Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.155.origin
Сетевая активность:
Подключается к:
- t####.####.com
- 1####.####.34:19000
- h####.####.com
- i####.####.com
- c####.####.com
- w####.####.com
- dn-gro####.####.me
Запросы HTTP GET:
- h####.####.com/static/js/md5.js
- i####.####.com/10010/upfile/v1/56e6e372ce319.jpg
- h####.####.com/static/js/remodal/remodal.min.js
- i####.####.com/10010/upfile/v1/56dd105ae247d.jpg
- h####.####.com/static/css/base.css
- h####.####.com/static/js/dragloader.js
- h####.####.com/static/skin1/images/pay-head.jpg
- i####.####.com/10010/upfile/v1/5704b5ccba82f.jpg
- i####.####.com/10010/upfile/v1/56e6ca670679e.jpg
- i####.####.com/10010/upfile/v1/56e6de9d234fa.jpg
- h####.####.com/upfile/v1/56d6ee6ba4cfd.jpg
- i####.####.com/10010/upfile/v1/56e6dd2b4d386.jpg
- w####.####.com/918shikan/1.mp4
- h####.####.com/json/channel_14.json
- i####.####.com/10010/upfile/v1/56dcfc0dd12e4.jpg
- h####.####.com/static/skin1/images/play.png
- h####.####.com/upfile/v1/570493b64e492.jpg
- i####.####.com/10010/upfile/v1/56e6dbc962204.jpg
- i####.####.com/10010/upfile/v1/56e6e08a15ccf.jpg
- h####.####.com/static/js/spin.min.js
- i####.####.com/10010/upfile/v1/56e6df9b1d772.jpg
- i####.####.com/10010/upfile/v1/56d7f84e41165.jpg
- i####.####.com/10010/upfile/v1/56ed5844dcc93.jpg
- dn-gro####.####.me/vds.js
- i####.####.com/10010/upfile/v1/5704b3feec011.jpg
- i####.####.com/10010/upfile/v1/56d9537c48bee.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####&sn=####
- h####.####.com/upfile/v1/56ed9f973199c.jpg
- i####.####.com/10010/upfile/v1/56e78d6b92735.jpg
- h####.####.com/static/css/swiper.min.css
- i####.####.com/10010/upfile/v1/56d96048f3067.jpg
- h####.####.com/json/slide.json
- i####.####.com/10010/upfile/v1/56ed59c2ec1c7.jpg
- h####.####.com/channel.html
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- h####.####.com/static/css/common.css
- i####.####.com/10010/upfile/v1/5704b4abde34b.jpg
- w####.####.com/ban/?callback=####&_=####
- h####.####.com/upfile/v1/56d7f7eac479b.jpg
- h####.####.com/upfile/v1/56d6f7be3df5d.jpg
- i####.####.com/10010/upfile/v1/5704b13872461.jpg
- h####.####.com/json/channel_7.json
- i####.####.com/10010/upfile/v1/57077d9f6be67.jpg
- h####.####.com/?c=####
- i####.####.com/10010/upfile/v1/56dd081e7ff95.jpg
- h####.####.com/static/js/swiper.jquery.min.js
- i####.####.com/10010/upfile/v1/56db07c34d57f.png
- h####.####.com/static/skin1/images/close.png
- t####.####.com/products/80f5437e815e47e6/web/h5.tt-hongkong.com/settings/general
- i####.####.com/10010/upfile/v1/56d9600d8a748.jpg
- h####.####.com/hm.js?cc80756####
- h####.####.com/home.html
- i####.####.com/10010/upfile/v1/56ed59243a3a3.jpg
- i####.####.com/10010/upfile/v1/56f7decb72ecd.jpg
- h####.####.com/static/skin1/images/icon.png
- i####.####.com/10010/upfile/v1/56d952bb9fb9b.png
- h####.####.com/json/channel_1.json
- h####.####.com/static/js/jquery-2.0.3.min.js
- h####.####.com/upfile/v1/5704bfed97379.jpg
- i####.####.com/10010/upfile/v1/57077ef1972da.jpg
- i####.####.com/10010/upfile/v1/56f637fec8b1d.jpg
- c####.####.com/json/1061_block.json
- h####.####.com/static/skin1/images/pay_weixin.png
- i####.####.com/10010/upfile/v1/5704b5765eeee.jpg
- i####.####.com/10010/upfile/v1/56e7cf9378895.jpg
- h####.####.com/static/js/common.min.js
- h####.####.com/static/skin1/images/pay_alipay.png
- i####.####.com/10010/upfile/v1/5704b68edb472.jpg
- h####.####.com/json/channel_13.json
Запросы HTTP POST:
- 1####.####.34:19000/v2/chis
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.libs/libus.so
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/zzconfig.xml
- /sdcard/Download/channel_conf1
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Download/channel_conf
- /sdcard/.twservice/qshp_3002_2206.zip
- /data/data/####/EOZTzhVG.jar
- /data/data/####/files/mobclick_agent_cached_####305
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/sbcnua_d/sbcnua_f.zip
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
