Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.1848.origin
Сетевая активность:
Подключается к:
- a####.####.site:8090
- p####.club
- p####.####.com
- a####.####.site
Запросы HTTP GET:
- a####.####.site:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
- p####.club/web/videofm/fmpath1481108476600.gif
- p####.club/web/videofm/fmpath1480679031645.PNG
- p####.club/web/videofm/fmpath1480673489372.PNG
- a####.####.site/getdata?cpid=####&packagename=####
- p####.club/web/videofm/fmpath1480678926207.PNG
- p####.club/web/videofm/fmpath1480679079004.PNG
- a####.####.site/afee?cpid=####&appfee_id=####&fee=####&smsc=####&imsi=####&p=####&appname=####&sign=####
- a####.####.site/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
- p####.club/web/videofm/fmpath1480673347155.PNG
- p####.club/web/videofm/fmpath1480673074320.PNG
- p####.club/web/videofm/fmpath1480673274497.PNG
- p####.club/web/videofm/fmpath1480679289957.PNG
- p####.club/web/videofm/fmpath1480672662665.PNG
Запросы HTTP POST:
- p####.####.com/api/q/a/35313985d3b9ccc38ab579d35065afe66
- p####.club/memberInfo/memberRegister.do
- p####.club/memberInfo/memberLogin.do
- p####.club/memberInfo/queryVideoList.do
- p####.####.com/api/statis/35313985d3b9ccc38ab579d35065afe66/app-642D1C4773244960AE61DB70F699E4D3
- p####.club/memberInfo/queryVideoSort.do
- p####.club/memberInfo/queryLeftMin.do
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/####/cache/xUtils_img/e3f69682c5f6c1b80fc7163f40b65798.tmp
- /data/data/####/shared_prefs/edition.xml
- /sdcard/Android/data/####/cache/xUtils_img/82faa7f51619624447d3b2dfa8ea2eac.tmp
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/app_process_lock/77520850336.504
- /data/data/####/shared_prefs/ma_epay_share.xml
- /sdcard/Android/data/####/cache/xUtils_img/69de938e936ad23802b73f7bf0dccfb9
- /data/data/####/shared_prefs/xplayer.xml
- /data/data/####/databases/bil_db-journal
- /data/data/####/app_process_lock/690256006561.783
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_process_lock/77520851183.7564
- /data/data/####/databases/MA_epay_db-journal
- /data/data/####/shared_prefs/ma_epay_share.xml.bak
- /data/data/####/app_process_lock/77520850925.1543
- /data/data/####/app_process_lock/77520850257.3887
- /data/data/####/databases/bil_db
- /data/data/####/shared_prefs/TDpref_shorttime.xml
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/databases/xUtils_http_cache.db-journal
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /sdcard/Android/data/####/cache/xUtils_img/f9a1b83146e8fcb1995de59e1aed966d
- /sdcard/Android/data/####/cache/xUtils_img/82faa7f51619624447d3b2dfa8ea2eac
- /sdcard/Android/data/####/cache/xUtils_img/fc84163d6e00a45fa34654a046c900f5
- /sdcard/Android/data/####/cache/xUtils_img/b65deecb078239f0bc6520df81a24dbc.tmp
- /sdcard/Android/data/####/cache/xUtils_img/f9a1b83146e8fcb1995de59e1aed966d.tmp
- /data/data/####/files/talkingdata_app_version_preferences_file
- /data/data/####/databases/sms_db
- /data/data/####/files/TDtcagent.db
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/databases/xUtils_http_cookie.db
- /data/data/####/app_process_lock/204860991149.25
- /data/data/####/app_process_lock/690256000699.432
- /data/data/####/shared_prefs/b_share.xml.bak
- /sdcard/Android/data/####/cache/xUtils_img/69de938e936ad23802b73f7bf0dccfb9.tmp
- /data/data/####/baea/tmb.jar
- /data/data/####/app_process_lock/690256004803.064
- /data/data/####/files/INSTALLATION
- /data/data/####/databases/sms_db-journal
- /data/data/####/app_process_lock/204860991744.884
- /data/data/####/shared_prefs/new_vvsion.xml
- /data/data/####/databases/xUtils_http_cookie.db-journal
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/app_process_lock/204860991671.22
- /data/data/####/app_process_lock/204860990954.582
- /data/data/####/app_process_lock/204860989722.259
- /data/data/####/shared_prefs/TDCloudSettingsConfig642D1C4773244960AE61DB70F699E4D3.xml.bak
- /sdcard/.tcookieid
- /sdcard/Android/data/####/cache/xUtils_img/69141a76a0ad8da2ba975fde05a640c6.tmp
- /data/data/####/databases/MA_epay_db
- /sdcard/Android/data/####/cache/xUtils_img/15068e53e783bfd36ef2c4af0456161f
- /data/data/####/files/talkingdata_app_process_preferences_file
- /data/data/####/app_process_lock/204860991486.934
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/app_process_lock/690256004147.151
- /data/data/####/shared_prefs/nnt_data.xml.bak
- /sdcard/Android/data/####/cache/xUtils_img/15068e53e783bfd36ef2c4af0456161f.tmp
- /data/data/####/app_process_lock/77520850994.8894
- /data/data/####/shared_prefs/ma_call.xml.bak
- /data/data/####/app_process_lock/690256008243.479
- /data/data/####/app_process_lock/77520850723.7084
- /sdcard/Android/data/####/cache/xUtils_img/b65deecb078239f0bc6520df81a24dbc
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/app_process_lock/690256001568.523
- /data/data/####/databases/talkingdata_app.db-journal
- /sdcard/Android/data/####/cache/xUtils_img/9ff4f45c0c5cf83dce139f3a06adc0b9
- /data/data/####/shared_prefs/TDCloudSettingsConfig642D1C4773244960AE61DB70F699E4D3.xml
- /data/data/####/shared_prefs/TDpref_longtime.xml
- /sdcard/Android/data/####/cache/xUtils_img/69141a76a0ad8da2ba975fde05a640c6
- /data/data/####/files/td.lock
- /data/data/####/shared_prefs/b_setting.xml.bak
- /data/data/####/files/tdlock.txt
- /data/data/####/shared_prefs/TDpref_longtime.xml.bak
- /data/data/####/app_process_lock/690255999994.979
- /data/data/####/app_process_lock/204860990189.271
- /data/data/####/app_process_lock/204860989931.334
- /data/data/####/shared_prefs/ma_phone.xml
- /data/data/####/app_process_lock/690256005940.852
- /data/data/####/databases/xUtils_http_cache.db
- /sdcard/Android/data/####/cache/xUtils_img/fc84163d6e00a45fa34654a046c900f5.tmp
- /data/data/####/app_process_lock/204860992170.331
- /data/data/####/app_process_lock/690256006809.985
- /sdcard/Android/data/####/cache/xUtils_img/9ff4f45c0c5cf83dce139f3a06adc0b9.tmp
- /data/data/####/app_process_lock/204860991912.181
- /data/data/####/app_process_lock/690256007373.675
- /data/data/####/app_process_lock/77520851022.7643
- /data/data/####/app_process_lock/77520851086.0709
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /sdcard/Android/data/####/cache/xUtils_img/e3f69682c5f6c1b80fc7163f40b65798
- /data/data/####/shared_prefs/ma_data.xml.bak
- /sdcard/gooogle/userid.cfg
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/app_process_lock/77520850797.3723
- /sdcard/Android/data/####/cache/xUtils_img/130b9a9c2a71651a607815d91056ee9e.tmp
Присваивает атрибут 'исполняемый' для следующих файлов:
- /sdcard/gooogle/userid.cfg
Другие:
Может автоматически отправлять СМС-сообщения.
