Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- p####.st
- m####.social
- i####.####.com
- z####.ru
- u####.####.net
- c####.####.net
- i####.####.st
- p####.####.com
- r####.####.com
- c####.####.com
- j####.####.xyz
- t####.global
- trackme####.com
- l####.####.com
- b####.com
- a####.####.com
- d####.####.com
Запросы HTTP GET:
- p####.####.com/tap.php?v=####&nid=####&expires=####&put=####
- i####.####.st/static/script/modernizr.js
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&su...
- r####.####.com/r1/ucm?id=####&r1s=####
- r####.####.com/r1/rmxucm?xid=####
- j####.####.xyz/?s3=####
- r####.####.com/r1/ucm?r1s=####&google_gid=####&google_cver=####
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####...
- trackme####.com/r/2126e256-384f-11e7-a281-1141413bfbe5/0/
- i####.####.com/setuid?entity=####&code=####
- b####.com/rms/BingCore.Bundle/cj,nj/ea12a751/faef1996.js?bu=####
- b####.com/az/hprichbg/rb/DeltaJunction_ROW10566794579_1024x768.jpg
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- m####.social/mUqI8N
- d####.####.com/d/28835593aa4714877?sub=####&sub2=####&do=####&test=####
- i####.####.st/static/css/base.css
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- p####.st/cm/?&r1s=####
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerMenuOnClick/cj,...
- b####.com/rms/AutoSug/cj,nj/0c47b80b/85a18b5c.js?bu=####
- a####.####.com/fd/ls/l?IG=####&CID=####&TYPE=####&DATA=####
- l####.####.com/l.php?u=####&h=####
- c####.####.net/pixel?googl####&google_nid=####&google_hm=####&r1s=####
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- b####.com/fd/ls/GLinkPing.aspx?IG=####&CID=####&ID=####
- b####.com/AS/Suggestions?pt=####&mkt=####&qry=####&cp=####&css=####&cvid...
- z####.ru/apkfff?keyword=####
- b####.com/ImageResolution.aspx?w=####&h=####&hash=####&r=####
- m####.social/scmf/OrMCe04Lcp0lODlLfjnB1W4K3k5-QD5JEAk6T5xGQNdu60cwA0ZAqB...
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- c####.####.com/?a=####&c=####&p=####&E=####&s1=####&s2=####&s3=####
- l####.####.com/l.php?u=####&h=####&s=####
- p####.####.com/tap.php?cookie_redirect=####&v=####&nid=####&expires=####...
- b####.com/rms/rms%20answers%20Identity%20Mobile$MobileSnrWindowsLiveConn...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/fd/s/a/sbbtn.png
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- trackme####.com/r/2126e256-384f-11e7-a281-1141413bfbe5/1/
- d####.####.com/d/28835593aa4714877?sub=####&sub2=####
- b####.com/?r=####
- t####.global/hrfp?url=####
- r####.####.com/r1/bcm/p23
- b####.com/Passport.aspx?popup=####
- b####.com/hpmob?r=####&IG=####&IID=####
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- c####.####.net/pixel?google_cm=####&google_nid=####&google_hm=####&r1s=#...
- a####.####.com/cms/v1?esig=####&nwid=####&sigv=####
- p####.st/scms/OrMCe04Lcp0lOFmbgiY8tvQTxDSAR758cThLe8BmD5c2OAp7/mUqI8N
- u####.####.net/w/1.0/sd?cc=####&id=####&val=####
- u####.####.net/w/1.0/sd?id=####&val=####
- r####.####.com/r1/pixel/x8208
Запросы HTTP POST:
- b####.com/fd/ls/lsp.aspx?
- b####.com/fd/ls/lsp.aspx
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/app_app_apk/whatsapp.dat.jar
- /data/data/####/files/asdfg
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1482359356.zip
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 41 40 508264 /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2.zip 2168832 1899391136 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar
- /system/bin/dexopt --dex 27 40 40 244980 /data/data/####/app_app_apk/whatsapp.dat.jar 1244605072 1478167118 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
