Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.64.origin
Сетевая активность:
Подключается к:
- trac####.####.com
- go####.com
- u####.####.com
- go####.nl
- t####.####.net
- 1####.####.97:8002
- a####.####.net
- c####.####.com
- e####.####.com
- 1####.####.97
- gl####.####.com
- b####.####.cn
- l####.####.com
- m####.####.com
- i####.####.cn
- a####.####.com
Запросы HTTP GET:
- l####.####.com/XejlngMx43PdGfSBnq3cK4ZHlBDxW2DACy1jkscE-kSnUj6EEBnMyrtxyMn71aO_xuc=w144
- e####.####.com/event.php
- i####.####.cn/widget/AIMS/Upload/Imp/IconImg/538317057/CC343B3355BC2A2B071957/650241.png
- b####.####.cn/icon/2016/8d/i1014000249.png
- c####.####.com/export/58cd38d870e8a/76801/4700907/5dade44224074a4b?timestamp=####&rewards=####&bundleId=####&applicationUserId=####&deviceOs=####&devi...
- go####.nl/?gfe_rd=####&ei=####
- b####.####.cn/icon/2016/10d/i1833901059.png
- l####.####.com/8VI09LFD_Sm62X2fMwWKGtyiKMIxoEa8AGG8C9iLPzb4YUnFGiNF6ehhUg6nELq0Vpc=w144
- go####.com/
- b####.####.cn/icon//2016/9u/i513066843.png
- b####.####.cn/icon/2016/8u/i92979064.png
- b####.####.cn/icon/2016/10u/i184108008.png
- a####.####.com/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runtime=####...
- b####.####.cn/icon/2016/8d/i1840154877.png
- 1####.####.97:8002/m/umeng:571dd88de0f55a595e001bf1/10002/At-hgvAzbM14O6ciVoNH1WJQzwsXRyEQ8lJoxsghZKaT?s=MDUzN####&c=####&pm=####&sv=####&ov=####
- a####.####.net/native/v2/recommend?pversion=####&request_id=####&appkey=####&channel=####&ua=####&adv_id=####&aid=####&local=####&lang=####&sys_name=#...
- go####.nl/xjs/_/js/k=xjs.qs.nl.GKjRVf0WrK8.O/m=sx,c,sb_mob,bct,cdos,elog,hsm,jsa,mbsf,qim,r,qsm,d,csi/am=gCNopykAAhQAsCo0FtgLEApQCYA/rt=j/d=1/t=zcms/r...
- b####.####.cn/icon/2016/6d/i2021903982.png
- b####.####.cn/icon/2016/9u/i1988258425.png
- b####.####.cn/icon/2016/9d/i1000992698.png
- c####.####.com/?a=####&c=####&E=####
- l####.####.com/0MLteWwAYrO63ciEBAHxVh3kbM5lKb6Qv-k5Dhdh5mY7iHJjR-uHx55_iWpkk4K4CQ=w144
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&channel=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####&req_a...
- a####.####.net/stat/v2/imp?aff_id=####&ak_id=####&local=####&channel=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&aff_sub6=####&aff_sub7=####&aff_sub8=####&google_adv_id=####&sub_affiliate_id=#...
- a####.####.net/call/v2/ad/click_callback?ads_id=####&aff_id=####&ak_id=####&local=####&channel=####&recommend_id=####&from_sdk=####&aid=####&click_rou...
- l####.####.com/sy1zNHDNfGfOl2RCSdweAY5Rwj-0LtVLIIprwOzIDAUbp09s2_YdiAOuyKmfAwynzQ=w144
- b####.####.cn/icon/2016/8u/i9987662.png
- b####.####.cn/icon/2016/7u/i1683370791.png
- b####.####.cn/icon/2016/8u/i1061593066.png
- u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- l####.####.com/fSKMIAZ3YTyi3j1Yqr8rTfPAW6Ds9WzhCXBfHwSjM7ugD1RMcQm7SbGIQBadRSMX0w=w144
- l####.####.com/cngucWo8pgR9DHpbQ9-jOSfEPtFM22gBMRPdLsIKyCE6mQvPlcBsP-IXJqroCDCvNGc=w144
- a####.####.com/nocache/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runt...
- b####.####.cn/icon/2016/8u/i375850773.png
- a####.####.com/api.php?&sk=####&osv=####&icc=####&chn=####&vc=####&ipkg=####
- a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local=####&channel=####&recommend_id=####&from_sdk=####&aid=####&click_route=####&s...
- l####.####.com/3I1LDm2ILYPYSSOALekLsHSi2qAS4h5RaanPD2nGhD8ZyATholwR5AI5GN5lLAlHTGo=w144
- a####.####.com/api.php?sk=####
- l####.####.com/TUrqjW8F7uWS6m9ePYiUoajGC8Ac19glpQlJsBfI7MGzV0eVwaGbEewaNnIkpolyu48N=w144
- t####.####.net/click/click?offer_id=####&aff_id=####&campaign=####&install_callback=####
- 1####.####.97/m/umeng:571dd88de0f55a595e001bf1/10002/At-hgvAzbM14O6ciVoNH1WJQzwsXRyEQ8lJoxsghZKaT?s=MDUzN####&c=####&pm=####&sv=####&ov=####
- l####.####.com/jtghoLzBdrBH2wEdPM3SENYMOF-t9EoiyRjWXsazIuEIo23hk_k21rNcilBxtEtbQlk=w144
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- l####.####.com/G2SlmzJ7or2yZ-ChgNJK_QUCIF7xRV-PYMcaC6nlbk6yU4jMVy7x48qYZf0sKEFslA=w144
- trac####.####.com/click/18629387?app_key=####&gaid=####&idfa=####&pb=####
- go####.nl/xjs/_/js/k=xjs.qs.nl.GKjRVf0WrK8.O/m=syi,syl,em3,syk,aa,abd,sy25,sy2a,sy1z,sy27,sy29,sy23,sy20,sy22,sy2b,sy2c,sy2d,emh,async,syaz,sy3u,sy9i,...
Запросы HTTP POST:
- a####.####.com/nocache/api.aspx?iszip=####&g=####&v=####&channel=####&language=####&model=####&resolution=####&packagename=####&uid=####&sdk=####&runt...
- e####.####.com/event.php
- a####.####.com/api/check_app_update
- a####.####.com/?p=####
- m####.####.com/v2/register
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/####/cache/uil-images/4w8ul06vqkov713xrqlr96838
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/dollargetter.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/Android/data/####/cache/uil-images/72vuq6tdv0o4gt7i7ji0e6r13
- /data/data/####/files/config
- /sdcard/Android/data/####/cache/uil-images/2gib7ipampnlw78rybzj7cjcc
- /sdcard/Android/data/####/cache/uil-images/5nsmld28j5mgbkivdkmva9h5
- /sdcard/Android/data/####/cache/uil-images/favddj7vznmq95kqevjg21sc
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/shared_prefs/curtain_sp.xml
- /sdcard/Juice/ksuid
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/uil-images/78kl28b8s16urspv5nbqz8f9y
- /data/data/####/shared_prefs/PhoneUtil.xml
- /data/data/####/shared_prefs/sharedpreferences_batmobi_offers.xml
- /sdcard/JNI-1164211312Temp
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/baidu/tempdata/ls.db
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/databases/gref.db
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/databases/xUtils.db-journal
- /sdcard/Android/data/####/cache/uil-images/1ust94vzwbkkdqpclakthdh1u
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/curtain_sp.xml.bak
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /sdcard/Android/data/####/cache/uil-images/1uae5tx60stpt9hnyk7ugacgx
- /data/data/####/databases/gref.db-journal
- /data/data/####/databases/apps.db-journal
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/####/cache/uil-images/5yun30ck9x5b6r1p673xod6oy
- /sdcard/Android/data/####/cache/uil-images/5f8axxykcdgwuodaj67gh6i3x
- /data/data/####/files/lldt/firll.dat
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- /sdcard/Juice/channel
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/cmd/hideapi_hook
- /sdcard/Android/data/####/cache/uil-images/53cwqxb79byckqq7zwijm3dse
- /data/data/####/files/cmd/btscreen
- /sdcard/Android/data/####/cache/uil-images/7kpcx3raplhptsa89a42hxys2
- /sdcard/baidu/tempdata/ls.db-journal
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/channel
- /data/data/####/databases/active.db
- /sdcard/Android/data/####/cache/uil-images/2pw372qz20w6ghhs92oun2e47
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /sdcard/Android/data/####/cache/uil-images/2bamqhcezsssxelrseowglu8o
- /data/data/####/files/cmd/andashi_service
- /data/data/####/files/ksuid
- /sdcard/Android/data/####/cache/uil-images/79m5k3vdlwi9pum1drf6qlvxk
- /data/data/####/databases/active.db-journal
- /sdcard/Android/data/####/cache/uil-images/2k99echxethe0k2euetbthq7j
- /sdcard/Android/data/####/cache/uil-images/4jv9nvhu9itg7oa6h49cgkw8u
- /data/data/####/databases/bat_statistics.db-journal
- /data/data/####/files/bigbang.dex
- /data/data/####/shared_prefs/sharedpreferences_batmobi_settings.xml
- /data/data/####/files/DaemonServer
- /sdcard/Android/data/####/cache/uil-images/cc9u9pr6741nx14rkzogbbfp
- /data/data/####/files/cmd/andashi_service.jar
- /sdcard/Android/data/####/cache/uil-images/2568qggxodwgbhot3ra0gp0jo
- /sdcard/Android/data/####/cache/uil-images/62leflan4hrksjulwgzcmjew1
- /sdcard/Android/data/####/cache/uil-images/1lnq5zr3ndlvcnb01upsm4g4p
- /sdcard/Android/data/####/cache/uil-images/6borng1e75v6ei1qzmr4ilfe5
- /data/data/####/files/cmd/cust.prop
- /sdcard/Android/data/####/cache/uil-images/3hjsfw5jgxm476ny6gcbk3xu2
- /data/data/####/databases/dollargetter.db-journal
- /data/data/####/shared_prefs/ContextData.xml
- /sdcard/Android/data/####/cache/uil-images/67ocp61o3bldhq5d4n9v191x9
- /data/data/####/files/cmd/23
- /data/data/####/files/agoo.pid
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /sdcard/baidu/.cuid
- /data/data/####/files/cmd/hideapi_hook.jar
- /sdcard/OnionStore/.log/log.txt
- /data/data/####/cache/JNI--1847835108Temp
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/cmd/hideapi_hook
- /data/data/####/files/cmd/hideapi_hook.jar
- /data/data/####/files/DaemonServer
Другие:
Запускает следующие shell-скрипты:
- sh
Может автоматически отправлять СМС-сообщения.
