Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1867.origin
- Android.SmsSend.1888.origin
Сетевая активность:
Подключается к:
- go####.com
- go####.nl
- t####.####.com
- u####.com:7079
- c####.####.net
- affshar####.com
- and####.####.com
- c####.####.com
- p####.####.link
- gl####.####.com:9090
- gl####.####.com
- statist####.com
- u####.com
Запросы HTTP GET:
- c####.####.com/landings/51156/1482505631/images/logo.png
- c####.####.com/landings/19326/js/6a26daa78732c4dbeed9eabcc4d1bd0b.js?146...
- go####.com/
- c####.####.com/landings/51156/1482505631/images/img2.jpg
- c####.####.com/landings/51156/1482505631/images/img12.jpg
- c####.####.com/landings/19326/css/a9675f00b3b6659e65519b22c776ba50.css?1...
- c####.####.com/landings/51156/1482505631/images/img10.jpg
- c####.####.com/landings/51156/1482505631/images/img7.jpg
- go####.nl/?gfe_rd=####&ei=####
- c####.####.com/landings/51156/1482505631/images/img9.jpg
- go####.nl/images/hpp/gsa_super_g-64.gif
- go####.nl/images/nav_logo242.png
- c####.####.com/landings/51156/1482505631/images/bg.jpg
- go####.nl/images/nav_logo242_hr.png
- go####.nl/gen_204?atyp=####&ct=####&cad=####&ogsr=####&id=####&ic=####&o...
- c####.####.com/landings/51156/1482505631/css/a9675f00b3b6659e65519b22c77...
- c####.####.com/landings/51156/1482505631/images/img8.jpg
- gl####.####.com/trace?offer_id=####&aff_id=####&pid=####&cid=####&publis...
- p####.####.link/c/da57dc555e50572d?s1=####&s2=####&click_id=####
- c####.####.com/landings/51156/1482505631/images/img5.jpg
- go####.nl/logos/doodles/2017/ferdinand-monoyers-181st-birthday-510593909...
- gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
- c####.####.com/landings/51156/1482505631/images/img11.jpg
- t####.####.com/click?cid=####&s1=####&s2=####
- c####.####.com/landings/51156/1482505631/images/img1.jpg
- c####.####.com/landings/51156/1482505631/images/img4.jpg
- go####.nl/gen_204?atyp=####&ct=####&cad=####&tt=####&ei=####&zx=####
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- go####.nl/xjs/_/js/k=xjs.qs.nl.jDjm49QCb44.O/m=sy7,syi,em3,syh,aa,abd,sy...
- c####.####.com/landings/51156/1482505631/images/img6.jpg
- p####.####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=##...
- c####.####.com/landings/51156/1482505631/js/avsc2.js?148250####
- affshar####.com/mzARocGO-v?l2=####&l1=####
- go####.nl/gen_204?s=####&atyp=####&ei=####&imc=####&imn=####&imp=####&ad...
- c####.####.com/landings/51156/1482505631/js/6a26daa78732c4dbeed9eabcc4d1...
- statist####.com/adv_pxl?pid=####&id=####
- go####.nl/xjs/_/js/k=xjs.qs.nl.jDjm49QCb44.O/m=sx,c,sb_mob,bct,cdos,elog...
- c####.####.com/landings/51156/1482505631/images/img3.jpg
- t####.####.com/ck.php?id=####&transaction_id=####&subid_spx=####
- go####.nl/gb/images/qi1_36e7b564.png
Запросы HTTP POST:
- u####.com/jsdk/sd.action?b=####
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- and####.####.com/rqd/async?aid=####
- u####.com:7079/jsdk/sd.action?b=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_crashrecord/1004
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/SexVideo/20170502.txt
- /data/data/####/fileswapsdk/local/170502124936033.dex
- /data/data/####/fileswapsdk/local/localCopy.data
- /data/data/####/fileswapsdk/local/go.png
- /data/data/####/files/target.dex
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/security_info
- /data/data/####/shared_prefs/.xml
- /data/data/####/files/local_crash_lock
- /data/data/####/shared_prefs/crashrecord.xml
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.genymotion.version
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/dexopt --dex 27 40 40 37780 /data/data/####/files/target.dex 1251050105 2038587644 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/sh -c getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop gsm.sim.state2
- getprop ro.build.fingerprint
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.aa.romver
- getprop ro.aa.romver
- getprop ro.lewa.version
- /system/bin/sh -c getprop ro.secure
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- getprop androVM.vbox_dpi
- getprop ro.build.rom.id
- getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.debuggable
- getprop ro.debuggable
- getprop ro.vivo.os.build.display.id
- getprop ro.secure
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop qemu.sf.fake_camera
- getprop qemu.sf.fake_camera
- getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop gsm.sim.state
- getprop ro.meizu.product.model
- getprop ro.board.platform
- getprop ro.build.version.opporom
- getprop ro.genymotion.version
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop androVM.vbox_dpi
- getprop gsm.sim.state
- getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop gsm.sim.state2
- /system/bin/sh -c getprop ro.build.version.emui
- getprop ro.build.version.emui
- /system/bin/dexopt --dex 27 47 40 288796 /data/data/####/fileswapsdk/local/170502124936033.dex 1252552333 34489205 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.
Может автоматически отправлять СМС-сообщения.
