Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.122.origin
Сетевая активность:
Подключается к:
- 2####.####.233:8080
- ws####.####.com
- appsup####.####.com
- os####.####.com
- 2####.####.233:14000
- q####.####.com
- 2####.####.233:443
- c####.####.com
- 2####.####.51
- ping####.####.com
- sup####.####.com
- 2####.####.233
- a####.####.com
- qzones####.####.cn
Запросы HTTP GET:
- os####.####.com/upload/task/task_14235387216107.jpg
- 2####.####.51/static/upload/category/category_14013634922916.png
- appsup####.####.com/cgi-bin/appstage/mstats_report?report_type=####&plat...
- sup####.####.com/include/qqmaileditor/editor.js
- 2####.####.51/static/upload/category/category_14013634718464.png
- 2####.####.51/static/upload/tmp/zixun.png
- q####.####.com/open/mobile/login/qzsjump.html?appid_for_getting_config=#...
- ping####.####.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=##...
- os####.####.com/upload/task/task_14235385484852.jpg
- os####.####.com/upload/task/task_1422952401619.jpg
- sup####.####.com/js/isd_speed.js
- os####.####.com/upload/task/task_14235383979745.jpg
- os####.####.com/upload/task/task_14235389722523.jpg
- 2####.####.51/static/upload/category/category_14118830302709.png
- 2####.####.51/api/categorylist?offset=####&limit=####
- sup####.####.com/include/js/all.js
- sup####.####.com/include/style/comm2010.css
- 2####.####.51/static/upload/category/category_14013634464799.png
- c####.####.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=####&st...
- 2####.####.51/static/upload/news/news_14014310848797.jpg
- qzones####.####.cn/c/=/open/mobile/login/js/login_browser_jump.js,/open/...
- sup####.####.com/js/forum/forum_780.js
- 2####.####.51/static/upload/category/category_14013634300082.png
- sup####.####.com/write.shtml?fid=####&ADPUBNO=####
- 2####.####.51/api/tasklist?cid=####&offset=####&limit=####
- 2####.####.51/static/upload/category/category_14118830504095.png
- 2####.####.51/api/indexrecommmend?offset=####&limit=####
- sup####.####.com/include/js/qmtool.js
- 2####.####.51/static/upload/news/news_14014162931449.jpg
- os####.####.com/upload/task/task_14235386345353.jpg
- os####.####.com/upload/task/task_14229521283157.jpg
- os####.####.com/upload/task/task_142295292173.jpg
- qzones####.####.cn/qconn/widget/mobile/login/images/loading.gif?max_age=...
- 2####.####.51/api/normaltopic
- qzones####.####.cn/open_proj/qqconnect/h5login/css/jump2.css?t=####
- sup####.####.com/login.shtml?fid=####&url=####
- qzones####.####.cn/open_proj/qqconnect/h5login/css/sprite/jump2.png?max_...
- os####.####.com/upload/task/task_14229514447696.jpg
Запросы HTTP POST:
- 2####.####.233:443/
- ws####.####.com/tpns.cgi
- sup####.####.com/cgi-bin/loginInfo
- c####.####.com/qqconnectutil/sdk
- 2####.####.233:14000/
- 2####.####.233/
- a####.####.com/app_logs
- 2####.####.233:8080/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/device_id.xml
- <Package Folder>/databases/KeyValueDB
- <Package Folder>/databases/dbwaYi-journal
- <Package Folder>/databases/KeyValueDB-journal
- <Package Folder>/databases/WorkInfoDB-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/com.tencent.open.config.json.1101477100
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/shared_prefs/<Package>.tpush.local.setting.private.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/databases/RecordInfoDB-journal
- <Package Folder>/app_fxgt/classes.jar
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Может автоматически отправлять СМС-сообщения.
