Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- t####.####.com
- d####.####.cn
- y####.####.cn
- p####.####.com
- c####.####.com
- e####.####.com
- a####.####.com
- pi####.####.com
- l####.####.com
- 1010jia####.com
Запросы HTTP GET:
- t####.####.com/pic18/user_photo/20161224/96d70b2c5f4e4dc965ddc2462ca9d16...
- c####.####.com/bootstrap/3.3.5/css/bootstrap-theme.min.css
- t####.####.com/html5new/2.0/js/jquery.mmenu.min.all.js
- c####.####.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=####&st...
- t####.####.com/pic18/user_photo/20161026/0d2963355ba1fa4ff757f43a06b6ac3...
- 1010jia####.com/html5new/2.0/images/loginqq.png
- c####.####.com/bootstrap/3.3.5/js/bootstrap.min.js
- 1010jia####.com/html5new/2.0/daan/upload_list?default####
- t####.####.com/pic18/user_photo/20161211/efa49c08d7d6ab058f67af0f37f7e13...
- 1010jia####.com/html5new/2.0/images/me_icon.png
- 1010jia####.com/html5app/?default####
- t####.####.com/pic18/user_photo/20161122/269999cd301d8156236a94332e9a249...
- t####.####.com/html5new/2.0/js/jquery.flexslider.js
- t####.####.com/html5new/2.0/js/my.js?v=####
- 1010jia####.com/html5app/images/yj.png
- 1010jia####.com/html5app/js/skin/flexible.js
- 1010jia####.com/html5app/images/back.png
- t####.####.com/pic18/user_photo/20161029/6a1785d541116e9dd31c79e361f69cb...
- 1010jia####.com/html5app/login?default####
- t####.####.com/pic18/user_photo/20170215/eaee0f97cb52753c6a8abb60b84f2e7...
- t####.####.com/pic18/user_photo/20161020/72bdb4ef5587b9afca24e4569d6e80e...
- t####.####.com/pic18/user_photo/20161012/1c517de786b816ec12a98edc7a480ff...
- t####.####.com/pic18/user_photo/20161015/a943cbd3a2cfec133e6c1f237b2b5e0...
- 1010jia####.com/html5app/images/zuye_icon.png
- t####.####.com/html5new/2.0/images/back.png
- 1010jia####.com/html5app/css/index.css?v=####
- t####.####.com/html5new/2.0/js/jquery.cookie.js
- t####.####.com/pic18/user_photo/20161106/5e64b601e7affec70c07c80805cf6fb...
- 1010jia####.com/html5app/js/jquery.cookie.js
- c####.####.com/jquery/1.11.3/jquery.min.js
- 1010jia####.com/html5new/2.0/?default####
- t####.####.com/pic18/user_photo/20161123/d02f09e141db6cf4b7855769ac6bade...
- c####.####.com/bootstrap/3.3.5/fonts/glyphicons-halflings-regular.ttf
- t####.####.com/pic18/user_photo/20170207/9c99665f80caf71f12a704b23cfb4f6...
- 1010jia####.com/html5app/js/swipe2.js
- 1010jia####.com/html5new/2.0/images/logo1.png
- 1010jia####.com/html5app/images/sm.png
- 1010jia####.com/html5app/js/jquery.mmenu.min.all.js
- 1010jia####.com/html5new/2.0/ajax/index/a/more_need/page/2/1
- t####.####.com/pic18/user_photo/20161119/6b6d78f7f32f14a5ca1068e0e919924...
- 1010jia####.com/html5new/2.0/images/daansq.png
- t####.####.com/pic18/user_photo/20161101/ba5c2482bae2011d4464e65eb014255...
- t####.####.com/pic18/user_photo/20170216/05f05e7e831241c8bb79ef0153d6943...
- 1010jia####.com/html5new/2.0/css/daan/upload_list.css
- 1010jia####.com/html5new/2.0/images/shao.png
- t####.####.com/html5new/2.0/css/index.css?v=####
- 1010jia####.com/html5new/2.0/images/collects.png
- t####.####.com/pic18/user_photo/20161106/25a69e2ffc4b584c642b9e2c7acf38e...
- t####.####.com/pic18/user_photo/20161106/a66ca0a1f2cc9e587f5f2a9446e39c7...
- 1010jia####.com/html5new/2.0/images/loginwx.png
- 1010jia####.com/html5app/images/me_icon.png
- t####.####.com/pic18/user_photo/20161009/2cb274f8fb200e4ad370ed04d3e858d...
- 1010jia####.com/html5app/js/my.js?v=####
- 1010jia####.com/html5app/images/no_login_pic.png
- t####.####.com/pic18/user_photo/20170208/e0978cfc64327130b53ec449908e26f...
- 1010jia####.com/html5new/2.0/js/iscroll-probe.js
- e####.####.com/app/s.js?siteId=####&goTop=####
- t####.####.com/pic18/user_photo/20170221/d7a680802d24cf8ffc1363545fb6e7b...
- t####.####.com/pic18/user_photo/20161121/d6b6243242771264525f7f0ded2467c...
- t####.####.com/pic18/user_photo/20161225/6a400ae595f6bbef75508e53221e7af...
- 1010jia####.com/html5app/images/serch_02.png
- t####.####.com/pic18/user_photo/20170122/4dd058d11fe54d628113b1b6930662b...
- 1010jia####.com/html5new/2.0/images/logo2.png
- t####.####.com/pic18/user_photo/20161026/6bb68a18728675efe45da72201fabb9...
- t####.####.com/html5new/2.0/css/date/jquery.mmenu.all.css
- t####.####.com/pic18/user_photo/20170212/83895028b5a2f84df5b0c768dfc58af...
- t####.####.com/html5new/2.0/images/xiala.png
- t####.####.com/pic18/user_photo/20161026/f5919f0f8c0682dbeec784036b51891...
- t####.####.com/pic18/user_photo/20161029/e6355630b022ff29eab5dd10d3ea6d3...
- d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar
- t####.####.com/html5new/2.0/images/xs.png
- 1010jia####.com/html5new/2.0/images/zysq.png
- t####.####.com/pic18/user_photo/20161026/8bfe9dc65c3f964ff11e9eacf89b79f...
- 1010jia####.com/html5new/2.0/js/push_flush.js
- 1010jia####.com/html5app/images/collects.png
- 1010jia####.com/html5app/images/sc.png
- c####.####.com/bootstrap/3.3.5/css/bootstrap.min.css
- 1010jia####.com/html5app/images/loginqq.png
- t####.####.com/pic18/user_photo/20170209/e1356afcfe775956a24dfa0e98a03a6...
- t####.####.com/html5new/2.0/images/fdj1.png
- t####.####.com/pic18/user_photo/20170211/0ae08f0520abcd5036681bbe58ee6c5...
- t####.####.com/pic18/user_photo/20170206/bb5b975c811fff2ef56390680d713a2...
- p####.####.com/cityjson?ie=####
- 1010jia####.com/html5new/2.0/images/pigai.png
- t####.####.com/pic18/user_photo/20161127/e918187b496f02a484e9c2b9bf8bc55...
- 1010jia####.com/html5app/images/loginwx.png
- t####.####.com/pic18/user_photo/20161113/7ce3e2e4345bc425b1d60d5b519c4c5...
- 1010jia####.com/html5new/2.0/images/mine_homework.png
- t####.####.com/html5new/2.0/js/skin/flexible.js
- 1010jia####.com/html5new/2.0/js/swipe2.js
- 1010jia####.com/html5new/2.0/images/news.png
- t####.####.com/pic18/user_photo/20161012/9e9055331270cfd13ca8dd46a805b99...
- t####.####.com/pic18/user_photo/20161211/2af9b9a6e3a5a5d3c208bf912468869...
- 1010jia####.com/html5new/2.0/images/zuye_icon.png
- t####.####.com/pic18/user_photo/20161112/bbc53303db152de406ece67288a242f...
- 1010jia####.com/html5app/js/myform.js?1####
- t####.####.com/pic18/user_photo/20161119/6eb5945f00ff59e96cc53d69d3ca6c8...
- t####.####.com/html5new/2.0/images/shouyebj.jpg
- y####.####.cn/k2?protocol=####&version=####&cid=####
- 1010jia####.com/html5new/2.0/search/result?word=####
- t####.####.com/pic18/user_photo/20161012/0099345b8dcf9bd2940d379f1f48f55...
- t####.####.com/pic18/user_photo/20161127/6523fd3ced69b500e88cb9284d68fc7...
- 1010jia####.com/html5app/images/serch_01.png
- 1010jia####.com/html5app/css/date/jquery.mmenu.all.css
- t####.####.com/pic18/user_photo/20161026/c8a5a446b4553d9ee47bfa7b11fa92a...
- 1010jia####.com/html5app/js/jquery.flexslider.js
Запросы HTTP POST:
- pi####.####.com/mstat/report/?index=####
- y####.####.cn/k1?requestId=####&g=####&ua=####
- l####.####.com/sdk.php
- pi####.####.com/mstat/report
- a####.####.com/app_logs
- l####.####.com/offline_loc
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/files/cfg/l/DVVersion.cfg
- <Package Folder>/databases/ua.db
- <Package Folder>/files/com.tencent.open.config.json.310657022
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/files/cfg/h/DVDirectory.cfg
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/files/lldt/firll.dat
- <Package Folder>/files/exid.dat
- <Package Folder>/files/cfg/a/ResPack.rs
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/databases/wxop_tencent_analysis.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/ofld/ofl_location.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/ofld/ofl.config
- <Package Folder>/files/.imprint
- <Package Folder>/cache/webviewCacheChromium/f_00002c
- <Package Folder>/cache/webviewCacheChromium/f_00002b
- <Package Folder>/cache/webviewCacheChromium/f_00002a
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/cfg/a/satellitestyle.sty
- <Package Folder>/cache/webviewCacheChromium/f_00001c
- <Package Folder>/cache/webviewCacheChromium/f_000023
- <Package Folder>/cache/webviewCacheChromium/f_000022
- <Package Folder>/cache/webviewCacheChromium/f_000021
- <Package Folder>/cache/webviewCacheChromium/f_000020
- <Package Folder>/cache/webviewCacheChromium/f_000027
- <Package Folder>/cache/webviewCacheChromium/f_000026
- <Package Folder>/cache/webviewCacheChromium/f_000025
- <Package Folder>/cache/webviewCacheChromium/f_000024
- <Package Folder>/cache/webviewCacheChromium/f_000029
- <Package Folder>/files/cfg/a/trafficstyle.sty
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/files/ofld/ofl_statistics.db
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/files/cfg/h/DVHotMap.cfg
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/files/cfg/l/DVDirectory.cfg
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/cfg/h/DVHotcity.cfg
- <Package Folder>/databases/pri_wxop_tencent_analysis.db-journal
- <Package Folder>/files/ver.dat
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000028
- <Package Folder>/files/ofld/ofl_location.db-journal
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/cache/webviewCacheChromium/f_00001f
- <Package Folder>/cache/webviewCacheChromium/f_00001d
- <Package Folder>/cache/webviewCacheChromium/f_00001e
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/files/cfg/l/DVHotMap.cfg
- <Package Folder>/files/libcuid.so
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/files/cfg/h/DVVersion.cfg
- <Package Folder>/files/ofld/ofl_statistics.db-journal
- <Package Folder>/files/cfg/a/mapstyle.sty
- <Package Folder>/files/cfg/l/DVHotcity.cfg
- <Package Folder>/shared_prefs/authStatus_<Package>;remote.xml
- <Package Folder>/shared_prefs/.mta-wxop.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Может автоматически отправлять СМС-сообщения.
