Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- p####.####.top
- c####.####.cn
Запросы HTTP GET:
- c####.####.cn/upload/201705/24/img/20170524164352075.png
- c####.####.cn/sfile/201705/30/all/cp_V2.7.7.txt
- c####.####.cn/upload/201705/24/app/20170524164406385.apk
Запросы HTTP POST:
- p####.####.top/sdf/sdm
- p####.####.top/hadat/iic/yd
- p####.####.top/jzbdt/ghbcw/d
- p####.####.top/jzbdt/abhip/x
- p####.####.top/hadat/ajdnz/meby
- p####.####.top/jzbdt/hrzj/fd
- p####.####.top/jzbdt/tnkc/yrlz/cw
- p####.####.top/jzbdt/mrwgm/insk/insv
- p####.####.top/jzbdt/mp/cyb
- p####.####.top/sdf/fjibh
- p####.####.top/jzbdt/f/wngh/k
- p####.####.top/hadat/tzoi/ndl
- p####.####.top/jzbdt/vm/ydio/rw
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/sfe.xml
- /data/anr/traces.txt
- <Package Folder>/shared_prefs/oupeng_pushed_content.xml.bak
- <Package Folder>/oupeng/pushedcontent/MeituConfig/config.json
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/res/9170d18860b2b09ee4fb47d288a028c4.jpg
- <Package Folder>/oupeng/pushedcontent/OnlineConfig/config.json
- <Package Folder>/shared_prefs/statservice_oupeng_user_prefs.xml
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/config.json
- <Package Folder>/oupeng/pushedcontent/SearchEngines/SearchEngines.zip
- <Package Folder>/oupeng/pushedcontent/MeituConfig/res/5187473cb58f685053ece1236422445b.png
- <Package Folder>/oupeng/pushedcontent/MeituConfig/res/c3c4c9f60508eef34618d08fc92ce1e1.png
- <Package Folder>/oupeng/pushedcontent/SearchEngines/config.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/oupeng/pushedcontent/MeituConfig/res/ed6b2966d4c7876465f675840ed00ba5.png
- <Package Folder>/oupeng/pushedcontent/MeituConfig/MeituConfig.zip
- <Package Folder>/oupeng/pushedcontent/OnlineConfig/OnlineConfig.zip
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/files/ph.jar
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/res/6e8797b17bce0a32a14250f70c49d411.jpg
- <Package Folder>/shared_prefs/CONST_firstInstallTime.xml
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/res/283f1b2acb5be8172b73ccb53db48954.jpg
- <Package Folder>/files/qy.jar
- <Package Folder>/databases/statistic.db
- <Package Folder>/shared_prefs/CONST_firstChannelID.xml
- <Package Folder>/shared_prefs/user_settings.xml.bak
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/CONST_first_launch.xml
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/RecommendCardConfig.zip
- <Package Folder>/databases/statistic.db-journal
- <Package Folder>/oupeng/pushedcontent/SearchEngines/res/d8cc3f005146fa4fe3446a748f7549ba.png
- <Package Folder>/oupeng/pushedcontent/SearchEngines/res/727eaaa9d7b70bdfe2c25202ca0324a1.png
- <Package Folder>/oupeng/pushedcontent/SearchEngines/res/73cacdbca833d72ba0cddf89a00e1bc2.png
- <Package Folder>/shared_prefs/user_settings.xml
- <Package Folder>/oupeng/pushedcontent/SearchEngines/res/0e6dfe3b4c9173e41ae0518e0321744e.png
- <Package Folder>/shared_prefs/ddsping.xml
- <Package Folder>/oupeng/pushedcontent/RecommendCardConfig/res/8e97e7564967823358d4bb9801ab9944.jpg
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/shared_prefs/oupeng_pushed_content.xml
- <Package Folder>/files/sw.jar
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/stats_data.1496111621362
- <Package Folder>/oupeng/pushedcontent/SearchEngines/res/b1c8f099d5c47eb8a4137db24e81f77b.png
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
