Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- ap####.####.com
- q####.####.cn
- i####.####.com
- d####.####.cn
- and####.####.com
- w####.####.cn
- api####.####.com
- res####.####.com
- m####.####.com
- a####.####.com
Запросы HTTP GET:
- i####.####.com/home_images/89_1482459729.png
- and####.####.com/servertest/api?city_id=####&device_model=####&os=####&v...
- i####.####.com/qs_img/qs_topic/3557.jpg
- m####.####.com/openapi/directsale/cartnumber?sign=####&city_id=####&devi...
- and####.####.com/NewFunction?city_id=####&device_model=####&os=####&v=##...
- i####.####.com/qs_img/qs_banner/244351.jpg
- and####.####.com/exposure/list?city_id=####&device_model=####&os=####&v=...
- and####.####.com/newfunction/getcitylist?city_id=####&vtotal=####&device...
- i####.####.com/qs_img/qs_icon/58045.jpg
- i####.####.com/qs_img/qs_banner/238251.jpg
- i####.####.com/user_avatar/5/e/29274774.jpg
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- i####.####.com/adver_images/2047_1495189598.png
- i####.####.com/qs_img/qs_topic/3559.jpg
- i####.####.com/user_avatar/e/3/215243930.jpg
- and####.####.com/zz4055E52C108369F7261070A7B4912414147021044C81C712660C7...
- i####.####.com/user_avatar/e/b/214867727.jpg
- i####.####.com/qs_img/qs_topic/3553.jpg
- i####.####.com/qs_img/qs_banner/238247.jpg
- i####.####.com/home_images/2293_1490344664.jpg
- i####.####.com/qs_img/qs_icon/58047.jpg
- i####.####.com/user_avatar/2/2/213030631.jpg
- i####.####.com/home_images/99_1459146387.png
- i####.####.com/home_images/95_1459146269.png
- and####.####.com/exposure/tabs?city_id=####&device_model=####&os=####&v=...
- i####.####.com/adver_images/2043_1494928472.png
- and####.####.com/Newfunction/mainpage?city_id=####&device_model=####&os=...
- i####.####.com/home_images/97_1459146324.png
- i####.####.com/qs_img/qs_banner/238249.jpg
- q####.####.cn/qqapp/100908995/E919295CF670DF4C60F3BD394639B88D/100
- i####.####.com/adver_images/2005_1488793579.png
- i####.####.com/home_images/87_1482459702.png
- i####.####.com/qs_img/qs_banner/244349.jpg
- and####.####.com/newgetinfo/newexpresslist?city_id=####&device_model=###...
- i####.####.com/home_images/91_1482459751.png
- and####.####.com/Personcenter/info?city_id=####&device_model=####&os=###...
- w####.####.cn/mmopen/b9qm2UZhD96kBtxWLtjjsdH1NrFibm4PD7dA9Y61d1epetm4lJ3...
- i####.####.com/user_avatar/e/9/213357959.jpg
- and####.####.com/zz4055ED26188B69F7201461853032ED8018A132AAC001EFCD22413...
- and####.####.com/exposure/subjectdetail?city_id=####&device_model=####&o...
- i####.####.com/home_images/93_1459146193.png
- i####.####.com/user_avatar/4/8/214979332.jpg
Запросы HTTP POST:
- and####.####.com/api/clientreport
- api####.####.com/v3/log/init
- ap####.####.com/AndroidV8.9.5/baidu
- s####.####.com/cw/cp.action?requestId=####&g=####
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
- res####.####.com/v3/geocode/regeo
- res####.####.com/v3/fastconnect?
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/database/pushinfo.db
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/databases/branddata.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/snowplowEvents.sqlite-journal
- <Package Folder>/databases/zxcvbnm.db-journal
- <Package Folder>/files/bdpush_modeconfig.json
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/pushclient.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/report.db-journal
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/databases/pushstat_5.3.0.db
- <Package Folder>/files/libcuid.so
- <Package Folder>/databases/mycity.db-journal
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/last_known_location.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/pushstat_5.3.0.db-journal
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
