Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- g####.####.com
- cld####.####.com
- i####.####.com
- c-h####.####.com
- 7j####.####.com
- and####.####.com
- s####.####.cn
- d####.####.com
- w####.####.com
- as####.####.cn
- 1####.####.225
- m####.####.com
- n####.####.com
- a####.####.com
Запросы HTTP GET:
- cld####.####.com/content/detail?contentid=####&username=####&platform=##...
- cld####.####.com/cms/38/03/8e13014e04c71f93b857b43334f794b0.jpg
- s####.####.cn/cms/25/82/f01edc58ba9a11ea6d38bb0c5f91c072.jpg
- s####.####.com/lpic/93f/993/f1b/dd27bc08d6655280090c5f254ef7dc92.png
- s####.####.cn/cms/41/40/b72f78b5fdff8d2f80f039d5e30d42ba.png
- s####.####.cn/cms/34/37/62b408bbf84e14881eda36a2d7f4d4e2.jpg
- s####.####.com/sp342/2017/05/22/09223807065.jpg.webp
- s####.####.com/sp342/2017/04/18/13230525441.jpg.webp
- s####.####.com/sp342/2013/10/21/16583266325.jpg.webp
- s####.####.com/2014/10/29/10490672393_230X306.jpg.webp
- s####.####.com/cr/sdk/170417/des_V17041703Aj1so32.zip
- and####.####.com/cms/24/85/b14cfafb56db03620a0ccd95052d10e8.jpg
- d####.####.com/recommend?uid=####&ppi=####&vipUser=####&num=####&removeV...
- s####.####.com/sp342/2016/04/18/17585240671.jpg.webp
- cld####.####.com/cms/41/45/a12a8b61344af553dc105818f8896bf2.gif
- s####.####.com/sp342/2017/03/20/13543150420.jpg.webp
- a####.####.com/getUserCreditDoublePolicy?appid=####&from=####&format=###...
- as####.####.cn/cms/20/48/3ca7889db8b07c62dc914a2201694f8e.png
- cld####.####.com/cms/38/38/1f98b08d491fe243cf37e9e3a9958793.png
- s####.####.com/config/hz-hzv3.conf
- cld####.####.com/cms/37/45/3fd3ad1760b12e6a5350a3d5d391d8fc.jpg
- s####.####.com/lpic/cc6/7b7/b9a/0264a093a07ee42de449232dbf3bff07.jpg?pro...
- as####.####.cn/cms/35/40/8db70647a44111198efddc916dfdce5c.jpg.webp
- s####.####.com/2011/12/08/18365358451_230X306.jpg.webp
- m####.####.com/sc/v3/pplive/ref/fans_246/combine/feed/list?appid=####&ap...
- 7j####.####.com/tdata_Bpa453
- s####.####.cn/cms/13/75/896aeb6299b18f1631efc30ae531d2ef.jpg
- s####.####.com/cms/25/07/a3aceb1b5e5f4aa060efeddd192d55b9.png
- d####.####.com/ikandelivery/ipadad?pos=####&dnt=####&did=####&carrier=##...
- s####.####.cn/cms/25/63/829dc084eb7c13e25577f28bfd19b57e.jpg
- and####.####.com/cms/12/44/4ec6e5e2410d44e00a9d5b7b71814b89.jpg
- s####.####.com/cms/11/83/4bc75805d5b84fe30379e1a044934941.png
- s####.####.com/cms/11/82/498e9bc11b86c89e1534848c19f05919.png
- m####.####.com/
- s####.####.cn/cms/20/15/598dfa206e53389eb8a371d305d60fdc.jpg
- s####.####.cn/cms/41/95/522bcef5ac43969ae6005d0bbdf224ff.jpg
- s####.####.com/2014/04/23/10514403916_230X306.jpg.webp
- s####.####.cn/cms/33/98/921ef507b32e030b75c7c99cfe74203a.jpg
- as####.####.cn/imgs/materials/2017/5/19/20170519194124_suning-170519-520...
- cld####.####.com/cms/53/86/f60141497238a8787af5974b034346d0.jpg
- cld####.####.com/cms/18/76/d9338cc595ddfebb40f65b446e3b5323.jpg
- cld####.####.com/cms/42/43/f355ff2123b529d65034f9feaa983699.jpg
- g####.####.com/cr/sv/getGoFile?name=####
- s####.####.com/2016/09/21/09552039950_230X306.jpg.webp
- s####.####.cn/cms/11/56/fc55ac3c11781aa49f4d2094e68a5161.jpg
- s####.####.com/lpic/05b/cff/6a0/72e6ed950b3742b2f6bd10ad9f28ff96.jpg?pro...
- cld####.####.com/generalConfig?platform=####&configkey=####&appplt=####&...
- and####.####.com/cms/30/35/0a7152e904bbf4b6aacd5549b9926ddb.jpg
- s####.####.com/lpic/a59/67e/1d8/604798e8556aa309563bd5af3916e0cc.jpg?pro...
- as####.####.cn/cms/22/45/ab6a88c1f94887994313a7d3b5f4a141.jpg.webp
- s####.####.com/2017/03/27/12590936475_230X306.jpg.webp
- as####.####.cn/cms/16/72/d034b09b2226da864b491468624aecc8.png
- s####.####.com/cms/19/46/ab512720fe145f793ecbe6b5f0ee2229.png
- s####.####.com/sp342/2014/07/04/16531883794.jpg.webp
- s####.####.com/cms/16/35/c66c61fda8eb103aaf86bdf565afa2bc.png
- s####.####.com/sp342/2017/05/04/18081747886.jpg.webp
- s####.####.com/cms/38/38/1f98b08d491fe243cf37e9e3a9958793.png
- s####.####.cn/cms/24/88/35a27c7a0568bf2ee674f7b36b9751e9.jpg
- cld####.####.com/rongtoken/get?userid=####&nickname=####
- s####.####.cn/cms/34/49/96cca586b1f106f8c08556446a7d770c.jpg
- s####.####.cn/cms/30/87/7669f826499c3541f6d297cbb68c713b.jpg
- s####.####.com/sp342/2009/02/16/09540255011.jpg.webp
- s####.####.com/sp342/2017/05/04/11142630771.jpg.webp
- s####.####.com/lpic/944/84f/643/9bafe0779c4b6b98f4bb43fa89dcebbe.png
- s####.####.cn/cms/22/00/e057f074820cbd90de58395bd807781a.jpg
- as####.####.cn/cms/39/35/f5e255e4cbf8c6ace832ba82d318d983.png
- s####.####.cn/cms/36/26/cc1b96fbaac0732e7f24d2aebe725514.jpg
- s####.####.cn/cms/23/85/aee791dc696c8e4cb3a6da03554a709b.png
- s####.####.cn/cms/16/91/044f7443ed87ad8347810c97d56fbaf6.jpg
- w####.####.com/get/aphone?index=####&appplt=####&dstr=####&md5=####&appi...
- s####.####.com/sp342/2014/07/11/16470350125.jpg.webp
- s####.####.com/cms/23/06/63096992fe06dbf294683cb1b75523b6.png
- and####.####.com/cms/28/49/e91eb307652dcb06f61ed78d2fc6b293.jpg
- s####.####.com/sp342/2016/08/24/10555544147.jpg.webp
- s####.####.cn/cms/48/85/c29168dfc4812bbf3d806d015a22761f.jpg
- s####.####.cn/cms/29/21/8dd00b6b85bbb0bdb7bad802aac4bfdc.jpg
- s####.####.cn/cms/51/82/a3c9214009cbdc9f71f61e268c9305f2.jpg
- s####.####.com/2012/04/14/16424309825_230X306.jpg.webp
- cld####.####.com/tab/v1/list?platform=####&appid=####&appver=####&appplt...
- cld####.####.com/cms/17/04/c2999dfd58cf6cb5853848d4f78e3fca.gif
- cld####.####.com/cms/34/54/783a61707f279cd780bde2a6e1e6da04.gif
- s####.####.cn/cms/30/60/8267193e3c574c607007690d33db558d.jpg
- 7j####.####.com/tdata_aVK029
- cld####.####.com/getConfig?ZGV2aWN####
- cld####.####.com/cms/26/81/11325d0347f8277a0b7e98be8ed21ef2.png
- s####.####.cn/cms/49/89/608a80e121b76cfa56cf85e817edd8c9.jpg
- s####.####.com/sp342/2017/02/24/16331687350.jpg.webp
- s####.####.com/topic/v1/get?businessid=####&businesstype=####
- s####.####.com/lpic/04d/129/bba/a227031071cb442e20547b707557e4c5.jpg?pro...
- cld####.####.com/cms/16/65/a0c68297f4609fbe5c687adf00c30e68.jpg
- s####.####.cn/cms/25/06/6705313de8a9fa90f77d3ec9849dc60b.jpg
- s####.####.cn/cms/22/44/204b5052918167d2b881bfd76f6a27f4.jpg
- s####.####.com/cms/19/29/561e047817ee645da0a2b6ee8e7a6e7a.png
- m####.####.com/v4/module?lang=####&platform=####&appid=####&appver=####&...
- s####.####.cn/cms/94/19/7c337d33441c23288d225f26c8484ef7.jpg
- and####.####.com/cms/32/45/29ec36b62800125b63ca51e3afabdc74.jpg
- s####.####.cn/cms/14/99/db924fc4ceca77d9608bc7049399bc58.jpg
- s####.####.com/sp342/2016/11/18/02000642735.jpg.webp
- s####.####.cn/cms/41/58/53175de1be991fe2dceb28ebde8b00ca.jpg
- cld####.####.com/control?ver=####&userLevel=####&platform=####&osv=####&...
- s####.####.com/cms/18/58/ec1c4e42822e782f3e2dd1e555b82d34.png
- s####.####.cn/cms/31/18/9c29e7ace8225eb03439747765157bff.jpg
- s####.####.com/sp342/2012/03/09/10440309411.jpg.webp
- cld####.####.com/generalConfig?platform=####&appplt=####&configType=####...
- and####.####.com/cms/37/21/5f1ec1a86a7b01a90813fa63aee438a2.jpg
- s####.####.com/cms/12/29/c7c5c302c5f8d5e85a2acaca2701f72d.png
- s####.####.com/sp342/2017/05/10/16324056812.jpg.webp
- s####.####.com/2011/03/28/14022419549_230X306.jpg.webp
- s####.####.cn/cms/32/24/52836e957825dedc3b8c83d3891a8be2.jpg
- i####.####.com/jk/1.html?0eDcpuP####
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- s####.####.com/sp342/2017/05/16/11025303284.jpg.webp
- s####.####.cn/cms/51/72/632ebc273424907f8277a69114373183.jpg
- s####.####.com/lpic/a1d/620/96f/cbc280fbef0bf44a1d72a1b28bd93ffc.jpg?pro...
- cld####.####.com/check_update?platform=####&appplt=####&osv=####&appid=#...
- cld####.####.com/globalConfig?platform=####&appplt=####&osv=####&appid=#...
- s####.####.com/sp342/2017/05/15/12032595170.jpg.webp
- s####.####.cn/cms/13/57/a09efd655a026fd397fb47a64bd5571b.jpg
- cld####.####.com/cms/26/14/a0193da8501f05a99944e070496ed52a.jpg
- and####.####.com/softlist?device=####&platform=####&sv=####&listid=####&...
- d####.####.com/ikanstat/ipadstat?pos=####&tid=####&sid=####&cid=####&pid...
- cld####.####.com/cms/17/02/6b8e5719afe01f5a90b7318a3a8bf5a6.gif
- cld####.####.com/tab/v1/detail?tabid=####&platform=####&appid=####&appve...
- cld####.####.com/cms/22/73/93642d566dd4fe69b84ef1f78951267f.gif
- s####.####.cn/cms/25/93/145b1ffca9b4c5c571dd6ac6292242e5.jpg
- s####.####.cn/cms/15/05/993920fb2a5230edb14b6115b02b709d.jpg
- s####.####.cn/cms/21/58/201d6043b939f43bd9613e40785a991c.jpg
- s####.####.com/cms/23/79/f40f61bf1df8a962ccb72d5ded38c4da.png
- i####.####.com/1.html?sdPg0uX####
- as####.####.cn/cms/41/80/945ef81c0f11507dc14aff387a033d31.png
- s####.####.cn/cms/23/14/36f726bb0a0eefa97534d3771f6ccfe6.jpg
- cld####.####.com/manual_update?platform=####&appplt=####&osv=####&appid=...
- s####.####.com/cms/19/13/de5f123f0eea25fd412227ae7e36c196.png
- as####.####.cn/cms/40/08/420462a279acbe7b942cfe917564f7bb.png
- s####.####.com/2011/08/09/16191811991_230X306.jpg.webp
- cld####.####.com/cms/20/89/0e9c8cda1259ad030a64f15447f34282.jpg
- cld####.####.com/cms/33/69/ac1ddd0c86948d9fd4d52f6112390941.jpg
- and####.####.com/cms/30/75/c4bbc582cc0ee76f6a27602082bb5ebf.jpg
- and####.####.com/cms/14/42/4b3d0e57a230351827f6bf892ac19615.jpg
- and####.####.com/cms/35/04/47bbe1fe1512ad0d1da484b58255e51b.gif
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- d####.####.com/recTopic?uid=####&extraFields=####&rmTopicIds=####&src=##...
- 7j####.####.com/tdata_SEy321
- 7j####.####.com/tdata_inM454
- s####.####.com/sp342/2017/03/13/16531076314.jpg.webp
- as####.####.cn/cms/11/69/5bf97bf564ef8c28b34602220b5e7c66.jpg.webp
- and####.####.com/cms/12/34/dcd2fb6aed8dc8e4270bae92024c3d6c.jpg
- cld####.####.com/cms/25/61/6ee20ffc922ba96eb437d55dd5a314f4.jpg
- w####.####.com/public/ppi?appid=####&appplt=####&cc=####&appver=####&dev...
- s####.####.cn/cms/25/38/29a65ee66e25cf64eb11590a6c97c055.jpg
- s####.####.com/sp342/2017/04/27/17262034951.jpg.webp
- cld####.####.com/cms/40/09/efc3028787400f6f6ded4b79cc6328ea.jpg
- s####.####.cn/cms/26/20/a18c2e85cb0defd5b0a54b195014046a.jpg
- s####.####.cn/cms/15/77/7046f570e41a642b939b7e4045fcb61f.jpg
- s####.####.cn/cms/30/57/662f834bb4a237227d90fa902f9cdbcf.jpg
- s####.####.com/2017/03/27/15545424552_230X306.jpg.webp
- s####.####.cn/cms/24/12/8092727cc57186d6cc95c11447d3c275.jpg
Запросы HTTP POST:
- s####.####.com/api.php?format=####&t=####
- g####.####.com/cr/sv/getEPList
- s####.####.com/api.htm?format=####&t=####
- n####.####.com/navipush.json
- n####.####.com/navi.xml
- a####.####.com/app_logs
- 1####.####.225/dreport
- c-h####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/XmSmLockFile.txt
- /data/anr/traces.txt
- <Package Folder>/ReadyHost.txt
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes1000225812.zip
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 0771 <Package Folder>/.syslib-
- getenforce
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- rm <Package Folder>/files/hftJcw46N.dex
- /data/data/####/files/gdaemon_20151105 0 ####/com.igexin.sdk.PushService 25239 300 0
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm -f <Package Folder>/files/hftJcw46N.dex
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- chmod 0771 /data/data/####/.syslib-
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- rm <Package Folder>/files/hftJcw46N.jar
- sh <Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 25239 300 0
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- chmod 700 <Package Folder>/files/gdaemon_20151105
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- chmod 700 /data/data/####/files/gdaemon_20151105
- <error:2>
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- rm -f <Package Folder>/files/hftJcw46N.jar
- <dexopt>
Может автоматически отправлять СМС-сообщения.
