Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.396.origin
- Android.DownLoader.348.origin
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- ms####.####.com
- o####.####.com
- file####.####.com
- bj####.####.com
- l####.####.com
- m####.####.com
- a####.####.com
Запросы HTTP GET:
- file####.####.com/urlimg/2016/12/24/151590407.jpg
- m####.####.com/app/server_line.ashx?app_code=####
- ms####.####.com/lhc_result.js?timestamp=####
- file####.####.com/business/2016/05/05/110547523.png
- m####.####.com/member/getPersonalInfo?memberId=####
- a####.####.com/api/app/cangetmoreapplist?platformid=####&client_name=####&version=####
- m####.####.com/app/server_line.ashx?app_code=####&app_version=####
- a####.####.com/service/ad?position=####
- bj####.####.com/lhc_result.js?timestamp=####
- m####.####.com/market/recommendcount
- a####.####.com/api/app/version?id=####
- file####.####.com/urlimg/2017/03/10/203747615.jpg
- a####.####.com/service/ad?position=####×tamp=####
- l####.####.com/lhbd.js
- file####.####.com/business/2016/07/13/110170801.png
- file####.####.com/urlimg/2016/12/24/151385084.jpg
- file####.####.com/urlimg/2017/03/24/152216690.png
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/bim.xml
- /data/data/####/shared_prefs/bid.xml
- /data/data/####/databases/cs.db
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml.bak
- /data/data/####/files/14854185572409.jar
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml
- /data/data/####/shared_prefs/yoappInfo_pre.xml
- /data/data/####/shared_prefs/bak.xml
- /data/data/####/databases/qcut_download.db-journal
- /data/data/####/shared_prefs/bah.xml
- /sdcard/1485418557403u.jar
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/1485418562375b.jar
- /data/data/####/shared_prefs/yoappInfo_pre.xml.bak
- /data/data/####/shared_prefs/bam.xml
- /data/data/####/files/1485418569827.jar
- /data/data/####/databases/yop_download.db-journal
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/shared_prefs/fcut_trategy_pre.xml
- /data/data/####/shared_prefs/coni_io_356507059351895.xml
- /data/data/####/shared_prefs/i.xml
- /data/data/####/shared_prefs/yo_fconf_pre.xml.bak
- /data/data/####/databases/po_download.db-journal
- /data/data/####/shared_prefs/url.xml
- /data/data/####/shared_prefs/ybappInfo_pre.xml
- /data/data/####/cache/64ef15e8ab97dc06de8f9ea3825a12a3.jpg
- /data/data/####/shared_prefs/cix.xml
- /data/data/####/shared_prefs/push.xml
- /data/data/####/shared_prefs/eid.xml
- /data/data/####/shared_prefs/cfj.xml
- /data/data/####/shared_prefs/ybappInfo_pre.xml.bak
- /sdcard/Android/data/code/MID.DAT
- /data/data/####/cache/3d2e00e77db630cdeed0546b0e66186b.jpg
- /data/data/####/cache/2c40d4670651c9c150deab6e790e1472.png
- /data/data/####/shared_prefs/cfb.xml
- /data/data/####/shared_prefs/MyPrefsFile.xml
- /data/data/####/shared_prefs/fcut_conf_pre.xml
- /data/data/####/shared_prefs/yo_fconf_pre.xml
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml
- /data/data/####/shared_prefs/yoconf_pre.xml.bak
- /data/data/####/shared_prefs/yotrategy_pre.xml
- /data/data/####/shared_prefs/ltime.xml
- /data/data/####/files/14854185618075.jar
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/files/14854185569990.jar
- /data/data/####/shared_prefs/ybconf_pre.xml
- /sdcard/1485418557538q.jar
- /data/data/####/databases/cs.db-journal
- /data/data/####/cache/ad774c19349f5825e20ad992926d1020.jpg
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml.bak
- /data/data/####/cache/fa6be05d0d17ec81014a064550e7726f.png
- /data/data/####/files/1485418569829.jar
- /data/data/####/files/14854185568597.jar
- /data/data/####/shared_prefs/coni_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/fcut_conf_pre.xml.bak
- /data/data/####/cache/effdc89dee6fa0e2c8c0f50e91248f9f.png
- /data/data/####/shared_prefs/yoconf_pre.xml
- /data/data/####/shared_prefs/ftime.xml
- /sdcard/1485418557701u.jar
- /data/data/####/shared_prefs/cft.xml
- /data/data/####/shared_prefs/baj.xml
- /data/data/####/shared_prefs/fcut_trategy_pre.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/files/1485418569819.jar
- /data/data/####/shared_prefs/baq.xml
- /data/data/####/databases/db_d.db-journal
- /sdcard/Download/pdat/names.dat
- /sdcard/Download/pdat/share.dat
Другие:
Может автоматически отправлять СМС-сообщения.
