Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.102.origin
- Android.Loki.15.origin
- Android.MulDrop.84.origin
- Android.Backdoor.336.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.336.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- adr####.com
- syndica####.####.com
- buzzade####.com
- w####.link
- t####.####.rocks
- technol####.net
- pixp####.com
- bonga####.com
- c####.####.media
- t####.####.online
- w####.####.com
- pu####.com
- trackme####.com
- toponc####.com
- pha####.info
- u####.####.com
- 9699-26####.####.net
- i####.####.com
- datat####.com
- p####.####.com
- ip####.io
- f####.####.com
- bik####.com
- x####.####.com
- daily-o####.com
- m####.####.com
- statist####.com
- o####.camp
- pag####.####.com
- ald####.com
- go####.com
- t####.####.gdn
- t####.####.com
- cleando####.com
- gl####.####.com
- a####.####.com
- celery####.com
- appsfor####.mobi
- g####.####.com
- tra####.####.com
- se####.####.com
- traktra####.com
- adplexm####.####.com
- c####.####.com
- d####.####.com
- e####.####.com
- mobile####.me
- 5####.####.184
- l####.####.xyz
Запросы HTTP GET:
- x####.####.com/click?i=####
- g####.####.com/afu.php?zoneid=####
- se####.####.com/sites/?cat=####&camp=####&categoryid=####&conv=####
- go####.com/
- bik####.com/d/15143458cac3ab0e1bc?source=####&sub=####
- pu####.com/www/delivery/lg_two.php?bannerid=7949&campaignid=2251&zoneid=...
- t####.####.com/hit.php?c=####&ps=####&csurl=####&subid=####
- u####.####.com/zcvisitor/748a18dd-48b4-11e7-8daf-06506a27a916?campaignid...
- traktra####.com/?a_aid=####&page=####&clickid=####&pubid=####
- t####.####.com/ck.php?line_item_id=####&target=####&keyword=####&match=#...
- a####.####.com/pull/top_offer?gaid=####&id=####
- adr####.com/?placement=####&redi####
- syndica####.####.com/splash.php?idzone=####&type=####&sub=####
- p####.####.com/new_pre/facebook/DE/iphone7/?url=####&access_token=####
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- t####.####.online/?utm_term=####&clickverify=####&utm_content=####
- w####.link/click?c=####&tracker=####&ptrack=####
- adplexm####.####.com/imp?p=####&ct=####&ap=####&referrer=####&psid=####&...
- d####.####.com/?r=####&zoneid=####&pbk2=####&var=####&1=####&uuid=####&a...
- gl####.####.com/mobiledirect/?uid=####&aid=####&back=####&push=####&soun...
- daily-o####.com/?flux_fts=####&flux_cost=####&aff_id=####&aff_sub2=####&...
- cleando####.com/css/styles.css
- mobile####.me/?sl=####&data1=####&data2=####&data3=####&data4=####&_uu=#...
- toponc####.com/a/display.php?r=####&sub1=####&treqn=####&runauction=####...
- pag####.####.com/pagead/js/adsbygoogle.js
- celery####.com/48f20/3tAQ/ytNc/zt5NhL0/nJsR0OIbalXb_oZuCYCTkLIUYhZYwBrup...
- ip####.io/json
- d####.####.com/thinking/group/rtt_0525_666.apk
- e####.####.com/c/da57dc555e50572d?s1=####&s2=####&s3=####&s5=####&click_...
- t####.####.gdn/?v=####&KW=####&s1=####
- e####.####.com/thinking/group/exp
- buzzade####.com/a/display.php?r=####
- c####.####.com/jquery-1.11.3.min.js
- appsfor####.mobi/?sl=####&data1=####&data2=####&data3=####&data4=####
- 5####.####.184/passthrough_redirect?ptru=####&ptlu=####&ptrv=####
- c####.####.com/script/wait.php?stamat=####
- trackme####.com/r/a9b20806-48b4-11e7-8c88-1142231f61e0/0/
- t####.####.rocks/?utm_medium=####&utm_campaign=####&1=####&cid=####
- p####.####.com/r/986/p/Re.30816
- a####.####.com/ajax/libs/jquery/1.10.2/jquery.min.js
- pha####.info/redirect?tid=####&ref=####&subid=####&q=####
- u####.####.com/zcvisitor/90e88485-48b4-11e7-8009-063ab7638866?campaignid...
- datat####.com/d/15143458cac3ab0e1bc?source=####&sub=####&do=####&test=####
- technol####.net/wp-content/themes/sparkle-childtheme/style.css?ver=####
- pixp####.com/?id=####&to=####&ta=####
- c####.####.media/adplexmedia/tags/xdirect/xdirect.html?p=####&serverdoma...
- p####.####.com/?m=####&a=17197####&pubid=####&ba=####
- i####.####.com/popunders/map/style10.css
- tra####.####.com/?p=####&media_type=####&click_id=####
- c####.####.com/landings/19326/js/6a26daa78732c4dbeed9eabcc4d1bd0b.js?146...
- l####.####.xyz/templates/_common/_templates/spin-casino_MASTER/js/countu...
- g####.####.com/?utm_term=####&clickverify=####&utm_content=####
- o####.camp/offer?a=####&o=####&t=####&subid=####&subid4=####&pt=####&pid...
- t####.####.com/click?cid=####
- w####.####.com/afu.php?zoneid=####
- 9699-26####.####.net/red?id=####&alias=####&1=####
- statist####.com/adv_pxl?pid=####&id=####
- f####.####.com/s/robotocondensed/v14/Zd2E9abXLFGSr9G3YK2MsMEHkXu385rSv8s...
- bonga####.com/track?c=####&ps=####&csurl=####&subid=####
- f####.####.com/css?family=####&ver=####
Запросы HTTP POST:
- a####.####.com/app_logs
- m####.####.com/errorview/api/601
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- p####.####.com/myservercb/api/1800
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/files/.snow/.ir
- <Package Folder>/files/.snow/.dsmt.apk
- <Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
- <Package Folder>/files/exid.dat
- <Package Folder>/files/.imprint
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/files/.snow/busybox
- <Package Folder>/files/.snow/exp
- <Package Folder>/files/.snow/.dico.apk
- <Package Folder>/files/hello/hello.dex
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/files/.snow/.zip/mkdevsh
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/files/.snow/.client
- <Package Folder>/files/.snow/.catr.apk
- <Package Folder>/files/.snow/.uks
- <Package Folder>/files/.snow/.dg
- <Package Folder>/files/.snow/checkFile13
- <Package Folder>/files/dbcbd7361f0fdf0d3db91bd4710f63ca.data
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/.snow/checkFile0
- <Package Folder>/files/source.apk
- <Package Folder>/files/.snow/.ukd
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/.snow/.dlsb.apk
- <Package Folder>/files/.snow/.uok
- <Package Folder>/files/wrhlrci/libRppEcpLJpRVcTveVlala.so
- <Package Folder>/files/.snow/.dlme.apk
- <Package Folder>/files/hello.apk
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/.snow/myshell
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/files/.work/postroot.sh
- <Package Folder>/files/.default/dbcbd7361f0fdf0d3db91bd4710f63ca.data.temp
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/files/wrhlrci/libhMEnYimzyYJbxvhuzxc.so
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/.snow/.service
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/files/.snow/.zip/rsh
- <Package Folder>/databases/ua.db
- <Package Folder>/files/.snow/a.xml
- <Package Folder>/files/wrhlrci/libKueWuLGqMMnRgVVgbt.so
- <Package Folder>/files/.default/.p.apk
- <Package Folder>/files/.snow/supolicy
- <Package Folder>/files/wrhlrci/libIQPFsmOUChmkwhbDdynamicloader.so
- <Package Folder>/files/.snow/b.png
- <Package Folder>/files/.snow/.zip/r1
- <Package Folder>/files/.snow/.zip/r4
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.snow/.zip/r3
- <Package Folder>/files/.snow/.zip/r2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.snow/.center.tapk
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.snow/.zip/rt8
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- chown 0:0 /system/app/oneshs.apk
- chown 0:0 /system/bin/debuggerd
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chown 0.0 /system/bin/.author
- app_process /system/bin com.android.commands.pm.Pm disable com.num.hum.kong.ui.op.er
- chown 0:0 /system/app/Linkcai.apk
- chmod 777 <Package Folder>/files/.snow/.zip/
- app_process /system/bin com.android.commands.pm.Pm disable com.kai.kia.dou.ye.cai
- mount -o remount ro /system
- app_process /system/bin com.android.commands.pm.Pm disable com.wo.ai.girl.huy.wp
- chmod 777 <Package Folder>/files/.snow/b.png
- mount -o remount,ro /system
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- chown 0:0 /system/app/LocalFacebook.apk
- rm /system/bin/debuggerd
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- mount -ro remount ro /system
- chmod 777 <Package Folder>/files/.snow/a.xml
- /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
- chown 0:0 /data/local/tmp/busybox
- chown 0:0 /system/lib/libsoon.so
- mount -wo remount rw /system
- chmod 777 <Package Folder>/files/.snow/.ukd
- chmod 777 <Package Folder>/files/.snow/.uok
- chmod 777 <Package Folder>/files/.snow/.dg
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- chcon u:object_r:system_file:s0 /system/bin/debuggerd
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- chown 0:0 /system/xbin/.ci.pm
- chmod 777 <Package Folder>/files/.snow/.uks
- chown 0:0 /system/xbin/.cp
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chmod 777 <Package Folder>/files/.snow/supolicy
- df /system
- chown 0:0 /system/xbin/supolicy
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.work/postroot.sh
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chown 0:0 /data/local/tmp/.catr.apk
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chown 0.0 /system/app/oneshs.apk
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- app_process /system/bin com.android.commands.pm.Pm enable com.num.hum.kong.ui.op.er
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- mount -wo remount,rw /system
- chown 0.0 /system/xbin/.cp
- chmod 777 <Package Folder>/files/.snow/.client
- chmod 777 <Package Folder>/files/.snow/myshell
- chmod 777 <Package Folder>/files/.snow/exp
- chown 0:0 /system/app/RomterFacebook.apk
- mount -o remount,rw /system
- app_process /system/bin com.android.commands.pm.Pm enable com.wo.ai.girl.huy.wp
- chown 0:0 /system/app/Dingps.apk
- <error:2>
- app_process /system/bin com.android.commands.pm.Pm enable com.kai.kia.dou.ye.cai
- mount -ro remount,ro /system
- chown 0:0 /system/app/Lowerp.apk
- chown 0:0 /system/bin/.author
- sh
- chown 0.0 /system/app/Linkcai.apk
- chown 0.0 /data/local/tmp/.catr.apk
- chown 0.0 /system/xbin/.ci.pm
- chown 0:0 /system/xbin/.rainin
- chown 0.0 /system/bin/debuggerd
- chcon u:object_r:system_file:s0 /system/xbin/.cp
- /system/bin/sh ./mkdevsh
- <dexopt>
Может автоматически отправлять СМС-сообщения.
