Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Сетевая активность:
Подключается к:
- s####.####.com
- gu####.####.com:99
- g####.####.com
- j####.####.la
- j####.####.com
- m####.####.com
- 2####.com
- st####.####.com
- gu####.####.com
- c####.####.cn
Запросы HTTP GET:
- 2####.com/templets/2tuyszy/images/js/index.js
- 2####.com/js/ads/head960x90.js
- 2####.com/templets/2tuyszy/images/js/jquery.lazyload.min.js
- gu####.####.com/style.css
- j####.####.com/js/c/10396_2099.js
- 2####.com/templets/2tuyszy/images/js/common.js
- st####.####.com/shiping.mp4
- j####.####.com/r/f.php?uid=####&pid=####
- m####.####.com/static/search/iconfont/search_iconfont_128e950d.ttf
- m####.####.com/s?word=####
- j####.####.la/18895933.js
- m####.####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm%402%2Csz%401320...
- m####.####.com/static/search/image_default.png
- 2####.com/templets/2tuyszy/images/js/common1.js
- st####.####.com/ssouye.jpg
- 2####.com/
- gu####.####.com/
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- 2####.com/templets/2tuyszy/images/js/function.js
- m####.####.com/se/static/font/cicon_61a03f3.ttf
- gu####.####.com:99/v1/?action=####&device=####&newver=####
- m####.####.com/se/static/img/iphone/pagelogo.png
- 2####.com/templets/2tuyszy/images/js/jquery.SuperSlide.2.1.1.js
- 2####.com/js/ads/640x150foot.js
- 2####.com/templets/2tuyszy/images/js/jquery-1.7.1.min.js
- 2####.com/templets/2tuyszy/images/style.css
- m####.####.com/static/search/clear.png
- m####.####.com/static/index/promB/mmsicon.png
- c####.####.cn/timg?wiseala####&size=####&quality=####&sec=####&di=####&s...
- s####.####.com/z_stat.php?id=####&web_id=####
- 2####.com/js/ads/250x250.js
Запросы HTTP POST:
- gu####.####.com/v3/version.asp
- g####.####.com/cr/sv/getEPList
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/PreExcuModsInfo.txt
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/ReadyHost.txt
- <Package Folder>/files/1495005857639_cgr.so
- <Package Folder>/files/.yflurrydatasenderblock.f2c82e9a-4530-4a18-8ecf-abefe84da5ea
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_Q2DT8JD4NF4MJYZXF4VP_216
Другие:
Запускает следующие shell-скрипты:
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/NF9TKqee1.jar > /dev/null 2>&1
- cat /proc/mounts
- chmod 0771 /data/data/####/.syslib-
- /data/data/####/files/us.vRFB0M0EP7Ac6X0Tl7da20P14Xjqh -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/NF9TKqee1.dex > /dev/null 2>&1
- sh <Package Folder>/files/us.NF9TKqee1D8mENGMGY8grGpF9XCGJ -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.NF9TKqee1D8mENGMGY8grGpF9XCGJ > /dev/null 2>&1
- /data/data/####/files/us.NF9TKqee1D8mENGMGY8grGpF9XCGJ -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- <error:2>
- getenforce
- <dexopt>
Может автоматически отправлять СМС-сообщения.
