Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.481.origin
Сетевая активность:
Подключается к:
- s####.####.com
- imgc####.####.com
- s####.####.cn
- 2####.####.46
- m####.####.com
- i####.####.cn
- a####.####.com
- qzones####.####.cn
Запросы HTTP GET:
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- 2####.####.46/img.ninebox.cn/dat/c/1.0.9/10.dat?wsiphost=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- i####.####.cn/dat/p/2.1.3/11.dat
- m####.####.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datatype=####&posid=####&adposcount=####&ext=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_btn_black.png
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/release/plugin.dex-482.jar
- i####.####.cn/cdn.cooguo.com/download/mediapic/ui_1.0.8.tar.gz?wsiphost=####
- 2####.####.46/img.ninebox.cn/dat/p/2.1.3/11.dat?wsiphost=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20160830/banner.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appcache
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-open.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_btn.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_car_bg.jpg
- 2####.####.46/download/jarFile/SDKAutoUpdate/for_dex36.19.tar.gz
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_black.gif
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20160830/interstitial.js
- 2####.####.46/download/mediapic/ui_1.0.8.tar.gz
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- i####.####.cn/dat/c/1.0.9/10.dat
- i####.####.cn/dat/b/1.0.5/12.dat
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon.gif
Запросы HTTP POST:
- s####.####.cn/admin/bcp.action?requestId=####
- s####.####.cn/admin/sc.action?requestId=####
- m####.####.com/cooguogw/media.action
- m####.####.com/cooguogw/interface.action?advertModule=####
- s####.####.cn/admin/nbad.action
- a####.####.com/veegao/niris.action?requestId=####
- m####.####.com/cooguogw/iris.action?g=####
- s####.####.com/activate?queueSize=####
- a####.####.com/veegao/ncp.action?requestId=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/ki.xml
- /sdcard/Download/mediaAd/clst.dat
- /sdcard/Download/upgrade/jar_dex2.2.8/test.jar
- /data/data/####/shared_prefs/mid.xml
- /data/data/####/databases/GDTSDK.db
- /data/data/####/databases/boxcpdownloads
- /data/data/####/cache/webviewCacheChromium/data_3
- /sdcard/Download/mediaAd/ui/ui_1.0.8/close.dat
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Download/9j/cp/1.0.3/10.dat
- /data/data/####/shared_prefs/toggle_flag_pref.xml
- /data/data/####/databases/GDTSDK.db-journal
- /sdcard/Download/cp/time.dat
- /data/data/####/shared_prefs/xy.xml
- /sdcard/Download/9j/names.dat
- /sdcard/Android/data/code/KI.DAT
- /data/data/####/shared_prefs/rp.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####.a.xml
- /sdcard/Download/mediaAd/ui/ui_1.0.8.tar.gz
- /sdcard/Download/vgp/clearT.dat
- /data/data/####/shared_prefs/running_app_name.xml
- /sdcard/Download/upgrade/jar_dex.tar.gz
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/Download/ads/clst.dat
- /sdcard/Download/ads/st.dat
- /sdcard/Android/data/code/MI.DAT
- /data/data/####/shared_prefs/vgdata.xml
- /data/data/####/databases/pdown
- /data/data/####/shared_prefs/adstates.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/coo_id.xml.bak
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/shared_prefs/dat.xml
- /sdcard/Android/data/code/MID.DAT
- /sdcard/Download/mediaAd/ui/ui_1.0.8/more.dat
- /data/data/####/files/15.jar
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp
- /sdcard/Download/ads/rt.dat
- /data/data/####/shared_prefs/LocationType.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/14.jar
- /data/data/####/databases/cpdownloads
- /sdcard/Download/mediaAd/ui/ui_1.0.8/voice2.dat
- /data/data/####/shared_prefs/box_cp_states.xml
- /sdcard/Download/9j/2.0.7/11.dat
- /data/data/####/shared_prefs/coo_id.xml
- /sdcard/Download/9j/share.dat
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /sdcard/Download/9j/cp/1.dat
- /sdcard/Download/9j/cp/st.dat
- /data/data/####/databases/com.tpj.tpc-journal
- /data/data/####/shared_prefs/adinfo.xml
- /data/data/####/.lib/libexecmain.so
- /sdcard/Download/9j/2.dat
- /data/data/####/databases/pdown-journal
- /data/data/####/shared_prefs/data.xml
- /sdcard/Download/mediaAd/ui/ui_1.0.8/process.dat
- /data/data/####/databases/pdownloads
- /data/data/####/databases/cpdownloads-journal
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /data/data/####/shared_prefs/app.xml
- /sdcard/Download/mediaAd/ui/ui_1.0.8/tra_voice1.dat
- /data/data/####/databases/pri_tencent_analysis.db-journal
- /data/data/####/shared_prefs/kp_shortcut.xml
- /data/data/####/databases/com.tpj.tpc
- /data/data/####/files/13.jar
- /sdcard/Download/mediaAd/ui/ui_1.0.8/download.dat
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /data/data/####/shared_prefs/dim.xml
- /sdcard/Android/####/b.jar
- /sdcard/Download/9j/7.dat
- /data/data/####/shared_prefs/type.xml
- /sdcard/Download/mediaAd/ui/ui_1.0.8/voice1.dat
- /data/data/####/databases/boxcpdownloads-journal
- /sdcard/ki
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
- /sdcard/Download/ads/u.dat
- /sdcard/Android/####/c.jar
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/.lib/libexec.so
- /data/data/####/files/11.jar
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Download/9j/sidebar/1.0.1/d.dat
- /data/data/####/shared_prefs/j-id.xml
- /data/data/####/shared_prefs/rs.xml
- /data/data/####/shared_prefs/78ab7951635d207fab7f0a8eb8bb66e70029d5df49b3d7b9.xml
- /data/data/####/shared_prefs/vs.xml
- /data/data/####/shared_prefs/dat.xml.bak
- /data/data/####/app_e_qq_com_setting/devCloudSetting.cfg
- /data/data/####/shared_prefs/dij.xml
- /data/data/####/databases/vdownloads-journal
- /sdcard/Android/data/####/cache/gdtadmobwebcache/ApplicationCache.db-journal
- /sdcard/Download/vgp/nousr.dat
- /sdcard/Android/data/code/.vapp.dat
- /data/data/####/files/12.jar
- /data/data/####/shared_prefs/mi.xml
- /data/data/####/shared_prefs/vgdata.xml.bak
- /data/data/####/databases/pdownloads-journal
- /sdcard/Download/mediaAd/ui/ui_1.0.8/tra_voice2.dat
- /data/data/####/databases/vdownloads
- /sdcard/Download/mediaAd/ui/ui_1.0.8/tra_close.dat
- /data/data/####/shared_prefs/cooguo_media_propert_pref.xml
- /data/data/####/databases/tencent_analysis.db-journal
- /data/data/####/shared_prefs/request_prefs.xml
- /data/data/####/shared_prefs/78ab7951635d207fab7f0a8eb8bb66e70029d5df49b3d7b9.xml.bak
- /sdcard/Download/upgrade/jar_dex2.2.8/icp.dat
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
