Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.218.origin
- Android.Backdoor.542.origin
- Android.Triada.219.origin
Сетевая активность:
Подключается к:
- trac####.####.com
- e####.####.in
- d3656q1####.####.net
- a####.####.com:9090
- a####.####.in
- c####.####.com
- atracki####.####.com
- wina####.com:8006
- a####.####.com
- kar####.com
- l####.####.com
- premium####.com
- t####.####.info
- wina####.com
Запросы HTTP GET:
- a####.####.com/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&plugVer...
- kar####.com/06m03/W5tP/VZ9f/DdMDGqXA8uDAko5iM_i8CboPVe1V0ck1NedXGYK1_R4n...
- l####.####.com/assets/83434662/styles/brands/apple.css?v=####
- d3656q1####.####.net/sail732.so
- a####.####.com:9090/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=...
- t####.####.info/9fd67b5e-bf36-48d8-b97c-52a4c60633dd?Pubid=####&clickid=...
- l####.####.com/assets/68a7ebbe/js/common.js?v=####
- a####.####.com/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&...
- l####.####.com/assets/83434662/js/scripts.js?v=####
- l####.####.com/nl/iPhone7whiteexcl?networkid=####&publisher=####&optinfo...
- premium####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- c####.####.com/416cbbfc-1049-4fef-9e7f-cdf6a770008a?clickid=####
- e####.####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&chu...
- l####.####.com/nl/iphone7white?networkid=####&publisher=####&optinfo=####
- a####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&plugVe...
- l####.####.com/assets/83434662/js/jquery.countdown.min.js?v=####
- l####.####.com/assets/83434662/styles/layouts/layout-phone.css?v=####
- trac####.####.com/async_click?mb_pl=####&mb_nt=####&mb_campid=####&mb_au...
- kar####.com/75C36/skWC/pkbO/okvfnnw/8A6CyiL7ItBSaZVtKk6_I7epc13kCTlyI-vg...
- trac####.####.com/warning.html?err=####
- l####.####.com/assets/68a7ebbe/js/jquery.maskedinput.min.js?v=####
- l####.####.com/assets/9d84ffa2/jquery.min.js?v=####
- l####.####.com/assets/83434662/styles/main/style.css?v=####
- a####.####.in/interface/vsupdate_hk.php?vers=####&cid=####&qid=####&uid=...
- a####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&plugVersi...
- atracki####.####.com/transaction/post_click?offer_id=####&aff_id=####&af...
- l####.####.com/assets/83434662/fonts/HelveticaNeueCyr-Light.otf
- e####.####.in/interface/mothdow.php?subid=####&pjid=####&uid=####&Imsi=#...
- a####.####.com/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&plugVersi...
- premium####.com/d/8628258512f2f83059?sub=####
- e####.####.in/interface/shaziow.php?subid=####&pjid=####&uid=####&cpid=#...
- l####.####.com/assets/83434662/styles/colors/color-phone-white.css?v=####
- l####.####.com/assets/68a7ebbe/js/jquery.alphanum.js?v=####
- l####.####.com/assets/68a7ebbe/js/underscore-min.js?v=####
Запросы HTTP POST:
- wina####.com/service/com.ads.basic.model.ServerAddress?type=####
- a####.####.com/app_logs
- wina####.com:8006/service/com.like.system.model.ChipBind
- e####.####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=##...
- wina####.com/service/com.ads.sales.model.Mobile
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/bill.xml
- <Package Folder>/databases/su.sqlite
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/apps_/com.plugin.main/apk/base-1.apk
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/shared_prefs/share_cache.pref.xml
- <Package Folder>/files/exid.dat
- <Package Folder>/apps_/com.plugin.main/Signature/Signature_0.key
- <Package Folder>/cache/hisailer2138136474.so
- <Package Folder>/files/.imprint
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/su.sqlite-journal
- <Package Folder>/files/1495006111785.apk
- <Package Folder>/files/btsailer.apk
- <Package Folder>/files/sail732.so
- <Package Folder>/files/1495006153478.apk
- <Package Folder>/databases/net_dc_sdk.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/config.prop
- <Package Folder>/files/tmpversion
- <Package Folder>/shared_prefs/share_cache.pref.xml
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/1495006101128.apk
- <Package Folder>/shared_prefs/Argolisten.xml
- <Package Folder>/files/pvhmgg.dex
- <Package Folder>/cache/hisailer-256730903.so
- <Package Folder>/shared_prefs/shazi.xml
- <Package Folder>/files/1495006155692.apk
- <Package Folder>/files/1495006116033.apk
- <Package Folder>/cache/.android/noaok1.png
- <Package Folder>/databases/net_dc_sdk.db
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/.zuid
- <Package Folder>/files/libs_data
- <Package Folder>/cache/hisailer-1336064286.so
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/apps_/com.plugin.main/dalvik-cache/base-1.dex
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/databases/ua.db
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/cache/hisailer-1707963506.so
- <Package Folder>/files/core_service
- <Package Folder>/files/1495006107372.apk
- <Package Folder>/files/.zuid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/U922.apk
- <Package Folder>/files/pvhmgg.apk
- <Package Folder>/cache/hisailer1057597726.so
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/core_service
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/hisailer-883543138.so
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/1495006102192.apk
- <Package Folder>/files/1495006108534.apk
- <Package Folder>/shared_prefs/userconfig.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/qaleqy.so
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
