Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.256.origin
- Android.Triada.308.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.256.origin
- Android.Triada.308.origin
Сетевая активность:
Подключается к:
- a####.####.com
- b####.####.com
- b####.####.com:10180
- d####.####.com
- g####.####.com
- h####.####.cn
- i####.####.com
- n####.####.com:10091
- p####.####.com
- s####.####.cn
- s####.####.com
Запросы HTTP GET:
- a####.####.com/app/Public/NovelApp/js/lib/dust-full.min.js
- b####.####.com/api/pagetitle?meid=####&channel=####&appversion=####
- d####.####.com/video/d9d92d1621a660a114d0bdb2ff3207c8.mp4.png
- g####.####.com/cr/sv/crn?m5=####&nm=####
- h####.####.cn/navi.html
- i####.####.com/dr/250_500_/t01d21c6d71864d6c93.jpg
- i####.####.com/icon/75/8696626.png
- p####.####.com/d/novel_10468847549571655347.jpg
- p####.####.com/d/novel_14570900751840583332.jpg
- p####.####.com/t010abd7649857556cf.png
- p####.####.com/t011be43502be638b41.png
- p####.####.com/t0135694fa923031a1f.png
- p####.####.com/t0149568fa878e5380c.png
- p####.####.com/t0163236c9e66e03aa1.png
- p####.####.com/t01916141fd8498e0b2.png
- p####.####.com/t01a105a1f80026c8cc.png
- s####.####.cn/qdas/c.htm?p=####&u=####&gid=####&sid=####&title=####&mid=...
- s####.####.com/!3a5d911e/common.css
- s####.####.com/!983e1c6c/reset.0.0.1.css
- s####.####.com/static/06d321d0201af99d/monitor_analytic.js
- s####.####.com/static/a3563ac99dd4f517/zepto_1.1.2.js
- s####.####.com/static/c3627c678299bb7d.js
- s####.####.com/static/cf4354e51256ab15.css
- s####.####.com/sug?category=####&callback=####&word=####
Запросы HTTP POST:
- a####.####.com/app_logs
- b####.####.com:10180/device_info/store?reg=####&user=####&meid=####&time...
- n####.####.com:10091/opaService/link
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.shell_ass/####/libopalink.so_32
- <Package Folder>/.shell_ass/####/libopalink.so_64
- <Package Folder>/.shell_ass/libopalink.so
- <Package Folder>/.shell_ass/opa_link.jar
- <Package Folder>/.shell_ass/stupid
- <Package Folder>/.shell_ass/stupid.zip
- <Package Folder>/app_plugins-opt/####/libkhmigu.so
- <Package Folder>/cache/####/1f5cae2b4634d05ed1147794f35ef6b0c8252d31d1cf34f324b17576f613917d.0.tmp
- <Package Folder>/cache/####/3dc472a28f2b9f3cfd6fcd6d05a77fb5c72a70f92e7e765ae653a6282e0df5c1.0.tmp
- <Package Folder>/cache/####/3efffa41608ea1e157f62395c6f979fd458ebfc1b2deb0d8a0a1231438e355d0.0.tmp
- <Package Folder>/cache/####/56b05e08adb2026c24da4aa23c0637e26ecf87d0c094d449c2294d5c76cdaef3.0.tmp
- <Package Folder>/cache/####/62fad0b2790fa0c05610623a5888889cbf8aa72dff627857ea1fe1ad8f82be3f.0.tmp
- <Package Folder>/cache/####/70cdf3daabf4c4439287a7c671060a4c957f22dc406a5ce4b2bb9a6ae7e3036b.0.tmp
- <Package Folder>/cache/####/ccf0d6609d20becd3c4896b17d49265feebfbd4e1d54d38a33af28b22a7c3781.0.tmp
- <Package Folder>/cache/####/d33a1a7dd8bd0274d6d5c66df5c3c964393a5ebebd804885ffcd02bfba673bba.0.tmp
- <Package Folder>/cache/####/d3bbea6b3934dab57ac06e22943835e5520b3c3e5355d2e9b040088efd3afa39.0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/e539bd1d6fe6734491e3dfd5067ec17ca0c667001894e04085f5b64248defe01.0.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/oisx.png
- <Package Folder>/files/ru
- <Package Folder>/files/ru.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/cuf_config.xml
- <Package Folder>/shared_prefs/mt_status.xml
- <Package Folder>/shared_prefs/mt_status.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- cat /proc/version
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.product.cpu.abi
