Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.218.origin
- Android.Backdoor.542.origin
- Android.Triada.219.origin
Сетевая активность:
Подключается к:
- a####.####.com:9090
- d3656q1####.####.net
- e####.####.in
- atracki####.####.com
- trackme####.com
- insi####.####.com
- prelan####.net
- wina####.com:8006
- wina####.com
- l####.####.com
- st####.####.com
- premium####.com
- 1####.####.228:8006
- a####.####.in
- melad####.com
- a####.####.com
- mobilep####.com
- c####.####.com
- t####.global
- mobile####.me
- t####.####.info
- yout####.com
Запросы HTTP GET:
- l####.####.com/assets/83434662/styles/colors/color-phone-white.css?v=####
- d3656q1####.####.net/sail732.so
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/index.css
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####...
- melad####.com/04r59/YKT2eQ/dKez/cKqiKvI/Iu__fqw5kvkGPugJH-EVtB8s73bbuwn4...
- a####.####.com:9090/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=...
- t####.####.info/9fd67b5e-bf36-48d8-b97c-52a4c60633dd?Pubid=####&clickid=...
- trackme####.com/r/5ef8f756-393d-11e7-b0f3-1141944ceb19/0/
- l####.####.com/assets/68a7ebbe/js/common.js?v=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.min.js
- melad####.com/04r59/YKT-/dKez/cKqiKvI/Iu__fqw5kvkGPugJH-EVtB8s73bbuwn4jw...
- a####.####.com/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&...
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.squishy.js
- l####.####.com/assets/83434662/js/scripts.js?v=####
- yout####.com/d/27743573e1ed2af321?sub=####&publisher_id=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/script.js
- yout####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- premium####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- c####.####.com/416cbbfc-1049-4fef-9e7f-cdf6a770008a?clickid=####
- e####.####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&chu...
- l####.####.com/nl/iphone7white?networkid=####&publisher=####&optinfo=####
- a####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&plugVe...
- l####.####.com/assets/83434662/js/jquery.countdown.min.js?v=####
- l####.####.com/assets/83434662/styles/layouts/layout-phone.css?v=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/step1.html
- l####.####.com/assets/68a7ebbe/js/jquery.maskedinput.min.js?v=####
- a####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&plugVersi...
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&...
- l####.####.com/assets/83434662/styles/main/style.css?v=####
- st####.####.com/c/hotjar-465128.js?sv=####
- a####.####.in/interface/vsupdate_hk.php?vers=####&cid=####&qid=####&uid=...
- trackme####.com/r/5ef8f756-393d-11e7-b0f3-1141944ceb19/1/
- l####.####.com/assets/9d84ffa2/jquery.min.js?v=####
- mobile####.me/?sl=####&data1=####&data2=####&data3=####&data4=####
- atracki####.####.com/transaction/post_click?offer_id=####&aff_id=####&af...
- t####.global/hrfp?url=####
- l####.####.com/assets/83434662/fonts/HelveticaNeueCyr-Light.otf
- e####.####.in/interface/mothdow.php?subid=####&pjid=####&uid=####&Imsi=#...
- premium####.com/d/8628258512f2f83059?sub=####
- melad####.com/29A667/AthB/DNxR/VJAN66HM-3TkTRFqPFhi8ufC496Ayu1CMUE8IU1nQ...
- e####.####.in/interface/shaziow.php?subid=####&pjid=####&uid=####&cpid=#...
- l####.####.com/assets/83434662/styles/brands/apple.css?v=####
- l####.####.com/assets/68a7ebbe/js/jquery.alphanum.js?v=####
- l####.####.com/assets/68a7ebbe/js/underscore-min.js?v=####
Запросы HTTP POST:
- e####.####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=##...
- 1####.####.228:8006/service/com.ads.basic.model.ServerAddress?type=####
- wina####.com:8006/service/com.ads.sales.model.Mobile
- wina####.com/service/com.ads.basic.model.ServerAddress?type=####
- insi####.####.com/api/v1/client/sites/465128/visit-data?sv=####
- wina####.com/service/com.like.system.model.ChipBind
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/1493729624917.dex
- /data/data/####/databases/cc.db-journal
- /data/data/####/cache/hisailer-472933592.so
- /data/data/####/databases/ua.db
- /data/data/####/files/zcmxle.dex
- /data/data/####/files/1493729624917.apk
- /data/data/####/apps_/com.plugin.main/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/jihuos.xml
- /data/data/####/databases/cc.db
- /data/data/####/files/U922.apk
- /data/data/####/files/btsailer.apk
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/ua.db-journal
- /sdcard/Android/.zuid
- /data/data/####/files/sail732.so
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/1493729658511.apk
- /data/data/####/cache/.android/qzqfg1.png
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/userconfig.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/cache/hisailer1414477177.so
- /data/data/####/files/.imprint
- /data/data/####/cache/hisailer123481513.so
- /data/data/####/cache/a.log
- /data/data/####/files/jazwmp.so
- /sdcard/PluginLog/CrashLog/CrashLog_20170502125349_2129.log
- /data/data/####/files/libs_data
- /data/data/####/cache/hisailer71156230.so
- /data/data/####/shared_prefs/Argolisten.xml
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/exid.dat
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/tmpversion
- /data/data/####/databases/su.sqlite
- /data/data/####/files/core_service
- /data/data/####/databases/su.sqlite-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/webcache/localstorage/http_lp1.want-to-win.com_0.localstorage-journal
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/1493729631637.apk
- /sdcard/PluginLog/CrashLog/CrashLog_20170502125413_2208.log
- /data/data/####/files/zcmxle.apk
- /data/data/####/files/1493729653665.apk
- /data/data/####/app_dex/U922.dex
- /data/data/####/shared_prefs/bill.xml
- /sdcard/PluginLog/CrashLog/CrashLog_20170502125417_2343.log
- /data/data/####/databases/net_dc_sdk.db
- /data/data/####/shared_prefs/share_cache.pref.xml
- /data/data/####/apps_/com.plugin.main/Signature/Signature_0.key
- /data/data/####/files/webcache/ApplicationCache.db-journal
- /data/data/####/apps_/com.plugin.main/apk/base-1.apk
- /data/data/####/databases/net_dc_sdk.db-journal
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 72 40 49256 /data/data/####/files/btsailer.apk 1251624652 -1056122757 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- /system/bin/dexopt --dex 27 111 40 179000 /data/data/####/apps_/com.plugin.main/apk/base-1.apk 1253006438 -25815708 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 41 40 319740 /data/data/####/files/1493729653665.apk 1253006437 1168113070 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 41 40 319740 /data/data/####/files/1493729638202.apk 1253006437 1168113070 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 41 40 319740 /data/data/####/files/1493729658511.apk 1253006437 1168113070 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 63 40 113728 /data/data/####/files/U922.apk 1251639931 1963997904 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 40 40 14036 /data/data/####/files/zcmxle.apk 1253006432 1902479766 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framewor
- /system/bin/dexopt --dex 27 41 40 319740 /data/data/####/files/1493729624917.apk 1253006437 1168113070 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 41 40 319740 /data/data/####/files/1493729631637.apk 1253006437 1168113070 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
Может автоматически отправлять СМС-сообщения.
