Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690133603: auto##1777427130##mpl_zhushou##log in with 360
Сетевая активность:
Подключается к:
- ope####.####.cn
- p####.####.com
- s####.####.cn
- a####.####.cn
- p####.####.cn
- e####.####.cn
- pro####.####.cn
- m####.####.com
- m####.####.cn
Запросы HTTP GET:
- p####.####.com/t01be0a27aef569f958.png
- p####.####.com/t019f8ef4eda051d287.png
- p####.####.com/t0174e1b9dfb8d509ad.png
- p####.####.com/t01ced0ff4fd1878202.png
- p####.####.com/t0107130f7df7cae47b.png
- p####.####.com/t01f06bfb4f39f8c5aa.png
- ope####.####.cn/Iservice/FailOver?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re...
- p####.####.com/t0176476a6bf560ea5c.jpg
- ope####.####.cn/AppStore/getIsUpdate?ext=####&pname=####&sr=####&mysrc=####&toid=####&sa=####&inma=####&launcher=####&isnle=####&issys=####&vid=####&p...
- p####.####.com/dr/160_160_/t01a8fe30cb424d88ad.png
- p####.####.com/t01c9bc76933ae20906.png
- m####.####.cn/article/fresh?&prepage=####&curpage=####&is_first=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&...
- ope####.####.cn/AppStore/getRecomendAppsBytype?type=####&withext=####&prepage=####&curpage=####&page=####&os=####&vc=####&v=####&md=####&sn=####&cpu=#...
- ope####.####.cn/iservice/pluginStatus?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/AppPrivMap/getPrivMap?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/iservice/appJar?v=####&jvn=####&jvc=####
- p####.####.com/dr/160_160_/t01d7ba4f1b488506b9.png
- p####.####.com/dr/160_160_/t01e10d77cac0e72c2b.png
- m####.####.cn/baohe/list?version=####&toid=####&pst=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=...
- p####.####.com/t01210309f728ccd4da.png
- p####.####.com/t01fd6315e0ed6c48f0.png
- s####.####.cn/360baohe/c.html?para1=####
- p####.####.com/t010ebbe87154eadb98.png
- p####.####.com/t01fe98b06769f9e057.jpg
- ope####.####.cn/iservice/getAppDetail?s_stream_app=####&market_id=####&sort=####&pname=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&c...
- p####.####.com/t012c1acd3a20f1fa3f.png
- p####.####.com/t01d8fec838c8a07e6b.png
- ope####.####.cn/toolsManger/list?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re=...
- p####.####.com/t017fff687f1e6f54ae.png
- p####.####.com/t01bed22d225a375da4.png
- p####.####.com/t013dc973392d5bf451.png
- p####.####.com/dr/160_160_/t01bbf8ba43ec508004.png
- m####.####.com/cfg/appkey-cf6b551afe338f43
- ope####.####.cn/AppStore/getHotWordsIconsOfSearch?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&st...
- ope####.####.cn/inew/getRecomendApps?iszip=####&logo_type=####&deflate_field=####&bannertype=####&apiversion=####&ch=####&prepage=####&curpage=####&pa...
- ope####.####.cn/HuajiaoCtl/getZsSwitch?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=##...
- pro####.####.cn/profile/setting/getsetting?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCoun...
- p####.####.com/t01a2618580c687d5d8.png
- a####.####.cn/intf.php?method=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionname=####&appid=####&_token=####&apivers...
- p####.####.com/t0168d2584fc040d0f7.png
- p####.####.com/t0180e9262f0b036868.png
- p####.####.com/t01a3c7eb268649be0c.png
- p####.####.com/t01e89d596cefabd546.png
- a####.####.cn/intf.php?method=####&devtype=####&m1=####&m2=####&_t=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionnam...
- p####.####.com/t01cb3e5cc97fa58864.png
- p####.####.com/t01656c8b102705e16b.png
- p####.####.com/t0102d47914cbfccdba.png
- p####.####.com/dr/160_160_/t018f8e95a01bcfb383.png
- ope####.####.cn/webviewjs/domainlist?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####...
- s####.####.cn/ak/3416a75f4cea9109507cacd8e2f2aefc.html?m2=####
- p####.####.com/t011c0a3264d431b1c9.jpg
- ope####.####.cn/html/data/save_uninstall.json
- ope####.####.cn/Iservice/ServerConfig?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- p####.####.com/t01bb6912aca33f6f96.png
- p####.####.com/dr/160_160_/t01a3aa3836a423e3b7.png
- p####.####.com/t01b0ceb13f1b361fb3.png
- p####.####.com/t017ec550cc3220a0db.jpg
Запросы HTTP POST:
- ope####.####.cn/mintf/getAppsByPackNames?src=####&&silent=####&plugver=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m...
- p####.####.cn/pstat/plog.php
- p####.####.cn/update/update.php
- ope####.####.cn/NecessaryInstalled/appList?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCoun...
- ope####.####.cn/mintf/getAppsByPackNames?src=####&&silent=####&fotime=####&plugver=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=#...
- e####.####.cn/b/pv?&st=####&m2=####&model=####&mid=####
Дропперы:
Был загружен из Интернета следующими детектируемыми угрозами:
- Android.Packed.9821
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/crash.xml
- /data/data/####/shared_prefs/PermissionMap.xml
- /data/data/####/cache/image_cache/v2.ols100.1/20/V4aJJIY9iaDNcL3BkAUggjXtfc8.862858956.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/78/OCdqv2XaCQbLtQlwA4zrirN0A30.-1276397475.tmp
- /data/data/####/databases/new_downloads.db
- /data/data/####/files/uninstallRetainJson
- /data/data/####/cache/image_cache/v2.ols100.1/36/0pRG5FPPWc0nPwvkHHS8NfdCgw8.1044994547.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/58/JzGIOTo45UATk7kR-HYqGdlE4S0.1733028831.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/87/ErPxu_P9b_2sqlwibm8IpbBas-o.899316116.tmp
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/cache/image_cache/v2.ols100.1/84/Anof7o1Op3RhopjaUTsSc9vLMK0.1151324421.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_5.png
- /data/data/####/files/dir_uninstallretain_pic/pic_6.png
- /data/data/####/cache/image_cache/v2.ols100.1/65/q3UreAKndBTFeA7UaQsbYhxbK-o.-327376223.tmp
- /data/data/####/shared_prefs/event_config.xml
- /data/data/####/cache/image_cache/v2.ols100.1/50/LOPBiLKTReLywgq4swnUIpjsBnY.-873799291.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_4.png
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2093793135.zip
- /data/data/####/shared_prefs/LifeHelper.xml
- /data/data/####/files/imagepipeline.lock
- /data/data/####/shared_prefs/share_data.xml
- /data/data/####/localApkInfo.json
- /data/data/####/cache/image_cache/v2.ols100.1/60/JTvdcedeWJjtzP873vEcYy3mqa4.-1945103270.tmp
- /data/data/####/databases/new_downloads.db-journal
- /data/data/####/files/libsucore.so
- /data/data/####/cache/image_cache/v2.ols100.1/52/AuzRa-_uwLYXPjZhzgojoBYnEFo.cnt
- /data/data/####/cache/image_cache/v2.ols100.1/48/GgAZHKg3ihSNCrq87em0yHhZd7Q.1056724226.tmp
- /data/data/####/files/libsuav_nopie.so
- /data/data/####/cache/image_cache/v2.ols100.1/36/4TaZoWoNJ_FTz5f1QeXgBWEYHXQ.-552799397.tmp
- /data/data/####/shared_prefs/clear_shortcut.xml
- /data/data/####/databases/360appstoreInstallHistory.db
- /sdcard/360Log/downloadLog_main
- /data/data/####/shared_prefs/battery.xml
- /data/data/####/files/dir_uninstallretain_pic/pic_2.png
- /data/data/####/files/dir_uninstallretain_pic/pic_3.png
- /data/data/####/cache/image_cache/v2.ols100.1/49/foP-rghj47r3sAZvyXIBOObCW1I.671960995.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/44/pYfhcRt4mKzaqO4m8ROc4nhpZyU.1581278657.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/83/AKt7Pw3-iNyE9e2XJXyFHDR6AJ4.-1731466348.tmp
- /data/data/####/files/personal_center_setting_new
- /data/data/####/databases/ignoreupdate_appinfo.db
- /data/data/####/cache/image_cache/v2.ols100.1/61/1NGScv2aBhVV3XPP9ptuuwIQgd0.426640810.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_9.png
- /data/data/####/shared_prefs/MATSharedPreferences.xml
- /sdcard/Android/data/####/cache/http/616537595-2056551381
- /sdcard/Android/data/####/cache/http/1187788828-2056551381
- /data/data/####/cache/image_cache/v2.ols100.1/76/TisXzilHUF7IYkizDUaG-kaJ4XQ.1698120519.tmp
- /sdcard/temp.tmp~
- /data/data/####/cache/image_cache/v2.ols100.1/96/C1Lhh9ijK1Pi_2fwm0oUrd3yua4.1144947972.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/29/t6lYBD4W2ti4ZYnxU_NiURNWjGo.-1221376972.tmp
- /data/data/####/shared_prefs/crash.xml.bak
- /data/data/####/cache/image_cache/v2.ols100.1/53/p1p4VMJ9t31_4mpFZwxo6tCv0U8.440940536.tmp
- /sdcard/Android/data/.nomedia
- /data/data/####/cache/image_cache/v2.ols100.1/26/JuKHeTGdbv9I-wyDtbv-rwsR8Co.1300994180.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_8.png
- /data/data/####/databases/filelist.db-journal
- /data/data/####/files/dir_uninstallretain_pic/pic_1.png
- /data/data/####/databases/update_history.db
- /data/data/####/cache/image_cache/v2.ols100.1/40/92iuXXcGT_X_vjwbmThgVQvmuJs.1653012691.tmp
- /data/data/####/files/imagepipeline
- /data/data/####/databases/account.db-journal
- /data/data/####/cache/image_cache/v2.ols100.1/52/AuzRa-_uwLYXPjZhzgojoBYnEFo.683418223.tmp
- /data/data/####/databases/update_history.db-journal
- /data/data/####/cache/image_cache/v2.ols100.1/10/Z5C7DtiPgpBc4FIiui8cruslsAY.-449892918.tmp
- /data/data/####/shared_prefs/save_myself_config.xml
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/cache/image_cache/v2.ols100.1/23/9dR0aw3_HO110LmrGa54x3VDJ9E.-2136957071.tmp
- /sdcard/Android/data/####/cache/http/2106980589-1885218500
- /data/data/####/databases/download5.db-journal
- /data/data/####/cache/image_cache/v2.ols100.1/69/eo6GdOsu9KgiMwVldi67S0uRa_g.1374428332.tmp
- /data/data/####/shared_prefs/BaoHe_only_pref.xml.bak
- /data/data/####/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
- /data/data/####/files/rooter.jar
- /data/data/####/databases/articlelist.db-journal
- /data/data/####/databases/_ire-journal
- /data/data/####/shared_prefs/BaoHe_only_pref.xml
- /data/data/####/shared_prefs/PermissionMap.xml.bak
- /data/data/####/databases/account.db
- /data/data/####/cache/image_cache/v2.ols100.1/30/vU-uBf0sTrV8E3Y5vUokhGmDIWE.2093793135.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_7.png
- /data/data/####/shared_prefs/share_data.xml.bak
- /data/data/####/files/pluginconfigcache
- /sdcard/Android/data/####/cache/http/-159824860-1885218500
- /data/data/####/databases/360appstoreInstallHistory.db-journal
- /sdcard/Android/data/####/cache/http/-4881599011803665374
- /sdcard/Android/data/####/cache/http/-1053403281-827661190
- /data/data/####/databases/ignoreupdate_appinfo.db-journal
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/libsuav_nopie.so
- /data/data/####/files/libsucore.so
Другие:
Может автоматически отправлять СМС-сообщения.
