Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.414.origin
- Android.DownLoader.348.origin
- Android.DownLoader.455.origin
Сетевая активность:
Подключается к:
- 1####.####.214:8080
- g####.####.net
- h####.####.cn:8089
- d####.####.cn
- p####.####.net
- h####.####.cn
- 1####.####.131
- a####.####.cn
- p####.####.cn
- i####.####.cn
- c####.####.cn
- m####.####.cn
Запросы HTTP GET:
- h####.####.cn/event?page=####&etime=####&lang=####&resl=####&appkey=####...
- p####.####.cn/v1/accessinfo?id=####
- i####.####.cn/article//2017-03/25/729/7293919574061363810/648_c63b75b6cf...
- p####.####.cn/css/mobilebone.min.css
- i####.####.cn/article//2017-03/30/723/7233738015719634534/648_372eb63661...
- c####.####.cn/images/powered.png?t=####
- p####.####.cn/access/pubu/feedlist.html?accessId=####&xkey=####&areaId=#...
- p####.####.cn/v1/cplogo/96a8d2490dc04523a3430551cd987e48.png
- p####.####.cn/access/smallImg3/feedlist.html?accessId=####&xkey=####&are...
- c####.####.cn/images/nav_sy.png
- p####.####.cn/access/smallImg3/feedlist.js?t=####
- p####.####.cn/v2/feedDetail/e31c1f2a7d06486099be4c75764fd305.json?articl...
- c####.####.cn/images/from.png?t=####
- p####.####.cn/images/Figure2.png
- p####.####.cn/css/listCommon.css?t=####
- c####.####.cn/images/nav_fx.png
- c####.####.cn/js/banner.js?t=####
- c####.####.cn/v1/articleCorrelationInfo/7233738015719634534/e31c1f2a7d06...
- p####.####.cn/v2/feedList/e31c1f2a7d06486099be4c75764fd305.json?areaId=#...
- c####.####.cn/images/color_on.png
- p####.####.cn/v2/feedList/2df99cbbe90b42ce8c54a9e4f77a7a41.json?areaId=#...
- c####.####.cn/images/nav_zt.png
- p####.####.cn/v2/feedList/323b028888d241a692924de3c0777b33.json?areaId=#...
- c####.####.cn/js/lazyImg.js?t=####
- p####.####.cn/js/listCommon.js?t=####
- c####.####.cn/images/nav_pf.png
- d####.####.cn/cx/p?ext=NWE####&price=####
- p####.####.cn/v1/cplogo/29f676a4-c53e-4c64-b42a-ab364b062cb0.png
- p####.####.cn/access/smallImg/feedlist.js?t=####
- i####.####.cn/article//2017-03/30/723/7233738015719634534/648_f17eeb0a4f...
- p####.####.cn/access/smallImg/undefined
- p####.####.cn/images/icon_read.png
- p####.####.cn/v1/cplogo/180e397a-7de0-4583-a322-8e1cf3329a6e.png
- i####.####.cn/article//2017-04/19/354/3544671986680684901/648_43dbe290aa...
- p####.####.cn/css/pubu.css?t=####
- p####.####.cn/access/smallImg/feedlist.html?accessId=####&xkey=####&area...
- c####.####.cn/cclick?p=####
- a####.####.cn//adh?i_pid=####&u_id=####&u_t=####&u_g=####&i_w=####&i_h=#...
- c####.####.cn/images/interest.png?t=####
- p####.####.cn/images/focus/ico7.png
- h####.####.cn:8089/event?page=####&stime=####&lang=####&resl=####&appkey...
- c####.####.cn/images/nav_sz.png
- p####.####.cn/access/smallImg3/undefined
- p####.####.cn/images/contx.png
- 1####.####.214:8080/jfservice/a.jsp?k=####
- p####.####.cn/v1/access?id=####&ud=ZGlk####&ts=####&tk=####
- i####.####.cn/article//2017-03/15/736/7365699008907665717/648_3ad8d8ff02...
- i####.####.cn/article//2017-03/30/723/7233738015719634534/648_b4801dc4c4...
- p####.####.cn/v1/adArticle?accessId=####&xkey=####&language=####&devicet...
- i####.####.cn/article//2017-03/22/399/3991704630516474169/648_76eb6f5db2...
- i####.####.cn/adv//20170418/201704181116181418.jpg
- c####.####.cn/images/loading.gif
- 1####.####.131/spotService/a.jsp?k=####
- p####.####.net/sdk/js/mobile.js
- p####.####.cn/v2/feedDetail/2df99cbbe90b42ce8c54a9e4f77a7a41.json?articl...
- p####.####.cn/v1/logRecord?sourceType=####&fileName=####&message=####
- i####.####.cn/article//2017-03/14/412/4122535702953081138/648_70e7f4559f...
- i####.####.cn/article//2017-03/21/363/3630236887859673142/648_baaddc0b06...
- i####.####.cn/article//2017-04/22/405/4050481196943434547/648_8f1b2bdc13...
- p####.####.cn/images/zanzhu-icon.png
- p####.####.cn/images/loading.gif
- d####.####.cn/sdk/a.html?1492868####
- p####.####.cn/images/focus/ico4.png
- p####.####.cn/v1/cplogo/aad8b10a-ca7a-4f79-9499-6e2e23a7b7ca.png
- p####.####.net/sdk/js/ai.m.js
- g####.####.net/ga?type=####&mode=####&slotid=####&index=####&count=####&...
- i####.####.cn/article//2017-03/21/363/3631653244255035745/648_3cfdcc2298...
- c####.####.cn/images/time.png?t=####
- i####.####.cn/article//2017-04/19/722/7221018853082609712/648_29629a3031...
- p####.####.cn/access/pubu/feedlist.js?t=####
- c####.####.cn/cview?accessId=####&articleIds=####&xkey=####
- m####.####.cn/channel.html?uid=####&type=####&at=####&hn=####&wn=####&im...
- c####.####.cn/v1/feedDetail/7233738015719634534.html?ver=####&appId=####...
- i####.####.cn/article//2017-03/23/730/7305512804031737955/648_8b98d13b62...
- c####.####.cn/js/article.js?t=####
- p####.####.net/sdk/js/ifcm.js
- d####.####.cn/cx/p?ext=NjB####&price=####
- c####.####.cn/images/reading.png?t=####
- p####.####.cn/images/Xglasses.png
- c####.####.cn/css/style.css?t=####
- p####.####.cn/v1/cplogo/cbabb4089eff4cc8a15c88e47ccf29e8.png
- p####.####.cn/js/listBase.js
- i####.####.cn/contx/blank.aa
- c####.####.cn/js/browser.js?t=####
- g####.####.net/qa?slotid=####&adid=####&index=####&pvid=####&rn=####&mob...
- i####.####.cn/article//2017-03/30/723/7233738015719634534/648_818d898768...
- c####.####.cn/js/zepto.min.js
- h####.####.cn/event?page=####&stime=####&lang=####&resl=####&appkey=####...
- p####.####.cn/images/nav_sy.png
- p####.####.cn/v2/feedDetail/323b028888d241a692924de3c0777b33.json?articl...
- d####.####.cn/sdk/SDK_WEB_2.0.1.min.js?1492868####
- m####.####.cn/render.html?uid=####&type=####&at=####&hn=####&wn=####&img...
- c####.####.cn/images/nav_ml.png
- i####.####.cn/article//2017-04/19/347/3472336018713424226/648_1337ea85a1...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/d.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/shared_prefs/b1356507059351895.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/files/01492868729046.jar
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/41492868729445.jar
- /data/data/####/files/01492868728356.jar
- /data/data/####/databases/a1.db-journal
- /data/data/####/shared_prefs/c1356507059351895.xml
- /data/data/####/shared_prefs/xconf_pre.xml.bak
- /data/data/####/files/01492868695903.jar
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/shared_prefs/xappInfo_pre.xml
- /data/data/####/shared_prefs/i.xml
- /data/data/####/shared_prefs/1000.xml
- /data/data/####/files/01492868712229.jar
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/41492868695020.jar
- /data/data/####/shared_prefs/a1356507059351895.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/01492868696760.jar
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/a1356507059351895.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/shared_prefs/a1.xml
- /data/data/####/shared_prefs/xtrategy_pre.xml
- /data/data/####/files/01492868703732.jar
- /data/data/####/shared_prefs/c1356507059351895.xml.bak
- /data/data/####/shared_prefs/xconf_pre.xml
- /data/data/####/shared_prefs/b1356507059351895.xml
- /data/data/####/shared_prefs/b.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/41492868711654.jar
Другие:
Может автоматически отправлять СМС-сообщения.
