Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.k####.info:80
- TCP(HTTP/1.1) usenetj####.com:80
- TCP(HTTP/1.1) r.se####.y####.com:80
- TCP(HTTP/1.1) api-bin####.e-####.e-ms####.net:80
- TCP(HTTP/1.1) www.e####.nl:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) s.joym####.mobi:80
- TCP(HTTP/1.1) usenetv####.nl:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(SSL/3.0) www.e####.nl:443
- TCP(TLS/1.0) c####.fl####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) s.y####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) nl.se####.y####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) im####.se####.y####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) tse2-mm####.a-####.a-ms####.net:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) usenetj####.com:443
- TCP(TLS/1.0) cdn.amppro####.org:443
- TCP(TLS/1.0) www.e####.nl:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) tr####.mobitec####.xyz:443
Запросы DNS:
- a####.u####.com
- adser####.go####.com
- adser####.go####.nl
- api.b####.com
- api.k####.info
- c####.fl####.com
- cdn.amppro####.org
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- im####.se####.y####.com
- nl.se####.y####.com
- pag####.googles####.com
- r.se####.y####.com
- s.joym####.mobi
- s.y####.com
- t####.mm.b####.net
- t####.mm.b####.net
- t####.mm.b####.net
- t####.mm.b####.net
- tpc.googles####.com
- tr####.mobitec####.xyz
- usenetj####.com
- usenetv####.nl
- v####.se####.y####.com
- www.e####.nl
- www.go####.com
- www.google-####.com
- www.usenetj####.com
Запросы HTTP GET:
- api-bin####.e-####.e-ms####.net/osjson.aspx?query=####
- api.k####.info/v6/index.php?action=####&android=####&app_id=####&app_ver...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20171129/r20170110/show_ads_impl.js
- r.se####.y####.com/_ylt=AwrIQg1zyiVahWYARvfk0Cc5;_ylu=X3oDMTBzaG11ZjR2BH...
- s.joym####.mobi/?c=####&o=####&q=####
- usenetj####.com/accounts/default1/banners/260bef5f.gif
- usenetv####.nl/eweka/
- usenetv####.nl/go/eweka/
- usenetv####.nl/nieuw/wp-content/uploads/2013/04/check.png
- usenetv####.nl/wp-content/plugins/contact-form-7/includes/css/styles.css...
- usenetv####.nl/wp-content/plugins/contact-form-7/includes/js/jquery.form...
- usenetv####.nl/wp-content/plugins/contact-form-7/includes/js/scripts.js?...
- usenetv####.nl/wp-content/plugins/tablepress/css/default.min.css?ver=####
- usenetv####.nl/wp-content/plugins/tablepress/js/jquery.datatables.min.js...
- usenetv####.nl/wp-content/plugins/wp-customer-reviews/newstars.png
- usenetv####.nl/wp-content/plugins/wp-customer-reviews/wp-customer-review...
- usenetv####.nl/wp-content/themes/usenet/images/bg-main.png
- usenetv####.nl/wp-content/themes/usenet/images/buttons.png
- usenetv####.nl/wp-content/themes/usenet/images/commentformtextareabg.png
- usenetv####.nl/wp-content/themes/usenet/images/newsletterbutton.png
- usenetv####.nl/wp-content/themes/usenet/images/newsletterinputbg.png
- usenetv####.nl/wp-content/themes/usenet/images/quote.png
- usenetv####.nl/wp-content/themes/usenet/images/usenet-vergelijken.png
- usenetv####.nl/wp-content/themes/usenet/master.css
- usenetv####.nl/wp-content/themes/usenet/screen.css
- usenetv####.nl/wp-content/themes/usenet/scripts/custom.js
- usenetv####.nl/wp-content/themes/usenet/scripts/featuredcontentglider.js
- usenetv####.nl/wp-content/themes/usenet/scripts/jquery.js
- usenetv####.nl/wp-content/themes/usenet/style.css
- usenetv####.nl/wp-content/uploads/2013/04/usenet-betaalmethoden.jpg
- usenetv####.nl/wp-includes/js/comment-reply.min.js?ver=####
- usenetv####.nl/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- usenetv####.nl/wp-includes/js/jquery/jquery.js?ver=####
- www.e####.nl/?a_aid=####&a_bid=####
- www.google-####.com/ga.js
- www.google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=###...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/index
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/ur.so
- <Package Folder>/files/1.jar
- <Package Folder>/files/2.jar
- <Package Folder>/files/3.jar
- <Package Folder>/files/dataauygktb
- <Package Folder>/files/dog_x86
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/pref_landlord.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/cuteword
Другие:
Запускает следующие shell-скрипты:
- /system/bin/netcfg
- <Package Folder>/files/dog_x86 -ps <Package>/com.kai.ning.WorkerService -s com.kai.ning:worker_service
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.kai.ning.WorkerService
- chmod 755 <Package Folder>/files/dog_x86
Загружает динамические библиотеки:
- menglei
- ur
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
