Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.248.origin
- Android.Triada.226.origin
Сетевая активность:
Подключается к:
- statis####.####.com
- mo####.####.com
- o####.####.com
- r####.####.com
- mobads-####.####.com
- a####.####.com
Запросы HTTP GET:
- r####.####.com/res/qclx/upload/theme/1431682554451..jpg
- r####.####.com/res/qclx/upload/theme/1427873805802..jpg
- r####.####.com/res/qclx/upload/theme/1412729631026..jpg
- r####.####.com/res/qclx/upload/theme/1393483926454qrj2.jpg
- r####.####.com/res/qclx/upload/theme/1421138604394..zip
- r####.####.com/res/qclx/upload/theme/1415081733337..jpg
- r####.####.com/res/qclx/upload/theme/1412250535632..jpg
- r####.####.com/adsw/qclx.html
- r####.####.com/res/qclx/upload/theme/1428048473040..jpg
- r####.####.com/res/qclx/upload/theme/1418367150365..jpg
- r####.####.com/res/qclx/upload/theme/1412729604977..jpg
- mo####.####.com/cpro/ui/mads.php?code2=####
- r####.####.com/res/qclx/upload/theme/1416380439022..jpg
- mo####.####.com/ads/pa/8/__xadsdk__remote__8.35.jar
- mo####.####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=##...
- r####.####.com/res/qclx/upload/theme/1426056237191..jpg
- r####.####.com/res/qclx/upload/theme/1421138618872..jpg
- r####.####.com/res/qclx/upload/theme/1423813837383..jpg
- r####.####.com/res/qclx/upload/theme/1412836049508..jpg
- r####.####.com/res/qclx/upload/theme/1409736834693..jpg
- r####.####.com/res/qclx/upload/theme/1419579661046..jpg
- r####.####.com/res/qclx/upload/theme/1423556874348..jpg
- r####.####.com/res/qclx/upload/theme/1438591925655..jpg
Запросы HTTP POST:
- statis####.####.com/statistics/config.json
- o####.####.com/check_config_update
- r####.####.com/doc/service/down/user_info.json
- r####.####.com/doc/service/down/loading_page.json
- r####.####.com/doc/service/down/advertInfo.json
- mobads-####.####.com/brwhis.log
- r####.####.com/doc/service/up/init.json
- statis####.####.com/statistics/pv_uv.json
- r####.####.com/doc/service/down/vip_list.json
- statis####.####.com/statistics/init.json
- statis####.####.com/statistics/oprdetail.json
- statis####.####.com/statistics/event.json
- r####.####.com/doc/service/down/notify.json
- r####.####.com/doc/service/down/lazy_suit_list.json
- a####.####.com/app_logs
- r####.####.com/doc/service/down/theme_list_new.json
- r####.####.com/doc/service/down/audit.json
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/databases/call_desk.db-journal
- /sdcard/syezon/qclx/show/list/cache/4d88b9f74ecd684e49689060f45cb0c1
- /data/data/####/style/preview/res/drawable/pic01.png
- /data/data/####/style/preview/res/drawable/pic02.png
- /data/data/####/style/preview/res/drawable/shine02.png
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/syezon/qclx/show/v_cache/-506908304-1614137658
- /sdcard/syezon/qclx/show/list/cache/14f0bd847dde4d38fa02d5bbab6aa7e8
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/style/preview/res/drawable/bg01.jpg
- /data/data/####/style/preview/res/drawable/pic03.png
- /sdcard/syezon/qclx/show/v_cache/-495963660-102581025
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/syezon/call_plug/callshow/ringing/previewres/raw/theme_ring.mp3
- /data/data/####/style/preview/res/drawable/shine01.png
- /data/data/####/style/preview/res/drawable/wl02.png
- /data/data/####/shared_prefs/com.baidu.mobads.loader.xml
- /data/data/####/style/preview/res/drawable/bg02.jpg
- /sdcard/syezon/qclx/show/v_cache/120294170114595718
- /data/data/####/style/preview/res/drawable/answer01.png
- /data/data/####/style/preview/res/drawable/Keyboard02.png
- /data/data/####/style/preview/res/drawable/f01.png
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/syezon_agent_online_setting_####.xml.bak
- /data/data/####/style/preview/res/drawable/Keyboard01.png
- /sdcard/syezon/qclx/show/v_cache/-495963660213707036
- /data/data/####/style/preview/res/drawable/f02.png
- /data/data/####/style/preview/res/drawable/f03.png
- /sdcard/syezon/qclx/show/v_cache/-495963660649528269
- /data/data/####/files/heeivw_d/heeivw_f.zip
- /sdcard/syezon/qclx/show/v_cache/-495963660203585586
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/nGMDYrS0vppI9iOj5hguoA==/5wHj_EBYcPAQJj7ss4dXYQ==
- /sdcard/syezon/qclx/show/list/cache/d88a53364e3c48063b14948f3b42ae51
- /data/data/####/style/preview/ThemeBeautifulgirl.jar
- /data/data/####/style/preview/res/drawable/answer02.png
- /data/data/####/fileCache/vip_info_list.dat
- /data/data/####/shared_prefs/__xadsdk_downloaded__version__.xml
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- /sdcard/syezon/qclx/show/list/cache/74c6f06cad87589aadda8252528d6997
- /sdcard/syezon/qclx/show/list/cache/33deb1efc35d093734863a0622343e20
- /sdcard/syezon/qclx/show/list/cache/5980f9b28206fb96407a120c712120f3
- /sdcard/syezon/qclx/show/v_cache/-4959636601473599999
- /sdcard/.android/mobclick_agent_cache/####/detail
- /sdcard/syezon/qclx/show/v_cache/-200175017105419172
- /data/data/####/shared_prefs/__x_adsdk_agent_header__.xml
- /sdcard/syezon/qclx/show/list/cache/.nomedia
- /sdcard/syezon/qclx/show/v_cache/-495963660924528982
- /sdcard/syezon/qclx/show/list/cache/96edb042af1365791739f207a9068c42
- /data/data/####/shared_prefs/call_config.xml
- /data/data/####/shared_prefs/com.baidu.mobads.loader.xml.bak
- /data/data/####/files/umeng_it.cache
- /sdcard/syezon/qclx/show/list/cache/a7293682c59d4fd488ec23baf94395cc
- /data/data/####/style/preview/res/drawable/hd01.png
- /data/data/####/style/preview/res/drawable/ending01.png
- /data/data/####/style/preview/res/drawable/ending02.png
- /data/data/####/style/preview/res/drawable/Speaker02.png
- /sdcard/syezon/qclx/show/style/1421138604394..zip
- /sdcard/syezon/qclx/show/v_cache/-495963660-1756166818
- /sdcard/.android/mobclick_agent_cache/####/flowadd
- /data/data/####/style/preview/res/drawable/refusal02.png
- /data/data/####/shared_prefs/period_time.xml
- /data/data/####/style/preview/res/drawable/f04.png
- /sdcard/syezon/qclx/show/v_cache/-495963660-154784185
- /sdcard/syezon/qclx/show/list/cache/1946979e5be35e9e127c989a2166a689
- /sdcard/syezon/qclx/show/v_cache/-495963660343279853
- /sdcard/syezon/qclx/show/.nomedia
- /sdcard/syezon/qclx/show/list/cache/dc52116bbe654829687835d76d7f4905
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/RGhKu3ChPZPK2LtrpFSizw==/data.dat.tmp
- /sdcard/syezon/launcher/.nomedia
- /sdcard/syezon/qclx/show/list/cache/66acbbe24d6ac91ceb907ae43c397cef
- /sdcard/.android/mobclick_agent_cache/####/event
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/nGMDYrS0vppI9iOj5hguoA==/0PVHNe90w5d1Mmih
- /sdcard/syezon/qclx/show/list/cache/d0941b1636b8ffbe12d74e60aee4a62d
- /sdcard/syezon/qclx/show/v_cache/-495963660602061177
- /sdcard/syezon/qclx/show/list/cache/238f8ba01df6f07df549db46e8e6adfc
- /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
- /sdcard/syezon/qclx/show/v_cache/-495963660-286469699
- /data/data/####/style/preview/res/drawable/Speaker01.png
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__525d6e09-749d-4289-8ffb-fa7614c151d1.jar
- /data/data/####/style/preview/res/drawable/wl01.png
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/zsWbJAsADar8cwia2uT4AQ==.new
- /data/data/####/files/rdata_comhongdaccd.new
- /data/data/####/style/preview/res/drawable/refusal01.png
- /data/data/####/files/rdata_comhongdaccd
- /sdcard/syezon/qclx/show/v_cache/-495963660-384213692
- /data/data/####/style/preview/res/drawable/hd02.png
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/syezon/qclx/show/v_cache/-495963660230059175
- /sdcard/syezon/qclx/show/v_cache/-495963660-1320325247
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/wtj-R6fQrhF-6b7NkyClWw==.new
- /sdcard/syezon/qclx/show/list/cache/9a4a106e1aa0b373b1edb4baafbf136f
- /data/data/####/cache/volley/-1177802923-2134083281
- /data/data/####/style/preview/res/drawable/shine03.png
- /data/data/####/files/.imprint
- /sdcard/syezon/qclx/show/list/cache/1ede5169866a6322fa23055b23373e19
- /sdcard/syezon/qclx/show/v_cache/-495963660-2090435956
- /sdcard/syezon/qclx/show/list/cache/b0b2f391e7faf447832c4c3a0da9c953
- /sdcard/syezon/qclx/show/v_cache/-495963660-1305326981
- /data/data/####/shared_prefs/syezon_agent_online_setting_####.xml
- /sdcard/syezon/qclx/show/v_cache/-4959636601266024713
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/syezon/qclx/show/list/cache/a7afd1d05cc72a01c85bf77e5b2d3abd
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/call_config.xml.bak
- /sdcard/syezon/qclx/show/list/cache/45710d46713c51e6ebfd07b8ca4ebccf
- /data/data/####/files/m8y3U8eYZkv1brLvg2xLxaBFTc1FcOE3/TcTIzTZYNzXkql3sFwm1Ew==/u7OcHHD36uitpoeA.zip
Другие:
Может автоматически отправлять СМС-сообщения.
