Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1867.origin
- Android.SmsSend.1875.origin
Сетевая активность:
Подключается к:
- and####.####.com
- trackme####.com
- x####.zone
- buongi####.####.org
- s####.####.com
- c####.####.com
- prelan####.net
- t####.####.zone
- gas####.####.com
- t####.global
- ilv####.com
- statist####.com
- u####.com
- tango####.com
- f####.####.com
- a####.####.com
- t####.####.com
- mobilep####.com
- u####.com:7079
- c####.####.net
- milffi####.club
- mobile####.me
- yout####.com
Запросы HTTP GET:
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_3.gif
- trackme####.com/r/c7845494-3647-11e7-818b-114135882a1a/0/
- f####.####.com/css?family=####&subset=####
- c####.####.com/landings/58300/1492784968/images/body_2.jpg
- t####.####.com/zp-redirect?target=####&caid=####&zpid=####&cid=####&rt=#...
- gas####.####.com/jump?url=####
- c####.####.com/landings/58300/1492784968/images/ok.png
- x####.zone/c/da57dc555e50572d?s1=####&s2=####&s3=####&click_id=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/logo_sm.png
- x####.zone/c/b927d99d0d1e200f?clickid=####&pubid=####
- f####.####.com/s/roboto/v16/d-6IYplOFocCacKzxwXSOCZ2oysoEQEeKwjgmXLRnTc....
- ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVctnNBljUY2ZjZvt5uc5cevNAQ--Z-gEfe8T...
- milffi####.club/nl/lp33/files/10.jpg
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_5.gif
- x####.zone/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=####&s2...
- f####.####.com/s/roboto/v16/Hgo13k-tfSpn0qi1SFdUfSZ2oysoEQEeKwjgmXLRnTc....
- tango####.com/viamark.mobi?adTagId=####
- milffi####.club/nl/lp33/files/06.jpg
- milffi####.club/nl/lp33/files/09.jpg
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_1.gif
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.min.js
- milffi####.club/nl/lp33/files/logo.png
- c####.####.com/landings/58300/1492784968/images/cancel.png
- milffi####.club/nl/lp33/files/04.jpg
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_6.gif
- yout####.com/d/27743573e1ed2af321?sub=####&publisher_id=####
- t####.####.com/click?cid=####&s1=####&s2=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/index.css
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/script.js
- milffi####.club/nl/lp33/files/11.jpg
- yout####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_2.gif
- milffi####.club/nl/lp33/files/12.jpg
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.squishy.js
- milffi####.club/nl/lp33?voluumdata=####
- c####.####.com/landings/58300/1492784968/css/1bccb5a6116838231b3333b28e3...
- gas####.####.com/track?url=####&attempt=####
- c####.####.com/landings/58300/1492784968/images/body_1.jpg
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####...
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/apple-iphone7.png
- t####.####.com/ck.php?line_item_id=####&cid=####&site=####&token=####&pu...
- c####.####.com/landings/58300/1492784968/images/main_girl.jpg
- milffi####.club/nl/lp33/?voluumdata=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/step1.html
- c####.####.com/landings/58300/1492784968/images/loading_bar.gif
- c####.####.com/landings/58300/1492784968/images/age_2.jpg
- x####.zone/c/4cb8b82534b8d106?tid=####&token2=####
- c####.####.com/landings/58300/1492784968/js/avsc2.js?149278####
- f####.####.com/s/roboto/v16/QHD8zigcbDB8aPfIoaupKOvvDin1pK8aKteLpeZ5c0A....
- milffi####.club/nl/lp33/files/08.jpg
- trackme####.com/r/c7845494-3647-11e7-818b-114135882a1a/1/
- milffi####.club/nl/lp33/files/03.jpg
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_4.gif
- c####.####.com/landings/58300/1492784968/js/b040f9f4da7e868eabeee13dfd48...
- milffi####.club/nl/lp33/files/05.jpg
- buongi####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub...
- t####.####.zone/favtvnwVqi/?clickid=####&pubid=####&l1=####
- mobile####.me/?sl=####&data1=####&data2=####&data3=####&data4=####
- t####.global/hrfp?url=####
- gas####.####.com/click?aid=####&linkid=####&s3=####&s2=####
- c####.####.com/landings/58300/1492784968/images/age_1.jpg
- a####.####.com/ajax/libs/webfont/1/webfont.js
- milffi####.club/nl/lp33/files/02.jpg
- x####.zone/redirect/index?type=####&to=####&data=####&action=####
- c####.####.com/landings/58300/1492784968/images/relation_1.jpg
- milffi####.club/nl/lp33/files/01.jpg
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&...
- milffi####.club/nl/lp33/files/07.jpg
- gas####.####.com/track?url=####
- c####.####.com/landings/58300/1492784968/images/relation_2.jpg
- ilv####.com/55K39/I-2C/N-7P/M-PeLTc/YaaPe2WRVctnNBljUY2ZjZvt5uc5cevNAQ--...
- statist####.com/adv_pxl?pid=####&id=####
- s####.####.com/click?pid=####&offer_id=####&sub1=####&sub2=####&sub3=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/loader.gif
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
Запросы HTTP POST:
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- and####.####.com/rqd/async?aid=####
- u####.com:7079/jsdk/sd.action?b=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/app_crashrecord/1004
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/c201705202017.data
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/files/g201705202017.apk
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/dex/201705202017.apk
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/security_info
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/shared_prefs/.xml
- /data/data/####/files/local_crash_lock
- /data/data/####/shared_prefs/crashrecord.xml
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- getprop
- /system/bin/dexopt --dex 27 41 40 295984 /data/data/####/files/g201705202017.apk 1252166497 934122849 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 40 40 44940 /data/data/####/files/dex/201705202017.apk 0 -630323779 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/sh -c type su
- /system/bin/sh -c getprop
Может автоматически отправлять СМС-сообщения.
