Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1867.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m####.ads####.com:80
- TCP(HTTP/1.1) m.p####.com:80
- TCP(HTTP/1.1) m####.a####.com:80
- TCP(HTTP/1.1) trietha####.com:80
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) a28bd06####.pro####.y####.####.net:80
- TCP(HTTP/1.1) i####.zog.link:80
- TCP(HTTP/1.1) 1####.241.191.139:80
- TCP(HTTP/1.1) clk.apxadtr####.net:80
- TCP(HTTP/1.1) www.u####.com:80
- TCP(HTTP/1.1) cloudfr####.amazo####.com:80
- TCP(HTTP/1.1) syndica####.exoc####.com:80
- TCP(HTTP/1.1) p####.com:80
- TCP(HTTP/1.1) www.smarta####.com:80
- TCP(HTTP/1.1) in.tubecor####.com:80
- TCP(HTTP/1.1) syndica####.ex####.com:80
- TCP(HTTP/1.1) st.tubecor####.com:80
- TCP(HTTP/1.1) b.z####.link:80
- TCP(HTTP/1.1) gl####.top####.com:9090
- TCP(HTTP/1.1) st####.ex####.com:80
- TCP(HTTP/1.1) sc####.ban####.com:80
- TCP(HTTP/1.1) www.u####.com:7079
- TCP(TLS/1.0) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.0) st####.ex####.com:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) mc.ya####.ru:443
Запросы DNS:
- a28bd06####.pro####.y####.####.net
- ads.ex####.com
- b.z####.link
- clk.apxadtr####.net
- cloudfr####.amazo####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- gl####.top####.com
- i####.zog.link
- in.tubecor####.com
- m####.a####.com
- m####.ads####.com
- m.p####.com
- mc.ya####.ru
- p####.com
- poli####.com
- sc####.ban####.com
- st####.ex####.com
- st.tubecor####.com
- syndica####.ex####.com
- syndica####.exoc####.com
- t####.bruce####.com
- t####.bruce####.com
- www.google-####.com
- www.smarta####.com
- www.u####.com
Запросы HTTP GET:
- b.z####.link/a/555exo.html?idzone=####&w=####&h=####&ad_sub=####&ad_tags...
- cloudfr####.amazo####.com/x.png
- in.tubecor####.com/in/tcc/?promo=####&mc=####&dc=####&tc=####&subid=####
- m####.a####.com/redirect/index?type=####&to=aHR0####&data=####&action=####
- p####.com/?source=####&promo=####&subid=####
- p####.com/mt/AB/1482176.jpg
- p####.com/mt/Ak/598374.jpg
- p####.com/mt/Av/1170954.jpg
- p####.com/mt/Aw/1222963.jpg
- p####.com/mt/BE/1639129.jpg
- p####.com/mt/Bu/1119810.jpg
- p####.com/mt/By/1327282.jpg
- p####.com/mt/CA/1432656.jpg
- p####.com/mt/CB/1484388.jpg
- p####.com/mt/CE/1640400.jpg
- p####.com/mt/CS/2368927.jpg
- p####.com/mt/Cr/964752.jpg
- p####.com/mt/Cy/1328305.jpg
- p####.com/mt/Cz/1380674.jpg
- p####.com/mt/DD/1589591.jpg
- p####.com/mt/Di/497270.jpg
- p####.com/mt/Dm/705934.jpg
- p####.com/mt/Dn/757910.jpg
- p####.com/mt/Ei/498651.jpg
- p####.com/mt/Eu/1122392.jpg
- p####.com/mt/Ex/1278167.jpg
- p####.com/mt/Fq/915287.jpg
- p####.com/mt/Fz/1383245.jpg
- p####.com/mt/GB/1488838.jpg
- p####.com/mt/GC/1540639.jpg
- p####.com/mt/Gw/1228571.jpg
- p####.com/mt/Gx/1280246.jpg
- p####.com/mt/HA/1437478.jpg
- p####.com/mt/HD/1593822.jpg
- p####.com/mt/HI/1853601.jpg
- p####.com/mt/Hv/1177400.jpg
- p####.com/mt/ID/1594603.jpg
- p####.com/mt/IE/1646218.jpg
- p####.com/mt/Ii/502682.jpg
- p####.com/mt/Jx/1283378.jpg
- p####.com/mt/Jy/1335925.jpg
- p####.com/mt/KA/1440998.jpg
- p####.com/mt/KN/2116814.jpg
- p####.com/mt/Kl/660168.jpg
- p####.com/mt/Kx/1284269.jpg
- p####.com/mt/Ky/1336447.jpg
- p####.com/mt/LS/2377785.jpg
- p####.com/mt/MU/2482908.jpg
- p####.com/mt/NE/1651954.jpg
- p####.com/mt/NS/2379199.jpg
- p####.com/mt/Nr/975287.jpg
- p####.com/mt/Nz/1391191.jpg
- p####.com/mt/OU/2484724.jpg
- p####.com/mt/Ow/1236986.jpg
- p####.com/mt/Oy/1340656.jpg
- p####.com/mt/P0/2797578.jpg
- p####.com/mt/Pt/1081181.jpg
- p####.com/mt/Py/1341494.jpg
- p####.com/mt/QE/1654768.jpg
- p####.com/mt/Qw/1238840.jpg
- p####.com/mt/RB/1499685.jpg
- p####.com/mt/Ri/511007.jpg
- p####.com/mt/Ry/1343073.jpg
- p####.com/mt/SE/1656213.jpg
- p####.com/mt/Tr/981755.jpg
- p####.com/mt/UB/1502237.jpg
- p####.com/mt/UD/1606783.jpg
- p####.com/mt/Uk/618708.jpg
- p####.com/mt/VA/1451662.jpg
- p####.com/mt/VB/1503831.jpg
- p####.com/mt/VC/1555633.jpg
- p####.com/mt/WB/1504743.jpg
- p####.com/mt/XC/1557194.jpg
- p####.com/mt/Xi/517964.jpg
- p####.com/mt/Xx/1297369.jpg
- p####.com/mt/Xz/1401824.jpg
- p####.com/mt/YB/1506715.jpg
- p####.com/mt/Yr/986476.jpg
- p####.com/mt/Ys/1038692.jpg
- p####.com/mt/Yx/1298250.jpg
- p####.com/mt/Zv/1195867.jpg
- p####.com/mt/Zy/1351838.jpg
- p####.com/mt/Zz/1403217.jpg
- p####.com/mt/aM/2028814.jpg
- p####.com/mt/ay/1300401.jpg
- p####.com/mt/c1/2810422.jpg
- p####.com/mt/cy/1302243.jpg
- p####.com/mt/dD/1563121.jpg
- p####.com/mt/dz/1355463.jpg
- p####.com/mt/eD/1564892.jpg
- p####.com/mt/fG/1721454.jpg
- p####.com/mt/gD/1566408.jpg
- p####.com/mt/gq/890583.jpg
- p####.com/mt/hB/1463973.jpg
- p####.com/mt/hT/2399353.jpg
- p####.com/mt/hv/1151529.jpg
- p####.com/mt/hv/1151873.jpg
- p####.com/mt/il/632985.jpg
- p####.com/mt/iw/1204063.jpg
- p####.com/mt/jE/1621933.jpg
- p####.com/mt/kx/1258897.jpg
- p####.com/mt/lD/1571565.jpg
- p####.com/mt/lt/1051025.jpg
- p####.com/mt/lx/1259615.jpg
- p####.com/mt/mB/1468728.jpg
- p####.com/mt/n1/2821703.jpg
- p####.com/mt/nC/1521921.jpg
- p####.com/mt/nD/1573194.jpg
- p####.com/mt/nn/741601.jpg
- p####.com/mt/ny/1313275.jpg
- p####.com/mt/ny/1313411.jpg
- p####.com/mt/o1/2822074.jpg
- p####.com/mt/oC/1522519.jpg
- p####.com/mt/oD/1574431.jpg
- p####.com/mt/oL/1990688.jpg
- p####.com/mt/ox/1262685.jpg
- p####.com/mt/pl/639600.jpg
- p####.com/mt/pt/1055356.jpg
- p####.com/mt/pz/1367705.jpg
- p####.com/mt/qE/1628586.jpg
- p####.com/mt/qp/848440.jpg
- p####.com/mt/qw/1212973.jpg
- p####.com/mt/qx/1264077.jpg
- p####.com/mt/qz/1368839.jpg
- p####.com/mt/rC/1525553.jpg
- p####.com/mt/rk/589212.jpg
- p####.com/mt/rw/1213505.jpg
- p####.com/mt/rw/1213659.jpg
- p####.com/mt/ry/1317032.jpg
- p####.com/mt/so/798391.jpg
- p####.com/mt/ss/1006549.jpg
- p####.com/mt/tZ/2723736.jpg
- p####.com/mt/ti/487617.jpg
- p####.com/mt/ti/487992.jpg
- p####.com/mt/tw/1215750.jpg
- p####.com/mt/uC/1528087.jpg
- p####.com/mt/ui/488049.jpg
- p####.com/mt/uv/1164245.jpg
- p####.com/mt/vA/1425739.jpg
- p####.com/mt/vr/957995.jpg
- p####.com/mt/vx/1269539.jpg
- p####.com/mt/wB/1478504.jpg
- p####.com/mt/wE/1634790.jpg
- p####.com/mt/wi/490337.jpg
- p####.com/mt/wi/490980.jpg
- p####.com/mt/wv/1166811.jpg
- p####.com/mt/wx/1270729.jpg
- p####.com/mt/wz/1374114.jpg
- p####.com/mt/xE/1635439.jpg
- p####.com/mt/xi/491771.jpg
- p####.com/mt/xx/1271292.jpg
- p####.com/mt/xz/1375874.jpg
- p####.com/mt/yA/1428060.jpg
- p####.com/mt/yD/1584056.jpg
- p####.com/mt/yn/752178.jpg
- p####.com/mt/yw/1220118.jpg
- p####.com/mt/zA/1429007.jpg
- p####.com/mt/zC/1533209.jpg
- p####.com/mt/zv/1169910.jpg
- p####.com/mt/zx/1273187.jpg
- p####.com/mt/zz/1377744.jpg
- st.tubecor####.com/in?site=####&source=####&client=####&subid=####&promo...
- syndica####.ex####.com/ads-iframe-display.php?idzone=####&type=####&p=##...
- t####.bruce####.com/ck_jump?id=cz0zMDc5ODU3NTM2OTE0ODIxJnQ9MTUwOTYyOTYyM...
- trietha####.com/15w53/sV8D/v1sT/5xdG-DPFvAatKmbUd_PHzb8VOIg6QZZg5ZN2_yAb...
- www.smarta####.com/158rg203/f230/1aa0/20b1/3fa0/409a/5644230869385216/WW...
- www.u####.com/ru/findbutton0718.js
- www.u####.com/ru/processurl0718.js
- www.u####.com/ru/simulationClickYes0718.js
Запросы HTTP POST:
- www.u####.com:7079/jsdk/sd.action?b=####
- www.u####.com:7079/jsdk/sd.action?b=####&ca=####&ica=####&re=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_jgu/<Package>.jar
- <Package Folder>/app_jgu/ui.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/f_000047
- <Package Folder>/cache/####/f_000048
- <Package Folder>/cache/####/f_000049
- <Package Folder>/cache/####/f_00004a
- <Package Folder>/cache/####/f_00004b
- <Package Folder>/cache/####/f_00004c
- <Package Folder>/cache/####/f_00004d
- <Package Folder>/cache/####/f_00004e
- <Package Folder>/cache/####/f_00004f
- <Package Folder>/cache/####/f_000050
- <Package Folder>/cache/####/f_000051
- <Package Folder>/cache/####/f_000052
- <Package Folder>/cache/####/f_000053
- <Package Folder>/cache/####/f_000054
- <Package Folder>/cache/####/f_000055
- <Package Folder>/cache/####/f_000056
- <Package Folder>/cache/####/f_000057
- <Package Folder>/cache/####/f_000058
- <Package Folder>/cache/####/f_000059
- <Package Folder>/cache/####/f_00005a
- <Package Folder>/cache/####/f_00005b
- <Package Folder>/cache/####/f_00005c
- <Package Folder>/cache/####/f_00005d
- <Package Folder>/cache/####/f_00005e
- <Package Folder>/cache/####/f_00005f
- <Package Folder>/cache/####/f_000060
- <Package Folder>/cache/####/f_000061
- <Package Folder>/cache/####/f_000062
- <Package Folder>/cache/####/f_000063
- <Package Folder>/cache/####/f_000064
- <Package Folder>/cache/####/f_000065
- <Package Folder>/cache/####/f_000066
- <Package Folder>/cache/####/f_000067
- <Package Folder>/cache/####/f_000068
- <Package Folder>/cache/####/f_000069
- <Package Folder>/cache/####/f_00006a
- <Package Folder>/cache/####/f_00006b
- <Package Folder>/cache/####/f_00006c
- <Package Folder>/cache/####/f_00006d
- <Package Folder>/cache/####/f_00006e
- <Package Folder>/cache/####/f_00006f
- <Package Folder>/cache/####/f_000070
- <Package Folder>/cache/####/f_000071
- <Package Folder>/cache/####/f_000072
- <Package Folder>/cache/####/f_000073
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/tip.xml
- <SD-Card>/commonsdk/findbutton0718.js
- <SD-Card>/commonsdk/processurl0718.js
- <SD-Card>/commonsdk/simulationClickYes0718.js
Другие:
Загружает динамические библиотеки:
- qbkh
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
