Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Tool.SMSSend.76.origin
Сетевая активность:
Подключается к:
- t####.com
- t####.####.com
- v####.####.com
- h####.####.com
- jt####.com:8082
- w####.####.top
- s####.####.com
- r####.####.com
- jt####.com
- z####.####.com
- r####.####.com:81
- m####.####.com
- w####.####.top:9000
- a####.####.com
Запросы HTTP GET:
- v####.####.com/m/
- m####.####.com/static/upload/1397543848.png
- m####.####.com/static/upload/1430195919@2x.png
- m####.####.com/static/upload/1433410324@2x.png
- v####.####.com/h5/static/images/i_qy.png
- t####.####.com/m/2621865.html
- m####.####.com/static/js/weather.js
- v####.####.com/img/2017/03/25/sohutv/tvs/2/u419ax94A1H.jpg
- m####.####.com/static/upload/1397543885.png
- v####.####.com/h5/static/js/main.js
- m####.####.com/static/upload/1430196036@2x.png
- m####.####.com/website
- w####.####.top/api/info/config?key=####
- m####.####.com/static/upload/1430196072@2x.png
- t####.com/index?u=####&n=####&q=####&tj=####&i=####&uid=####
- v####.####.com/h5/static/css/css.css
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&showp=####&t=####&umuuid=####&h=####&rnd=####
- m####.####.com/static/upload/1437527773@2x.png
- v####.####.com/video/H5/static/images/ysdq.jpg
- v####.####.com/h5/static/images/logo.png
- v####.####.com/img/2017/03/23/youku/tvs/10/d036637lbF0.jpg
- m####.####.com/static/js/ylmf_mb.js
- m####.####.com/static/upload/1430196054@2x.png
- v####.####.com/img/up_img/201602/145647113330812.jpg
- m####.####.com/static/upload/1397543857.png
- m####.####.com/static/upload/1463545942@2x.png
- m####.####.com/x/page/u/4/j/u0327tx3a4j.html
- m####.####.com/static/js/common.js
- m####.####.com/static/upload/1463545853@2x.png
- m####.####.com/static/upload/1430196126@2x.png
- m####.####.com/search?fm=####
- m####.####.com/
- m####.####.com/static/js/zepto.min.js
- v####.####.com/video/H5/static/images/close.png
- m####.####.com/static/upload/1430195699@2x.png
- m####.####.com/static/js/fastClick.js
- m####.####.com/static/upload/1430195668@2x.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- s####.####.com/stat.php?id=####&web_id=####
- m####.####.com/static/upload/1430195934@2x.png
- m####.####.com/static/upload/1463545746@2x.png
- m####.####.com/static/upload/1397543866.png
- m####.####.com/static/upload/1430195773@2x.png
- v####.####.com/h5/static/js/ylmf_mb.min.js
- m####.####.com/static/images/s.png
- m####.####.com/static/upload/1463545813@2x.png
- m####.####.com/static/upload/1397543835.png
- m####.####.com/static/upload/1463556198@2x.png
- m####.####.com/static/upload/1463556231@2x.png
- m####.####.com/static/upload/1397543875.png
- m####.####.com/index.php?ct=####&ac=####&id=####&cache=####
- h####.####.com/hm.js?d1f57d1####
- m####.####.com/static/upload/1397543815.png
- m####.####.com/static/css/star.ttf
- m####.####.com/static/upload/1430195989@2x.png
- v####.####.com/h5/static/images/icon.png
- v####.####.com/img/up_img/201607/146960183446907.jpg
- s####.####.com/core.php?web_id=####&t=####
- m####.####.com/static/css/main.css
- v####.####.com/img/up_img/201606/146520499218492.jpg
- m####.####.com/static/upload/1463545962@2x.png
- v####.####.com/img/up_img/201609/147435666278693.jpg
- m####.####.com/static/upload/1463556142@2x.png
- m####.####.com/static/upload/1457927201@2x.jpeg
- v####.####.com/img/2017/03/25/qq/tvs/1/Y8084m0P989.jpg
- v####.####.com/img/up_img/201607/146830409492682.jpg
Запросы HTTP POST:
- r####.####.com:81/apione.php?do=####
- jt####.com/register
- w####.####.top:9000/d/atv?did=####&cid=####&vid=####&tid=####&no=####&ei=####&si=####&model=####&area=####&osVer=####
- r####.####.com/apione.php?do=####
- a####.####.com/app_logs
- m####.####.com/index.php
- jt####.com/feeinfo
- jt####.com:8082/net
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/dex/uz.jar
- /data/data/####/shared_prefs/user_20160607.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/files/mjuli.jar
- /data/data/####/shared_prefs/RPF.xml
- /data/data/####/shared_prefs/device.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/RPF.xml.bak
- /sdcard/device
- /sdcard/log/_lk_.log
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- reset
- unzip
- "/system/bin/clock.bin ebf05813c1"
- tar
- uncompress
- mke2fs
- netstat
- "/system/xbin/clock.bin ebf05813c1"
- telnet
- conbb od2gf04pd9
- uudecode
- brctl
- sh
- "/system/etc/clock.bin ebf05813c1"
- find
- su8
Может автоматически отправлять СМС-сообщения.
