Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.226.origin
- Android.Triada.151.origin
Сетевая активность:
Подключается к:
- g####.####.pw:6601
- 1####.####.com
- 1####.####.152
- 1####.####.152:8080
- 1####.####.199
- i####.####.cn
- c####.####.cn
- a####.####.com
- g####.####.pw
Запросы HTTP GET:
- c####.####.cn/img/wp-content/uploads/2016/12/t223-1-300x178.jpg
- 1####.####.com/ic.asp
- c####.####.cn/img/wp-content/uploads/2016/11/mn.png
- c####.####.cn/img/icons/201603//17/159a/56eab4cde4402.jpg
- c####.####.cn/img/20170321/4.gif
- c####.####.cn/img/wp-content/uploads/2016/11/mt.png
- c####.####.cn/img/icons/201603//17/0806/56eab7b3da7e1.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t228-1-300x161.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t229-1-300x170.jpg
- c####.####.cn/img/icons/201603//28/39fa/56f8ba86b7873.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- c####.####.cn/img/20170325/12123.gif
- c####.####.cn/img/20170116/8c27264f-ff4b-4c7c-8c09-e1fb12012119-001.jpg
- c####.####.cn/img/20170326/32200006209.jpg
- c####.####.cn/img/20170326/tokyo_hot-k1375%5B00_01_20%5D%5B20170326-232126-0%5D.JPG
- c####.####.cn/img/wp-content/uploads/2016/12/t212-1-300x170.jpg
- c####.####.cn/img/icons/201603//28/d01c/56f8b83d674ef.jpg
- c####.####.cn/img/icons/201603//28/b402/56f8ba0954f7f.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t219-1-300x168.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t218-300x170.jpg
- c####.####.cn/img/20170321/6.gif
- c####.####.cn/img/icons/201603//17/0b9a/56eab218c76da.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t234-1-300x162.jpg
- c####.####.cn/img/icons/201603//17/437f/56eab29455201.jpg
- c####.####.cn/img/icons/201603//17/ef15/56eab53bc35f2.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t226-1-300x153.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t227-1-300x144.jpg
- c####.####.cn/img/20170206/3d72f766-4916-4def-b831-d5580977dd73-001.jpg
- c####.####.cn/img/20170316/337ba2b72b9d10a3f639efa018480017.jpg
- c####.####.cn/img/wp-content/uploads/2016/12/t225-1-300x189.jpg
- c####.####.cn/img/icons/201603//28/bdd1/56f8b99a5002b.jpg
- c####.####.cn/img/icons/201603//28/6149/56f8b8b426316.jpg
- c####.####.cn/img/20170324/12123.gif
Запросы HTTP POST:
- 1####.####.152/app/v/activate
- 1####.####.152/app/v/commentList
- 1####.####.199/api/v1/config
- 1####.####.152:8080/app/v/configList
- g####.####.pw:6601/kitmain.aspx
- i####.####.cn/iplookup/iplookup.php?format=####
- a####.####.com/app_logs
- g####.####.pw/kitmain.aspx
- 1####.####.152/app/v/videoList
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/image_manager_disk_cache/013c432b7c4e1336cd0e513816a62147ea72eba3be87a11406a8850125d1042e.0.tmp
- /data/data/####/databases/cc.db-journal
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/cache/image_manager_disk_cache/ac48d57035c178581c5e3dbc1b8ad358aff908c49aca8fb51418c496fc157b0c.0.tmp
- /data/data/####/databases/ua.db
- /data/data/####/cache/image_manager_disk_cache/0a96402f0253d919fda492e28b58f8d666c1f54b0f91e3716e32e9ca46c874d7.0.tmp
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/image_manager_disk_cache/30d4cdd4b428d42e522387f392b28d8634b8def7a210e8b882eabf0ac1b74e19.0.tmp
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/image_manager_disk_cache/3530a7b62a5140e479022d532c1c9a86c950a2e85ce672f4a29230bc1ab127fa.0.tmp
- /data/data/####/files/queivg_d/queivg_f.zip
- /data/data/####/cache/image_manager_disk_cache/b1acd02584cb9cf83555dfbe1975c717aa5b45d4876c7609e6cc783e52a7efa9.0.tmp
- /data/data/####/cache/image_manager_disk_cache/b385d68931cf2d84cd2e5997e6653062bc02eb745deb2a5399b646abdba23908.0.tmp
- /data/data/####/databases/ua.db-journal
- /data/data/####/cache/image_manager_disk_cache/dc9570f37238af9d4dd05a37d5eb85677ca866e28e5e4b216a1b609e941fa521.0.tmp
- /data/data/####/cache/image_manager_disk_cache/dcdee6a1f952ab66d4f351af1e473c478f8cc0604dc17e455ada0353650ea364.0.tmp
- /data/data/####/files/rdata_comzndvsqew.new
- /data/data/####/cache/image_manager_disk_cache/370cc08e0dbc7b0f4cc1979d3b8275a5efe361de129598c5e514007345ec45a6.0.tmp
- /sdcard/sdtmp/id1e814a8f2-8ef9-4e0d-9061-d435d1011db8.tmp
- /data/data/####/cache/image_manager_disk_cache/a3b492ef1720831786b8b18456988b131c6bf03a2863b7bfff3d7ce33c2d3021.0.tmp
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/dR2UcKoU6_Rqtrg3fZJeAA==/data.dat.tmp
- /data/data/####/cache/image_manager_disk_cache/254710451bdf5afeb1b39305ce2f824542d9a3a81371ab83ba6e1b0d7c351c0f.0.tmp
- /data/data/####/app_devid/uuid3
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/sdtmp/id1d3e29eb7-12a1-4636-a2a1-5983c695a6a1.tmp
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/m5-UsccVeauU_ZiNw_QqIA==/lH_om-b_9fax5etH.zip
- /sdcard/sdtmp/id217e10758-e33c-4339-a16c-75deb0c03609.tmp
- /sdcard/tmpsd11012/test.datad703fe7-9494-4101-aa08-2cadc5f7aab1.tmp
- /data/data/####/cache/image_manager_disk_cache/0c29d75ea9e2a89575adcb281cfedaa3eb99beca3a5b1ce6966ce8ecea0b4efc.0.tmp
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/cache/image_manager_disk_cache/67fb2041f401afd4d551f23b644ce0c316a4940110d211c3de07973bcd1b6e85.0.tmp
- /data/data/####/cache/image_manager_disk_cache/3d7cbe4046bbee96ac8cce62964b7f440af7c7441e1e1d8539998a3eb4f8f134.0.tmp
- /data/data/####/cache/image_manager_disk_cache/026ca01714562f45f6ba4434c30aa1ecef0abdb943935919ba947d89e42170f5.0.tmp
- /data/data/####/cache/image_manager_disk_cache/86cf50a2089da90908cb44387facaa117ee6916fd55e8cdb511329682e383905.0.tmp
- /data/data/####/cache/image_manager_disk_cache/7b6fd79268d80ca89bfd61f0597d94b4b1a2b7c2495bd97ac4e701f35a422bb0.0.tmp
- /sdcard/.hand/lastaccc3b6026f-f709-4674-9fbd-12119b4bb18a.tmp
- /data/data/####/shared_prefs/rtparam5.xml
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /data/data/####/cache/image_manager_disk_cache/81fd048330b9ec9637872a44698370262c270d104f98d8cecb757c1e2639ac94.0.tmp
- /data/data/####/files/exid.dat
- /data/data/####/cache/image_manager_disk_cache/2c7abf6490eab7064ea90beb1858b9a57f38ddc68f8e0108743baa963fcde5b8.0.tmp
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/LudPxDkDdotds_u1SBWoGg==.new
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/cache/image_manager_disk_cache/1e2489f17364644049fdfccf9e42c3335a28afa5e63249e7191656eb638f1f3f.0.tmp
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/ne7xkut4sqkP4GbEqowVoA==.new
- /data/data/####/cache/image_manager_disk_cache/ff84bbd07200432dc09755aaac707318dd21d1a9f7bd6764962b19dae4161406.0.tmp
- /data/data/####/cache/image_manager_disk_cache/43819e7108b1022ddd6fe3c7134f11350cf3f15531429c55368e99eed8ea4aa7.0.tmp
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/09hbzYpD2vnOOBZmOLMwvQ==/WiMcYQKSJnCM30FBHorayQ==
- /data/data/####/cache/image_manager_disk_cache/3b62831594121146c74110571b332664de4d53b6dd552183619897aeda284d47.0.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/image_manager_disk_cache/8663bba2d3e3d14651e4c103e224a7fedebec4719d44d77fefbb9345f067a546.0.tmp
- /data/data/####/cache/image_manager_disk_cache/1fe7c228c341be124ca07b9cb69b4d5d76f63b1d350d0c2ca80b767f0e602b25.0.tmp
- /data/data/####/app_hand/lastacc
- /data/data/####/app_po/p7.apk
- /data/data/####/cache/image_manager_disk_cache/ab8c2ad4f1b92ff7f303cc9cc3f7f4009e6611053b3668fd161b0bfadee01f11.0.tmp
- /data/data/####/cache/image_manager_disk_cache/0a5aa52e204db29af1b16301d81adf3172eb4e9e10673aa1e375f7aa9ae7c5b3.0.tmp
- /data/data/####/files/OaJchEggelRQgOwcATpvcL6ScC8GHjvk/09hbzYpD2vnOOBZmOLMwvQ==/KRH2r30B9AAC72eu
- /sdcard/sdtmp/id2ca592196-c20e-4f4b-a6fc-7ccb7d558e83.tmp
- /sdcard/.uct/uuid3b796d719-f1bf-435a-bcd0-5f8a52b6bef6.tmp
- /data/data/####/cache/image_manager_disk_cache/4313cf4b4ab1a4dc4f5a85327c4c292db334596fe1cab55031068555e755668a.0.tmp
- /sdcard/sdtmp/id2
- /data/data/####/cache/image_manager_disk_cache/feefaa9fb5967a174b14b77ebf1b469a4386a5241fd3ec49412d979d28277452.0.tmp
- /data/data/####/cache/image_manager_disk_cache/ada7abeabd1ebd7342f7f13a2ceea4e1069f4c1cea6ac1e07c7d52205d0794c4.0.tmp
- /sdcard/.hand/lastaccf6af3cb3-ebd7-4df7-af28-4a1cd8d1b995.tmp
- /data/data/####/cache/image_manager_disk_cache/20545862938ebf0f6c01af87c0e03e4c926afa2a34748fa495ec2fbea88276da.0.tmp
Другие:
Запускает следующие shell-скрипты:
- cat /sys/class/net/wlan0/address
- /system/bin/.nbwayxwzt
- ls -l /system/bin/su
- getprop ro.yunos.build.version
- conbb od2gf04pd9
Может автоматически отправлять СМС-сообщения.
