Техническая информация
Вредоносные функции:
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) www.irturp####.com:80
- TCP(HTTP/1.1) and####.cli####.go####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(TLS/1.0) and####.cli####.go####.com:443
Запросы DNS:
- a####.google####.com
- and####.cli####.go####.com
- f####.google####.com
- m####.go####.com
- trans####.go####.com
- www.irturp####.com
Запросы HTTP GET:
- a####.google####.com/ajax/libs/jquery/1.9.1/jquery.min.js
- and####.cli####.go####.com/maps/api/js?sensor=####
- and####.cli####.go####.com/translate_a/element.js?cb=####
- f####.google####.com/css?family=####&subset=####
- www.irturp####.com/
- www.irturp####.com/index.php
- www.irturp####.com/wp-content/plugins/google-language-translator/css/sty...
- www.irturp####.com/wp-content/plugins/google-language-translator/css/too...
- www.irturp####.com/wp-content/plugins/google-language-translator/js/scri...
- www.irturp####.com/wp-content/plugins/parsi-font/assets/css/fonts.css
- www.irturp####.com/wp-content/plugins/responsive-lightbox-lite/assets/in...
- www.irturp####.com/wp-content/plugins/responsive-lightbox-lite/assets/ni...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/box-bg.jpg?136647####
- www.irturp####.com/wp-content/themes/IRTURPAN/images/dummy/brands/brands...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/dummy/cart-items/ca...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/dummy/slides/3/slid...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/dummy/slides/4/slid...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/jagged-border-bot.p...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/jagged-border-top.p...
- www.irturp####.com/wp-content/themes/IRTURPAN/images/logo.gif
- www.irturp####.com/wp-content/themes/IRTURPAN/js/bootstrap-tour/build/js...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/bootstrap.min.js
- www.irturp####.com/wp-content/themes/IRTURPAN/js/custom.js
- www.irturp####.com/wp-content/themes/IRTURPAN/js/goMap/js/jquery.gomap-1...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/isotope/jquery.isotope....
- www.irturp####.com/wp-content/themes/IRTURPAN/js/jquery-ui-1.10.3/css/sm...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/jquery-ui-1.10.3/js/jqu...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/jquery-ui-1.10.3/touch-...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/jquery.carouFredSel-6.2...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/modernizr.custom.56918.js
- www.irturp####.com/wp-content/themes/IRTURPAN/js/prettyphoto/css/prettyP...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/prettyphoto/js/jquery.p...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/rs-plugin/assets/timer....
- www.irturp####.com/wp-content/themes/IRTURPAN/js/rs-plugin/css/settings....
- www.irturp####.com/wp-content/themes/IRTURPAN/js/rs-plugin/js/jquery.the...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/rs-plugin/pluginsources...
- www.irturp####.com/wp-content/themes/IRTURPAN/js/underscore/underscore-m...
- www.irturp####.com/wp-content/themes/IRTURPAN/stylesheets/bootstrap.css
- www.irturp####.com/wp-content/themes/IRTURPAN/stylesheets/main.css
- www.irturp####.com/wp-content/themes/IRTURPAN/stylesheets/responsive.css
- www.irturp####.com/wp-content/uploads/2017/11/Panel-Radiator-color-irtur...
- www.irturp####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- www.irturp####.com/wp-includes/js/jquery/jquery.js?ver=####
- www.irturp####.com/wp-includes/js/wp-embed.min.js?ver=####
- www.irturp####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Отрисовывает собственные окна поверх других приложений.
