Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.269.origin
Сетевая активность:
Подключается к:
- w####.####.com:9004
- upl####.####.com
- h####.####.com
- p####.####.com
- c####.####.com
- d####.####.com
- w####.####.com
- y####.com
- u####.cn
- i####.####.cn
- m####.####.com
- a####.####.com
Запросы HTTP GET:
- m####.####.com/image/58aff48f220dd.png
- upl####.####.com/image/57c79a0a91f9f.png
- upl####.####.com/image/5808297a0b416.png
- upl####.####.com/image/589bbcf764bb4.jpg
- m####.####.com/image/58affac84fde2.png
- m####.####.com/image/58aff4836dcf7.png
- p####.####.com/ex?i=####
- upl####.####.com/image/57c799dad1826.png
- d####.####.com/hotwords/get?Position=####
- d####.####.com/static/css/style.css
- upl####.####.com/image/57c799e6591aa.png
- d####.####.com/?channel=####
- m####.####.com/image/58affb00d6bfb.png
- p####.####.com/ycmm?sz=####&pdbid=####&orderid=####&odid=####&rtbid=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=###...
- m####.####.com/image/58aff463b21b5.png
- m####.####.com/image/58aff4ac2d9d6.jpg
- m####.####.com/image/58aff43da8d5f.png
- upl####.####.com/image/58082a8752354.png
- h####.####.com/hm.gif?pid=####&channel=####&name=####&url=####&rnd=####
- m####.####.com/static/css/swiper.min.css
- p####.####.com/ycmm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/static/js/swiper.min.js
- m####.####.com/image/58affa9af089c.png
- upl####.####.com/image/57c974cec6bd1.png
- upl####.####.com/image/57c7c17fb23b9.png
- m####.####.com/image/58aff49a9f977.png
- p####.####.com/ycmm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=###...
- upl####.####.com/image/57c970ff7d83f.jpg
- m####.####.com/static/img/tobak.png
- h####.####.com/hm.js?1####
- m####.####.com/image/58aff4080bc15.png
- upl####.####.com/image/586075dc5de0b.png
- upl####.####.com/image/57c7c16f1f400.png
- m####.####.com/image/58aff429358b6.png
- m####.####.com/image/58aff3fe783d2.png
- m####.####.com/image/58aff4512a6b0.png
- a####.####.com/static/images/search-logo.png
- m####.####.com/image/58aff43409685.png
- m####.####.com/image/58affaecc7ece.png
- a####.####.com/static/js/union.js
- m####.####.com/image/58affa5b12a79.png
- upl####.####.com/image/589bbc67966db.jpg
- d####.####.com/static/js/page.js
- upl####.####.com/image/57c97506cdd3a.jpg
- upl####.####.com/image/57c7c1a8df223.png
- upl####.####.com/image/57c974e39ef29.png
- upl####.####.com/image/57c799f06c8e9.png
- upl####.####.com/image/57c799fa2ae91.png
- m####.####.com/
- m####.####.com/image/58affa52a78b4.jpg
- a####.####.com/pre?callback=####&pid=####&cuid=####&euid=####&cb=####&t=####
- m####.####.com/lib/js/e/jquery-1.2.6.pack.js
- m####.####.com/image/58affad27f90c.png
- m####.####.com/image/58aff4a3d79ff.png
- h####.####.com/hm.js?a02de45####
- upl####.####.com/image/589bbc9642fb3.jpg
- upl####.####.com/image/57c7c13fe17c6.png
- a####.####.com/search?type=####&pt=####&unionId=####&siteId=####&mid=####&w=####&h=####&euid=####&cuid=####&pid=####&pvt=####&pv=####&cUnionId=####&ex...
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- m####.####.com/image/58affa415e7b7.jpg
- m####.####.com/static/css/page.css
- m####.####.com/static/css/reset.css
- upl####.####.com/image/581aaf4077dd5.jpg
- m####.####.com/lib/skin/2013/base.css
- upl####.####.com/image/57c7c153983c2.png
- m####.####.com/static/img/menu2.png
- upl####.####.com/image/57c799c34d922.png
- upl####.####.com/image/57c79a2ca300d.png
- m####.####.com/image/58affa7463211.png
- i####.####.cn/iplookup/iplookup.php?format=####
- upl####.####.com/image/57c79a3c7cb03.png
- upl####.####.com/image/57c7c4197ca4f.jpg
- upl####.####.com/image/57c7c35fa3445.jpg
- upl####.####.com/image/57c78f360a1cb.png
- m####.####.com/image/58aff46e8cb46.png
- upl####.####.com/image/58082a6d63779.png
- d####.####.com/static/js/jquery-1.8.3.min.js
- upl####.####.com/image/57c79a0268174.png
- upl####.####.com/image/57c799cbde376.png
- m####.####.com/image/58aff119c30e4.jpg
- upl####.####.com/image/57edfcbf386da.png
- upl####.####.com/image/582bbb22c317d.png
- p####.####.com/ycmm?sz=####&pdbid=####&orderid=####&odid=####&rtbid=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=###...
- m####.####.com/image/58aff41f26ce3.png
- m####.####.com/image/58affa6b12f76.png
- m####.####.com/image/58aff140dab74.jpg
- m####.####.com/image/58aff44895387.png
- upl####.####.com/image/57c7aaca357d4.png
- m####.####.com/image/58aff4116551c.jpg
- m####.####.com/image/58affa7e4eee5.png
- m####.####.com/image/58affa8c7ac95.png
- u####.cn/45JmHC6
- m####.####.com/image/58aff109152da.jpg
- upl####.####.com/image/584a70ed22d64.png
- upl####.####.com/image/57c7c43a209b1.jpg
- upl####.####.com/image/57c97480d8fa6.jpg
- upl####.####.com/image/57c7a9e2a24be.png
- m####.####.com/static/img/f5.png
- upl####.####.com/image/57c7abb13c004.png
- upl####.####.com/image/583d4c086804f.png
- m####.####.com/image/58affb090231a.png
- m####.####.com/image/58affa49a3339.jpg
- m####.####.com/static/js/jquery-1.8.3.min.js
- m####.####.com/image/58aff54f5dd4e.jpg
- m####.####.com/?ac=####
- upl####.####.com/image/57c773c1a31cc.png
- m####.####.com/image/58aff12d54c12.jpg
- m####.####.com/image/58aff47902e06.png
- upl####.####.com/image/57c7c403b8eec.jpg
- m####.####.com/static/js/page.js
- m####.####.com/image/58affaba121dd.png
- upl####.####.com/image/57c7ad844d547.png
- upl####.####.com/image/584f4cbe4c16d.png
- c####.####.com/cpro/ui/cm.js
- m####.####.com/image/58affb12f4102.png
- m####.####.com/static/img/share.png
- m####.####.com/image/58affaf675be0.png
- upl####.####.com/image/57ca42034be01.png
- m####.####.com/image/58affaddda356.png
- upl####.####.com/image/57c7c1b9622ab.png
- m####.####.com/image/58aff45930428.png
- upl####.####.com/image/58082a41e78fb.png
Запросы HTTP POST:
- w####.####.com/api/getCfg.jsp
- w####.####.com/api/uploadInstallApps.jsp
- w####.####.com/api/getInAppFull.jsp
- w####.####.com/api/getDtk.jsp
- w####.####.com/api/getLauncher.jsp
- y####.com/cu.ashx
- w####.####.com/api/getSI.jsp
- w####.####.com/api/getFallDown.jsp
- w####.####.com/api/getFloat.jsp
- w####.####.com/api/getStartPop.jsp
- w####.####.com:9004/api/getCfg.jsp
- w####.####.com/api/uploadSaleInfo.jsp
- w####.####.com/api/getAreaId.jsp
- w####.####.com/api/getInAppFloat.jsp
- w####.####.com/api/getSlidingScreen.jsp
- w####.####.com/api/getStartNonFull.jsp
- w####.####.com/api/getStartDialog.jsp
- w####.####.com/api/getStartFull.jsp
- w####.####.com/api/uploadSale.jsp
- w####.####.com/api/getAlist.jsp
- w####.####.com/api/getSht.jsp
- w####.####.com/api/getInAppNonFull.jsp
- w####.####.com/api/getNotification.jsp
- w####.####.com/api/getExit.jsp
- w####.####.com/api/getStartWin.jsp
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_000011
- /sdcard/Android/data/system/cache/.hb/insifhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /sdcard/Android/data/system/cache/.hb/exthbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /sdcard/Android/data/system/cache/.hb/sdhm_l_hb_t
- /data/data/####/databases/baidu_cwv-journal
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /sdcard/Android/data/system/cache/.hb/swhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/insiohbm_l_hb_t
- /data/data/####/shared_prefs/gitConfig.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000010
- /sdcard/Android/data/system/cache/.hb/ntbhbm_l_hb_t
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/pp.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/databases/blue_cwv-journal
- /sdcard/Android/data/system/cache/.hb/snfhm_l_hb_t
- /data/data/####/shared_prefs/localtime.xml.bak
- /data/data/####/shared_prefs/areaInfo.xml
- /sdcard/Android/data/system/cache/.hb/DtkAdbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/cfghbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/sfhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/fhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /sdcard/Android/data/system/cache/.hb/sdhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/IUhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/lauhbm_l_hb_t
- /data/data/####/shared_prefs/localtime.xml
- /data/data/####/biz_close.jar
- /data/data/####/shared_prefs/online.xml
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/shared_prefs/device.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/databases/favorite.db-journal
- /data/data/####/shared_prefs/pp.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /sdcard/Android/data/system/cache/.hb/falhbm_l_hb_t
- /sdcard/device
- /sdcard/Android/data/system/cache/.hb/sihm_l_hb_t
- /data/data/####/files/80.tmp
- /sdcard/Android/data/system/cache/.hb/sihbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/insiwfhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
