Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
- Android.DownLoader.348.origin
Сетевая активность:
Подключается к:
- s####.####.com
- a####.com
- qq10615####.####.com
- h####.####.com
- i####.####.com
- t####.####.net
- a####.####.net
- p####.####.com
- r####.####.net
- w####.####.com
- aqw89####.####.com
- m####.####.com
- s####.####.net
- a####.####.com
Запросы HTTP GET:
- m####.####.com/template/doubiekan/js/zepto.min.js
- t####.####.net/v1/active?dv=####&ts=####&osv=####&pt=####&appid=####&ver=####&ft=####&cid=####
- i####.####.com/upload/vod/2017-01-25/201701251485304749.jpg
- m####.####.com/template/doubiekan/css/ico.png
- a####.####.net/v3/zip_upd?s=####
- a####.####.com/t/font_1448978046_1349916.ttf
- p####.####.com/push.js
- s####.####.net/stat/aos/v3/init?s=####
- m####.####.com/template/doubiekan/js/jquery.base.js
- a####.####.com/s.gif?r=####&l=####
- a####.com/scripts/mobile.js
- i####.####.com/upload/vod/2017-01-31/201701311485846233.jpg
- i####.####.com/upload/vod/2017-01-23/201701231485159641.jpg
- m####.####.com/template/doubiekan/css/status.png
- m####.####.com/template/doubiekan/js/home.js
- i####.####.com/upload/vod/2017-02-07/201702071486480464.jpg
- m####.####.com/js/tj.js
- i####.####.com/upload/vod/2017-01-28/201701281485614905.jpg
- i####.####.com/upload/vod/2017-01-17/201701171484656699.jpg
- h####.####.com/aa_dd.png
- s####.####.net/v3/init?s=####
- r####.####.net/video/aos/v1/req?s=####
- i####.####.com/upload/vod/2017-01-28/201701281485593616.jpg
- s####.####.net/banner/v4/req?s=####
- i####.####.com/upload/vod/2017-01-31/201701311485796091.jpg
- i####.####.com/upload/vod/2017-01-10/201701101484014841.jpg
- i####.####.com/upload/vod/2016-12-19/201612191482132969.jpg
- m####.####.com/favicon.ico
- i####.####.com/upload/vod/2017-01-27/201701271485530210.jpg
- aqw89####.####.com/adminzx3q.txt
- i####.####.com/upload/vod/2017-01-28/201701281485611211.jpg
- s####.####.net/stat/aos/v3/pkc?s=####
- m####.####.com/template/doubiekan/css/index.css
- i####.####.com/upload/vod/2016-12-16/201612161481860928.jpg
- i####.####.com/upload/vod/2016-12-13/201612131481614999.jpg
- m####.####.com/template/doubiekan/js/common.min.js
- m####.####.com/
- m####.####.com/template/doubiekan/css/lazyload.gif
- s####.####.net/aos/v3/pns?s=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&su=####&v=####&lv=####&tt=####
- i####.####.com/upload/vod/2017-02-14/201702141487068922.jpg
- i####.####.com/upload/vod/2016-12-19/201612191482149816.jpg
- i####.####.com/upload/vod/2017-02-01/201702011485950196.jpg
- r####.####.net/spot/aos/v2/reqv3?s=####
- m####.####.com/template/doubiekan/js/jquery-1.7.2.min.js
- i####.####.com/upload/vod/2017-01-29/201701291485699801.jpg
- i####.####.com/upload/vod/2016-09-21/201609211474471392.jpg
- i####.####.com/upload/vod/2017-02-03/201702031486131901.jpg
- i####.####.com/upload/vod/2017-01-07/201701071483760430.jpg
- w####.####.com/260/4.html
- m####.####.com/template/doubiekan/js/sildeFocusPlugin.js
- i####.####.com/upload/vod/2017-01-04/201701041483497414.jpg
- i####.####.com/upload/vod/2016-12-30/201612301483086515.jpg
- a####.com/
- i####.####.com/upload/vod/2017-01-16/201701161484559869.jpg
- i####.####.com/upload/vod/2016-11-21/201611211479692554.jpg
- h####.####.com/MMUUAA/4637/9cbf0136d739dc6e7ef6b5712f65a0cd
- a####.####.net/v3/get?s=####
- qq10615####.####.com/?s=####
- i####.####.com/upload/vod/2016-12-25/201612251482668234.jpg
- i####.####.com/upload/vod/2016-12-29/201612291482981771.jpg
- m####.####.com/template/doubiekan/js/iscroll.js
- m####.####.com/template/doubiekan/aaaa/index_foot.js
- i####.####.com/upload/vod/2017-01-18/201701181484702751.jpg
- m####.####.com/template/doubiekan/js/jquery-lazyload.js
- r####.####.net/spot/aos/v2/reqf?s=####
- h####.####.com/xiaofen.png
- m####.####.com/template/doubiekan/js/index.min.js
- m####.####.com/template/doubiekan/css/headerLogo.png
- h####.####.com/hm.js?5910111####
Запросы HTTP POST:
- a####.####.com/api/check_app_update
- t####.####.net/v1/android/packages?rt=####&sign=####
- s####.####.com/pkl16.html
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.jiagu.lock
- /data/data/####/shared_prefs/umeng_update.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/.dataycache/i42d45df023jnkdd93la483f9xGFKXI
- /data/data/####/shared_prefs/i.xml
- /data/data/####/databases/OxgHkj2lz09F-journal
- /data/data/####/databases/5089273019811cd25ae4daa90b70ef90
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- /data/data/####/files/libjiagu.so
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/539dc8a7010a3d98874ac5385564293d
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml
- /data/data/####/files/14854156555780.jar
- /data/data/####/databases/07765f614efbc948576bc2f8a3df213e
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/databases/539dc8a7010a3d98874ac5385564293d-journal
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/databases/1fba55cd3f802ac9a67ab60a44dfbcfc-journal
- /data/data/####/databases/P15pKIjsm64m-journal
- /sdcard/Android/data/.dataycache/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/databases/wIU6pTyUBYWX-journal
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/14854156815360.jar
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/databases/jqIqJYOT3JpT
- /data/data/####/files/14854156823509.jar
- /data/data/####/databases/OxgHkj2lz09F
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/databases/wsUL1uCdKvjD
- /data/data/####/databases/XKwVoK0huy3R
- /data/data/####/databases/5089273019811cd25ae4daa90b70ef90-journal
- /data/data/####/databases/07765f614efbc948576bc2f8a3df213e-journal
- /data/data/####/databases/XKwVoK0huy3R-journal
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/app_database/localstorage/http_m.s4yy.com_0.localstorage-journal
- /data/data/####/databases/T1oX0rhhuXWt-journal
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/781d7ae2dd967186bf309cef1aa5f296-journal
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /sdcard/Android/b9ac43c0263a27a271.db
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/coni_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/OFFERSCONFIG1.xml
- /data/data/####/databases/db_d.db-journal
- /data/data/####/shared_prefs/spotData.xml
- /data/data/####/databases/781d7ae2dd967186bf309cef1aa5f296
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/coni_io_356507059351895.xml
- /data/data/####/files/14854156558459.jar
- /data/data/####/databases/wIU6pTyUBYWX
- /data/data/####/databases/wsUL1uCdKvjD-journal
- /data/data/####/databases/jqIqJYOT3JpT-journal
- /data/data/####/cache/icons/WebpageIcons.db-journal
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml
- /data/data/####/databases/P15pKIjsm64m
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/databases/T1oX0rhhuXWt
- /data/data/####/databases/1fba55cd3f802ac9a67ab60a44dfbcfc
- /data/data/####/app_cache/ApplicationCache.db-journal
Другие:
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
