Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- ipen####.####.com
- g####.####.com
- h####.####.com
- i####.####.com
- u####.####.cn
- sspser####.####.com
- o####.####.com
- p####.####.com
- c####.####.com
- d####.####.com
- a####.####.cn
- api####.####.com
- z####.####.com
- 1####.####.225
- l####.####.com
- m####.####.com
- a####.####.com
- b####.####.com
Запросы HTTP GET:
- l####.####.com/inapp/TTDefaultJS.js
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/images/more_image.png
- a####.####.cn/images/5dab146409a78b3816fc1db7791bb2f6.jpg
- l####.####.com/thumb/4110002561bd243ac5c
- a####.####.cn/images/c8a30d28ecf379573bff698f6f368292.jpg
- i####.####.com/promotion/app/lt/?ac=####&channel=####&aid=####&app_name=...
- sspser####.####.com/pub/impression?token=N####
- u####.####.cn/rcmd/falls/getRtCmd?siteId=####&cki=####&num=####&chan=###...
- a####.####.cn/images/07386f99963aff10996dce47030cad6a.jpg
- a####.####.cn/images/30c7b6a42bc0aeab76651b34f1c4cf4f.jpg
- m####.####.com/rs/showPeopleVideoPlayerMulti.js
- s####.####.com/cr/sdk/170417/des_V17041703Aj1so32.zip
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/js/analytics_index.js
- a####.####.cn/7434eb6ce6217c1eb87dca0da3cd9fb0.jpg@1
- a####.####.cn/8cecaeaca655445ab8711ef2dd66c17e.jpg@1
- a####.####.cn/images/d727f35216f866b77e49ef720285365f.jpg
- i####.####.com/article/v1/tab_comments/?group_id=####&item_id=####&aggr_...
- a####.####.cn/images/b63ac71639c8d5b73d3e2137e451ce35.jpg
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/images/safari_menu.png
- a####.####.cn/6226742a95c86cfd97081d94a254e620.jpg@1
- a####.####.cn/images/f8a873af53eb577901e361812048ee01.jpg
- sspser####.####.com/pub/match?m=####&sid=####&scn=####&scf=####
- sspser####.####.com/pub/impression?token=O####
- a####.####.cn/a13795f31dc250d42f8ffbf870be32b3.jpg@1
- a####.####.cn/images/9ec75517cb087caae255abb4d1ea71f0.jpg
- p####.####.com/large/4d00054b126ceaf920
- l####.####.com/2/user/info/?iid=####&device_id=####&ac=####&channel=####...
- h####.####.com/attachment2010/2017/0420/17/04/20170420050435113.jpg
- l####.####.com/site/download/app/pl/news_article/112/ss_plugin_config.js...
- l####.####.com/list/190x124/1cc300009962f2ffbf73.webp
- a####.####.cn/images/97d1484b3b076d0108f48c151c61c85d.jpg
- h####.####.com/attachment2010/2017/0420/23/37/20170420113729715.jpg
- a####.####.cn/images/9a0e1daa7152e5d77fc765db70e7f6ea.jpg
- a####.####.cn/903bedb48673fd31d82d62d7b5c52aeb.jpg@1
- l####.####.com/site/app_web_article_online_updates/android_57_d0189d4293...
- a####.####.cn/1f328979bc9421f7ebd6f3a4ac4617ae.jpg@1
- a####.####.cn/images/f56d9e79a2042109a8149fd088fcffd5.jpg
- m####.####.com/r/MV8wXzEwNTEyODA2XzEyNjRfMTQ5MjY5MDk4MA==
- l####.####.com/service/2/app_alert/?has_market=####&lang=####&carrier=##...
- m####.####.com/monitor/settings/?_test=####&iid=####&device_id=####&ac=#...
- l####.####.com/inapp/information_lightspec.js?v=####
- m####.####.com/
- ipen####.####.com/2017/0417/d6af092a-1cdf-4cac-8ac3-8e4bdd90c8e0.jpg
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/libs/zepto.min.js
- l####.####.com/site/promotion/misc/whitelist.json?v=####&iid=####&device...
- a####.####.cn/b289b906c26e1467a83a7277e8d7ae85.jpg@1
- a####.####.cn/images/26c16618b8ec1480a4009c394336202d.jpg
- a####.####.cn/images/cee330e8f5dd15388e70eb977b9b72af.jpg
- a####.####.cn/images/ace2a319787669d5773405915929ed7f.jpg
- a####.####.cn/images/91e502e90b27f38575e042e74e739e29.jpg
- h####.####.com/attachment2010/2017/0420/17/24/20170420052418227.jpg
- ipen####.####.com/2017/0328/a35711f4-b220-436a-8927-3055d19834de.jpg
- a####.####.cn/images/8c90c6dad0095a3df091661146c11fd4.jpg
- l####.####.com/list/190x124/1cac000cc531c04df2a4.webp
- h####.####.com/attachment2010/2017/0420/thumb_235_120_20170420093614892....
- a####.####.cn/9bf6c0ca36343312b0d94c267b99f068.jpg@1
- sspser####.####.com/pub/impression?token=Z####
- g####.####.com/cr/sv/getGoFile?name=####
- h####.####.com/hm.js?91c21ad####
- ipen####.####.com/resource/js/base_mobile2.js
- l####.####.com/thumb/1782000f009020ac3e98
- h####.####.com/attachment2010/2017/0420/thumb_235_120_20170420092512955....
- a####.####.cn/images/4cb0aa8c64b120e7251fa57c14a7db7f.jpg
- i####.####.com/search/suggest/homepage_suggest/?iid=####&device_id=####&...
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/images/nav_more_btn.png
- h####.####.com/attachment2010/2017/0420/23/53/20170420115328323.jpg
- m####.####.com/monitor/appmonitor/v2/settings?iid=####&device_id=####&ac...
- sspser####.####.com/pub/impression?token=M####
- i####.####.com/2/article/hot_words/?iid=####&device_id=####&ac=####&chan...
- a####.####.cn/bdb50815cd9e94c4f478fcda02ad1f6e.jpg@1
- l####.####.com/site/download/app/apk/news_article/app_replaceable_images...
- i####.####.com/2/article/v50/refresh_tip/?min_behot_time=####&iid=####&d...
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/images/one_image.png
- a####.####.cn/fdf33df4983ad118076e63a98d452f42.png
- a####.####.cn/699f7c6ae0de69fa9409936b6b5e207f.jpg@1
- i####.####.com/service/1/app_activity/?view_cursor=####&iid=####&device_...
- m####.####.com/monitor/settings/?ac=####&channel=####&aid=####&app_name=...
- m####.####.com/apps/huanqiu/mindex.php?_=####&callback=####
- p####.####.com/thumb/1781000ae5672129210b
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/libs/flexble.js
- z####.####.com/stat.htm?id=####&r=####&iw=####&showp=####&lg=####&cnzz_e...
- a####.####.cn/72c6e7a95426555d7f180ef5044ed4e4.jpg@1
- a####.####.cn/4b1e7daf7ad9cee49b7fb7819bf44adf.jpg@1
- i####.####.com/2/article/city/?iid=####&device_id=####&ac=####&channel=#...
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- l####.####.com/service/2/app_notify/?allow_notify=####&leave_time=####&i...
- a####.####.cn/images/32a829db2b8f5606745099f603daca07.jpg
- l####.####.com/inapp/toutiao.js?ver=####
- a####.####.cn/images/e5be60fabb53cfb2458a777f08ac912d.jpg
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- i####.####.com/entry/subscription_list/v1/?req_type=####&iid=####&device...
- l####.####.com/feedback/2/list/?appkey=####&count=####&iid=####&device_i...
- a####.####.cn/77fdc4a1193bcf61a9ccee6902cc0184.jpg@1
- ipen####.####.com/resource/js/base_mobile.js
- l####.####.com/inapp/TTDefaultCSS.css
- a####.####.cn/6e1255eb6ead61d96897601506ca64d9.jpg@1
- l####.####.com/thumb/bc20009c5f0eec79da3
- b####.####.com/app/config?os=####&key=####&sdkv=####
- u####.####.cn/cmp/cmp.api?r=####&s=####&u=####
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/css/index.css
- a####.####.cn/images/bb5515a94a597e6953760e5745cca18b.jpg
- l####.####.com/origin/3796/2975850990
- h####.####.com/attachment2010/2017/0420/23/58/20170420115830595.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- ipen####.####.com/2017/0414/b97327c8-f6b1-4573-bf53-81213badfd61.jpg
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/images/header_logo.png
- a####.####.cn/article/content/15/1/6411093182540415489/64110931825404154...
- l####.####.com/site/download/plugin_patch/plugin/c346702aec1b91fbbc081bf...
- p####.####.com/list/190x124/1bf600112dccd258db96.webp
- a####.####.cn/images/ca188af856ccf6a8ebe4c8f4979cda09.jpg
- i####.####.com/follow/update/tips/?update_time=####&update_version=####&...
- a####.####.cn/176a17dcc35d12d5b4f5eb999d6892a1.jpg@1
- ipen####.####.com/2017/0414/53429b56-2adf-4c79-80d5-b25b0bbd2757.jpg
- a####.####.cn/images/ed27d2cfe5dc459c35bdd0dd2ce9cca6.jpg
- ipen####.####.com/resource/image/ad_sign_mobile.png
- l####.####.com/origin/3791/5035712059
- i####.####.com/2/article/information/v19/?group_id=####&item_id=####&agg...
- a####.####.cn/7f3d1d701ef220383433573539165eba.jpg@1
- sspser####.####.com/pub/impression?token=Y####
- l####.####.com/site/download/app/hijack/108/black_list_20170331.json?iid...
- i####.####.com/push/get_service_addrs/?iid=####&device_id=####&ac=####&c...
- c####.####.com/wapstat.php?siteid=####&r=####&rnd=####
- c####.####.com/cpro/ui/cm.js
- l####.####.com/inapp/information_antiad.js?ver=####
- i####.####.com/user/tab/tabs/?iid=####&device_id=####&ac=####&channel=##...
- d####.####.com/get_domains/v4/?ac=####&channel=####&aid=####&app_name=##...
- a####.####.cn/images/d41d8cd98f00b204e9800998ecf8427e.jpg
- a####.####.cn/images/3e1c54e8f9a1dd71864b774595f72e7b.jpg
- a####.####.cn/images/6dc27899b160d03e067cd26ff39f4990.jpg
- a####.####.cn/images/9e219197b73e0f5ba92946f3c56a2bd5.jpg
- sspser####.####.com/pub/match?m=####&sid=####&scn=####&scf=####×tam...
- a####.####.cn/images/d340627709c1e2f08f6ff90017458271.jpg
- p####.####.com/list/190x124/1c630002ce0e1706b07c.webp
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- h####.####.com/statics/www/hq_m/dist/m_huanqiu/js/index.js?v=####
Запросы HTTP POST:
- a####.####.com/app_logs
- g####.####.com/cr/sv/getEPList
- i####.####.com/service/2/app_log_config/?iid=####&device_id=####&ac=####...
- i####.####.com/service/14/app_ad/?_unused=####&carrier=####&mcc_mnc=####...
- api####.####.com/v3/log/init
- i####.####.com/article/category/sort/v1/?ac=####&channel=####&aid=####&a...
- o####.####.com/v2/check_config_update
- l####.####.com/service/2/app_log_config/?ac=####&channel=####&aid=####&a...
- o####.####.com/v2/get_update_time
- 1####.####.225/dreport
- i####.####.com/service/1/z_app_stats/?iid=####&device_id=####&ac=####&ch...
- d####.####.com/xs.gif?k=####&iv=####&c=####&dm=####&ac=####&s=####
- i####.####.com/article/category/get_subscribed/v1/?ac=####&channel=####&...
- i####.####.com/service/1/refresh_ad/?iid=####&device_id=####&ac=####&cha...
- i####.####.com/api/news/feed/v50/?iid=####&device_id=####&ac=####&channe...
- i####.####.com/api/ad/share/v1/?ac=####&channel=####&aid=####&app_name=#...
- i####.####.com/api/ad/comment/v1/?ac=####&channel=####&aid=####&app_name...
- i####.####.com/location/suloin/?iid=####&device_id=####&ac=####&channel=...
- i####.####.com/service/1/collect_settings/?iid=####&device_id=####&ac=##...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/ReadyHost.txt
- /data/data/####/cache/load_dex.tmp
- /sdcard/Android/data/.nomedia
- /data/anr/traces.txt
- /data/data/####/app_file_dex/MasterControl.jar
- /data/data/####/PreExcuModsInfo.txt
- /data/data/####/databases/MessageStore.db-journal
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/XmSmLockFile.txt
Другие:
Запускает следующие shell-скрипты:
- dumpsys meminfo
- getenforce
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- chmod 0771 /data/data/####/.syslib-
- cat /data/anr/traces.txt
- getprop persist.vivo.multiwindow
- getprop ro.build.version.emui
- procrank
- getprop persist.vivo.multiwindow_active
- /data/data/####/lib/libsupervisor.so #### com.ss.android.message.NotifyService ####:push /data/data/#### 0
Может автоматически отправлять СМС-сообщения.
