Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.1
Сетевая активность:
Подключается к:
- s####.####.com
- w####.####.com:10081
- h####.####.com
- yaochao####.com
- 3####.####.com
- logi####.####.com
- google-####.com
- p####.####.com
- h####.####.cn
- sta####.####.com
- c####.####.com
- d####.####.com
- f####.####.com
- w####.####.com
- a####.####.com
- y####.####.com
- z####.####.com
- m####.####.com
- st####.####.com
- m####.####.com:81
Запросы HTTP GET:
- h####.####.cn/assets/rev/m/style/reset.css
- p####.####.com/32/20160129/72/1454049498184_1_w190_h170_m.jpg
- p####.####.com/32/20170512/76/1494569822156_1_w600_h290_o.jpg
- p####.####.com/32/20160708/64/1467976002368_1_w190_h170_m.jpg
- y####.####.com/ya2.gif?nvid=####&userid=####&cc=####&rr=####&nn=####&nh=...
- p####.####.com/bcam?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- h####.####.cn/assets/rev/m/style/common.css?v=####
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- h####.####.cn/www/2017-03-24/26731f68b4d2d69504aa5170f8f43f6b.jpg
- p####.####.com/32/20170505/97/1493950310625_1_w600_h290_o.jpg
- p####.####.com/32/20170512/40/1494568501544_1_w600_h816_m.jpg
- google-####.com/ga.js
- z####.####.com/apk/20170220/173430/20170220173430.apk
- p####.####.com/icpm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- h####.####.cn/assets/rev/m/script/3gcontent.js?v=####
- p####.####.com/32/20160114/71/1452773627207_1_w190_h170_m.jpg
- h####.####.cn/assets/rev/m/images/new_3glm_top.png
- s####.####.com/s.htm?cproid=####&t=####
- h####.####.cn/assets/rev/m/images/new_3glm_iconc.png
- 3####.####.com/health/201705121354339.shtml
- h####.####.cn/assets/rev/m/images/bg-box-user.png
- yaochao####.com/backinfo/01jiHj40infos
- a####.####.com/afp/door/;ap=186206;ct=js;pu=4c451ece10ff899d0001;/?
- p####.####.com/32/20170512/98/1494568499554_1_w600_h900_m.jpg
- z####.####.com/img/20170220/173453/banner_20170220173447.jpg
- f####.####.com/it/u=726313884,4095522171&fm=76
- p####.####.com/32/20170508/99/1494222317411_1_w600_h290_o.jpg
- z####.####.com/img/20170412/191342/tablescreen_20170412191342.jpg
- p####.####.com/32/20170511/86/1494491487830_1_w72_h50_o.jpg
- p####.####.com/nccm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- h####.####.cn/assets/rev/m/images/new_3glm_iconh.png
- a####.####.com/afp/door/;ap=186216;ct=if;pu=4c451ece10ff899d0001;/?
- h####.####.cn/assets/rev/m/script/md5.js
- sta####.####.com/service/yaolan/yaolan_wap.js
- f####.####.com/it/u=2412832439,3169055132&fm=76
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- d####.####.com/2.0/Pos.do?x=####&y=####&prs=####&ep=####&pageflag=####&f...
- h####.####.cn/assets/rev/m/images/new_3glm_icond.png
- h####.####.cn/assets/rev/m/script/img-scroll.js
- p####.####.com/icpm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- 3####.####.com/images/bbs.gif
- h####.####.cn/assets/rev/m/script/3g-login.js?v=####
- h####.####.cn/assets/rev/m/images/icon-login-01.png
- s####.####.com/wxl0076.js
- st####.####.com/service/bcore/clientData.html
- p####.####.com/32/20170512/91/1494568493019_1_w600_h337_m.jpg
- h####.####.cn/assets/images/health_xq_12.png
- p####.####.com/32/20170512/108/1494568494444_1_w600_h800_m.jpg
- h####.####.cn/assets/app/lib/config3.js
- h####.####.cn/assets/rev/m/images/icon-triangle.png
- p####.####.com/32/20161114/11/1479087516427_1_w115_h115_m.jpg
- h####.####.cn/assets/rev/m/images/user-login.png
- d####.####.com/2.0/StdID.do?bfdid=####
- p####.####.com/32/20160113/65/1452651790017_1_w190_h170_m.jpg
- 3####.####.com/bbs/api/misc.php?type=####&callback=####&callback=####&_=...
- google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmc...
- c####.####.com/sync.htm?cproid=####
- h####.####.cn/assets/rev/m/images/down_yy.png?v=####
- h####.####.cn/assets/images/health_expert_logo_1128.png
- p####.####.com/32/20170512/106/1494568496234_1_w600_h800_m.jpg
- z####.####.com/customer_search/api/ping?logid=####&version=####&prod_id=...
- w####.####.com/yxzsy.html
- p####.####.com/32/20170512/47/1494583774767_1_w72_h50_o.jpg
- h####.####.cn/assets/rev/m/images/bg-to-top.png
- d####.####.com/js/om.js
- h####.####.cn/assets/rev/m/images/new_3glm_icona.png
- h####.####.cn/assets/rev/m/images/icon-check.png
- d####.####.com/2.0/PageView.do?p_p=####&tma=####&tmc=####&tmd=####&rs=##...
- h####.####.cn/assets/rev/m/images/app_down_yy.png
- yaochao####.com/backinfo/tiyri01jiHj40
- f####.####.com/it/u=3720202824,275285770&fm=76
- h####.####.cn/assets/app/lib/ovgap.js
- st####.####.com/api/2.0/bcore.min.js
- y####.####.com/ylk.ad.mini.js
- y####.####.com/ya1.jpg?&_nvid=####&userid=####&title=####&curl=####&from...
- h####.####.cn/assets/rev/m/script/jquery.min.js
- h####.####.cn/assets/rev/m/images/new_3glm_iconf.png
- y####.####.com/mpids.mini.js
- h####.####.cn/ya/yl.js?d=####
- z####.####.com/img/20151208/193208/closeimg_20151208193203.png
- d####.####.com/2.0/EndPageView.do?ep=####&pageflag=####&fingerprint=####...
- h####.####.cn/assets/images/health_opacity_p.png
- f####.####.com/it/u=544575444,543594239&fm=76
- h####.####.cn/assets/rev/m/style/module-index.css?v=####
- a####.####.com/afp/door/;ap=186204;ct=if;pu=4c451ece10ff899d0001;/?
- h####.####.cn/assets/rev/m/script/fn-index.js?v=####
- f####.####.com/it/u=3598326817,184444336&fm=76
- f####.####.com/it/u=123406542,2058679511&fm=76
- h####.####.cn/assets/rev/m/images/new_3glm_icong.png
- p####.####.com/32/20170510/11/1494403451019_1_w600_h290_o.jpg
- h####.####.cn/assets/rev/m/images/close.png
- f####.####.com/it/u=273440354,625088683&fm=76
- p####.####.com/icpm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&...
- f####.####.com/it/u=459219245,635003017&fm=76
- d####.####.com/2.0/StdID.do?bfdid=####&gid=####
- logi####.####.com/getuserinfo.ashx?isnew=####
- p####.####.com/sync_pos.htm?cproid=####&t=####
- p####.####.com/bcam?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- y####.####.com/ylk.mini.js
- h####.####.cn/assets/rev/m/images/icon-ability.png
- h####.####.cn/assets/rev/lib/final/3gfinalpage.js
- h####.####.cn/assets/rev/m/images/new_3glm_iconb.png
- z####.####.com/img/20151208/193240/closeimg_20151208193240.png
- z####.####.com/customer_search/api/js?sid=####&plate_url=####&t=####
- h####.####.cn/assets/rev/m/script/iScroll.js
- c####.####.com/js/hyapialltw.js
- d####.####.com/2.0/LinkClick.do?pth=####<=####&tp=####&ep=####&ln=####...
- p####.####.com/ucpm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- a####.####.com/afp/door/;ap=186208;ct=js;pu=4c451ece10ff899d0001;/?
- h####.####.cn/assets/rev/m/images/icon-share.png
- h####.####.cn/www/js/jquery.1.9.1.min.js
- a####.####.com/afp/door/;ap=186207;ct=js;pu=4c451ece10ff899d0001;/?
- h####.####.cn/assets/rev/m/images/logo.png
- c####.####.com/pixel?dspid=####
- 3####.####.com/today/jump?id=####
- c####.####.com/du?&baidu_user_id=####&cookie_version=####×tamp=####...
- h####.####.cn/assets/rev/m/images/new_3glm_icone.png?
- p####.####.com/32/20161114/7/1479087516295_1_w48_h48_m.jpg
- h####.####.cn/assets/rev/m/images/new_3glm_icon.png
- p####.####.com/32/20170511/100/1494491445732_1_w600_h290_o.jpg
- 3####.####.com/3g/comment_health/behavior.js?v=####
- y####.####.com/ya.jpg?&_nvid=####&userid=####&babybirth=####&username=##...
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- 3####.####.com/ask/phpapi/essence/index?callback=####&_=####
- h####.####.cn/assets/rev/m/images/icon-star.png
- f####.####.com/it/u=78041141,1486761205&fm=76
- h####.####.cn/assets/images/health_video_icon_1128.png
- h####.####.com/hm.js?0b90b86####
- p####.####.com/sync_pos.htm?cproid=####
- d####.####.com/2.0/StdID.do?bfdid=####&setcookie=####&is_newgid=####
- 3####.####.com/api/relation/collect/check_many_type?userId=####&typeIdLi...
- p####.####.com/bcam?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&...
- p####.####.com/32/20170509/33/1494299921825_1_w600_h290_o.jpg
- w####.####.com/adx.php?c=####
- 3####.####.com/index/global/loadmore.js
- h####.####.cn/assets/images/health_vide_bg_1128.png
- p####.####.com/32/20170510/118/1494403551734_1_w72_h50_o.jpg
- h####.####.cn/assets/rev/m/script/public-module.js?v=####
- h####.####.cn/assets/rev/m/script/shenmago_download_app_1.js?v=####
- p####.####.com/32/20170512/39/1494568498087_1_w600_h750_m.jpg
- h####.####.cn/assets/rev/m/script/fastclick.js
- c####.####.com/cpro/ui/cm.js
- p####.####.com/ucpm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- z####.####.com/ads/auto/jar/1_0_0094/zhsysgdi.jar
- z####.####.com/apk/20170412/191246/20170412191246.apk
- 3####.####.com/
- h####.####.cn/assets/rev/m/images/icon-search2.png
- f####.####.com/it/u=367384514,716709150&fm=76
- p####.####.com/ucpm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&...
- 3####.####.com/api/relation/collect/count?typeId=####&objId=####&isReal=...
- 3####.####.com/jk/image/plug_a.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- h####.####.cn/assets/rev/m/images/icon-triangle-down.png
Запросы HTTP POST:
- m####.####.com/hladserver/api/4
- m####.####.com/hladserver/api/2
- m####.####.com/hladserver/api/3
- w####.####.com:10081/OsService/OsStrategy
- m####.####.com:81/hladserver/api/1
- w####.####.com/OsService/OsStrategy
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/deu
- /data/data/####/cache/webviewCacheChromium/f_000018
- /sdcard/.android/dev.txt
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/files/init
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/files/.android/zhsysgdi.jar
- /sdcard/.android/459bf96bb73300da7a3ddaa6863c0c95.apk.tmp
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/.android/close.png
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/.android/51e67b93ded9b0925aecdc0e997688a4.apk.tmp
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/databases/vastpaydb
- /data/data/####/app_aty/classes.jar
- /data/data/####/files/mc.db
- /data/data/####/shared_prefs/xapcinfo.xml
- /data/data/####/shared_prefs/hlcsdpf.xml
- /data/data/####/files/init.jar
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/files/tiyritiyri
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/.android/thinpot.png
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/uaxj
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/v
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/shared_prefs/hlcsdpf.xml.bak
- /sdcard/.android/68654815
- /data/data/####/cache/01jiHj40infos01jiHj40infos
- /sdcard/.android/sign.info
- /sdcard/.android/fatpot.png
- /data/data/####/files/tiyri
- /data/data/####/cache/01jiHj40infos
- /data/data/####/databases/vastpaydb-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/databases/dbkdlf-journal
- /data/data/####/files/mc
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/yhyq.jar
Другие:
Запускает следующие shell-скрипты:
- getprop
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- rwdm ac554db364f
- /system/bin/dexopt --dex 27 91 40 385936 /data/data/####/files/.android/zhsysgdi.jar 1252756545 1035376436 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system
- rwdw eb47495f7bb
- conbb od2gf04pd9
- /system/bin/dexopt --dex 27 112 40 74636 /data/data/####/files/yhyq.jar 1232636096 245784742 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 44 40 8260 /data/data/####/files/init.jar 1232636097 574711341 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- /system/bin/dexopt --dex 27 45 40 179024 /data/data/####/app_aty/classes.jar 1232228995 1002695851 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
Может автоматически отправлять СМС-сообщения.
