Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- s####.####.com
- t####.####.com
- v####.####.com
- i####.####.com
- 2####.####.213
- d####.####.com
- o####.####.cn
- p####.####.com
- and####.####.com
- o####.####.com:8080
- c####.####.com
- 1####.####.123
- p####.####.cn
- 1####.####.214:8080
- 1####.####.214
- a####.####.com
- qzones####.####.cn
Запросы HTTP GET:
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_black.gif
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- p####.####.cn/gdt/0/DAAFXyiAMgASwABGBYTmrlC3Mdk8Aq.jpg/0?ck=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_btn_black.png
- t####.####.com/conv/sdk/spa/conv?encver=####&vx=####
- 1####.####.123/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datatype=####&posid=####&adposcount=####&ext=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20160830/banner.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-open.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- 1####.####.214:8080/jfservice/a.jsp?k=####
- c####.####.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=####&acttype=####&s=####
- 2####.####.213/imtt.dd.qq.com/16891/0723163FD3754C0BFEE4132A8EB0BB94.apk?mkey=####&f=####&c=####&fsname=####&csr=####&_gdt_ma_cdn_cb=####&qz_gdt=####&...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_btn.png
- v####.####.com/gdt_stats.fcg?viewid=####&i=####&os=####&gap=####
- p####.####.com/ma_icon/0/icon_42392809_1487571814/256
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- 1####.####.214/jfservice/a.jsp?k=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- i####.####.com/16891/0723163FD3754C0BFEE4132A8EB0BB94.apk?fsname=####&csr=####&_gdt_ma_cdn_cb=####&qz_gdt=####&appid=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- c####.####.com/gdt_trace_a.fcg?actionid=####&targettype=####&tagetid=####&sellerid=####&clickid=####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon.gif
- d####.####.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.cn/8/init
- and####.####.com/rqd/async
- s####.####.com/msg
- o####.####.cn/8/secret
- s####.####.com/click
- o####.####.com:8080/beacon/vercheck
- v####.####.com/gdt_stats.fcg
- o####.####.cn/8/find
- s####.####.com/activate
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/shared_prefs/beacontsa_cover.xml
- /data/data/####/app_e_qq_com_plugin/update_lc
- /sdcard/GDTDOWNLOAD/icon/838e5322d2f089f9c3987c8ef150cf16
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/beacontsa_cover_check.lock
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/i.xml
- /data/data/####/databases/GDTSDK.db-journal
- /data/data/####/app_e_qq_com_setting/devCloudSetting.cfg
- /data/data/####/databases/GDTSDK.db
- /data/data/####/tx_shell/libshella-2.8.2.so
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/gdtadmobwebcache/ApplicationCache.db-journal
- /data/data/####/files/.imprint
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /data/data/####/cache/GDTDOWNLOAD/image/3270af6f9eb036223fc6fa325d6165d6
- /data/data/####/mix.dex
- /data/data/####/app_zq/z.so
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/shared_prefs/cn.jpush.preferences.v2.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /data/data/####/shared_prefs/bmob_sp.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/security_info
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/files/01485418302455.jar
- /data/data/####/cache/GDTDOWNLOAD/image/5ead7c1916e321af3ee0d7d6aa595238.temp
- /data/data/####/files/local_crash_lock
- /data/data/####/shared_prefs/bmob_sp.xml
- /data/data/####/files/native_record_lock
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
- /data/data/####/shared_prefs/b.xml
- /data/data/####/cache/webviewCacheChromium/index
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libshella-2.8.2.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.rom.id
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
