Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- a####.####.com
- b####.####.cn
- d####.####.cn
- m####.####.cn
- ope####.####.cn
- p####.####.com
- q####.####.cn
- s####.####.cn
- s####.####.com
Запросы HTTP GET:
- b####.####.cn/static/js/monitor/m.js?J####
- d####.####.cn/jarFile/SDKAutoUpdate/rio.jar
- ope####.####.cn/AppStore/getIsUpdate?&clienttype=####&v=####&ch=####&sk=...
- p####.####.com/dm/160_160_/t014b84691f051429b9.png
- p####.####.com/dm/160_160_/t01c825606fe15cb105.png
- p####.####.com/dr/130_130_/t01fcd178db230a45a4.jpg
- p####.####.com/dr/280__/t014b58933c782363d9.jpg
- p####.####.com/t01147e38dda543d45c.png
- p####.####.com/t013c2faf6ef641963a.jpg
- p####.####.com/t0147c56143fb273bc9.png
- p####.####.com/t01693692e1e19dc81d.png
- p####.####.com/t018ea17707b44b696a.png
- q####.####.cn/1/common/recommendlogin?m1=####&m2=####&v=####&ch=####&ual...
- s####.####.cn/p.html?DNSfn=####&TcpFn=####&whiteRain=####&firstScreenLoa...
- s####.####.cn/w360/s.htm?p=####&u=####&id=####&guid=####&b=####&c=####&r...
- s####.####.com/!832a9973/mgfeapm.js
- s####.####.com/!87ad8de9/lazy_image.js
- s####.####.com/static/4819ad2e9a416c08.js
- s####.####.com/static/70cdb7b6494e61b5.js
- s####.####.com/static/8de68bab1e36ddd9.js
- s####.####.com/static/ef07ed774ba21b6a.js
Запросы HTTP POST:
- a####.####.com/app_logs
- m####.####.cn/?product=####&version=####&user=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/gameunion.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/.imprint
- <Package Folder>/files/helpershowblacklist.dat
- <Package Folder>/files/libpatch.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/xtopn2000.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/com.qiku.gamecenter.activity.base.fragment.BaseTabFragment.pagelaststate.xml
- <Package Folder>/shared_prefs/game_union_preference.xml
- <Package Folder>/shared_prefs/game_union_share_preference.xml
- <Package Folder>/shared_prefs/gameunion_share_preference.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Download/####/3.6_rio.jar.tmp
- <SD-Card>/cw/assetstime.dat
- <SD-Card>/gamecenter/####/-1358581877.tmp
- <SD-Card>/gamecenter/####/-1807831672.tmp
- <SD-Card>/gamecenter/####/-1966490587.tmp
- <SD-Card>/gamecenter/####/-413743801.tmp
- <SD-Card>/gamecenter/####/-478275969.tmp
- <SD-Card>/gamecenter/####/-555308669.tmp
- <SD-Card>/gamecenter/####/-691674127.tmp
- <SD-Card>/gamecenter/####/-970849501.tmp
- <SD-Card>/gamecenter/####/-978093878.tmp
- <SD-Card>/gamecenter/####/1143346786.tmp
- <SD-Card>/gamecenter/####/1396794223.tmp
- <SD-Card>/gamecenter/####/1498161025.tmp
- <SD-Card>/gamecenter/####/1627085527.tmp
- <SD-Card>/gamecenter/####/1639271191.tmp
- <SD-Card>/gamecenter/####/1733408736.tmp
- <SD-Card>/gamecenter/####/1834974963.tmp
- <SD-Card>/gamecenter/####/2036027974.tmp
- <SD-Card>/gamecenter/####/2090218045.tmp
- <SD-Card>/gamecenter/####/534829198.tmp
- <SD-Card>/gamecenter/####/944943265.tmp
- <SD-Card>/gamecenter/####/<Package>.png
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 777 /storage/emulated/0/gamecenter/.cache/advertise
- chmod 777 /storage/emulated/0/gamecenter/.cache/apk
- chmod 777 /storage/emulated/0/gamecenter/.cache/icon
- chmod 777 /storage/emulated/0/gamecenter/.cache/image
- chmod 777 /storage/emulated/0/gamecenter/.cache/imgeloader
- chmod 777 /storage/emulated/0/gamecenter/.cache/qstore
