Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106980000360216: auto##5362220478##mpc_yxhezi_and_200050236##该短信用于360游戏注册/登录
Сетевая активность:
Подключается к:
- and####.####.com
- rela####.####.cn
- ope####.####.cn
- p####.####.com
- a####.####.tv
- s####.####.cn
- q####.####.com
- p####.####.cn
- d####.####.com:8083
- m####.####.cn
Запросы HTTP GET:
- p####.####.com/t0178c548e210e9c425.png
- and####.####.com/group/?method=####&n=####
- a####.####.tv/live/index/getconfig?__plat=####&__version=####&client=###...
- rela####.####.cn/10/popup/activity?appid=####&nonce=####&rkey=####&signi...
- q####.####.com/media/e1b7562413ffec62628ef1aa1d4aae8a/57d7772c7c375.zip
- q####.####.com/160422/57b92647917cce029e2634ba82d77e69/libpatch.so
- rela####.####.cn/11/complex/packages?appid=####&nonce=####&rkey=####&sig...
- rela####.####.cn/system/login?from=####&pagetype=####&mid=####&appid=###...
- ope####.####.cn/index/upgrade?package=####&version=####&apk_version=####...
- q####.####.com/160422/7bcec7e7c45683a01b4ffc5c68c66f94/libpatch1.so
- s####.####.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####
- rela####.####.cn/10/popup/notice?appid=####&nonce=####&rkey=####&signid=...
- a####.####.tv/live/cat/getCats?__plat=####&__version=####&client=####&es...
- m####.####.cn/?product=####&version=####
- rela####.####.cn/10/popup/floatconf?appid=####&nonce=####&m2=####&os=###...
- rela####.####.cn/9/popup/version?rkey=####&signid=####
- rela####.####.cn/10/popup/popwin?appid=####&nonce=####&rkey=####&signid=...
- rela####.####.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=####&si...
- rela####.####.cn/9/popup/onexit?appid=####&nonce=####&rkey=####&signid=#...
- rela####.####.cn/10/popup/bbs?appid=####&nonce=####&rkey=####&signid=####
- rela####.####.cn/10/system/updatecertificate?appid=####&nonce=####&rkey=...
Запросы HTTP POST:
- p####.####.cn/sendstat
- p####.####.cn/update/update.php?p=####
- p####.####.cn/pstat/plog.php
- d####.####.com:8083/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/qihoo_game_session_info.xml.bak
- /data/data/####/shared_prefs/qihoo_https_cer_pre.xml
- /data/data/####/shared_prefs/QH_SDK_M2.xml
- /data/data/####/files/zip_download/gift/gift_09.png
- /data/data/####/files/zip_plugin_download/1/sdk_wukong.zip
- /data/data/####/shared_prefs/QH_SDK_TIMES.xml
- /data/data/####/shared_prefs/qihoo_hosts_cfg.xml
- /data/data/####/cache/360Download/libpatch.so
- /data/data/####/files/360/sdk/persistence/lock/Y29tLndvcmxkLnFpaG9vLmFwcA==.data.lock
- /sdcard/data/com/qhpush/regId/####
- /data/data/####/shared_prefs/coolcloud_config.xml
- /data/data/####/shared_prefs/QH_SDK_UserData.xml.bak
- /data/data/####/shared_prefs/sdk_apk_info.xml
- /data/data/####/files/zip_download/gift/gift_12.png
- /data/data/####/files/zip_download/gift/gift_13.png
- /data/data/####/files/zip_download/face/face_09.png
- /data/data/####/files/zip_download/gift/gift_07.png
- /data/data/####/files/zip_download/face/face_06.png
- /data/data/####/files/zip_download/face/face_05.png
- /data/data/####/shared_prefs/qh_login_cfg.xml
- /data/data/####/files/qhpush_game_stat_log.json
- /data/data/####/shared_prefs/QH_SDK_TIMES.xml.bak
- /data/data/####/files/zip_download/gift/gift_15.png
- /data/data/####/files/zip_download/gift/gift_05.png
- /data/data/####/files/zip_download/gift/gift_03.png
- /sdcard/data/com/qhpush/stat/E25B4EF4B3897F7D60_qch_np_lm_237758_####
- /data/data/####/shared_prefs/Pay_config.xml
- /sdcard/360/sdk/persistence/data/Y29tLndvcmxkLnFpaG9vLmFwcA==
- /data/data/####/files/zip_download/gift/gift_18.png
- /data/data/####/files/zip_download/face/face_16.png
- /data/data/####/shared_prefs/QH_SDK_UserData.xml
- /data/data/####/shared_prefs/qlocal_float_sdk_share_preference.xml
- /data/data/####/files/zip_download/gift/gift_14.png
- /data/data/####/files/zip_download/face/face_11.png
- /data/data/####/files/zip_download/face/face_07.png
- /data/data/####/shared_prefs/qihoo_https_cer_pre.xml.bak
- /data/data/####/files/zip_download/gift/gift_11.png
- /data/data/####/libs/armeabi/libpatch
- /data/data/####/files/zip_download/face/face_03.png
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/zip_download/face/face_08.png
- /data/data/####/files/qihoo_game_stat_log.json
- /data/data/####/files/zip_download/gift/gift_02.png
- /data/data/####/files/statistics.log
- /data/data/####/libs/armeabi/libpatch1
- /data/data/####/update.qh
- /data/data/####/files/zip_download/face/face_10.png
- /data/data/####/files/zip_download/gift/gift_06.png
- /data/data/####/databases/recordstoredb-journal
- /sdcard/360/sdk/persistence/report/Y29tLndvcmxkLnFpaG9vLmFwcA==
- /data/data/####/shared_prefs/share_data_updatesdk.xml
- /sdcard/360/sdk/persistence/02522a2b2726fb0a03bb19f2d8d9524d
- /data/data/####/files/zip_download/face/face_01.png
- /data/data/####/files/zip_download/face/face_13.png
- /data/data/####/shared_prefs/iapppay_config.xml
- /sdcard/360/sdk/persistence/backup/Y29tLndvcmxkLnFpaG9vLmFwcA==
- /data/data/####/shared_prefs/WukongSDKPre.xml
- /data/data/####/files/zip_download/gift/gift_16.png
- /data/data/####/shared_prefs/qh_login_cfg.xml.bak
- /data/data/####/files/zip_download/gift/gift_19.png
- /data/data/####/files/zip_download/gift/gift_01.png
- /data/data/####/files/zip_download/face/face_04.png
- /sdcard/360/sdk/persistence/dcsdid.dat
- /sdcard/Android/data/####/cache/uil-images/2srnjblqxn03998ej90uotas2.0.tmp
- /data/data/####/shared_prefs/qhopen_game_session_info.xml
- /data/data/####/cache/360Download/libpatch1.so
- /sdcard/data/com/qihoo/stat/randId
- /data/data/####/shared_prefs/qhpush_session_info.xml
- /data/data/####/files/zip_download/face/face_02.png
- /data/data/####/files/zip_download/face/face_12.png
- /data/data/####/shared_prefs/gamecenter_sdk_plugin_pre.xml.bak
- /data/data/####/shared_prefs/qihoo_game_session_info.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/zip_download/gift/gift_04.png
- /data/data/####/shared_prefs/gamecenter_sdk_plugin_pre.xml
- /data/data/####/files/zip_download/face/face_15.png
- /data/data/####/files/frameso
- /data/data/####/shared_prefs/WukongSDKPre.xml.bak
- /data/data/####/files/zip_download909894d6-1301-42a7-96a6-1898b15cd876.zip
- /data/data/####/files/zip_download/gift/gift_10.png
- /data/data/####/files/zip_download/gift/gift_08.png
- /data/data/####/files/zip_download/gift/gift_20.png
- /data/data/####/files/360/sdk/persistence/lock/Y29tLndvcmxkLnFpaG9vLmFwcA==.report.lock
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/qlocal_float_sdk_share_preference.xml.bak
- /sdcard/hello.txt
- /data/data/####/shared_prefs/QH_SDK_ReportPolicy.xml
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/files/zip_download/gift/gift_17.png
- /data/data/####/files/360/sdk/persistence/lock/Y29tLndvcmxkLnFpaG9vLmFwcA==.tick.lock
- /data/data/####/files/zip_download/face/face_14.png
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 66 40 2324736 /data/data/####/files/zip_plugin_download/1/sdk_wukong.zip 1228168039 1085847038 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/e
- chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image
- chmod 755 /data/data/####/cache/360Download
Может автоматически отправлять СМС-сообщения.
