Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.BankBot.372.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Перехватывает входящие смс и прекращает процесс их передачи обработчикам других приложений.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p####.vanc####.com:80
- TCP(HTTP/1.1) c####.vanc####.com:80
- TCP(HTTP/1.1) m.v####.com:80
- TCP(HTTP/1.1) i7.m.v####.####.com:80
- TCP(HTTP/1.1) sagawa-####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) q.v####.com:80
- TCP(HTTP/1.1) www.v####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) v####.v####.com:80
- TCP(HTTP/1.1) www.sagawa####.co.jp:80
- TCP(HTTP/1.1) i4.vanc####.com.####.com:80
- TCP(TLS/1.0) i7.m.v####.####.com:443
- TCP(TLS/1.0) mi5.vanc####.com.####.com:443
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
Запросы DNS:
- api.s####.b####.com
- c####.vanc####.com
- c####.vanc####.com
- i####.51.la
- i.vanc####.com
- i1.vanc####.com
- i10.m.v####.com
- i2.m.v####.com
- i2.vanc####.com
- i3.m.v####.com
- i3.vanc####.com
- i4.m.v####.com
- i4.vanc####.com
- i5.m.v####.com
- i5.vanc####.com
- i6.m.v####.com
- i7.m.v####.com
- i8.m.v####.com
- js.u####.51.la
- jsx.vanc####.com
- jsy.vanc####.com
- m.v####.com
- mi.vanc####.com
- mi1.vanc####.com
- mi2.vanc####.com
- mi5.vanc####.com
- mim####.v####.com
- p####.vanc####.com
- p####.zhanz####.b####.com
- q.v####.com
- s####.g.doublec####.net
- sagawa-####.com
- v####.v####.com
- www.google-####.com
- www.sagawa####.co.jp
- www.v####.com
Запросы HTTP GET:
- c####.vanc####.com/404/404.css?2012####
- c####.vanc####.com/css.ashx?href=####&v=####&comp####
- c####.vanc####.com/js.ashx?href=####&comp####
- c####.vanc####.com/js.ashx?href=####&v=####&comp####
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/6/6364205/mid/6364205-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/6/6364213/mid/6364213-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373596/mid/6373596-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373597/mid/6373597-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373598/mid/6373598-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373619/mid/6373619-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373620/mid/6373620-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373622/mid/6373622-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373624/mid/6373624-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6373887/mid/6373887-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6374840/mid/6374840-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6374843/mid/6374843-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6375454/mid/6375454-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6375481/mid/6375481-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6375774/mid/6375774-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6378269/mid/6378269-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6378484/mid/6378484-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6378509/mid/6378509-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6378511/mid/6378511-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379233/mid/6379233-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379298/mid/6379298-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379451/mid/6379451-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379452/mid/6379452-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379453/mid/6379453-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379454/mid/6379454-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379455/mid/6379455-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379474/mid/6379474-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379475/mid/6379475-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379479/mid/6379479-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379481/mid/6379481-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379485/mid/6379485-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379488/mid/6379488-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379489/mid/6379489-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379500/mid/6379500-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379501/mid/6379501-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379509/mid/6379509-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379516/mid/6379516-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379519/mid/6379519-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379520/mid/6379520-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379521/mid/6379521-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379523/mid/6379523-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379528/mid/6379528-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379603/mid/6379603-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379604/mid/6379604-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379607/mid/6379607-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379638/mid/6379638-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379641/mid/6379641-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379841/mid/6379841-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379843/mid/6379843-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379865/mid/6379865-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/7/6379869/mid/6379869-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380068/mid/6380068-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380088/mid/6380088-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380100/mid/6380100-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380113/mid/6380113-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380189/mid/6380189-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380197/mid/6380197-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380241/mid/6380241-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380245/mid/6380245-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380256/mid/6380256-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380281/mid/6380281-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380338/mid/6380338-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380351/mid/6380351-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380394/mid/6380394-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380425/mid/6380425-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380467/mid/6380467-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380794/mid/6380794-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380799/mid/6380799-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380845/mid/6380845-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380863/mid/6380863-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380866/mid/6380866-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380886/mid/6380886-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6380889/mid/6380889-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381262/mid/6381262-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381370/mid/6381370-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381374/mid/6381374-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381376/mid/6381376-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381378/mid/6381378-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381380/mid/6381380-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381390/mid/6381390-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381396/mid/6381396-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381407/mid/6381407-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381409/mid/6381409-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381410/mid/6381410-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381411/mid/6381411-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381412/mid/6381412-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381414/mid/6381414-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381417/mid/6381417-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381418/mid/6381418-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381424/mid/6381424-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381435/mid/6381435-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381502/mid/6381502-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381529/mid/6381529-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6381765/mid/6381765-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382075/mid/6382075-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382093/mid/6382093-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382102/mid/6382102-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382110/mid/6382110-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382292/mid/6382292-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382297/mid/6382297-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382348/mid/6382348-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382432/mid/6382432-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382439/mid/6382439-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382479/mid/6382479-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382507/mid/6382507-1...
- i4.vanc####.com.####.com/276/356/q80/product/6/3/8/6382627/mid/6382627-1...
- i4.vanc####.com.####.com/404/404_bg.jpg
- i4.vanc####.com.####.com/cms/20140116/spritesbgtop.png
- i4.vanc####.com.####.com/cms/20140414/vanclsprite.png
- i4.vanc####.com.####.com/cms/20150228/vanclsprite.png
- i4.vanc####.com.####.com/cms/20150605/w1.jpg
- i4.vanc####.com.####.com/cms/20150605/w2.jpg
- i4.vanc####.com.####.com/cms/20160802/onlinecustomer.png
- i4.vanc####.com.####.com/cms/20160802/seven.png
- i4.vanc####.com.####.com/cms/20160912/notice.png
- i4.vanc####.com.####.com/cms/20160923/logo18546.png
- i4.vanc####.com.####.com/cms/20170308/new_0308.png
- i4.vanc####.com.####.com/cms/20170329/icon_hot.png
- i4.vanc####.com.####.com/header/20130116/weixin.png
- i4.vanc####.com.####.com/other/kexin_brand_for_others.png
- i7.m.v####.####.com/Content/H5/img/search2.png
- i7.m.v####.####.com/oms/2014_8_29_16_39_33_7709.jpg
- i7.m.v####.####.com/oms/2018_7_26_14_37_13_4000_59x56.jpg
- i7.m.v####.####.com/oms/2018_7_9_14_59_50_8699_678x60.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_4_5849_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_4_6373_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_4_7943_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_4_8848_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_5_2229_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_10_16_33_5_800_750x396.jpg
- i7.m.v####.####.com/oms/2018_8_11_22_49_12_2583_59x56.jpg
- i7.m.v####.####.com/wap/2018_8_11_23_17_52_5925_640x402.jpg
- i7.m.v####.####.com/wap/2018_8_11_23_18_21_2966_640x402.jpg
- i7.m.v####.####.com/wap/2018_8_11_23_18_29_3019_640x402.jpg
- i7.m.v####.####.com/wap/2018_8_11_23_18_38_4599_640x402.jpg
- i7.m.v####.####.com/wap/2018_8_11_23_18_7_3000_640x402.jpg
- js.u####.51.la/19547835.js
- m.v####.com/
- m.v####.com/Content/H5/img/loading-slide.jpg
- p####.vanc####.com/error/404.aspx
- q.v####.com/group/52814784
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?l=####
- sagawa-####.com/
- sagawa-####.com/common/img/btn_pagetop01.png
- sagawa-####.com/css/demos.css
- sagawa-####.com/css/jquery-weui.css
- sagawa-####.com/css/phone.css
- sagawa-####.com/css/weui.min.css
- sagawa-####.com/help/
- sagawa-####.com/help/css/404.css
- sagawa-####.com/help/index.html
- sagawa-####.com/infl/jquery-1.9.1.min.js
- sagawa-####.com/infl/jquery.cookie.js
- sagawa-####.com/pp.html
- sagawa-####.com/sagawa_xml/information/top.xml?_=####
- sagawa-####.com/sagawa_xml/newsrelease/top.xml?_=####
- sagawa-####.com/sagawa_xml/notice/top.xml?_=####
- sagawa-####.com/sagawa_xml/whatsnew/top.xml?_=####
- v####.v####.com/wapvisit.ashx?version=####&requestid=####&parentrequesti...
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.sagawa####.co.jp/common/css/cmn_layout.css
- www.sagawa####.co.jp/common/css/cmn_module.css
- www.sagawa####.co.jp/common/css/cmn_style.css
- www.sagawa####.co.jp/common/css/plugins/magnific-popup.css
- www.sagawa####.co.jp/common/css/reset.css
- www.sagawa####.co.jp/common/img/btn_search.png
- www.sagawa####.co.jp/common/img/ico_blank01.png
- www.sagawa####.co.jp/common/img/ico_home01.png
- www.sagawa####.co.jp/common/img/ico_topicpath01.gif
- www.sagawa####.co.jp/common/img/logo_sagawa.png
- www.sagawa####.co.jp/common/img/logo_sgh.png
- www.sagawa####.co.jp/common/js/common.js
- www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.css
- www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.min.js
- www.sagawa####.co.jp/common/js/lib/jquery.ah-placeholder.js
- www.sagawa####.co.jp/common/js/lib/jquery.imagesloaded.js
- www.sagawa####.co.jp/common/js/lib/jquery.js
- www.sagawa####.co.jp/common/js/lib/plugins.js
- www.sagawa####.co.jp/common/js/universalanalytics.js
- www.sagawa####.co.jp/css/style.css
- www.sagawa####.co.jp/img/mv/ja/box_cm.png
- www.sagawa####.co.jp/img/mv/ja/box_goal.png
- www.sagawa####.co.jp/img/mv/ja/mv_bg.jpg
- www.sagawa####.co.jp/img/mv/ja/mv_txt2017a.png
- www.sagawa####.co.jp/img/mv/ja/mv_txt2017b.png
- www.sagawa####.co.jp/img/mv/mv_bg2017b_tablet.png
- www.sagawa####.co.jp/js/AppSelection.js
- www.sagawa####.co.jp/js/news.js
- www.sagawa####.co.jp/js/placeHolderSetting.js
- www.sagawa####.co.jp/js/top.js
- www.sagawa####.co.jp/js/topBranchSearch.js
- www.sagawa####.co.jp/js/track.js
- www.v####.com/
- www.v####.com/group/52814784
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/f_000043
- /data/data/####/f_000044
- /data/data/####/f_000045
- /data/data/####/f_000046
- /data/data/####/f_000047
- /data/data/####/f_000048
- /data/data/####/f_000049
- /data/data/####/f_00004a
- /data/data/####/f_00004b
- /data/data/####/f_00004c
- /data/data/####/f_00004d
- /data/data/####/f_00004e
- /data/data/####/f_00004f
- /data/data/####/f_000050
- /data/data/####/index
- /data/data/####/mybank.xml
- /data/data/####/mycode.jar
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Загружает динамические библиотеки:
- kao
Использует следующие алгоритмы для расшифровки данных:
- AES
- DES
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
Осуществляет доступ к информации об отправленых/принятых смс.
