Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106584211: 5fd3bec6c0a86a604200201060886070M302000A免费登录短信，请勿修改
Сетевая активность:
Подключается к:
- s####.####.com
- 7x####.####.com
- c-h####.####.com
- obf0c####.####.com
- w####.####.com
- 1####.####.195
- d####.####.com:8083
- boo####.####.cn
- m####.####.com
- a####.####.com
Запросы HTTP GET:
- boo####.####.cn/tdata_tcA311
- boo####.####.cn//pubres/picture/show_img/xinshufree.jpg
- boo####.####.cn/pubres/picture/show_img/yinengnn.jpg
- boo####.####.cn/pubres/picture/LoadingPage/-209853654156563477.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000077626/11000077626.jpg
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- boo####.####.cn/pubres/picture/show_img/wanbenfree.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000074446/11000074446.jpg
- w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000028085/11000028085.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000028142/11000028142.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000006280/11000006280.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000079573/11000079573.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000049442/11000049442.jpg
- boo####.####.cn//pubres/picture/show_img/wanbenfree.jpg
- s####.####.com/config/hz-hzv3.conf
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000072603/11000072603.jpg
- w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000031727/11000031727.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000002838/11000002838.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000001468/11000001468.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000000377/11000000377.jpg
- w####.####.com/r/?vt=####&cm=####&aaa_flag=####
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000069434/11000069434.jpg
- 7x####.####.com/zip/payjar_-1_20170418211225.zip
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000003116/11000003116.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000008173/11000008173.jpg
- boo####.####.cn/pubres/picture/show_img/xinshufree.jpg
- boo####.####.cn/tdata_DBk687
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000079588/11000079588.jpg
- boo####.####.cn/tdata_lqw967
- boo####.####.cn//pubres/picture/show_img/yinengnn.jpg
Запросы HTTP POST:
- s####.####.com/api.php?format=####&t=####
- a####.####.com/app_logs
- 1####.####.195/asg/portal.do
- m####.####.com/gateway.do
- c-h####.####.com/api.php?format=####&t=####
- d####.####.com:8083/useractive
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/.ishugui/K101651cache_web/cache_199/html.js
- /data/data/####/files/init.pid
- /sdcard/.ishugui/Cache/4lj7wje99e97cpd0nis07so6o
- /data/data/####/shared_prefs/Cookies250026699187743.xml
- /sdcard/.ishugui/Cache/6tyrfx09yvxe89nomzh4qvqr1
- /sdcard/.ishugui/Cache/69wo8vcgarwlcglgafesa5jwy
- /sdcard/.ishugui/books/11000001870/793704.kf
- /sdcard/.ishugui/Cache/1m8b2oznq4gej0qh7rb4mkff
- /sdcard/.ishugui/Cache/lf3vt0jmi0uwkel5x79zbwmw
- /sdcard/.ishugui/Cache/c8v4ui3g6x68afbnhsssqumg
- /sdcard/.ishugui/books/11000001253/bookinfo.bat
- /data/data/####/databases/dbqzmc-journal
- /sdcard/.ishugui/Cache/2y62l1ihdg2gi1itjwaf7om15
- /sdcard/.ishugui/books/11000001912/856445.kf
- /sdcard/.ishugui/Cache/39ykagtyuunh7h4yekxtc78ju
- /data/data/####/databases/pushg.db-journal
- /sdcard/.ishugui/K101651cache_web/cache_199/html.css
- /sdcard/libs/####.db
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/100400022600UploadUserBehavior.dat
- /sdcard/.ishugui/books/11000000439/bookinfo.bat
- /data/data/####/files/tdata_DBk687.tmp
- /sdcard/.ishugui/books/11000000439/244038.kf
- /data/data/####/files/tdata_DBk687.jar
- /sdcard/.ishugui/Cache/wdcs0kmxtpkioff6mea8zox1
- /data/data/####/databases/increment.db-journal
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/.system/confv9/visen.conf
- /data/data/####/files/mobclick_agent_cached_####1010305
- /data/data/####/files/run.pid
- /sdcard/.ishugui/empty.system
- /data/data/####/files/gdaemon_20161017
- /sdcard/.ishugui/books/11000001976/ex_info.kf
- /data/data/####/shared_prefs/gx_sp.xml
- /data/data/####/app_temp/libcryto_zywx.so
- /data/data/####/files/tdata_lqw967.jar
- /data/data/####/files/tdata_tcA311.tmp
- /data/data/####/app_libs/libcryto_zywx.so
- /sdcard/.ishugui/books/11000000271/bookinfo.bat
- /sdcard/.ishugui/Cache/6ky1tiljftav7srng2ahybd48
- /sdcard/.ishugui/books/11000001251/392144.kf
- /data/data/####/shared_prefs/conf_sp_name.xml
- /data/data/####/shared_prefs/myepay.xml
- /sdcard/system/tmp/local/tdata_lqw967
- /sdcard/.ishugui/payerr.txt
- /data/data/####/databases/pushgdm.db-journal
- /sdcard/.ishugui/cover/K101651.cover.tmp
- /sdcard/.system/confv9/visen.conf.temp
- /sdcard/.ishugui/books/11000001912/bookinfo.bat
- /sdcard/.ishugui/Cache/2oifxrykm65nmkcla9n5i0v1f
- /sdcard/.ishugui/books/11000000271/ex_info.kf
- /sdcard/.ishugui/Cache/1ipydlsd7ga2pl6937pexsj3
- /sdcard/system/tmp/local/tdata_DBk687
- /data/data/####/files/umeng_it.cache
- /sdcard/.ishugui/Cache/6dxymx188mgy7f152s9pdz4rn
- /sdcard/iapppay/statistics/####/statistics.log
- /sdcard/.ishugui/books/11000001870/ex_info.kf
- /sdcard/.ishugui/books/11000000271/188288.kf
- /sdcard/.ishugui/Cache/1k2fpa5y595w2rpb2wwvxueyj
- /sdcard/.ishugui/Cache/6yqqn0dd0d6lc9gcqrkr53bnd
- /data/data/####/shared_prefs/ishugui.shareInfo.xml
- /data/data/####/files/push.pid
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/.ishugui/Cache/1r990ezk8ipw9tnxvpbjd2iom
- /sdcard/.ishugui/books/11000000377/ex_info.kf
- /sdcard/.ishugui/books/11000001253/ex_info.kf
- /sdcard/.system/device/factory.dzt
- /data/data/####/databases/ishugui.db-journal
- /sdcard/.ishugui/K101651cache_web/cache_199/html.txt
- /data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
- /sdcard/.ishugui/books/11000001870/bookinfo.bat
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/system/tmp/local/tdata_tcA311
- /sdcard/.system/confv9/visen.conf.mark
- /sdcard/.ishugui/books/11000001912/ex_info.kf
- /sdcard/.ishugui/Cache/c7bxhl67yxy9nkbxv9o07ol2
- /data/data/####/files/defrayPriority100400022600250026699187743.dat
- /data/data/####/shared_prefs/iapppay_config.xml
- /sdcard/.ishugui/Cache/zz7pqgj0w4olea9bf319ig5i
- /sdcard/.ishugui/Cache/4xh9shomixhzzg10oso3byx7l
- /sdcard/.ishugui/.log/mianfei-xiaoshagiopwieqt_log.txt
- /sdcard/.ishugui/Cache/5y8w1wh5ldd9zhqxz1cl8e3hs
- /data/data/####/files/DownloadBillingList_100400022600_00000848_000000003288_250026699187743unanaly
- /data/data/####/files/tdata_tcA311.jar
- /sdcard/.ishugui/Cache/6c8xwxiax1a2czerr2kh9et53
- /sdcard/.ishugui/Cache/5m9ebh0mx2uxx7yxrg0sc95tw
- /sdcard/.ishugui/books/11000000439/ex_info.kf
- /sdcard/.ishugui/books/11000000377/227457.kf
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/.ishugui/books/11000001251/bookinfo.bat
- /sdcard/.ishugui/books/11000000377/bookinfo.bat
- /data/data/####/app_tcxec/classes.jar
- /data/data/####/files/tdata_lqw967.tmp
- /data/data/####/databases/pushext.db-journal
- /sdcard/.ishugui/Cache/7h5w8zhuwpgp1jvobylo6gzqe
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /sdcard/zywx/MyEPay/default_dex/####/myepay_data.jar
- /data/data/####/files/.imprint
- /sdcard/.system/confv9/paydex.dzlib.temp
- /sdcard/libs/app.db
- /sdcard/.ishugui/books/11000001976/931538.kf
- /sdcard/.ishugui/books/11000001251/ex_info.kf
- /sdcard/.ishugui/Cache/5gn0giu4eiomi6tj755ierl9j
- /sdcard/.ishugui/Cache/5zxmck24z1e5xc0t2glhaobfg
- /sdcard/.ishugui/Cache/608par6idsz6ke40nbswt5no6
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/.ishugui/cover/K101651.cover
- /sdcard/.ishugui/books/11000001253/392410.kf
- /sdcard/.ishugui/books/11000001976/bookinfo.bat
- /data/data/####/shared_prefs/Cookies250026699187743.xml.bak
- /sdcard/.ishugui/Cache/4zaujjex4502pz79kk4m6lp3w
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/gdaemon_20161017
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25874 300 0
- chmod 700 /data/data/####/files/gdaemon_20161017
Может автоматически отправлять СМС-сообщения.
