Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.cn
- 7x####.####.com
- o####.####.com
- c####.####.com
- z####.####.com
- t####.####.cn
- c####.####.cn
- a####.####.com
Запросы HTTP GET:
- c####.####.cn/game/icon/2987935627291.jpg
- c####.####.cn/game/icon/s/1484302255606.png
- c####.####.cn/game/pic/2017-05-02/1493730707004.jpg
- c####.####.cn/game/icon/s/1494568241977.png
- c####.####.cn/game/icon/s/1455766922912.png
- c####.####.cn/game/icon/2958570535082.jpg
- c####.####.cn/resources/gj.png
- c####.####.cn/game/icon/2938958624765.jpg
- c####.####.cn/game/icon/s/1484551984450.png
- c####.####.cn/game/icon/s/1479193094554.png
- c####.####.cn/game/icon/2987516880592.png
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- c####.####.cn/game/icon/s/1483093449496.png
- c####.####.cn/game/icon/s/1446461029626.png
- c####.####.cn/game/icon/s/1461638287833.png
- c####.####.cn/game/icon/s/1495077217794.png
- t####.####.cn/2153773471/50/5719368419/0
- 7x####.####.com/d/jquery-1.10.1.min.js
- c####.####.cn/game/icon/s/1490586805994.png
- c####.####.cn/game/icon/s/1467702192004.png
- c####.####.cn/game/icon/s/1467185152802.png
- t####.####.cn/crop.0.0.180.180.50/44844cd8jw1e8qgp5bmzyj2050050aa8.jpg
- c####.####.cn/game/icon/s/1478745416488.png
- c####.####.cn/game/icon/s/1493203656485.png
- c####.####.cn/game/icon/s/1459178363000.png
- c####.####.cn/game/icon/2988138719005.png
- c####.####.cn/game/pic/2017-05-02/1493730706802.jpg
- c####.####.cn/game/icon/s/1495077692344.png
- c####.####.cn/game/icon/s/1492687616975.png
- c####.####.cn/game/icon/s/1495188149882.png
- c####.####.cn/game/icon/s/1495182145571.png
- c####.####.cn/game/icon/2986984944419.jpg
- c####.####.cn/game/icon/s/1468291860661.png
- c####.####.cn/game/icon/2975134770228.png
- c####.####.cn/game/icon/s/1484906335275.png
- c####.####.cn/game/icon/s/1493730705903.png
- c####.####.cn/game/icon/s/1474600883892.png
- c####.####.cn/game/icon/2987696512917.png
- c####.####.cn/game/icon/2975134698687.png
- c####.####.cn/game/icon/s/1490955455890.png
- c####.####.cn/game/icon/s/1494416582105.png
- c####.####.cn/game/pic/2017-05-02/1493730707205.jpg
- c####.####.cn/resources/internet.png
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- c####.####.cn/game/pic/2017-05-02/1493730707403.jpg
- c####.####.cn/game/icon/s/1492658141504.png
- s####.####.com/core.php?web_id=####&t=####
- t####.####.cn/1149521112/50/1279875000/1
- s####.####.com/z_stat.php?id=####&web_id=####
- c####.####.cn/resources/tx.png
- c####.####.cn/game/icon/s/1481770141495.png
- c####.####.cn/game/icon/s/1491028697133.png
- c####.####.com/9.gif?abc=####&rnd=####
- c####.####.cn/game/icon/s/1478568746902.png
- c####.####.cn/game/icon/2938958591174.jpg
- c####.####.cn/game/icon/2961926916951.jpg
- c####.####.cn/game/icon/s/1494328660006.png
- c####.####.cn/game/icon/2956851889240.jpg
- c####.####.cn/game/icon/s/1477046966703.png
- t####.####.cn/default/images/default_avatar_male_50.gif
- d####.####.cn/css/main.css?f=####
- c####.####.cn/game/icon/2987698728891.jpg
- c####.####.cn/game/icon/s/1487819053331.png
- c####.####.cn/game/icon/2975134778067.png
- c####.####.cn/game/icon/2938973024836.png
- c####.####.cn/game/icon/2988195793666.jpg
- c####.####.cn/game/icon/s/1483068945762.png
- c####.####.cn/game/icon/2939153776925.jpg
- c####.####.cn/resources/datapackage.png
- c####.####.cn/game/icon/s/1484900335455.png
- c####.####.cn/game/icon/2958570153254.jpg
- c####.####.cn/game/pic/2017-05-02/1493730706594.jpg
- c####.####.cn/game/icon/s/1488689707525.png
- c####.####.cn/game/icon/s/1481272765738.png
- c####.####.cn/game/icon/s/1470123893124.png
- c####.####.cn/resources/noadvert.png
- c####.####.cn/game/icon/s/1486265438051.png
- c####.####.cn/game/icon/s/1491451269713.png
- c####.####.cn/game/icon/2938958611092.jpg
- c####.####.cn/file/20170520/dd54c6c8-88be-4711-8901-db78241a9dc4.gz
- c####.####.cn/game/icon/2987698694276.png
- c####.####.cn/game/icon/s/1473404301131.png
- c####.####.cn/game/icon/2938958573523.jpg
- c####.####.cn/game/icon/s/1493977472130.png
- c####.####.cn/game/icon/s/1452673169879.png
- d####.####.cn/tactics.htm?m=####&gamecode=####
- c####.####.cn/game/icon/s/1489124514190.png
- c####.####.cn/game/icon/2975134745737.png
- c####.####.cn/game/icon/2988213839969.jpg
- c####.####.cn/game/icon/s/1486622890167.png
- c####.####.cn/game/icon/s/1493284793763.jpg
- c####.####.cn/game/icon/s/1461840342202.png
- c####.####.cn/game/icon/s/1493263394645.png
- c####.####.cn/game/icon/2988105341485.jpg
- c####.####.cn/game/icon/s/1482981582992.png
- c####.####.cn/game/icon/s/1493182337577.png
- c####.####.cn/game/icon/2975134753076.png
- c####.####.cn/game/icon/s/1492580695300.png
- c####.####.cn/game/icon/s/1495013560004.png
- c####.####.cn/game/icon/s/1495101385579.png
- t####.####.cn/3972051922/50/5729431149/1
Запросы HTTP POST:
- d####.####.cn/getapkupgrade
- d####.####.cn/getplatbasicinfo
- d####.####.cn/getgamegiftlist
- a####.####.com/app_logs
- d####.####.cn/getpushlist
- o####.####.com/v2/get_update_time
- d####.####.cn/gettooltip
- d####.####.cn/getgamedetail
- d####.####.cn/getgamecommentlist
- s####.####.com/cw/cp.action?requestId=####&g=####
- d####.####.cn/getrelativegames
- o####.####.com/v2/check_config_update
- d####.####.cn/getgamelist
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- d####.####.cn/uploaduserapksinfo
- d####.####.cn/getwapgameconfig
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/online_below_list
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/rank_title
- <Package Folder>/shared_prefs/Jolo_play.xml
- <Package Folder>/databases/DownloadManager.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/online_banner
- <Package Folder>/files/rank_first_lc
- <Package Folder>/files/home_notice
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/home_list
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/mobclick_agent_cached_<Package>6200030
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/jolo_play_games
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/game_type_c
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/home_recommand
- <Package Folder>/files/online_game_info
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
