Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.222.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- s####.####.com
- a####.####.com:7901
- 1####.####.com
- h####.####.com
- i####.####.com
- w####.####.cn
- 1####.####.35
- ha####.####.com
- google-####.com
- p####.####.com
- b####.####.com:9230
- c####.####.com
- d####.####.com
- c####.####.com:8080
- f####.####.com
- z####.####.com
- h####.####.org
- m####.####.com
- 1####.####.215
- m####.####.cn
Запросы HTTP GET:
- m####.####.com/ifeed/more?tj_page=####&from=####&tn=####&page=####&id=##...
- s####.####.com/static/html5-index/js/zepto_14ab7a5.js
- m####.####.com/static/p.gif
- m####.####.cn/coop/mobile/index.php?rid=####&padapi=####&av=####&encpass...
- m####.####.com/static/html5-index/js/fingerPrint_161b85b.js
- s####.####.com/static/html5-index/js/iscroll-lite4_a51bdc3.js
- w####.####.cn/;jsessionid=BEACA048FE471F3B6CCFE48F63487516
- m####.####.com/static/img/qunaericon.png
- c####.####.com:8080/ads/js/webAdClick32.js
- s####.####.com/hky0129.js
- s####.####.com/hky0130.js
- m####.####.com/static/tj.gif?level=####&page=####&pos=####&tn=####&t=####
- google-####.com/analytics.js
- s####.####.com/static/html5-index/widget/falls/gxhWords/gxhWords_593c278...
- m####.####.cn/coopapi/partner/accredit.php?domain=####&next_action=####&...
- 1####.####.com/givhiqk/link?c=####
- s####.####.com/static/html5-index/img/guanggao1_374ef54.png
- 1####.####.com/ur7e50c7dcf6cefe3a904b23dcf3ab67bf05.js
- w####.####.cn/render?6####
- m####.####.cn/coop/mobile/index.php?id=####&t=####&padapi=####&av=####&e...
- h####.####.org/skin/ucss.js
- ha####.####.com/api/searchrecom?c=####&type=####&dataType=####&pageid=##...
- 1####.####.com/ug3a1ecf95f2cdf23edb4c3e83a0f166bd06acde0b36.js
- m####.####.cn/tao/dll/f7b615be97959098e3fa.js
- m####.####.cn/tao/v8/f77f550d51890429d2ba.js
- m####.####.com/hao123_api/x/sync_bduss?_=####&callback=####
- m####.####.cn/coop/mobile/index.php?id=####&padapi=####&av=####&encpass=...
- p####.####.com/fe/iifeng_index_touch/styles/iifeng_index_touch_main_fd01...
- s####.####.com/static/html5-index/widget_48964ec.css
- m####.####.cn/v/o7/8baa068be790dfbe15124fdbdf512745.png
- m####.####.cn/v/y0/3f04592efb196fae43cb0a840fe3ffbf.png
- m####.####.cn/?src=####
- m####.####.cn/coop/mobile/index.php?ver=####&padapi=####&av=####&encpass...
- c####.####.com/pdt/cfg/ad/js/20160812/mobile_inice_v1.js
- 1####.####.35/liverepeater/playstream?StreamN####
- s####.####.com/static/html5-index/widget/card/card_fcad_once/card_fcad_o...
- m####.####.cn/live.6.cn/e6u2/rm.php?location=####&referer=####&browser=#...
- s####.####.com/static/html5-index/img/guide_3ef30c4.png
- h####.####.org/lang.js?v=####
- m####.####.com/static/img/58tongcheng40.png
- s####.####.com/static/html5-index/widget/card/card_fcad_second/card_fcad...
- 1####.####.215/v60858222-104853994_20170428074352_908711_hls/playlist.m3u8
- m####.####.com/
- s####.####.com/static/img/newzx/fy0427_01.jpg
- m####.####.cn/coop/mobile/index.php?padapi=####&av=####&encpass=####&log...
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- i####.####.com/
- p####.####.com/common/reset_160525.css
- s####.####.com/static/img/newzx/jk170426-1.jpg
- h####.####.org/?f=####
- m####.####.cn/img/fonts/iconfont_v38.ttf
- c####.####.com/ads/js/webAdClick32.js
- m####.####.cn/coop/mobile/index.php?type=####&padapi=####&av=####&encpas...
- s####.####.com/core.php?web_id=####&t=####
- p####.####.com/a/2016/0809/sta_collection_common_iifeng_v4.js
- s####.####.com/z_stat.php?id=####&web_id=####
- m####.####.cn/v/r8/1812dc1c7dc47f57eee610161aee86ec.png
- p####.####.com/a/2015/0716/jquery.lazyload.min.js
- m####.####.com/static/tj.gif?level=####&page=####&pos=####&fp_result=###...
- s####.####.com/static/html5-index/falls/css/siteIcon_e4fa7bc.css
- p####.####.com/fe/iifeng_index_touch/scripts/iifeng_index_touch_main_f09...
- h####.####.org/stat.js?v=####
- w####.####.cn/
- s####.####.com/static/common/js/djlib_4547868.js
- 1####.####.35/v64178435-104853496_20170428074353_168836_hls/playlist.m3u8
- s####.####.com/static/img/newzx/fy0427_03.jpg
- 1####.####.215/liverepeater/playstream?StreamN####
- m####.####.com/static/img/shuangseqiuicon.png
- h####.####.org/skin/base.css
- m####.####.com/hao123_api/d
- d####.####.com/x.gif?he=####&dm=####&v=####&li=####&rnd=####
- m####.####.cn/v/j1/50ac136e3982320d7ea45df8c785ed88.png
- m####.####.com/static/img/logo/logo150623.png
- s####.####.com/static/html5-index/img/group_b2e485a.png
- m####.####.cn/live/?s=####
- h####.####.org/filter/expr.js?v=####
- m####.####.com/static/img/souhuxin-4040.png
- m####.####.com/static/html5-index/css/base/icon_0601378.css
- s####.####.com/static/html5-index/widget_5be514a.js
- s####.####.com/static/img/newzx/l427-3.jpg
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&d...
- p####.####.com/ifengimcp/sta/20140312/jquery_1.11.js
- h####.####.org/jslib.js
- c####.####.com/js/hyapialltw.js
- p####.####.com/a/2016/0325/swiper.min.css
- f####.####.com/hunter/alog/alog.min.js?v=####
- m####.####.com/hao123_api/next/widget?wid=####&tj_page=####&from=####&tn...
- s####.####.com/static/img/newzx/qg170427-1.jpg
- m####.####.com/r/image/2017-02-21/e3d62e9d54ac945fecb4d2d22438aac9.png
- m####.####.cn/coop/mobile/index.php?padapi=####&ver=####&type=####
- m####.####.cn/v/s6/2c405ae446524c96de1dd38a886f6669.png
- h####.####.org/skin/1.css
- m####.####.cn/tao/v8/347ade84b4df8778c2c7.js
- m####.####.com/j.php?tn=####&z=####&from=####&page=####&level=####&ver=#...
- p####.####.com/a/2017/0215/tongji20170215.js
- m####.####.cn/tao/es6-promise.js
- s####.####.com/static/html5-index/widget/falls/gxhWords/gxhWords_bf8eb51...
- s####.####.com/img/1L/Aw/2F/mk/ch/o/blank.gif
- m####.####.cn/coop/mobile/index.php?type=####&ruid=####&uid=####&padapi=...
- 1####.####.com/a?cff=####&gv=####&cf=####&qef=####&psi=####&pcy=####&puv...
- m####.####.com/static/img/icon/wangyi20160301.png
- s####.####.com/static/html5-index/card/js/swiper_4bb3bcc.js
- m####.####.cn/v/l5/459512d533b687f940fce5be7ecfe83f.png
- p####.####.com/a/2015/0716/jquery-2.1.4.min.js
- s####.####.com/static/img/newzx/nx170426-1.jpg
- w####.####.cn/render/?1####
- p####.####.com/a/2017/0329/sta_collection_iifeng_pv_v8.js
- m####.####.cn/v/e2/5f758ffe3b68b44ba45757b748089163.png
- p####.####.com/a/2016/0325/swiper.min.js
- m####.####.com/static/img/zhilian20170101.png
- s####.####.com/static/img/newzx/l427-7.jpg
- m####.####.com/static/img/tengxun_40.png
- s####.####.com/static/common/lib/mod_75d1f98.js
- m####.####.com/?union=####&from=####&tn=####
- m####.####.cn/tao/v8/e75d52697a0806deb20e.js
- p####.####.com/a/2017/0301/6536a6cc8eded54.js
- ha####.####.com/static/mapping/bd.php?type=####
- h####.####.com/dianj/?u=####&ie=####&tm=####&cm=####&md=####&at=####&v=#...
- h####.####.org/index.js?v=####
- s####.####.com/static/html5-index/common/fc_ad_second_3a5b587.css
Запросы HTTP POST:
- a####.####.com:7901/
- b####.####.com:9230/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00002f
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/app_338903769/libnaturally.so
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000034
- /data/data/####/cache/webviewCacheChromium/f_000035
- /data/data/####/cache/webviewCacheChromium/f_000036
- /data/data/####/cache/webviewCacheChromium/f_000037
- /data/data/####/cache/webviewCacheChromium/f_000030
- /data/data/####/cache/webviewCacheChromium/f_000031
- /data/data/####/cache/webviewCacheChromium/f_000032
- /data/data/####/cache/webviewCacheChromium/f_000033
- /data/data/####/cache/webviewCacheChromium/f_000038
- /data/data/####/cache/webviewCacheChromium/f_000039
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00003b
- /data/data/####/app_database/CachedGeoposition.db
- /sdcard/.069d9c2c/be1950e3/ps/NlTv3L5l923x53Al.xml
- /data/data/####/cache/webviewCacheChromium/f_00003d
- /data/data/####/cache/webviewCacheChromium/f_00003e
- /data/data/####/cache/webviewCacheChromium/f_00003f
- /data/data/####/cache/webviewCacheChromium/f_00003a
- /data/data/####/databases/webviewCookiesChromium.db
- /data/data/####/cache/webviewCacheChromium/f_00003c
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/old_webviewCacheChromium_000/index
- /sdcard/.069d9c2c/be1950e3/db/u8xtzdldQLEldTE32.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/app_bEdlTm3/B8aN.jLLl.so
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/app_database/CachedGeoposition.db-journal
- /data/data/####/cache/ApplicationCache.db
- /data/data/####/cache/old_webviewCacheChromium_000/data_2
- /data/data/####/cache/old_webviewCacheChromium_000/data_3
- /data/data/####/cache/old_webviewCacheChromium_000/data_0
- /data/data/####/cache/old_webviewCacheChromium_000/data_1
- /data/data/####/app_database/GeolocationPermissions.db
- /data/data/####/databases/h5db.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/app_database/GeolocationPermissions.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/files/030b140d031630773571.jar
- /sdcard/.069d9c2c/be1950e3/db/u8xtzdldQLEldTE32.db
- /data/data/####/cache/webviewCacheChromium/f_00004a
- /data/data/####/cache/webviewCacheChromium/f_00004b
- /data/data/####/cache/webviewCacheChromium/f_000049
- /data/data/####/cache/webviewCacheChromium/f_000048
- /data/data/####/files/t63ttd2.apk
- /data/data/####/cache/webviewCacheChromium/f_000045
- /data/data/####/cache/webviewCacheChromium/f_000044
- /data/data/####/cache/webviewCacheChromium/f_000047
- /data/data/####/cache/webviewCacheChromium/f_000046
- /data/data/####/cache/webviewCacheChromium/f_000041
- /data/data/####/cache/webviewCacheChromium/f_000040
- /data/data/####/cache/webviewCacheChromium/f_000043
- /data/data/####/cache/webviewCacheChromium/f_000042
- /data/data/####/files/030b140d031652800016.jar
- /data/data/####/databases/webview.db-journal
- /sdcard/.069d9c2c/be1950e3/ps/oAaN96L5El32.xml
- /sdcard/.069d9c2c/be1950e3/ps/ShtLXdt.xml
- /data/data/####/cache/ApplicationCache.db-journal
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 42 40 494116 /data/data/####/files/030b140d031353323642.jar 1231723056 868478875 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/dexopt --dex 27 42 40 494116 /data/data/####/files/030b140d031375350087.jar 1231723056 868478875 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/dexopt --dex 27 42 40 494116 /data/data/####/files/030b140d031652800016.jar 1231723056 868478875 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/dexopt --dex 27 42 40 494116 /data/data/####/files/030b140d031630773571.jar 1231723056 868478875 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n ####/com.burst.CreepService
Может автоматически отправлять СМС-сообщения.
