Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.78.origin
Сетевая активность:
Подключается к:
- s####.####.com
- g####.####.com
- mo####.####.com
- w####.####.cn
- se####.####.com
- b####.com
- sptcd####.####.com
- fc####.####.com
- c####.####.com
- st####.####.net
- t####.####.cn
- l####.####.com
- m####.####.com
- 1####.####.144
- c####.####.cn
- a####.####.com
Запросы HTTP GET:
- m####.####.com/se/transcode/static/js/global/frame_d76236c.js
- m####.####.com/speed/static/tj.gif?pagetype=####&logid=####&ta_net=####&...
- m####.####.com/se/static/js/fusion/deps/fusion_4f0fdee.js
- c####.####.com/v6/game/platform/images/51gameLogo_new.gif
- m####.####.com/static/searchbox/openjs/share.js?v=####
- m####.####.com/se/static/js/fusion/b-scroll/b-scroll_4463064.js
- c####.####.com/game/2016/201611/20161124/d15cda898dae557fd6ca298ce4e608f...
- c####.####.com/v6/game/website/common/images/topbarbg.gif
- c####.####.com/v6/game/website/tx/js.js?v=####
- m####.####.com/se/static/js/fusion/deps/naboo_a0624f6.js
- g####.####.com/mms/graph/static/resource/sdk/v1.9.8/mms-wise.js
- c####.####.com/v6/game/website/lycq/images/txt_btm_bg.jpg
- sptcd####.####.com/nocache/s.gif?&ran=####
- c####.####.com/v6/game/website/lycq/images/t_btn_bg.png
- m####.####.com/se/static/js/modules/feedback/feedback_b847024.js
- m####.####.com/se/static/pmd/pmd/share/share_cc26fe3.js
- c####.####.com/v6/game/website/lycq/images/hot.jpg?v=####
- c####.####.com/v6/game/website/common/images/game_btm_guide.png
- c####.####.com/v6/game/website/lycq/images/game_info_bg.jpg
- m####.####.com/su?pre=####&p=####&ie=####&json=####&from=####&sugsid=###...
- m####.####.com/static/tj.gif?time=####
- c####.####.com/v6/game/website/lycq/images/final_box_bg.jpg
- m####.####.com/se/transcode/static/js/global/qwbdbox_8937b33.js
- m####.####.com/se/transcode/static/img/tc-banner_1efebb5.png
- c####.####.com/game/2017/201704/20170405/ff39bda7addd3bed176197a770f10e9...
- c####.####.com/game/2017/201703/20170320/4adcf6652c4c32d1215ccb928f32e07...
- m####.####.com/static/search/iconfont/search_iconfont_128e950d.ttf
- c####.####.com/v6/game/website/lycq/images/title_word.png
- c####.####.com/game/2016/201611/20161124/d16280f3782ed5256e8537f37ea5eac...
- w####.####.cn/sanzijing/8110.htm
- sptcd####.####.com/cache/s.gif?&ran=####
- c####.####.com/game/2017/201703/20170318/41818b710aa936fc0d4eb0baa594e60...
- se####.####.com/mwb.gif?fm=####&qid=####&type=####&did=####&q=####&data=...
- m####.####.com/se/transcode/static/js/global/fpbmain_4b2c93c.js
- c####.####.com/game/2016/201611/20161124/47da7d7cb141060d80dec97603c2f51...
- se####.####.com/mwb.gif?type=####&fm=####&data=####&qid=####&did=####&q=...
- m####.####.com/s?word=####&sa=####&ts=####&t_kt=####&ie=####&rsv_t=####&...
- m####.####.com/se/transcode/static/js/global/showLog_d81ef5f.js
- 1####.####.144/rp/feed?content-type=####&jsonp=####&di=####&lineNum=####...
- mo####.####.com/
- m####.####.com/rec?platform=####&ms=####&rset=####&word=####&qid=####&rq...
- s####.####.com/static/dspui/js/mw.js?_=####
- m####.####.com/static/search/clear.png
- m####.####.com/static/index/promB/mmsicon.png
- m####.####.com/his?callback=####&type=####&pic=####&lid=####&net=####&hi...
- l####.####.com/website/ajaxload/?what=####&game_id=####
- b####.com/rp/wordner?id=####&user=####&logid=####&title=####&page_url=##...
- c####.####.com/v6/game/website/lycq/images/yxzl.png?v=####
- m####.####.com/se/transcode/static/js/global/postmessage_dc33c34.js
- c####.####.com/v6/game/website/lycq/images/ice.png
- b####.com/nocache/fesplg/s.gif?url=####&time=####&suc=####&type=####&dev...
- c####.####.com/v6/passport/js/loginframe.js?v=####
- g####.####.com/login/initlogin?from=####&callback=####&_=####
- m####.####.com/se/static/js/fusion/b-scroll/bdscroll_10fab41.js
- c####.####.com/game/2017/201703/20170320/e189a7f04dadb03651d07dc58cf1fe7...
- c####.####.com/v6/game/website/common/core/website.js?v=####
- m####.####.com/se/static/js/fusion/deps/spark_10e7396.js
- m####.####.com/se/static/img/iphone/pagelogo.png
- g####.####.com/port/logininfo/iptips?callback=####&_=####
- m####.####.com/error
- m####.####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm%401%2Csz%401320...
- t####.####.cn/timg?p####&quality=####&size=####&sec=####&di=####&src=####
- m####.####.com/se/transcode/static/js/global/pageB_817d349.js
- c####.####.com/v6/game/website/lycq/images/icon_txt.png
- c####.####.com/??v6/glo####
- m####.####.com/s?word=####
- c####.####.com/v6/game/website/lycq/images/userbox_btm.jpg?v=####
- m####.####.com/se/transcode/static/pmd/font/cicon_63f9f8c.ttf
- m####.####.com/se/static/js/fusion/deps/fusion.best_5bb531c.js
- c####.####.cn/timg?wiseala####&size=####&quality=####&sec=####&di=####&s...
- g####.####.com/dss/stat/?key_name=####&c2=####&c3=####&v=####
- a####.####.com/push/init.jsp?appid=####
- c####.####.com/v6/game/website/common/images/trans_bg.png
- s####.####.com/common/openjs/openBox.js?_v=####
- m####.####.com/static/search/resultLogo2.png
- fc####.####.com/w.gif?eid=####&baiduid=####&query=####&queryUtf8=####&se...
- m####.####.com/se/static/pmd/pmd/deps/detect_c8b750a.js
- c####.####.com/v6/game/website/lycq/images/start_game.jpg
- c####.####.com/v6/game/website/common/css/website_ext.css?v=####
- g####.####.com/api/getsortdata/undefined/undefined?callback=####&_=####
- c####.####.com/v6/game/website/lycq/js/mouseMove.js?v=####
- m####.####.com/se/static/js/fusion/deps/iscroll_d8d3456.js
- c####.####.com/v6/game/website/lycq/css/mouseover.css?v=####
- c####.####.com/v6/game/website/zlcq/images/weixin.jpg
- c####.####.com/game/2016/201611/20161124/9530e989bcb8d6e5f967333066393ac...
- m####.####.com/se/transcode/static/js/global/getShareInfo_710b61a.js
- m####.####.com/static/search/image_default.png
- m####.####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm%400%2Csz%401320...
- m####.####.com/tc?tcreq4log=####&ct=####&cst=####
- m####.####.com/se/static/js/fusion/b-scroll/scroll_973715e.js
- l####.####.com/
- c####.####.com/game/2016/201611/20161124/0ef1c33c8926a0357f0aeac89b3bd7c...
- c####.####.com/v6/game/website/common/css/common.css?v=####
- g####.####.com/mms/graph/static/resource/sdk/mobile-wise.js?v=####
- c####.####.com/game/2016/201611/20161124/c50b44f9229abad6fdbe45d4f2cc7c8...
- c####.####.com/v6/game/website/lycq/images/gl_bg.jpg
- a####.####.com/is/init.jsp?appid=####
- c####.####.com/v6/global/css/layer.css?v=####
- m####.####.com/se/static/font/cicon_61a03f3.ttf
- m####.####.com/se/static/js/uiamd/bdbox/base_bae6da8.js
- m####.####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm@1,sz@1320_1001,...
- c####.####.com/v6/game/website/lycq/css/official.css?v=####
- m####.####.com/se/static/js/uiamd/bdbox/util_52abf9b.js
- m####.####.com/se/search/search.js
- st####.####.net/gamesite/lanyue//gw/images/per_hot.png
- m####.####.com/error.jsp?traceid=####
- m####.####.com/s?word=####&rq=####&sa=####&rsf=####&pqid=####&rqid=####
- c####.####.com/v6/game/website/lycq/images/footer_text.png
- st####.####.net/gamesite/lanyue//gw/images/per_ice.png
Запросы HTTP POST:
- a####.####.com/is/info.jsp
- a####.####.com/is/init.jsp
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/dtnum.xml
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/files/vcom
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/shared_prefs/appshare.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/.cache/csanzijing.jar
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/appshare.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/com.apprush.game.sanzijing.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
