Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- +447388454813: mobzi
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) x####.mo####.com:80
- TCP(HTTP/1.1) cdn-l####.nl.sto####.####.com:80
- TCP(HTTP/1.1) mobigo-####.api.membe####.com:80
- TCP(HTTP/1.1) ma####.bootstr####.com:80
- TCP(HTTP/1.1) cdn-s####.nl.sto####.####.com:80
- TCP(TLS/1.0) www.go####.com:443
Запросы DNS:
- cdn-l####.nl.sto####.####.com
- cdn-s####.nl.sto####.####.com
- cy.mo####.com
- ma####.bootstr####.com
- mobigo-####.api.membe####.com
- mt####.go####.com
- www.go####.com
- x####.mo####.com
Запросы HTTP GET:
- cdn-l####.nl.sto####.####.com/5954196/video/Exotic_brunette_with_big_tit...
- cdn-l####.nl.sto####.####.com/5954202/video/Busty_babe_poses_by_the_pool...
- cdn-s####.nl.sto####.####.com/5954162/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954162/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954182/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954182/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954188/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954188/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954190/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954192/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954196/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954196/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954198/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954198/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954202/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954202/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954208/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954212/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954214/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954220/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954226/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954228/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954228/thumb/baseline/4/w220i
- cdn-s####.nl.sto####.####.com/5954230/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954232/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954234/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954236/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954238/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954244/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954246/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954252/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954254/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954256/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954258/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954260/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954264/thumb/baseline/1/w120i
- cdn-s####.nl.sto####.####.com/5954266/thumb/baseline/1/w120i
- ma####.bootstr####.com/font-awesome/4.4.0/css/font-awesome.min.css
- mobigo-####.api.membe####.com/api/download/5954196/format/ipod.mp4&till=...
- mobigo-####.api.membe####.com/api/download/5954202/format/ipod.mp4&till=...
- x####.mo####.com/?che=####
- x####.mo####.com/?che=####&cateID=####&page=####
- x####.mo####.com/?che=####&contId=####&page=####&cateID=####
- x####.mo####.com/images/cyTopAdult2.jpg
- x####.mo####.com/images/termscy.png
- x####.mo####.com/wapstyleadult.css
Запросы HTTP POST:
- x####.mo####.com/_revot/sms.php
- x####.mo####.com/_revot/stats.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
Другие:
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
