####.####.net/h5/201605/26/ec62a1dfe6.jpg
- i####.####.net/h5/201605/26/f7e9712245.jpg
- i####.####.net/h5/201605/26/7748113752.jpg
- i####.####.net/h5/201605/26/257b814952.jpg
- i####.####.net/h5/201605/26/ed1de80dab.jpg
- i####.####.net/h5/201605/26/a493901384.jpg
- i####.####.net/h5/201605/26/c383a5ca68.jpg
- i####.####.net/h5/201605/26/db76ae966b.jpg
- i####.####.net/h5/201605/26/4c19d79bdc.jpg
- i####.####.net/h5/201605/26/3209d9c166.jpg
- i####.####.net/h5/201605/26/04d204b1b3.png
- n####.net/js/jquery.js?v=####
- i####.####.net/h5/201605/26/9ca076b11e.jpg
Запросы HTTP POST:
- r####.####.com:81/apione.php?do=####
- r####.####.com/apione.php?do=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/shared_prefs/sncomconfig.xml
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/WebViewSettings.xml
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/local/tmp/sensorstart
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/mjuli.jar
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/shared_prefs/device.xml
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/device
- /data/data/####/cache/webviewCacheChromium/index
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/local/tmp/sensorstart
Другие:
Запускает следующие shell-скрипты:
- arp
- vi
- ls -al su
- su
- echo id exit
- id
- cut
- ls -al vi
- chmod 777 /system/bin/sensorstart
- ls -al cut
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2220 --user 0
- daemonize
- ls -al daemonize
- mount -o rw,remount /system
- conbb od2gf04pd9
- ls -al killall5
- xargs
- ls -al arp
- killall5
- chmod 777 sensorstart
- touch sensorstart
- sh
- ls -al xargs
- /system/bin/dexopt --dex 27 40 40 268164 /data/data/####/files/mjuli.jar 1233562810 511362868 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- su8
Использует повышенные привилегии.
Может автоматически отправлять СМС-сообщения.
