Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.465.origin
- Android.Loki.10.origin
Сетевая активность:
Подключается к:
- ikan####.com
- c####.####.com
- im####.####.com
- 1####.####.cn
- i####.####.net
- i####.####.com
- iy####.com
- b####.com
- p####.####.com
- im####.####.cn
- 1####.####.cn:88
- s####.####.in
- fkdown####.####.cn
- w####.com
- fkse####.####.com:8080
- l####.####.com
- h####.com
Запросы HTTP GET:
- i####.####.com/Picture/680x580/1/1459/1459095.jpg
- ikan####.com/uploads/allimg/110629/1_110629222617_1.jpg
- i####.####.com/tuku/yulantu/140421/330226-1404211P51621.jpg
- fkdown####.####.cn/ad10016_jf_jk_0517_stone.apk
- i####.####.com/uploadImages/2012/236/4YNWA295SE6G.jpg
- iy####.com/yodlq/attachement/jpg/site2/20080823/00138f2576900a1a3c5f56.jpg
- h####.com/
- im####.####.com/UploadFiles/images/s/20120611/20120611164308328327200.jpg
- p####.####.com/fengjingbizhi/shijieshanshuifengguanghejikuanpingbizhi/sh...
- c####.####.com/pic/n40471.png
- h####.com/d/file/20130422/77372871eb47ee00ba3b2dad9b072725.jpg
- im####.####.cn/allimg/1/20150119230206.jpg
- i####.####.com/2015/a1/120/d/24.jpg
- i####.####.net/Mon_1211/107_285982_df53f88ffb37990.jpg?9####
- w####.com/d/file/20130422/77372871eb47ee00ba3b2dad9b072725.jpg
- 1####.####.cn:88/Discuz/forum/201211/21/141024m9hwhvchs115wcs5.jpg
- i####.####.net/Mon_1211/107_285982_58aa08e54e3ea72.jpg?1####
- i####.####.net/Mon_1211/107_285982_a33730cad062fa3.jpg?1####
- i####.####.net/Mon_1211/107_285982_ac95f3c702fefa7.jpg?1####
- b####.com/uploads/allimg/130618/1-13061PU442.jpg
- s####.####.in/coopic/home.php?udid=####&os=####&osv=####&dt=####&dml=###...
- 1####.####.cn/Discuz/forum/201211/21/141024m9hwhvchs115wcs5.jpg
- i####.####.com/2014/f6/96/d/84.jpg
- i####.####.com/2015/a1/136/d/201.jpg
- i####.####.com/uploadImages/2012/236/MY5VY3I33BF9.jpg
Запросы HTTP POST:
- l####.####.com/sal.php
- l####.####.com/pv.php
- l####.####.com/i.php
- fkse####.####.com:8080/api/updateCheck.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/fankingbox/appapk/fsdk80000.apk
- <Package Folder>/app_libs/.atmp_8.log
- <Package Folder>/shared_prefs/fanking.sdk.xml
- <Package Folder>/fankingbox/appapk/update/ad10016.tmp
- <Package Folder>/shared_prefs/fksdk_pid_config.xml
- <Package Folder>/fankingbox/appapk/ad10016.apk
- <Package Folder>/shared_prefs/tmp0a01.xml.xml
- <Package Folder>/databases/53a1d7a472f6f5beaadd2d86f72eae42
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/settingsLog.xml.bak
- <Package Folder>/shared_prefs/gallst.xml
- <Package Folder>/shared_prefs/alias.xml
- <Package Folder>/shared_prefs/settingsLog.xml
- <Package Folder>/shared_prefs/fanking.strategy.sdk.xml
- <Package Folder>/fankingbox/appapk/update/ad10016.apk
- <Package Folder>/shared_prefs/fanking.sdk.xml.bak
- <Package Folder>/files/libbatterysaver.so
- <Package Folder>/app_libs/.atmp9.jar
- <Package Folder>/shared_prefs/amtrack.xml
- <Package Folder>/databases/53a1d7a472f6f5beaadd2d86f72eae42-journal
- <Package Folder>/cache/journal
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
