Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069013360002: easyRegister_8d61ce1535a9f822d68f206e1a6b2518
Сетевая активность:
Подключается к:
- a####.####.com
- bai####.com
- f####.####.net
- i####.####.net
- l####.####.com
- n####.####.com
- o####.####.com
- r####.####.com
- s####.####.cn
- s####.####.net
Запросы HTTP GET:
- bai####.com/api/mobile/City.all/
- f####.####.net/201706/c2dd3baeff1066a6c3c2339739eb2450.png
- i####.####.net/07435975c8cac2e870230f92efaee0be.jpg_180x180
- i####.####.net/2b8165a9ba9272e263f8ec034cb41027.png_180x180
- i####.####.net/ab2b7ef129aa95513f88820886f63652.jpg_180x180
- s####.####.net/img/app/icons/category/cheliang.png?disableCache=####
Запросы HTTP POST:
- a####.####.com/api/check_app_update
- a####.####.com/app_logs
- l####.####.com/offline_loc
- n####.####.com/navipush.json
- o####.####.com/check_config_update
- r####.####.com/rqd/sync
- s####.####.cn/v2/report
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_plugin/lib-login.jar
- <Package Folder>/cache/####/02a17166fa385cbeb7646ca831d8e3bb97ecd27a61216444a62069652d74773b.0.tmp
- <Package Folder>/cache/####/0a0fbd08d5f5d3a3259a16fcf1c58eb0488cf48c64aee28629a515db6bb33250.0.tmp
- <Package Folder>/cache/####/0a56ffdf048d135fbbd70790a7866da3bae2dcdb5f881f3a461880a7db8df7f5.0.tmp
- <Package Folder>/cache/####/0b1b0ed159ef20de714412c43b003bbb2030e840e3ee6189a462162849851d2e.0.tmp
- <Package Folder>/cache/####/13b1711d99ed89fed0eefe6fb5fa3a5c05c46a167a02533d2f6d319a9d7db8bb.0.tmp
- <Package Folder>/cache/####/26af0625a30a5b2622a4b5a3f8d0a702a4523737f778b34c3f250c353330428e.0.tmp
- <Package Folder>/cache/####/2e8097be3e7be8858a065dcbcff636b7ccc578f94acf740cf3dacb100734e613.0.tmp
- <Package Folder>/cache/####/30564a8c6a90c4d2d068d780e4cf2c7d308b71dca069b2811e59e87f7d578f89.0.tmp
- <Package Folder>/cache/####/3324cb36bc1aca31e5ad0f2732a4e7d4bfd575cf9140b7c635f72aa905017777.0.tmp
- <Package Folder>/cache/####/382ba4a9e914598ea31f813df7e15455aed04912e52ae93f8d1ded92b55cd6d2.0.tmp
- <Package Folder>/cache/####/3ce4770c0b7a05bd3f9152397c91b5c36d5c965a79f1b46a618ffd09134d55a3.0.tmp
- <Package Folder>/cache/####/5befb5b1ffb514ec94207f83b6fac868647e4a4116084b65a2d879943db929bf.0.tmp
- <Package Folder>/cache/####/6e93a008788bf927301c7a16656fe0648b79cae51fa2f32fb8493c56e0d35b02.0.tmp
- <Package Folder>/cache/####/6fc724b9e0664a9a369aaaf7700992adc70e365fe7b4bd55369dec987430166f.0.tmp
- <Package Folder>/cache/####/92a4ca02b30581b41b0b5ea13f79ea31f0729d19b53b89de85c49d52b64da18b.0.tmp
- <Package Folder>/cache/####/a0d4a7564c9894fa4a7baf84c371bf681cdab043b98f2df6c3ff9952e7313615.0.tmp
- <Package Folder>/cache/####/a31f77f34b89df9262aafdd6934fa12cae7533aa8a7873ef23a9d7afee93baa7.0.tmp
- <Package Folder>/cache/####/a3d25e57956cb17fbbf4a38ec258c7807ff896a175a76e9571accb4ca6f9bdac.0.tmp
- <Package Folder>/cache/####/a5f79697359c5aeceda76869d9af95080aea0621af802c55bed28861fa99f38b.0.tmp
- <Package Folder>/cache/####/ab31fc813b0ba301dcc8dfaf142deaf2416a926522a1ca923f1bab9a81873789.0.tmp
- <Package Folder>/cache/####/b2a6de8603e0c974c6e798f5fb19501c09fad827ab9dce6c57247b95e3603b33.0.tmp
- <Package Folder>/cache/####/b5b3174e0918418ea9a4d6dfd8513c2b84896e3dedb07ca316c08730b21beb9e.0.tmp
- <Package Folder>/cache/####/d4530e0b1fa0cc9d640f4233341dac000cba44e2006008369ac2633142cfcd53.0.tmp
- <Package Folder>/cache/####/dd519c6f3aaeacf7f6681e0c6252ca5a3775232f6234964ddc79db47acb16b2d.0.tmp
- <Package Folder>/cache/####/dfdc64d719c4e9a349a97f1352dab7fee14eb6b51308be5942a2037d99f37f32.0.tmp
- <Package Folder>/cache/####/e06e1a3ae08be1e08330c90552d17ef3c105aee465fd312d44373daa235dbeff.0
- <Package Folder>/cache/####/e971e83fea8079c15ae9f5041e9a2058d4b132cde9fd28664b8e372e5e423ebd.0.tmp
- <Package Folder>/cache/####/fb84a5bcae9a8cc6d8802ed91b5fe98178233e90cd8eec7a125cf521d8778aa9.0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1012182921.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1843189096.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes1883179782.zip
- <Package Folder>/databases/bugly_db-journal
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/network.db
- <Package Folder>/databases/network.db-journal
- <Package Folder>/databases/rep.db-journal
- <Package Folder>/databases/rong_version.db
- <Package Folder>/databases/rong_version.db-journal
- <Package Folder>/databases/task.db
- <Package Folder>/databases/task.db-journal
- <Package Folder>/databases/track.db-journal
- <Package Folder>/files/####/DVDirectory.cfg
- <Package Folder>/files/####/DVHotMap.cfg
- <Package Folder>/files/####/DVHotcity.cfg
- <Package Folder>/files/####/DVVersion.cfg
- <Package Folder>/files/####/ResPack.rs
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/mapstyle.sty
- <Package Folder>/files/####/ofl.config
- <Package Folder>/files/####/ofl_location.db
- <Package Folder>/files/####/ofl_location.db-journal
- <Package Folder>/files/####/ofl_statistics.db
- <Package Folder>/files/####/ofl_statistics.db-journal
- <Package Folder>/files/####/satellitestyle.sty
- <Package Folder>/files/####/tracker1496212869772.log
- <Package Folder>/files/####/trafficstyle.sty
- <Package Folder>/files/.imprint
- <Package Folder>/files/PrefsFile
- <Package Folder>/files/_alertmsg
- <Package Folder>/files/_category
- <Package Folder>/files/_city.3.6.0
- <Package Folder>/files/_loginToken
- <Package Folder>/files/_subscribe_strategy
- <Package Folder>/files/_user_chat_peer
- <Package Folder>/files/cityjson
- <Package Folder>/files/com.baixing.data.AppThemeConfig
- <Package Folder>/files/com.baixing.data.CateUiData
- <Package Folder>/files/com.baixing.data.CategoryLocalData
- <Package Folder>/files/com.baixing.data.GeneralMap
- <Package Folder>/files/com.baixing.data.MobileConfig
- <Package Folder>/files/com.baixing.datamanager.AppConfig.Config
- <Package Folder>/files/com.baixing.datamanager.CategoryManager.SecondHandMeta
- <Package Folder>/files/com.baixing.datamanager.HomePageDataManager.HomeData
- <Package Folder>/files/com.baixing.view.fragment.PersonalFragment.UserFunctionItems
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/files/mobclick_agent_cached_<Package>70301
- <Package Folder>/files/mobile_web_view_config
- <Package Folder>/files/saveFirstStepCate
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/ver.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/COUNTLY_STORE.xml
- <Package Folder>/shared_prefs/FIRST_START_ACTION.xml
- <Package Folder>/shared_prefs/Statistics.xml
- <Package Folder>/shared_prefs/Statistics.xml.bak
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/authStatus_<Package>;ipc.xml
- <Package Folder>/shared_prefs/authStatus_<Package>;remote.xml
- <Package Folder>/shared_prefs/authStatus_io.rong.push.xml
- <Package Folder>/shared_prefs/bx_share_deviceID.xml
- <Package Folder>/shared_prefs/cn.jpush.serverconfig.xml
- <Package Folder>/shared_prefs/cn.jpush.serverconfig.xml.bak
- <Package Folder>/shared_prefs/com.baixing.activity.BXMainActivity.xml
- <Package Folder>/shared_prefs/hasShownGuide.xml
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/rc_navigation_info.xml
- <Package Folder>/shared_prefs/statistics_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ller.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/baidu/.cuid
- <SD-Card>/baixing/####/-1386471912
- <SD-Card>/baixing/####/-1733886973
- <SD-Card>/baixing/####/-1778370758
- <SD-Card>/baixing/####/-2051094408
- <SD-Card>/baixing/####/-556268527
- <SD-Card>/baixing/####/-938581017
- <SD-Card>/baixing/####/1295419664
- <SD-Card>/baixing/####/1414484391
- <SD-Card>/baixing/####/1756532182
- <SD-Card>/baixing/####/422863123
- <SD-Card>/baixing/####/969603372
- <SD-Card>/baixing/last_crash.txt
- <SD-Card>/data/.push_deviceid
- <SD-Card>/test.0
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- <dexopt>
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.product.cpu.abi
- logcat -d -v threadtime
