Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Duad.2.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- t####.####.com
- g####.####.net
- sta####.####.com
- and####.####.com
- r####.####.com
- d321wy3####.####.net
- gl####.####.com
- a####.####.com
Запросы HTTP GET:
- g####.####.net/prod/upload/adunion/images/4a0/170_170_911e95d03a939003.png
- sta####.####.com/contents/videos_screenshots/2258000/2258412/preview_hq....
- g####.####.net/prod/upload/adunion/images/d13/796_416_778d86f87bac5963.j...
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=#...
- g####.####.net/prod/upload/adunion/images/7bc/170_170_6a9156a1563694e0.png
- g####.####.net/prod/upload/adunion/images/8f6/741_417_979677c50e0f0911.j...
- g####.####.net/prod/upload/adunion/images/1c6/170_170_1024cc6937ec969c.png
- sta####.####.com/contents/videos_screenshots/2569000/2569446/preview.jpg
- g####.####.net/prod/upload/adunion/images/769/170_170_22025f649ac530d9.png
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub####&af...
- g####.####.net/prod/upload/adunion/images/bda/170_170_af4a562029cd91b5.png
- g####.####.net/prod/upload/adunion/images/751/170_170_71dd0ea21de02eba.png
- g####.####.net/prod/upload/adunion/images/889/170_170_05d10a96f90e7723.png
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=#...
- g####.####.net/prod/upload/adunion/images/43a/170_170_4021478af36dee1f.png
- g####.####.net/prod/upload/adunion/images/b9e/1200_628_6415c86f7f2855ac....
- g####.####.net/prod/upload/adunion/images/fa0/170_170_40402c3e9216480b.png
- g####.####.net/prod/upload/duunion/images/f2f/170_170_4591a2f85d8c50a1.png
- sta####.####.com/contents/videos_screenshots/2599000/2599154/preview_hq....
- t####.####.com/click?pid=####&offer_id=####&sub1=####&sub2=####
- g####.####.net/prod/upload/adunion/images/487/170_170_0ca28bf9dcebaee5.png
- g####.####.net/prod/upload/adunion/images/2e6/1200_628_934730c105767704....
- g####.####.net/prod/upload/adunion/images/ba1/170_170_c9d4041d54c3bf2c.png
- g####.####.net/prod/upload/adunion/images/65b/1200_628_bca5e965d87578ec....
- sta####.####.com/contents/videos_screenshots/2451000/2451341/preview.jpg
- g####.####.net/prod/upload/adunion/images/2e0/170_170_9e572a376da16410.png
- sta####.####.com/contents/videos_screenshots/2774000/2774228/preview.jpg
- sta####.####.com/contents/videos_screenshots/2839000/2839825/preview.jpg
- g####.####.net/prod/upload/duunion/images/b55/170_170_52805dfe61e960cb.png
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&...
- sta####.####.com/contents/videos_screenshots/2563000/2563635/preview.jpg
- g####.####.net/prod/upload/adunion/images/5d8/741_417_6d24d4a576e05ae3.j...
- sta####.####.com/contents/videos_screenshots/2601000/2601476/preview.jpg
- g####.####.net/prod/upload/adunion/images/950/796_416_5abe399ec744cd0c.j...
- g####.####.net/prod/upload/adunion/images/360/170_170_fea1f8b876242aaa.png
- g####.####.net/prod/upload/adunion/images/08f/1200_628_95230142b7245187....
- g####.####.net/prod/upload/adunion/images/9e8/170_170_c6029ed0e7e250d8.png
- g####.####.net/prod/upload/adunion/images/4af/170_170_ab2cd1cf0174fcdb.png
- sta####.####.com/contents/videos_screenshots/2790000/2790227/preview.jpg
- g####.####.net/prod/upload/duunion/images/b3c/170_170_271f06c5e190e167.png
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####...
- g####.####.net/prod/upload/adunion/images/878/170_170_3949543610e5e0f4.png
- d321wy3####.####.net/apps/20170316/com_iqoption-178.apk
- g####.####.net/prod/upload/adunion/images/0b0/1200_628_0a2f6d76d6af5ae4....
- g####.####.net/prod/upload/adunion/images/927/800_400_a751d446ae3d53a3.j...
- sta####.####.com/contents/videos_screenshots/2839000/2839648/preview.jpg
- g####.####.net/prod/upload/adunion/images/211/170_170_d150af084604cbdf.png
- g####.####.net/prod/upload/duunion/images/e97/170_170_c961fe403fecc0ce.png
- g####.####.net/prod/upload/adunion/images/2da/170_170_97b6daabc6f45061.png
- g####.####.net/prod/upload/duunion/images/8cb/170_170_061cc19f21fcdc7c.png
- g####.####.net/prod/upload/adunion/images/667/1200_628_d17459ef1ccbc141....
- g####.####.net/prod/upload/duunion/images/97c/170_170_156a5404e0ab9d91.png
- g####.####.net/prod/upload/adunion/images/3f1/170_170_43d5ebfe06720f8d.png
Запросы HTTP POST:
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dp...
- and####.####.com/rqd/async
- r####.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk=####&dpi...
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/pl.apk
- /data/anr/traces.txt
- /data/data/####/databases/cc/cc.db
- /data/data/####/databases/gfad.db-journal
- /data/data/####/files/AdjustIoPackageQueue
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/picasso-cache/e48334ab600cf3bebc8ed17ba433ec52.1.tmp
- /data/data/####/tx_shell/libshella-2.7.2.0.so
- /data/data/####/Plugin/com.iqoption/lib/libcrashlytics.so
- /data/data/####/Plugin/com.iqoption/lib/libgame.so
- /data/data/####/cache/picasso-cache/591fbf42bbb7f06d1619106b22a7eeb5.0.tmp
- /data/data/####/cache/picasso-cache/bf207c9365c15e667678b87457f0a2d2.0.tmp
- /data/data/####/cache/picasso-cache/dc97496f6422550673ad27f82242410d.1.tmp
- /data/data/####/files/pl.apk.tmp.tmp
- /data/data/####/files/AdjustIoActivityState
- /data/data/####/cache/picasso-cache/1903103d15f66b4f274320f9201f73b3.1.tmp
- /data/data/####/databases/_nohttp_cookies_db.db
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/picasso-cache/43c8fa137a40a43f19d049268aa8a8f5.1.tmp
- /data/data/####/cache/picasso-cache/bf207c9365c15e667678b87457f0a2d2.1.tmp
- /data/data/####/Plugin/com.iqoption/lib/libcrashlytics-envelope.so
- /data/data/####/cache/picasso-cache/1903103d15f66b4f274320f9201f73b3.0.tmp
- /data/data/####/Plugin/com.iqoption/lib/librsjni.so
- /data/data/####/cache/picasso-cache/43c8fa137a40a43f19d049268aa8a8f5.0.tmp
- /data/data/####/daemon.t.tmp
- /data/data/####/Plugin/com.speed.top/dalvik-cache/base-1.dex
- /data/data/####/cache/picasso-cache/ddb764e4ee1e52402287b7a1521a24a9.0.tmp
- /data/data/####/cache/picasso-cache/ddb764e4ee1e52402287b7a1521a24a9.1.tmp
- /data/data/####/Plugin/com.speed.top/apk/base-1.apk
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/mix.dex
- /data/data/####/files/native_record_lock
- /data/data/####/cache/picasso-cache/0ddfc023ebff761bba9f82934444b8cf.1.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/picasso-cache/d5ee6b5b80f03cc34504dd327c9a7368.1.tmp
- /data/data/####/Plugin/com.speed.top/Signature/Signature_0.key
- /data/data/####/cache/picasso-cache/dc97496f6422550673ad27f82242410d.0.tmp
- /data/data/####/databases/_nohttp_cookies_db.db-journal
- /data/data/####/cache/picasso-cache/a8786b466caf6a1d40b180d2943ba5b6.0.tmp
- /data/data/####/cache/picasso-cache/d5ee6b5b80f03cc34504dd327c9a7368.0.tmp
- /data/data/####/Plugin/com.iqoption/dalvik-cache/base-1.dex
- /data/data/####/cache/picasso-cache/a8786b466caf6a1d40b180d2943ba5b6.1.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/files/security_info
- /data/data/####/Plugin/com.iqoption/apk/base-1.apk
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/Plugin/com.iqoption/Signature/Signature_0.key
- /data/data/####/cache/picasso-cache/e48334ab600cf3bebc8ed17ba433ec52.0.tmp
- /data/data/####/cache/picasso-cache/591fbf42bbb7f06d1619106b22a7eeb5.1.tmp
- /data/data/####/files/local_crash_lock
- /data/data/####/cache/picasso-cache/0ddfc023ebff761bba9f82934444b8cf.0.tmp
- /data/data/####/Plugin/com.iqoption/lib/libRSSupport.so
- /sdcard/gpopp/com.iqoption
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libshella-2.7.2.0.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/dexopt --dex 27 74 40 2613972 /data/data/####/Plugin/com.speed.top/apk/base-1.apk 1233212138 1843989968 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/sh -c getprop ro.meizu.product.model
- getprop ro.gn.gnromvernumber
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- getprop ro.aa.romver
- getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- getprop ro.lewa.version
- getprop ro.build.rom.id
- getprop ro.lenovo.series
- getprop ro.yunos.version
- /system/bin/sh -c getprop ro.board.platform
- getprop ro.build.nubia.rom.name
- chmod 700 /data/data/####/tx_shell/libshella-2.7.2.0.so
- sh /data/data/####/daemon -p ####/daemon -r am startservice --user 0 -n ####/####.service.CoreService -e key daemon -i 2594
- getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.version.opporom
- getprop ro.build.tyd.kbstyle_version
- getprop ro.meizu.product.model
- getprop ro.board.platform
- getprop ro.build.version.opporom
- chmod 777 /data/data/####/daemon
- sh /data/data/####/daemon -p ####/daemon -r am startservice --user 0 -n ####/####.service.CoreService -e key daemon -i 2241
- /data/data/####/daemon -p ####/daemon -r am startservice --user 0 -n ####/####.service.CoreService -e key daemon -i 2241
- getprop ro.build.version.emui
- /data/data/####/daemon -p ####/daemon -r am startservice --user 0 -n ####/####.service.CoreService -e key daemon -i 2594
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- getprop ro.miui.ui.version.name
- /system/bin/dexopt --dex 27 52 40 292 /data/data/####/mix.dex 1493729022 -49011495 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /syst
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/dexopt --dex 27 89 40 7744448 /data/data/####/Plugin/com.iqoption/apk/base-1.apk 0 509656675 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
