Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.1007.origin
- Android.DownLoader.1051.origin
- Android.RemoteCode.231.origin
- Android.SmsBot.760.origin
- Android.Triada.4567
- Android.Triada.5071
- Android.Triada.510.origin
- Android.Triada.573.origin
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) api.applove####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) d.moce####.com:9091
- TCP(HTTP/1.1) hw9####.new####.com:80
- TCP(HTTP/1.1) a####.r####.com:16002
- TCP(HTTP/1.1) a####.r####.com:13002
- TCP(HTTP/1.1) d.moce####.com:80
- TCP(HTTP/1.1) gc4####.9####.com:80
- TCP(HTTP/1.1) fung####.ly####.com:80
- TCP(HTTP/1.1) log.koapk####.com:80
- TCP(HTTP/1.1) 13.2####.16.115:8081
- TCP(HTTP/1.1) dwq.fs####.com:80
- TCP(HTTP/1.1) 1####.255.240.243:80
- TCP(HTTP/1.1) 36####.ob####.com:80
- TCP(HTTP/1.1) jz####.mc####.com:12029
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) o####.cz####.com:10051
- TCP(TLS/1.0) 1####.250.179.202:443
- TCP(TLS/1.0) fd59035####.safef####.googles####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP(TLS/1.0) al####.u####.com:443
- TCP(TLS/1.0) cdn.amppro####.org:443
- TCP(TLS/1.0) d####.seven####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) bxx.pooboo####.com:443
- TCP(TLS/1.0) fo####.site:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) a####.r####.com:13003
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.2) 2####.58.214.10:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.250.179.142:443
- UDP 1####.194.160.74:443
- UDP 2####.58.214.10:443
Запросы DNS:
- 36####.ob####.com
- a####.r####.com
- a####.u####.com
- adser####.go####.com
- adser####.go####.nl
- android####.go####.com
- api.applove####.com
- bxx.pooboo####.com
- cdn.amppro####.org
- d####.dd7####.com
- d####.seven####.com
- d.moce####.com
- dwq.fs####.com
- fd59035####.safef####.googles####.com
- fo####.site
- fung####.ly####.com
- gc4####.9####.com
- googl####.g.doublec####.net
- hw9####.new####.com
- jz####.mc####.com
- log.koapk####.com
- m####.go####.com
- nu####.js####.com
- o####.cz####.com
- pag####.googles####.com
- pv.s####.com
- q####.m####.com
- securep####.g.doublec####.net
- tpc.googles####.com
- u####.u####.com
- vi####.wit####.com
- wcf.seven####.com
- www.go####.com
- z5.c####.com
- z9.c####.com
Запросы HTTP GET:
- 36####.ob####.com/modellog/OEUW24U3RE9EUTR99EURF98.cl
- api.applove####.com/api/v3/cache/get?osv=####&srnc=####&token=####&ds=##...
- api.applove####.com/api/v3/search/get?osv=####&token=####&pm=####&os=###...
- api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
- d####.dd7####.com/upload/hw/batdex20191010.jar
- d####.dd7####.com/upload/hw/c1005dex20190527.jar
- d####.dd7####.com/upload/hw/h5rq20191022.jar
- d####.dd7####.com/upload/hw/kklz02dex20200414.jar
- d####.dd7####.com/upload/hw/lsdk20200506.jar
- d####.dd7####.com/upload/hw/mf20200508.jar
- d####.dd7####.com/upload/hw/qcdex20200316.jar
- d####.dd7####.com/upload/plog/cy1028.jar
- d####.dd7####.com/upload/plog/jar20190515.jar
- d####.dd7####.com/upload/plog/jrw20210630.jar
- d####.dd7####.com/upload/plog/kk20201106.jar
- d####.dd7####.com/upload/plog/ps20210219.jar
- d####.dd7####.com/upload/plog/sdk0625.jar
- d####.dd7####.com/upload/plog/sh290_20210810.jar
- d####.dd7####.com/upload/plog/skk20210416.jar
- d####.dd7####.com/upload/plog/xianmm0512.jar
- d####.dd7####.com/upload/plog/yeah0510.jar
- dwq.fs####.com/dtbx/liangzong/hwlz06.zip
- dwq.fs####.com/dtbx/liangzong/lz04.zip
- dwq.fs####.com/dtbx/yeahmobi/unsigned.zip
- dwq.fs####.com/dtbx/yunshi/awli-release.zip
- dwq.fs####.com/plugins/applh0723.zip
- dwq.fs####.com/plugins/dp2.zip
- dwq.fs####.com/plugins/yz058Uc30i0913.zip
- fo####.site:443/ewewew/s20211101220628.1
- fung####.ly####.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-lo...
- fung####.ly####.com/lym07ly07/fonts/fontawesome-webfont.woff2?v=####
- fung####.ly####.com/lym07ly07/game/quick-elimination-of-fruit/
- fung####.ly####.com/lym07ly07/images/favicon.ico
- fung####.ly####.com/lym07ly07/images/logo/blade-cut-fruit-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/christmas-panda-parkour-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/deep-sea-gem-mining-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/double-stickman-jumping-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/little-amster-eating-menlon-se...
- fung####.ly####.com/lym07ly07/images/logo/mathematical-puzzle-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/maze-lovers-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/neon-people-running-all-the-wa...
- fung####.ly####.com/lym07ly07/images/logo/quick-elimination-of-fruit-log...
- fung####.ly####.com/lym07ly07/images/logo/quick-knife-cut-ice-cream-logo...
- fung####.ly####.com/lym07ly07/images/logo/rolling-shield-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/shuttle-between-sectet-doors-l...
- fung####.ly####.com/lym07ly07/images/logo/stickman-ultimate-duel-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/thief-parkour-logo.jpg
- fung####.ly####.com/lym07ly07/images/logo/wizard-cool-run-logo.jpg
- fung####.ly####.com/lym07ly07/images/sokiDa.jpg
- fung####.ly####.com/lym07ly07/images/top.png
- fung####.ly####.com/lym07ly07/public/bootstrap.min.css
- fung####.ly####.com/lym07ly07/public/font-awesome.min.css
- fung####.ly####.com/lym07ly07/static/jquery-1.11.2.min.js
- fung####.ly####.com/lym07ly07/static/shejiwo.js
- fung####.ly####.com/lym07ly07/static/theme.css
- gc4####.9####.com/zsyunsxda
- gc4####.9####.com/zsyunsxda/
- gd.a.s####.com:443/cityjson
- www.go####.com/pagead/drt/ui
- z.c####.com/stat.htm?id=####&cnzz_eid=####
Запросы HTTP POST:
- a####.r####.com:13002/84gcjmo/
- a####.r####.com:13002/ck0k66o/
- a####.r####.com:13002/v1jyved/
- a####.r####.com:13003/ck0k66o/
- a####.r####.com:16002/0mlo16/
- a####.r####.com:16002/h7bj93/
- al####.u####.com:443/unify_logs
- al####.u####.com:443/zcfg
- d####.seven####.com:443/FBService.svc/asdfasdfadsfas
- d####.seven####.com:443/FBService.svc/d3f23rf334f3
- d.moce####.com/wap/gateway
- d.moce####.com:9091/wap/gateway
- def####.cn.zb.####.com:443/api/postZdata
- def####.cn.zb.####.com:443/api/updateZdata
- hw9####.new####.com/api/activite
- hw9####.new####.com/api/offer
- hw9####.new####.com/api/tbdynamic
- hw9####.new####.com/apidata/showeb
- jz####.mc####.com:12029/hfdlls/
- jz####.mc####.com:12029/i3v8nb/
- jz####.mc####.com:12029/lfkdnr/
- log.koapk####.com/pgm/sr/gm/gy
- o####.cz####.com:10051/getjar/
- o####.cz####.com:10051/getsol/
- o####.cz####.com:10051/repjar/
