Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- h####.####.com
- c####.com
- d####.####.cn
- du####.cn
- google-####.com
- c####.####.com
- z####.####.com
- mlui####.com
- pag####.####.com
Запросы HTTP GET:
- mlui####.com/voyance/index.php?c=####
- s####.####.com/core.php?web_id=####&show=####&t=####
- pag####.####.com/pagead/js/r20170517/r20170110/show_ads_impl.js
- c####.####.com/9.gif?abc=####&rnd=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- mlui####.com/voyance/assets/contents/js/content/nl.js?_=####
- mlui####.com/voyance/assets/contents/js/vendor/geop.js
- mlui####.com/voyance/assets/contents/templates/spmlonlv7_0/images_mobile...
- h####.####.com/hm.js?cdeccc9####
- du####.cn/images/an.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- du####.cn/images/mobhome.png
- du####.cn/sm/mobapp/xmcsindex.asp
- pag####.####.com/pagead/show_ads.js
- mlui####.com/voyance/assets/contents/js/content/spamtrap.js?_=####
- mlui####.com/voyance/assets/contents/css/mobile.css
- mlui####.com/voyance/assets/contents/js/vendor/mailcheck.js
- mlui####.com/voyance/assets/contents/js/loader_v4_mobile.js
- c####.com/stat/website.php?web_id=####
- mlui####.com/vii/index.php/RouterPs/index?controller=####&c=####&ap=####...
- mlui####.com/voyance/assets/contents/templates/spmlonlv7_0/js_mobile/adm...
- mlui####.com/voyance/assets/contents/templates/spmlonlv7_0/css_mobile/st...
- mlui####.com/voyance/assets/contents/js/persist.js
- mlui####.com/voyance/assets/contents/js/persist-min.js
- mlui####.com/voyance/assets/contents/css/font-awesome/fonts/fontawesome-...
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&u...
- pag####.####.com/pagead/js/adsbygoogle.js
- s####.####.com/stat.php?id=####&show=####
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- mlui####.com/voyance/assets/contents/js/destroySession.js
- du####.cn/images/wnlbg.jpg
- mlui####.com/voyance/assets/contents/js/vendor/jquery.js
- s####.####.com/img/pic1.gif
- google-####.com/analytics.js
- mlui####.com/voyance/spmlonlv7_0/script_mobile.xml
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- mlui####.com/voyance/assets/contents/templates/spmlonlv7_0/js_mobile/hel...
- du####.cn/images/mobtop.jpg
- du####.cn/images/mobback.png
- mlui####.com/voyance/assets/contents/js/vendor/bootbox.min.js
- mlui####.com/voyance/assets/contents/css/font-awesome/css/font-awesome.m...
- mlui####.com//voyance/index.php?controller=####&c=####&ap=####&ac=####&p...
- mlui####.com/voyance/assets/contents/templates/spmlonlv7_0/js_mobile/js.js
Запросы HTTP POST:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
