Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.542.origin
- Android.HiddenAds.89.origin
- Android.Siggen.6036
- Android.HiddenAds.76.origin
- Android.Triada.218.origin
- Android.Triada.219.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- 1####.####.228:8006
- 1####.####.226:9000
- wina####.com:8006
- 1####.####.228
- 1####.####.226
- wina####.com
Запросы HTTP GET:
- 1####.####.226/like/36/8e8158e4fbe5486a94e2a7a1e647e830.apk
- 1####.####.226:9000/like/36/2c28b1983459418e81e16308158818b5.png
- 1####.####.226/like/30/cf3cd42fc521484cab1114f1a60a9eb3.apk
- 1####.####.226/like/36/0038dc3d1ca844339d9d42f25ecad5d9.png
- 1####.####.226/like/36/5530e6194b7742a086993a798b59530b.apk
Запросы HTTP POST:
- wina####.com/service/com.ads.sales.model.Mobile
- 1####.####.228:8006/service/com.ads.basic.model.ServerAddress?type=####
- wina####.com:8006/service/com.ads.basic.model.ServerAddress?type=####
- wina####.com/service/com.like.system.model.ChipBind
- wina####.com/service/com.ads.track.model.Offer
- wina####.com/service/com.ads.basic.model.ServerAddress?type=####
- 1####.####.228/service/com.ads.basic.model.ServerAddress?type=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/apps_/com.android.browser/data/com.android.browser/files/.zuid
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/Android/cache/_like_36_2c28b1983459418e81e16308158818b5.png
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/Android/cache/_like_36_0038dc3d1ca844339d9d42f25ecad5d9.png
- <Package Folder>/files/1495006115250.apk
- <Package Folder>/databases/su.sqlite
- <Package Folder>/apps_/com.plugin.main/apk/base-1.apk
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_36_8e8158e4fbe5486a94e2a7a1e647e830.apk.tmp
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/shared_prefs/share_cache.pref.xml
- <Package Folder>/apps_/com.plugin.main/Signature/Signature_0.key
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/cache/.android/_like_36_0038dc3d1ca844339d9d42f25ecad5d9.png.apk
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_30_cf3cd42fc521484cab1114f1a60a9eb3.apk.tmp
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_36_5530e6194b7742a086993a798b59530b.apk
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/cache/.android/_like_36_2c28b1983459418e81e16308158818b5.png.apk
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_36_8e8158e4fbe5486a94e2a7a1e647e830.apk
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_36_5530e6194b7742a086993a798b59530b.apk.tmp
- <Package Folder>/files/nzqbel.apk
- <Package Folder>/files/1495006110058.apk
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/Android/cache/_like_30_cf3cd42fc521484cab1114f1a60a9eb3.apk
- <Package Folder>/files/1495006122643.apk
- <Package Folder>/files/config.prop
- <Package Folder>/shared_prefs/share_cache.pref.xml
- <Package Folder>/cache/.android/ufigz1.png
- <Package Folder>/apps_/com.nethd34.player/dalvik-cache/base-1.dex
- <Package Folder>/apps_/com.nethd34.player/Signature/Signature_0.key
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/cache/.android/_like_36_8e8158e4fbe5486a94e2a7a1e647e830.apk.apk
- <Package Folder>/files/.zuid
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/.zuid
- <Package Folder>/files/libs_data
- <Package Folder>/apps_/com.android.browser/dalvik-cache/base-1.dex
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/shared_prefs/share_cache.pref.xml
- <Package Folder>/databases/su.sqlite-journal
- <Package Folder>/apps_/com.plugin.main/dalvik-cache/base-1.dex
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/files/.zuid
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/cache/.android/_like_36_5530e6194b7742a086993a798b59530b.apk.apk
- <Package Folder>/files/core_service
- <Package Folder>/apps_/com.nethd34.player/apk/base-1.apk
- <Package Folder>/apps_/com.android.browser/Signature/Signature_0.key
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/Android/cache/_like_36_0038dc3d1ca844339d9d42f25ecad5d9.png.tmp
- <Package Folder>/apps_/com.nethd34.player/data/com.nethd34.player/cache/.android/_like_30_cf3cd42fc521484cab1114f1a60a9eb3.apk.apk
- <Package Folder>/apps_/com.android.browser/data/com.android.browser/shared_prefs/share_cache.pref.xml
- <Package Folder>/files/glbjrp.so
- <Package Folder>/files/1495006122132.apk
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/core_service
- <Package Folder>/apps_/com.plugin.main/data/com.plugin.main/files/Android/cache/_like_36_2c28b1983459418e81e16308158818b5.png.tmp
- <Package Folder>/apps_/com.android.browser/apk/base-1.apk
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
