Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.64.origin
Сетевая активность:
Подключается к:
- t####.####.com
- u####.####.com
- go####.nl
- go####.com
- a####.####.net
- k####.####.me
- r####.####.com
- c####.####.com
- e####.####.com
- cli####.com
- gl####.####.com
- b####.####.cn
- m####.####.com
- i####.####.cn
- a####.####.com
Запросы HTTP GET:
- go####.com/
- e####.####.com/event.php
- i####.####.cn/widget/AIMS/Upload/Imp/IconImg/538317057/CC343B3355BC2A2B071957/650241.png
- b####.####.cn/icon/2016/8d/i1014000249.png
- r####.####.com/?r=####&l=####&p=####&c=####
- k####.####.me/sw/1224292/CD2/&placement=LP2246886_CD2
- go####.nl/?gfe_rd=####&ei=####
- b####.####.cn/icon/2016/10d/i1833901059.png
- t####.####.com/c/kjkQReSu4-FdZgb8T0dYY66MTUOHecCaIBH9i0rhLPs/CF?subid1=####&subid2=####&placement=####&m.gaid=####&m.idfa=####
- a####.####.com/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runtime=####...
- b####.####.cn/icon/2016/8d/i1840154877.png
- b####.####.cn/apk/2016/10d/a2105347070.apk
- a####.####.com/sw/2246886/CD2/&placement=LP3267440_CD49932
- c####.####.com/?a=####&c=####&E=####
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&channel=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####&req_a...
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&aff_sub6=####&aff_sub7=####&aff_sub8=####&google_adv_id=####&sub_affiliate_id=#...
- b####.####.cn/icon/2016/8u/i9987662.png
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- b####.####.cn/icon/2016/7u/i1683370791.png
- u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- a####.####.com/nocache/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runt...
- gl####.####.com/trace?offer_id=####&aff_id=####
- b####.####.cn/icon/2016/8u/i375850773.png
- go####.nl/xjs/_/js/k=xjs.qs.nl.JYx5JThGHtY.O/m=syi,syl,em3,syk,aa,abd,sy25,sy2a,sy1z,sy27,sy29,sy23,sy20,sy22,sy2b,sy2c,sy2d,emh,async,syaz,sy3u,sy9i,...
- a####.####.com/api.php?&sk=####&osv=####&icc=####&chn=####&vc=####&ipkg=####
- a####.####.com/api.php?sk=####
- go####.nl/xjs/_/js/k=xjs.qs.nl.JYx5JThGHtY.O/m=sx,c,sb_mob,bct,cdos,elog,hsm,jsa,mbsf,qim,r,qsm,d,csi/am=gCNopykAAhQAsCo0FtQLEApQCYA/rt=j/d=1/t=zcms/r...
- a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local=####&channel=####&recommend_id=####&from_sdk=####&aid=####&click_route=####&s...
- a####.####.net/native/v2/recommend?pversion=####&request_id=####&appkey=####&channel=####&ua=####&adv_id=####&aid=####&local=####&lang=####&sys_name=#...
- cli####.com/click.php?camp=####&pubid=####&
Запросы HTTP POST:
- a####.####.com/nocache/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runt...
- e####.####.com/event.php
- a####.####.com/api/check_app_update
- a####.####.com/?p=####
- m####.####.com/v2/register
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/AppStore.xml
- /sdcard/Android/data/####/cache/uil-images/2568qggxodwgbhot3ra0gp0jo
- /sdcard/baidu/tempdata/ls.db
- /data/data/####/cache/JNI--912724023Temp
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- /data/data/####/files/cmd/btscreen
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /data/data/####/shared_prefs/Alvin2.xml
- /sdcard/baidu/tempdata/ls.db-journal
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/databases/dollargetter.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /sdcard/JNI-1740456775Temp
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/databases/gref.db
- /data/data/####/shared_prefs/sharedpreferences_batmobi_offers.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/dollargetter.db-journal
- /data/data/####/databases/xUtils.db-journal
- /data/data/####/files/channel
- /data/data/####/files/config
- /sdcard/Android/data/####/cache/uil-images/1ust94vzwbkkdqpclakthdh1u
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/curtain_sp.xml.bak
- /data/data/####/databases/active.db
- /sdcard/Android/data/####/cache/uil-images/67ocp61o3bldhq5d4n9v191x9
- /data/data/####/files/cmd/cust.prop
- /data/data/####/databases/bat_statistics.db-journal
- /sdcard/Android/data/####/cache/uil-images/3hjsfw5jgxm476ny6gcbk3xu2
- /data/data/####/shared_prefs/curtain_sp.xml
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /sdcard/Android/data/####/cache/uil-images/1uae5tx60stpt9hnyk7ugacgx
- /data/data/####/databases/gref.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/files/cmd/andashi_service
- /data/data/####/files/ksuid
- /data/data/####/databases/apps.db-journal
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/databases/active.db-journal
- /data/data/####/files/cmd/23
- /sdcard/Android/data/####/cache/uil-images/2k99echxethe0k2euetbthq7j
- /sdcard/Juice/ksuid
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- /data/data/####/files/agoo.pid
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/cache/webviewCacheChromium/f_000003
- /sdcard/baidu/.cuid
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/shared_prefs/PhoneUtil.xml
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/bigbang.dex
- /sdcard/Juice/channel
- /sdcard/OnionStore/apk/1_com.uc.iflow_22.apk.tmp
- /data/data/####/files/cmd/hideapi_hook.jar
- /data/data/####/shared_prefs/sharedpreferences_batmobi_settings.xml
- /sdcard/OnionStore/.log/log.txt
- /data/data/####/files/cmd/hideapi_hook
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/DaemonServer
- /sdcard/Android/data/####/cache/uil-images/cc9u9pr6741nx14rkzogbbfp
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /data/data/####/files/cmd/andashi_service.jar
- /data/data/####/cache/webviewCacheChromium/index
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/cmd/hideapi_hook
- /data/data/####/files/cmd/hideapi_hook.jar
- /data/data/####/files/DaemonServer
Другие:
Запускает следующие shell-скрипты:
- sh
Может автоматически отправлять СМС-сообщения.
