Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1859.origin
Сетевая активность:
Подключается к:
- plat####.####.com
- ckst####.com
- google-####.com
- and####.####.com
- f####.####.com
- s####.com
- a####.####.com
Запросы HTTP GET:
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-sexy-hel...
- ckst####.com/js/flowplayer/flowplayer-3.2.6.min.js
- ckst####.com/cr2/static/www.sexy.com/10609/images/logo.png
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-lovely-j...
- ckst####.com/cr2/global/styles/global.css
- ckst####.com/cr2/global/images/flags/shiny/64/NL.png
- ckst####.com/cr2/static/www.sexy.com/10609/images/languages-shiny.png
- ckst####.com/cr2/static/www.sexy.com/10609/images/checkmark.png
- s####.com/or/v69gqjk?aff_id=####&format=####&source=####&referrer=####&o...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-gorgeous...
- plat####.####.com/v1/share_2.png
- plat####.####.com/widgets.js
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-shy-cynt...
- s####.com/of/v69gqjk?aff_id=####&format=####&source=####&offer_id=####&a...
- plat####.####.com/widgets/tweet_button.5b6375bb17bd9edb2f4e7f8f12971999....
- s####.com/
- ckst####.com/cr2/global/images/rta.jpg
- ckst####.com/cr2/static/www.sexy.com/10609/images/copywriting/front/nl/a...
- a####.####.com/ajax/libs/jquery/1.9.1/jquery.min.js
- google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=...
- ckst####.com/js/fancybox/2.1.4/jquery.fancybox.pack.js?v=####
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-pretty-n...
- ckst####.com/cr2/global/js/modernizr.custom.js
- ckst####.com/js/fancybox/2.1.4/jquery.fancybox.css?v=####
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-nice-car...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-charming...
- ckst####.com/cr2/static/www.sexy.com/10609/images/side-imgs/fuck-lovely-...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-charming...
- s####.com/asset/dynamic/javascript/include?zid=####&pid=####&random=####...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-sexy-jen...
- ckst####.com/cr2/global/js/idangerous.swiper.min.js
- ckst####.com/cr2/static/www.sexy.com/10609/images/logo-full.png
- ckst####.com/cr2/static/www.sexy.com/10609/images/welcome.jpg
- f####.####.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-shy-nikk...
- s####.com/of/1v28sko?aff_id=####&format=####&source=####&offer_id=####&a...
- ckst####.com/cr2/static/www.sexy.com/10609/images/copywriting/front/en/a...
- ckst####.com/cr2/static/www.sexy.com/10609/images/side-imgs/meet-beautif...
- ckst####.com/cr2/static/www.sexy.com/10609/images/share.png
- ckst####.com/cr2/static/www.sexy.com/10609/styles/styles.css
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-pretty-a...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-lovely-s...
- ckst####.com/cr2/static/www.sexy.com/10609/images/side-imgs/date-sexy-la...
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&u...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-pretty-a...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-charming...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-shy-shar...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-sexy-bon...
- plat####.####.com/v1/share.js
- ckst####.com/cr2/assets/scripts/tracking-hasoffers-4-11-0-10.min.js
- f####.####.com/css?family=####
- ckst####.com/cr2/static/www.sexy.com/10609/js/scripts.js
- s####.com/nl/?token=####
- ckst####.com/cr2/static/www.sexy.com/10609/images/side-imgs/date-gorgeou...
- ckst####.com/cr2/global/images/asacp.png
- s####.com/or/1v28sko?aff_id=####&format=####&source=####&referrer=####&o...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-beautifu...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-beautifu...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-nice-mel...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/meet-gorgeous...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-lovely-m...
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-beautifu...
- google-####.com/analytics.js
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/fuck-nice-sta...
- ckst####.com/cr2/global/js/global.js
- ckst####.com/cr2/static/www.sexy.com/10609/images/profiles/date-gorgeous...
- f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...
Запросы HTTP POST:
- and####.####.com/rqd/async
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/s
- <Package Folder>/cache/webviewCacheChromium/f_000023
- <Package Folder>/shared_prefs/preferences.xml
- <Package Folder>/files/libdt.so
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/cache/webviewCacheChromium/f_00002c
- <Package Folder>/cache/webviewCacheChromium/f_00002b
- <Package Folder>/cache/webviewCacheChromium/f_00002a
- <Package Folder>/files/mcr.apk
- <Package Folder>/cache/webviewCacheChromium/f_00002f
- <Package Folder>/cache/webviewCacheChromium/f_00002e
- <Package Folder>/cache/webviewCacheChromium/f_00002d
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/databases/batterymessage.db
- <Package Folder>/databases/batterymessage.db-journal
- <Package Folder>/files/native_record_lock
- <Package Folder>/files/AdjustIoActivityState
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/time_p.xml
- <Package Folder>/files/local_crash_lock
- <Package Folder>/databases/bugly_db_legu-journal
- <Package Folder>/cache/webviewCacheChromium/f_000029
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000021
- <Package Folder>/cache/webviewCacheChromium/f_000020
- <Package Folder>/cache/webviewCacheChromium/f_000027
- <Package Folder>/cache/webviewCacheChromium/f_000026
- <Package Folder>/cache/webviewCacheChromium/f_000025
- <Package Folder>/cache/webviewCacheChromium/f_000024
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/files/AdjustIoPackageQueue
- <Package Folder>/cache/webviewCacheChromium/f_00001f
- <Package Folder>/cache/webviewCacheChromium/f_00001d
- <Package Folder>/cache/webviewCacheChromium/f_00001e
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/cache/webviewCacheChromium/f_00001c
- <Package Folder>/cache/webviewCacheChromium/f_000022
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/files/c
- <Package Folder>/files/security_info
- <Package Folder>/mix.dex
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/a
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/tx_shell/libshella-2.8.2.so
- <Package Folder>/cache/webviewCacheChromium/f_000028
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.2.so
- chmod 700 /data/data/####/tx_shell/libshella-2.8.2.so
- getprop ro.yunos.version
- getprop ro.board.platform
- /system/bin/sh -c getprop ro.board.platform
- <dexopt>
- /system/bin/sh -c type su
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
