Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Tool.SMSSend.76.origin
Сетевая активность:
Подключается к:
- m####.####.net
- ca####.####.com
- d####.####.cn
- a####.####.net
- p####.####.com
- ji####.com
- w####.####.cn
- m####.####.com
- tuina####.net
- b####.####.org
- b####.####.com
Запросы HTTP GET:
- p####.####.com/Uploads/vod/2016-06/5760e62b17b3e.jpg
- ji####.com/uploads/allimg/201701/d3dec430202d6660.jpg
- ji####.com/uploads/s/201702/82c6019a87afcf70.jpg
- ji####.com/uploads/allimg/201701/f32a91b18cbf3142.jpg
- ji####.com/js/common.js
- p####.####.com/Uploads/vod/2016-10/57eeb3693528f.jpg
- ji####.com/js/okgg/content360x300.js
- ji####.com/okjs/tj.js
- m####.####.com/19458
- ji####.com/templets/default/images/js/jq.js
- m####.####.net/uu.php?s=Njc4O####&is_img=####&zsys=####
- m####.####.com/d/file/juqing/2016-05-16/c10ebeb95a61c31305b3622ffbc3bc72.jpg
- ji####.com/uploads/allimg/201701/fe48be24c2587357.jpg
- ca####.####.com/MTMwMQ13011301/1210/1481353333.gif
- ji####.com/templets/default/images/1f7Zl.png
- d####.####.cn/?y####
- ji####.com/templets/default/images/js/hd.js
- ji####.com/uploads/s/201702/fa33a31c154c8114.png
- b####.####.org/uploads/allimg/160716/fccc6c8a8b54fcd7.jpg
- ji####.com/uploads/allimg/201701/24a77db47aa99eee.jpg
- ji####.com/
- p####.####.com/Uploads/vod/2015-09/560a5db4014d6.jpg
- tuina####.net/
- b####.####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
- ji####.com/js/okgg/sjnry01.js
- ji####.com/templets/default/images/button.png
- ji####.com/templets/default/images/logo.png
- ca####.####.com/images/xlclose.png
- ji####.com/js/okgg/pcsjdh.js
- ji####.com/uploads/allimg/201701/bcb25ca8908d1c86.jpg
- ji####.com/templets/default/images/lazyload.gif
- ji####.com/js/okgg/ok168tj.js
- p####.####.com/Uploads/vod/2015-08/55d2feda2fa6b.jpg
- ji####.com/okjs/WX.jpg
- ji####.com/templets/default/images/js/jquery.lazyload.js
- ji####.com/lunli/xindegege_weixiongmei/
- ji####.com/templets/default/images/js/1.7.2.min.js
- a####.####.net/view.php?pid=####&gettype=####
- p####.####.com/556522/ff017c75697ceac3.jpg
- w####.####.cn/large/005Il5nXjw1fbgr0irqpjj30s20ciaev.jpg
- ji####.com/js/function.js
- w####.####.cn/bmiddle/91e87880gw1f3yb2fcha4j20700a03yo.jpg
- ji####.com/templets/default/images/style.css
- ji####.com/uploads/s/201702/12449c70531aa0f7.jpg
- ji####.com/uploads/s/201702/ac9d0b35f26ed74f.jpg
- ji####.com/include/ajax.php?action=####&id=####×tamp=####
- ji####.com/js/okgg/sjnry02.js
- p####.####.com/Uploads/vod/2016-12/5841d41f59156.jpg
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/WebViewSettings.xml
- /data/data/####/files/dex/pks.jar
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
