Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- 2####.####.32
- 7j####.####.com
- c####.####.net
- c-h####.####.com
- d####.####.cn
- d####.####.com
- dce####.####.com
- h####.####.com
- i####.####.com
- s####.####.com
Запросы HTTP GET:
- 2####.####.32/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/rio.jar?wsiphost...
- 7j####.####.com/tdata_CgN316
- d####.####.cn/jarFile/SDKAutoUpdate/rio.jar
- d####.####.com/api/game/getrescnt?package=####&app_id=####&channel_id=##...
- dce####.####.com/api/v2/group/search/by_game_id/212050
- i####.####.com/uploads/icons/2/4/2433820d549ecb659156e4df9acd28f5.png
- s####.####.com/config/hz-hzv3.conf
Запросы HTTP POST:
- c####.####.net/async/dc/appstore
- c-h####.####.com/api.php?format=####&t=####
- h####.####.com/app.gif
- s####.####.com/api.php?format=####&t=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/Staistics
- <Package Folder>/databases/Staistics-journal
- <Package Folder>/databases/dataeye_database_C530161078E360C0E85CBFE1C87C8B42D.db
- <Package Folder>/databases/dataeye_database_C530161078E360C0E85CBFE1C87C8B42D.db-journal
- <Package Folder>/databases/download.db
- <Package Folder>/databases/download.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/favorite
- <Package Folder>/databases/favorite-journal
- <Package Folder>/databases/hjdata.db
- <Package Folder>/databases/hjdata.db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1496215283533
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_JOf603
- <Package Folder>/files/tdata_JOf603.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/LTBL_Game.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/configs.xml
- <Package Folder>/shared_prefs/dc.C530161078E360C0E85CBFE1C87C8B42D.preferences.xml
- <Package Folder>/shared_prefs/dc.C530161078E360C0E85CBFE1C87C8B42D.preferences.xml.bak
- <Package Folder>/shared_prefs/dc.current.preferences.xml
- <Package Folder>/shared_prefs/dc.current.preferences.xml.bak
- <Package Folder>/shared_prefs/hj_datasdk_settings.xml
- <Package Folder>/shared_prefs/hj_datasdk_settings.xml.bak
- <Package Folder>/shared_prefs/loadingImg.xml
- <Package Folder>/shared_prefs/packverson.xml
- <Package Folder>/shared_prefs/requisite.xml
- <Package Folder>/shared_prefs/requisite.xml.bak
- <Package Folder>/shared_prefs/setting.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/version.xml
- <Package Folder>/shared_prefs/versionUpdate.xml
- <SD-Card>/.SystemService/####/uid
- <SD-Card>/.SystemService/appids.dat
- <SD-Card>/Android/####/-1116389268.tmp
- <SD-Card>/Android/####/-1275834869.tmp
- <SD-Card>/Android/####/-1374002273.tmp
- <SD-Card>/Android/####/-1579817728.tmp
- <SD-Card>/Android/####/-160068717
- <SD-Card>/Android/####/-1717181965.tmp
- <SD-Card>/Android/####/-1760205980.tmp
- <SD-Card>/Android/####/-1880261815.tmp
- <SD-Card>/Android/####/-1895763230.tmp
- <SD-Card>/Android/####/-1950915303.tmp
- <SD-Card>/Android/####/-1952745207.tmp
- <SD-Card>/Android/####/-1969342414.tmp
- <SD-Card>/Android/####/-2121638333.tmp
- <SD-Card>/Android/####/-253739616.tmp
- <SD-Card>/Android/####/-43382441.tmp
- <SD-Card>/Android/####/-52020674.tmp
- <SD-Card>/Android/####/-539408109.tmp
- <SD-Card>/Android/####/-5477714.tmp
- <SD-Card>/Android/####/-604346498.tmp
- <SD-Card>/Android/####/-692103600.tmp
- <SD-Card>/Android/####/-710544119.tmp
- <SD-Card>/Android/####/-737648751.tmp
- <SD-Card>/Android/####/-930820568.tmp
- <SD-Card>/Android/####/-932656176.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1017759705.tmp
- <SD-Card>/Android/####/1062845182.tmp
- <SD-Card>/Android/####/11152027.tmp
- <SD-Card>/Android/####/1214538945.tmp
- <SD-Card>/Android/####/1361386632.tmp
- <SD-Card>/Android/####/138663360.tmp
- <SD-Card>/Android/####/1669529505.tmp
- <SD-Card>/Android/####/1716732018.tmp
- <SD-Card>/Android/####/18427182.tmp
- <SD-Card>/Android/####/1848692443.tmp
- <SD-Card>/Android/####/197952697.tmp
- <SD-Card>/Android/####/2120045154.tmp
- <SD-Card>/Android/####/21917129.tmp
- <SD-Card>/Android/####/241107766.tmp
- <SD-Card>/Android/####/279425437.tmp
- <SD-Card>/Android/####/349384581.tmp
- <SD-Card>/Android/####/3514e7cb671ee7a06b1ed6bc22c14dac.0
- <SD-Card>/Android/####/449573792.tmp
- <SD-Card>/Android/####/452702571.tmp
- <SD-Card>/Android/####/505049840.tmp
- <SD-Card>/Android/####/566016745.tmp
- <SD-Card>/Android/####/572756810.tmp
- <SD-Card>/Android/####/718118582.tmp
- <SD-Card>/Android/####/719709235.tmp
- <SD-Card>/Android/####/791461094.tmp
- <SD-Card>/Android/####/796065746.tmp
- <SD-Card>/Android/####/876350660.tmp
- <SD-Card>/Android/####/913131af4b69784214eeadb760297e24.0
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/####/3.6_rio.jar.tmp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
- <SD-Card>/cw/assetstime.dat
- <SD-Card>/huanju/####/config.properties
- <SD-Card>/huanju/.cuid
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_JOf603
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.youxier.app/files/gdaemon_20161017 0 com.youxier.app/com.igexin.sdk.PushService 24521 300 0
- /system/bin/sh
- <dexopt>
- chmod 700 /data/data/com.youxier.app/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 777 /data/data/com.youxier.app/cache
- chmod 777 /data/data/com.youxier.app/cache/apk
- chmod 777 <Package Folder>/cache
- chmod 777 <Package Folder>/cache/apk
- getprop ro.miui.ui.version.name
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24521 300 0
