Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.371.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.371.origin
Сетевая активность:
Подключается к:
- 3####.####.com
- s####.####.com
- q####.####.cn
- w####.####.cn
- 7j####.####.com
- p####.####.com
- s####.####.cn
- d####.####.com
- f####.####.com
- y####.####.com
- st####.####.com
- ping####.####.com
- isds####.####.com
- a####.####.com
- b####.####.com
Запросы HTTP GET:
- p####.####.com/ma_pic2/0/shot_11526743_2_1458720831/550
- y####.####.com/a/2015/1127/pc_drip_bannerbg.jpg
- d####.####.com/about.html
- a####.####.com/a4d7bfeed0556e351450428584122.dex
- y####.####.com/a/2015/1130/pc_iphone_csn_4.png
- y####.####.com/a/2016/1027/pc_iphone_csn_1.png
- d####.####.com/d/nsd/jquery.touchslider.js
- s####.####.com/stat.html?site=####&action=####&down_cat=####&down_type=#...
- p####.####.com/ma_pic2/0/shot_11526743_4_1458720831/550
- y####.####.com/a/2015/1130/about_img4.png
- y####.####.com/a/2015/1130/pc_banner_txt_hid.png
- d####.####.com/d/nsd/DD_belatedPNG.js
- y####.####.com/20141231/fa.min.js
- y####.####.com/a/2015/1130/pc_banner_txt_4.png
- y####.####.com/a/2015/1130/ph_menu_bg.png
- y####.####.com/a/2015/1130/pc_banner_itemcur.png
- d####.####.com/
- 3####.####.com/dist/webapp_andtouch/res/global/icon_myapp.png
- y####.####.com/a/2015/1130/pc_banner_iphone.png
- a####.####.com/o/res/dist/js/tcss.min.js
- 7j####.####.com/tdata_KtX382
- y####.####.com/a/2015/1127/d_ifeng_screen.png
- a####.####.com/o/simple.jsp?pkgname=####
- p####.####.com/ma_pic2/0/shot_11526743_3_1458720831/550
- y####.####.com/a/2015/1130/about_img3.png
- y####.####.com/a/2015/1130/about_img2.png
- y####.####.com/a/2015/1127/pc_recapp_3.jpg
- p####.####.com/s/18E2tH
- y####.####.com/a/2015/1130/ph_drip_logo.png
- y####.####.com/a/2015/1130/mob_qq.png
- y####.####.com/a/2015/0121/index.js
- w####.####.cn/mmopen/ibyfC9qyHSWAw2sL8iaNhYSfYw9ovs5RKOCiaDpmyeIiazR1KJl...
- y####.####.com/a/2015/1130/pc_banner_txt_2.png
- b####.####.com/static/zgz/senduserinfo.php?uuid=####&appv=####&client=##...
- y####.####.com/a/2015/1201/rszgz-sharelogo.png
- p####.####.com/ma_pic2/0/shot_11526743_1_1458720831/550
- f####.####.com/update.html?version=####
- d####.####.com/pad.html
- y####.####.com/a/2015/1130/pc_drip_bannerbg.jpg
- q####.####.cn/g?b=####&k=####&s=####&t=####
- isds####.####.com/cgi-bin/r.cgi?flag1=####&flag2=####&flag3=####&flag5=#...
- y####.####.com/a/2015/1130/pc_banner_txt_5.png
- st####.####.com/page.js?uri=####&ref=####&snapid=####&uid=####&sid=####&...
- y####.####.com/a/2015/1127/pc_recapp_1.jpg
- a####.####.com/o/ajax/log/ActionLog?page=####&fromcase=####&type=####&id...
- y####.####.com/a/2015/1130/about_img1.png
- s####.####.cn/ma_icon/0/icon_11526743_1458720835/96
- 3####.####.com/dist/webapp_andtouch/res/micro/appdetailloading.png
- s####.####.com/stat.html?site=####&page=####&down_cat=####&down_type=###...
- y####.####.com/a/2015/1127/d_ifeng_qrcode_new.png
- y####.####.com/a/2015/1130/pc_banner_txt_1.png
- y####.####.com/a/2015/1130/pc_banner_txt_3.png
- y####.####.com/base/jQuery/jquery-1.9.1.min.js
- d####.####.com/app/rszgz/index.shtml?gw_mo####
- y####.####.com/a/2015/1127/d_ifeng_title.png
- y####.####.com/a/2015/0121/zepto.min.js
- st####.####.com/dursta.js?action=####&datatype=####&value=####&uri=####&...
- y####.####.com/a/2015/1127/pc_recapp_4.jpg
- 7j####.####.com/tdata_gOY640
- y####.####.com/a/2015/1130/pc_iphone_csn_5.png
- y####.####.com/a/2016/1027/pc_iphone_csn_3.png
- ping####.####.com/pingd?scl=####&tt=####&tz=####&vs=####&dm=####&url=###...
- d####.####.com/app/rszgz/android/update.json
- y####.####.com/a/2015/1130/pc_iphone_csn_2.png
- y####.####.com/a/2015/0121/iscroll.js
- y####.####.com/a/2015/1130/pc_banner_item.png
- y####.####.com/a/2015/1130/jquery.touchslider.js
- p####.####.com/ma_pic2/0/shot_11526743_5_1458720831/550
- y####.####.com/a/2015/1127/pc_foot_logo.jpg
- a####.####.com/o/res/micro/myapp-logo.png
- y####.####.com/a/2015/1127/pc_recapp_2.jpg
- w####.####.cn/mmopen/dxKEsjQBP4SwSseWq2GIwMsW3dBX5542V1nycNGSbXh6ttJ8yuh...
- s####.####.com/stat.html?site=####&action=####&rehost=####&refrom=####&u...
- y####.####.com/a/2016/0824/nmob_wx.png
Запросы HTTP POST:
- s####.####.com/api.php?format=####&t=####
- a####.####.com/app_logs
- f####.####.com/adCenter/app/get
- f####.####.com/adCenter/seo/get
- f####.####.com/adCenter/ad/get
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/init.pid
- <Package Folder>/files/run.pid
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/dbname-journal
- <Package Folder>/shared_prefs/jianfanti.xml
- <Package Folder>/files/gdaemon_20151105
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/dbname
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/shared_prefs/pdr.xml
- <Package Folder>/shared_prefs/ddspname.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/cache/ddcp.dex
- <Package Folder>/shared_prefs/jianfanti_storages.xml
- <Package Folder>/shared_prefs/sharedPreferencesName.xml
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/shared_prefs/jianfanti.xml.bak
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/clientid.xml
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/files/push.pid
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/gdaemon_20151105 0 ####/com.igexin.sdk.PushService 24748 300 0
- chmod 700 /data/data/####/files/gdaemon_20151105
- <dexopt>
- sh <Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 24748 300 0
- chmod 700 <Package Folder>/files/gdaemon_20151105
Может автоматически отправлять СМС-сообщения.
