Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1867.origin
- Android.SmsSend.1901.origin
Сетевая активность:
Подключается к:
- l####.####.com
- u####.com:7079
- c####.####.net
- gl####.####.com
- p####.####.com
- and####.####.com
- gl####.####.com:9090
- b####.mobi
- trackme####.com
- transr####.com
- u####.com
Запросы HTTP GET:
- l####.####.com/uploads/landings/302/main/iPhone2.png
- l####.####.com/assets/83434662/styles/brands/apple.css?v=####
- u####.com/ru/ru0527processurl.js
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- l####.####.com/assets/68a7ebbe/js/common.js?v=####
- gl####.####.com/mobiledirect/?uid=####&aid=####&back=####&push=####&soun...
- l####.####.com/assets/83434662/js/scripts.js?v=####
- trackme####.com/r/3dbd799c-42a5-11e7-af0b-1141969f9755/1/
- trackme####.com/r/3dbd799c-42a5-11e7-af0b-1141969f9755/0/
- l####.####.com/nl/iPhone7whiteexcl?networkid=####&publisher=####&optinfo...
- l####.####.com/nl/iphone7white?networkid=####&publisher=####&optinfo=####
- l####.####.com/assets/83434662/js/jquery.countdown.min.js?v=####
- p####.####.com/archivos/close.png
- b####.mobi/path/lp.php?trvid=####&trvx=####&extid=####&amount=####&pubid...
- l####.####.com/assets/83434662/styles/layouts/layout-phone.css?v=####
- l####.####.com/assets/68a7ebbe/js/jquery.maskedinput.min.js?v=####
- transr####.com/89p18/cF9V/fltF/JhcZ9FUV7aldC9fCjaJwHqLB6jetNehzF-dfdSLT-...
- l####.####.com/assets/9d84ffa2/jquery.min.js?v=####
- l####.####.com/assets/83434662/styles/main/style.css?v=####
- gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
- u####.com/ru/ru0527findbutton20161226.js
- l####.####.com/assets/83434662/fonts/HelveticaNeueCyr-Light.otf
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- l####.####.com/assets/83434662/styles/colors/color-phone-white.css?v=####
- transr####.com/89p18/ZFwZ/cF9V/dFJEowc/JhcZ9FUV7aldC9fCjaJwHqLB6jetNehzF...
- u####.com/ru/ru0527simulationClickYes.js
- l####.####.com/assets/68a7ebbe/js/jquery.alphanum.js?v=####
- l####.####.com/assets/68a7ebbe/js/underscore-min.js?v=####
Запросы HTTP POST:
- u####.com/jsdk/sd.action?b=####
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- and####.####.com/rqd/async?aid=####
- u####.com:7079/jsdk/sd.action?b=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/crashrecord.xml
- <Package Folder>/app_crashrecord/1004
- <Package Folder>/files/local_crash_lock
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/fileswapsdk/local/170517102739320.dex
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/databases/bugly_db_-journal
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/fileswapsdk/local/go.png
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/files/wapsdk/run.dex
- <Package Folder>/fileswapsdk/local/localCopy.data
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/security_info
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- getprop
- <dexopt>
- /system/bin/sh -c type su
- /system/bin/sh -c getprop
Может автоматически отправлять СМС-сообщения.
