Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.226.origin
- Android.Triada.151.origin
Сетевая активность:
Подключается к:
- 1####.####.152
- m####.####.cn
- 1####.####.com
- c####.####.com
- tpum####.####.com
- g####.####.pw:6601
- 1####.####.152:8080
- 1####.####.199
- i####.####.cn
- a####.####.com
- g####.####.pw
Запросы HTTP GET:
- m####.####.cn/img/icons/201603//28/07e5/56f8ba36d6c47.jpg
- m####.####.cn/img/wp-content/uploads/2016/12/t229-1-300x170.jpg
- m####.####.cn/img/20170324/12123.gif
- m####.####.cn/img/icons/201603//28/814b/56f8b90f3953c.jpg
- m####.####.cn/img/wp-content/uploads/2016/12/t226-1-300x153.jpg
- m####.####.cn/img/wp-content/uploads/2016/12/t225-1-300x189.jpg
- m####.####.cn/img/icons/201603//28/b402/56f8ba0954f7f.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- c####.####.com/ip2city.asp
- m####.####.cn/video/tysy/t226.mp4
- 1####.####.com/ic.asp
- m####.####.cn/img/wp-content/uploads/2016/07/zsq25.jpg
- m####.####.cn/img/20170321/4.gif
- m####.####.cn/img/wp-content/uploads/2016/12/t227-1-300x144.jpg
- tpum####.####.com/thirdPay/pay/gateway?appId=####&partnerId=####&channelOrderId=####&platform=####&totalFee=####&body=####&sdkVersion=####&attach=####...
- m####.####.cn/img/wp-content/uploads/2016/12/t228-1-300x161.jpg
- m####.####.cn/img/guoguo/money/mm.png
- m####.####.cn/img/20170326/tokyo_hot-k1375[00_01_20][20170326-232126-0].JPG
- m####.####.cn/img/20170326/32200006209.jpg
- m####.####.cn/img/wp-content/uploads/2016/12/t223-1-300x178.jpg
- m####.####.cn/img/icons/201603//28/d01c/56f8b83d674ef.jpg
- m####.####.cn/img/icons/201603//17/9a31/56eab6108f0c1.jpg
- m####.####.cn/img/wp-content/uploads/2016/07/zsq84.jpg
Запросы HTTP POST:
- 1####.####.152/app/v/videoList
- 1####.####.152/app/v/payRequest
- 1####.####.152/app/v/commentList
- 1####.####.199/api/v1/config
- 1####.####.152/app/v/configList
- g####.####.pw:6601/kitmain.aspx
- i####.####.cn/iplookup/iplookup.php?format=####
- a####.####.com/app_logs
- g####.####.pw/kitmain.aspx
- 1####.####.152:8080/app/v/activate
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/picasso-cache/2343949e31727a465109aad82943b877.1.tmp
- /data/data/####/databases/cc.db-journal
- /data/data/####/cache/picasso-cache/3f1e3c011fb43b3c3999a694b21e7a28.0.tmp
- /data/data/####/cache/picasso-cache/0788926905ae75340b05d22791145880.1.tmp
- /sdcard/.uct/uuid3252add63-9ed3-4b43-89d8-6c4f89ea4b4d.tmp
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/Wa4t0UhJ7yCVnJdDUteyHQ==/4X0BaXx5L6YV7HY1
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/volley/12352018891704560014
- /data/data/####/files/queivg_d/queivg_f.zip
- /data/data/####/cache/picasso-cache/65158b98a2fd67a6272d8ec0f5391773.1.tmp
- /sdcard/sdtmp/id2b59fc35c-dd1f-4086-a493-92a5175d3104.tmp
- /data/data/####/databases/ua.db-journal
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/QjYcWHcFCBupoilUQ_NPFA==.new
- /data/data/####/cache/picasso-cache/31db4d984724810d66841f8763eb905e.1.tmp
- /data/data/####/cache/picasso-cache/755656c9f29f250c756a6a7e6ee25ef4.1.tmp
- /data/data/####/files/rdata_comzndvsqew.new
- /data/data/####/cache/picasso-cache/3f1e3c011fb43b3c3999a694b21e7a28.1.tmp
- /data/data/####/cache/picasso-cache/11b737c39269d1f88efe02794243f292.1.tmp
- /data/data/####/cache/picasso-cache/journal
- /data/data/####/cache/picasso-cache/85e46c4f9bac1f5f7ee82a2ec3994bad.0.tmp
- /data/data/####/app_devid/uuid3
- /data/data/####/cache/picasso-cache/85e46c4f9bac1f5f7ee82a2ec3994bad.1.tmp
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/Wa4t0UhJ7yCVnJdDUteyHQ==/M1XaCJAaMY0QA-wHUzv_Hw==
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/picasso-cache/11b737c39269d1f88efe02794243f292.0.tmp
- /sdcard/tmpsd11012/test.dat29974b97-07dc-4891-ab8f-dee5342977ae.tmp
- /data/data/####/cache/picasso-cache/6832a8b2b160020e30a6b5f7819c8790.1.tmp
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/ychYacTxk98wxrXYkiGIGA==/data.dat.tmp
- /sdcard/sdtmp/id2d48cd977-9579-456b-acd0-decbc9bbe771.tmp
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/YBWD4RIjgdp700xPkJoTdg==.new
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/cache/picasso-cache/3966d6a6058c47bbae4dc781227ba408.1.tmp
- /data/data/####/cache/picasso-cache/64d228b5db70f24c5973e88f62e52dc1.1.tmp
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/cache/picasso-cache/3966d6a6058c47bbae4dc781227ba408.0.tmp
- /data/data/####/cache/picasso-cache/755656c9f29f250c756a6a7e6ee25ef4.0.tmp
- /data/data/####/files/exid.dat
- /data/data/####/cache/picasso-cache/31db4d984724810d66841f8763eb905e.0.tmp
- /sdcard/sdtmp/id1a6113ff0-982e-4943-abc5-def98a5e6089.tmp
- /data/data/####/files/.imprint
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/cache/picasso-cache/680b1b43b214fac35f4fa2926c14a625.1.tmp
- /data/data/####/cache/picasso-cache/2343949e31727a465109aad82943b877.0.tmp
- /data/data/####/cache/picasso-cache/76e3e768903acaeeda8c311cc74cdaf5.0.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/picasso-cache/fb803772a6bc48d14bfef10773e231e6.1.tmp
- /data/data/####/cache/picasso-cache/ab5eab2c2e9ba8b6339c74830f0f59be.1.tmp
- /data/data/####/cache/picasso-cache/f2cd9d659876f69b72aa0d5104d3599c.1.tmp
- /data/data/####/cache/picasso-cache/64d228b5db70f24c5973e88f62e52dc1.0.tmp
- /data/data/####/cache/picasso-cache/53eea9a89c5aeba990fe963a1462b2b2.0.tmp
- /data/data/####/cache/picasso-cache/53eea9a89c5aeba990fe963a1462b2b2.1.tmp
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/PsTJ6URZPuLvYLzCQq-QdA==/L8zNnp-ALJxiUgDn.zip
- /data/data/####/cache/picasso-cache/0788926905ae75340b05d22791145880.0.tmp
- /data/data/####/cache/picasso-cache/76e3e768903acaeeda8c311cc74cdaf5.1.tmp
- /data/data/####/cache/picasso-cache/f2cd9d659876f69b72aa0d5104d3599c.0.tmp
- /data/data/####/app_hand/lastacc
- /sdcard/sdtmp/id17900939b-731e-4907-8357-2604234c9261.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/app_po/p7.apk
- /sdcard/.hand/lastacc43823bbb-f55c-49b7-b04d-5328e5d0af1d.tmp
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/cache/picasso-cache/3bba6d04c2810166983cbb7e6ece9787.1.tmp
- /data/data/####/cache/picasso-cache/3bba6d04c2810166983cbb7e6ece9787.0.tmp
- /data/data/####/cache/picasso-cache/65158b98a2fd67a6272d8ec0f5391773.0.tmp
- /data/data/####/cache/picasso-cache/680b1b43b214fac35f4fa2926c14a625.0.tmp
- /data/data/####/cache/picasso-cache/6832a8b2b160020e30a6b5f7819c8790.0.tmp
- /sdcard/.hand/lastacc347fd3d8-5f7b-47fc-8109-19b0f27d5519.tmp
- /data/data/####/cache/picasso-cache/fb803772a6bc48d14bfef10773e231e6.0.tmp
- /data/data/####/cache/ACache/-437307511
- /data/data/####/shared_prefs/rtparam5.xml
- /data/data/####/files/2jaJfq8TPCaEgYk0MrSF8C7kyD9DMddk/QjYcWHcFCBupoilUQ_NPFA==
- /data/data/####/cache/picasso-cache/ab5eab2c2e9ba8b6339c74830f0f59be.0.tmp
Другие:
Запускает следующие shell-скрипты:
- conbb od2gf04pd9
- ls -l /system/bin/su
- /system/bin/.nbwayxwzt
- getprop ro.yunos.build.version
- cat /sys/class/net/wlan0/address
Может автоматически отправлять СМС-сообщения.
