Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Сетевая активность:
Подключается к:
- u####.####.com
- 5####.####.14
- g####.####.com
- qiy####.com
- if####.####.com
- d####.####.com
- cloud####.####.com
- api-####.####.com
- m####.####.com
- m2-glid####.####.tv
- a####.####.com
Запросы HTTP GET:
- u####.####.com/xiuchang/20170512/a2/dd/xiuchang_59158aced2999d2a4926a2dd...
- u####.####.com/xiuchang/20170516/28/16/xiuchang_591af8f8f6882e3d3f9e2816...
- u####.####.com/xiuchang/20170518/a3/a6/xiuchang_591d0ba2ad8c125e42c5a3a6...
- qiy####.com/qixiu/fix/app/qixiu_level_41_30x30.png
- qiy####.com/qixiu/fix/app/vip_1@2x.png
- u####.####.com/xiuchang/20170510/92/45/xiuchang_5912de64d2999d2a48249245...
- m####.####.com/v5/alt/act?t=####&rn=####&rseat=####&rpage=####&block=###...
- qiy####.com/qixiu/fix/app/qixiu_level_54_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_100_30x30.png
- u####.####.com/xiuchang/20170429/53/e3/xiuchang_590484e6d2999d2a459d53e3...
- qiy####.com/qixiu/fix/app/qixiu_level_46_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_48_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_44_30x30.png
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- qiy####.com/qixiu/fix/app/qixiu_level_85_30x30.png
- u####.####.com/xiuchang/20170511/2a/88/xiuchang_5914511414d4555f78292a88...
- qiy####.com/qixiu/fix/app/qixiu_level_56_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_82_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_72_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_09_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_78_30x30.png
- u####.####.com/xiuchang/20170413/0f/e6/xiuchang_58ef816ead8c12426c720fe6...
- 5####.####.14/cdn/qiyiapp/20170215/200758w5d51dcd044b7dfe1700b8a232a517a...
- qiy####.com/qixiu/fix/app/qixiu_level_20_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_50_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_33_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_61_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_37_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_16_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_99_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_31_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_75_30x30.png
- u####.####.com/xiuchang/20161219/1b/54/xiuchang_5857a3a2ad8c1251c7041b54...
- qiy####.com/qixiu/fix/app/qixiu_level_45_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_94_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_26_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_38_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_65_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_64_30x30.png
- qiy####.com/qixiu/fix/app/vip_enter@2x.png
- qiy####.com/qixiu/fix/app/qixiu_level_81_30x30.png
- u####.####.com/xiuchang/20170519/38/37/xiuchang_591e9fb3d2999d7a15aa3837...
- qiy####.com/qixiu/fix/app/qixiu_level_43_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_97_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_68_30x30.png
- u####.####.com/xiuchang/20170519/0c/57/xiuchang_591e730ad2999d7a15aa0c57...
- u####.####.com/xiuchang/20170228/bb/d9/xiuchang_58b54372f6882e4b72e7bbd9...
- qiy####.com/qixiu/fix/app/qixiu_level_66_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_05_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_18_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_19_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_62_30x30.png
- u####.####.com/xiuchang/20170507/ea/2c/xiuchang_590e024af6882e3d421bea2c...
- qiy####.com/qixiu/fix/app/qixiu_level_04_30x30.png
- u####.####.com/xiuchang/20170420/64/0b/xiuchang_58f84e2714d4551fb63a640b...
- qiy####.com/qixiu/fix/app/qixiu_level_90_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_13_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_63_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_86_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_59_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_88_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_07_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_23_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_92_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_55_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_51_30x30.png
- u####.####.com/xiuchang/20170519/51/f6/xiuchang_591edda3d2999d7a15aa51f6...
- qiy####.com/qixiu/fix/app/qixiu_level_57_30x30.png
- u####.####.com/xiuchang/20170518/de/5a/xiuchang_591d994df6882e37fc40de5a...
- qiy####.com/qixiu/fix/app/qixiu_level_29_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_67_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_83_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_08_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_35_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_12_30x30.png
- m####.####.com/b?t=####&de=####&nu=####&pu=####&pf=####&p=####&p1=####&p...
- m####.####.com/v5/ypt/push?t=####&p1=####&u=####&pushv=####&result=####&...
- qiy####.com/qixiu/fix/app/qixiu_level_02_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_76_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_42_30x30.png
- m####.####.com/v5/alt/act?t=####&rn=####&rseat=####&block=####&pu=####&p...
- u####.####.com/xiuchang/20170421/3e/5e/xiuchang_58f96d30ad8c12426afb3e5e...
- qiy####.com/qixiu/fix/app/qixiu_level_10_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_22_30x30.png
- u####.####.com/xiuchang/20170313/41/a6/xiuchang_58c6a452d2999d3b95a141a6...
- qiy####.com/qixiu/fix/app/qixiu_level_98_30x30.png
- u####.####.com/xiuchang/20170426/59/4f/xiuchang_590059f3f6882e3d4036594f...
- qiy####.com/qixiu/fix/app/qixiu_level_77_30x30.png
- cloud####.####.com/apis/push/get_brokers.action?ver=####&device_id=####&...
- qiy####.com/qixiu/fix/app/qixiu_level_73_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_34_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_01_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_21_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_47_30x30.png
- if####.####.com/video/3.0/v_codec?platform=####&model=####&cpufamily=###...
- qiy####.com/qixiu/fix/app/qixiu_level_71_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_03_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_39_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_17_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_24_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_53_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_74_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_95_30x30.png
- if####.####.com/fusion/3.0/hotfix/common?app_k=####&app_v=####&app_t=###...
- qiy####.com/qixiu/fix/app/qixiu_level_60_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_93_30x30.png
- m####.####.com/qos?t=####&tm3=####&pu=####&pf=####&p=####&p1=####&u=####...
- qiy####.com/qixiu/fix/app/qixiu_level_14_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_70_30x30.png
- a####.####.com/apis/public/push/gray/switch?deviceId=####&version=####&a...
- qiy####.com/qixiu/fix/app/qixiu_level_32_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_15_30x30.png
- qiy####.com/ppsxiu/android/fix/models-android.zip
- u####.####.com/xiuchang/20170512/5d/3e/xiuchang_59157c1174d579597f775d3e...
- u####.####.com/xiuchang/20170519/42/f6/xiuchang_591edab2d2999d7a130842f6...
- u####.####.com/xiuchang/20170514/13/90/xiuchang_5917b281d2999d2a44481390...
- qiy####.com/qixiu/fix/app/qixiu_level_30_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_87_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_40_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_58_30x30.png
- m####.####.com/cconf?appkey=####&plat=####&apppkg=####&appver=####&netwo...
- qiy####.com/qixiu/fix/app/qixiu_level_80_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_52_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_27_30x30.png
- d####.####.com/cdn/qiyiapp/20170215/200758w5d51dcd044b7dfe1700b8a232a517...
- qiy####.com/qixiu/fix/app/qixiu_level_11_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_69_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_06_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_36_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_84_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_89_30x30.png
- m####.####.com/v5/alt/act?t=####&rn=####&rpage=####&pu=####&p1=####&u=##...
- qiy####.com/qixiu/fix/app/qixiu_level_96_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_25_30x30.png
- u####.####.com/xiuchang/20170310/ec/2b/xiuchang_58c1a9edf6882e4b7418ec2b...
- qiy####.com/qixiu/fix/app/qixiu_level_28_30x30.png
- u####.####.com/xiuchang/20170518/2c/48/xiuchang_591d8050f6882e3800b22c48...
- d####.####.com/v.f4v
- qiy####.com/qixiu/fix/app/qixiu_level_49_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_79_30x30.png
- qiy####.com/qixiu/fix/app/qixiu_level_91_30x30.png
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- m2-glid####.####.tv/v2/ugc/novice_mission.json
- d####.####.com/dsign
- d####.####.com/dinfo
- api-####.####.com/stream/getBatch
- m2-glid####.####.tv/v1/product/product_effects.json
- m2-glid####.####.tv/v1/ugc/recommend_index.json
- m2-glid####.####.tv/v1/bags/classify.json
- m2-glid####.####.tv/v1/recommend/banners.json
- a####.####.com/conn
- a####.####.com/log4
- m2-glid####.####.tv/v1/product/get_virtual_dressing_material.json
- m2-glid####.####.tv/v1/ugc/get_multi_recommend_info.json
- m2-glid####.####.tv/v2/recommend/hot_anchor.json
- m2-glid####.####.tv/v1/ugchashtag/get_hashtag.json
- a####.####.com/conf5
- m####.####.com/v5/mbd/qos_hotfix?p1=####&crpo=####&plgv=####&plg=####&v=...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes907102152.zip
- <Package Folder>/ReadyHost.txt
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/app_file_dex/MasterControl.jar
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/us.mQa4FB91kK7ttuRCae2j51q4JW6v0 -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh <Package Folder>/files/us.O14241869JlRh63Cg8X6C5g8NlOMi -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- getenforce
- sh <Package Folder>/files/us.qM02p75bgcdFRY5C8EA7d38g7M8hm -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- chmod 0771 /data/data/####/.syslib-
- <error:2>
- mount
- /data/data/####/files/us.O14241869JlRh63Cg8X6C5g8NlOMi -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- cat /proc/cpuinfo
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/qM02p75bg.jar > /dev/null 2>&1
- sh
- chmod 0771 <Package Folder>/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/qM02p75bg.dex > /dev/null 2>&1
- sh <Package Folder>/files/us.854M4jeK9nrtPUpKg4l22P2899o20 -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.854M4jeK9nrtPUpKg4l22P2899o20 > /dev/null 2>&1
- sh <Package Folder>/files/us.mQa4FB91kK7ttuRCae2j51q4JW6v0 -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- /data/data/####/files/us.854M4jeK9nrtPUpKg4l22P2899o20 -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- <dexopt>
- /data/data/####/files/us.qM02p75bgcdFRY5C8EA7d38g7M8hm -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.qM02p75bgcdFRY5C8EA7d38g7M8hm > /dev/null 2>&1
Может автоматически отправлять СМС-сообщения.
