Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 15595005292: i2mPNk1AOWWu6IO69LttHIXkg==
Сетевая активность:
Подключается к:
- s####.####.com
- ut####.cn
- i####.####.net
- d####.####.com
- qiushib####.com
- c####.####.net
- qb-m####.####.com
- p####.####.com
- r####.####.com
- c####.####.com
- be####.####.com
- a####.####.cn
- w####.####.com
- f####.####.com
- e####.####.cn
- s####.####.com:36800
- st####.####.com
- ut####.cn:8080
- a####.####.com
Запросы HTTP GET:
- st####.####.com/images/newarticle/like@1.5.png?v=####
- a####.####.cn/download/?s=####
- f####.####.com/it/u=959100585,1197998252&fm=76
- st####.####.com/watermark/ef5d0223eb9dc4921ae49deb26b0cc14.gif!/gifto/jpg
- qiushib####.com/gif/static/dist/images/logo-new-0410.png?v=####
- p####.####.com/system/avtnew/2470/24703920/thumb/20170319133040.JPEG?ima...
- p####.####.com/s?ti=####&pis=####&tpr=####&dc=####&ctxant=####&cja=####&...
- f####.####.com/it/u=451484931,2297541900&fm=76
- f####.####.com/it/u=1557247643,2552796483&fm=76
- st####.####.com/images/thumb/anony.png?v=####
- c####.####.com/gpixel?google_gid=####&google_cver=####
- p####.####.com/s?tcn=####&dis=####&cce=####&di=####&ctxant=####&exps=###...
- st####.####.com/images/newarticle/sad@1.5x.png
- p####.####.com/system/avtnew/3088/30880816/thumb/201705161545417.JPEG
- p####.####.com/system/avtnew/3350/33508780/thumb/20170324215131.JPEG?ima...
- e####.####.cn/c.php?s=Jnpvb####&p=aj0wJ####
- f####.####.com/it/u=1028174797,1876566456&fm=76
- p####.####.com/system/avtnew/837/8371100/thumb/20140828222020.jpg?imageV...
- st####.####.com/static/images/mip_article/logo.png
- st####.####.com/watermark/e78351b31a411b6480fb6cffa24d5d4a.gif!/gifto/jpg
- c####.####.com/cpro/ui/pr.js
- p####.####.com/system/avtnew/3221/32215536/thumb/20170223052606.JPEG?ima...
- r####.####.com/banner/img/close.png
- qiushib####.com/new4/session?1495005####
- qiushib####.com/gif/static/dist/js/app.min.js?v=####
- st####.####.com/watermark/4dc206e27c626d4e7255911bf09272a3.gif!/gifto/jpg
- st####.####.com/js/dist/touch/app.min.js?v=####
- f####.####.com/it/u=3249290878,1403091144&fm=76
- st####.####.com/watermark/c93c20732016fceb2828ee35f1b3854b.gif!/gifto/jpg
- p####.####.com/s?dtm=####&chi=####&dc=####&exps=####&col=####&cpl=####&t...
- st####.####.com/images/newarticle/btn-play-small.png
- p####.####.com/system/avtnew/3212/32124777/thumb/2017051616311366.JPEG?i...
- st####.####.com/watermark/196c17b833fa320f300cbdd9ff3a1d6b.gif!/gifto/jpg
- st####.####.com/watermark/ad0fa414859150456dc8197cca0369fa.gif!/gifto/jpg
- p####.####.com/system/avtnew/2654/26547488/thumb/2016101601394420.JPEG
- st####.####.com/images/newarticle/nearby_gender_female@1.5x.png
- p####.####.com/s?pss=####&chi=####&dai=####&tpr=####<u=####&pis=####&a...
- be####.####.com/sr7e50c7dcf6cefe3c9e4c20ddf0a867bf05.js
- f####.####.com/it/u=4228703483,1343260474&fm=76
- be####.####.com/id3a1ecf98f6c9f530db1c7582affa32f71bf3d41128ea38e01e382f...
- qiushib####.com/users/28831688/
- i####.####.net/a/2017-05-15/14948322988720.gif
- qiushib####.com/gif/
- c####.####.com/sync.htm?cproid=####
- f####.####.com/it/u=1147162656,3738604960&fm=76
- f####.####.com/it/u=2758238868,1236188348&fm=76
- qiushib####.com/gif/static/dist/images/icon_index.png?v=####
- f####.####.com/it/u=1610178692,856597863&fm=76
- f####.####.com/it/u=974292842,417635106&fm=76
- st####.####.com/watermark/c8b84dd303db996c1402344e0ae8e0f6.gif!/gifto/jpg
- st####.####.com/watermark/196c17b833fa320f300cbdd9ff3a1d6b.gif
- be####.####.com/gf3a1ecf91feccff38db1c7582affa32f71bf3d41128ea38e01e382f...
- qiushib####.com/gif/1-29961.html
- p####.####.com/system/avtnew/3365/33653568/thumb/2017041408455094.JPEG?i...
- st####.####.com/images/newarticle/nearby_gender_male@1.5x.png
- p####.####.com/system/avtnew/1167/11678685/thumb/2017051623340382.JPEG
- st####.####.com/watermark/29dfdcf102569d30c088637ca5990a9b.gif!/gifto/jpg
- qiushib####.com/
- st####.####.com/watermark/1f74cccd6e6982f2d9ef10d0469a80e5.gif!/gifto/jpg
- e####.####.cn/effect.php?type=####&planid=####&adsid=####&zoneid=####&ui...
- st####.####.com/images/newarticle/cmt@1.5x.png
- qb-m####.####.com/snapshot/9f991725234ee4930ff37bcd603858ca.jpg
- f####.####.com/it/u=317216685,3238474478&fm=76
- p####.####.com/system/avtnew/3175/31752341/thumb/20170202044847.JPEG?ima...
- qb-m####.####.com/snapshot/ba856c79767f36e9f29bdd4c89572324.jpg
- p####.####.com/system/avtnew/3059/30591370/thumb/20170408170726.JPEG?ima...
- f####.####.com/it/u=2714438872,3147991768&fm=76
- f####.####.com/it/u=1818621076,2684225141&fm=76
- e####.####.cn/rk.php?id=####
- p####.####.com/uploads/apk/cqdjb/cqdjb_jiudian_cpm_210.apk
- st####.####.com/images/cmt-god.png
- qiushib####.com/gif/static/dist/css/app.min.css?v=####
- f####.####.com/it/u=207263703,3158410109&fm=76
- st####.####.com/watermark/13c4c4a549aaf5dc2b8d13efa812f8f2.gif!/gifto/jpg
- st####.####.com/images/newarticle/laugh@1.5x.png
- st####.####.com/watermark/26aa2bb558ee7fc6fac7f7b95b4c96f2.gif!/gifto/jpg
- st####.####.com/watermark/f897a8f9b993f04f32aeeca7a111ea52.gif!/gifto/jpg
- f####.####.com/it/u=161552877,2856868494&fm=76
- f####.####.com/it/u=2399118720,1669033898&fm=76
- p####.####.com/acam?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- f####.####.com/it/u=351730517,3282120492&fm=76
- st####.####.com/images/touch/page-pre.png?v=####
- be####.####.com/zt3a1ecf98f7caf631db1c7582affa32f71bf3d41128ea38e01e382f...
- f####.####.com/it/u=689057515,4125451004&fm=76
- f####.####.com/it/u=4089404840,4176501585&fm=76
- p####.####.com/system/avtnew/3012/30120003/thumb/2017041605591513.JPEG?i...
- p####.####.com/system/avtnew/3154/31540456/thumb/20160403231106.jpg?imag...
- c####.####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- st####.####.com/js/src/touch/lingxi.js?v=####
- c####.####.net/pixel?google_nid=####&googl####
- f####.####.com/it/u=331768604,190245983&fm=76
- f####.####.com/it/u=2581781212,2318207455&fm=76
- f####.####.com/it/u=3115223153,3707908756&fm=76
- st####.####.com/watermark/712a01123c1e1cf5ed3f8a87f036f880.gif!/gifto/jpg
- i####.####.net/a/2017-05-15/14948323203693.gif
- f####.####.com/it/u=33717312,1635832931&fm=76
- qiushib####.com/gif/static/dist/images/icon_coll.png?v=####
- st####.####.com/watermark/3d97008c24b7d41b660af9b6c83ed333.gif!/gifto/jpg
- qiushib####.com/gif/static/dist/images/right.png?v=####
- p####.####.com/system/avtnew/1167/11678685/thumb/2017051623340382.JPEG?i...
- f####.####.com/it/u=1452575101,1986754607&fm=76
- p####.####.com/system/avtnew/2883/28831688/medium/2017051108472215.JPEG
- st####.####.com/watermark/1e6010c91cb9a2ec0365c8ef0d4af319.gif!/gifto/jpg
- st####.####.com/watermark/45674e8b48bc290d3022d070118e36a5.gif!/gifto/jpg
- qiushib####.com/gif/static/dist/images/left.png?v=####
- st####.####.com/images/touch/colline.png?v=####
- st####.####.com/css/dist/touch/app.min.css?v=####
- p####.####.com/sync_pos.htm?cproid=####
- p####.####.com/system/avtnew/2883/28831688/thumb/2017051108472215.JPEG?i...
- f####.####.com/it/u=3162040903,1180349419&fm=76
- f####.####.com/it/u=1461840845,2055856769&fm=76
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- st####.####.com/watermark/b0f7346ccd8a83e95bb20ef76e561024.gif!/gifto/jpg
- f####.####.com/it/u=392036210,3112544238&fm=76
- w####.####.com/adx.php?c=####
- p####.####.com/system/avtnew/3020/30201529/thumb/20170118120709.JPEG
- st####.####.com/watermark/f57f031584ba3c1c56993f480c63f972.gif!/gifto/jpg
- f####.####.com/it/u=1797281260,2791807190&fm=76
- st####.####.com/watermark/5a735b3a96fe2c356e114cb9c90f62a0.gif!/gifto/jpg
- f####.####.com/it/u=3712825453,692518663&fm=76
- st####.####.com/images/touch/page-next.png?v=####
- qiushib####.com/article/119033997
- p####.####.com/system/avtnew/1600/16003871/thumb/20170509213713.JPEG
- c####.####.com/cpro/ui/cm.js
- d####.####.com/cpv/images/afo.png
- p####.####.com/cqdjb/jiudian/cpm/210.html
- st####.####.com/watermark/1f73e898747af12510cd465159d511be.gif!/gifto/jpg
- e####.####.cn/c.php?s=Jnpvb####&p=aj0wJ####&srccpv=####
- p####.####.com/system/avtnew/2680/26800306/thumb/20170511062257.JPEG?ima...
- p####.####.com/system/avtnew/1722/17221979/thumb/20170102091358.JPEG
- p####.####.com/system/avtnew/3186/31867193/thumb/20170217180501.JPEG?ima...
- f####.####.com/it/u=3529675473,871310510&fm=76
- f####.####.com/it/u=714961855,787381951&fm=76
- st####.####.com/watermark/1df0a2f210e0372c5b2afdf61a410d96.gif!/gifto/jpg
- st####.####.com/watermark/cef9948f7081b47bcfbff4bf5cc52429.gif!/gifto/jpg
Запросы HTTP POST:
- s####.####.com/cfgplan.action
- s####.####.com:36800/cfgplan.action
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- a####.####.com/app_logs
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/webviewCacheChromium/f_000030
- <Package Folder>/cache/webviewCacheChromium/f_000023
- <Package Folder>/cache/webviewCacheChromium/f_000031
- <Package Folder>/cache/webviewCacheChromium/f_000033
- <Package Folder>/cache/webviewCacheChromium/f_000034
- <Package Folder>/cache/webviewCacheChromium/f_000035
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/cache/webviewCacheChromium/f_00002c
- <Package Folder>/cache/webviewCacheChromium/f_00002b
- <Package Folder>/cache/webviewCacheChromium/f_00002a
- <Package Folder>/cache/webviewCacheChromium/f_00002f
- <Package Folder>/cache/webviewCacheChromium/f_00002e
- <Package Folder>/cache/webviewCacheChromium/f_00002d
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/files/.imprint
- <Package Folder>/cache/webviewCacheChromium/f_00001e
- <Package Folder>/shared_prefs/pluginLib.xml
- <Package Folder>/cache/webviewCacheChromium/f_000036
- <Package Folder>/databases/cc.db
- <Package Folder>/cache/webviewCacheChromium/f_000037
- <Package Folder>/databases/utopay.db-journal
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/exid.dat
- <Package Folder>/shared_prefs/mlib.xml
- <Package Folder>/cache/webviewCacheChromium/f_000029
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000021
- <Package Folder>/cache/webviewCacheChromium/f_000020
- <Package Folder>/cache/webviewCacheChromium/f_000027
- <Package Folder>/cache/webviewCacheChromium/f_000026
- <Package Folder>/cache/webviewCacheChromium/f_000025
- <Package Folder>/cache/webviewCacheChromium/f_000024
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/app_dex/utopay.jar
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/databases/sms_db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/sms_db
- <Package Folder>/cache/webviewCacheChromium/f_00001f
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/cache/webviewCacheChromium/f_00001d
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/cache/webviewCacheChromium/f_00001c
- <Package Folder>/cache/webviewCacheChromium/f_000022
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/files/mj.apk
- <Package Folder>/cache/webviewCacheChromium/f_000032
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_000028
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- getprop apps.customerservice.device
Может автоматически отправлять СМС-сообщения.
