Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- a####.####.com
- b####.####.cn
- d####.####.cn
- m####.####.cn
- ope####.####.cn
- p####.####.com
- q####.####.cn
- s####.####.com
Запросы HTTP GET:
- b####.####.cn/static/js/jquery/jquery-1.10.2.min.js
- d####.####.cn/jarFile/SDKAutoUpdate/rio.jar
- ope####.####.cn/AppStore/getIsUpdate?&clienttype=####&v=####&ch=####&sk=...
- p####.####.com/t01fca09c8869682be2.png
- q####.####.cn/1/common/r?m1=####&bf=####&m2=####&sk=####&v=####&jdata=##...
- s####.####.com/static/344bcf04732d0744.js
- s####.####.com/static/70cdb7b6494e61b5.js
- s####.####.com/static/8de68bab1e36ddd9.js
Запросы HTTP POST:
- a####.####.com/app_logs
- m####.####.cn/?product=####&version=####&user=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/gameunion.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/.imprint
- <Package Folder>/files/helpershowblacklist.dat
- <Package Folder>/files/libpatch.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/xtopn2000.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/com.qiku.gamecenter.activity.base.fragment.BaseTabFragment.pagelaststate.xml
- <Package Folder>/shared_prefs/com.qiku.gamecenter.activity.base.fragment.BaseTabFragment.pagelaststate.xml.bak
- <Package Folder>/shared_prefs/game_union_preference.xml
- <Package Folder>/shared_prefs/game_union_share_preference.xml
- <Package Folder>/shared_prefs/gameunion_share_preference.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Download/####/3.6_rio.jar.tmp
- <SD-Card>/cw/assetstime.dat
- <SD-Card>/gamecenter/####/-1151744605.tmp
- <SD-Card>/gamecenter/####/-1275377275.tmp
- <SD-Card>/gamecenter/####/-1286926919.tmp
- <SD-Card>/gamecenter/####/-1358581877.tmp
- <SD-Card>/gamecenter/####/-1405380245.tmp
- <SD-Card>/gamecenter/####/-1884484232.tmp
- <SD-Card>/gamecenter/####/-191632614.tmp
- <SD-Card>/gamecenter/####/-2099684485.tmp
- <SD-Card>/gamecenter/####/-2116427939.tmp
- <SD-Card>/gamecenter/####/-2117223626.tmp
- <SD-Card>/gamecenter/####/-413743801.tmp
- <SD-Card>/gamecenter/####/-478275969.tmp
- <SD-Card>/gamecenter/####/-73346597.tmp
- <SD-Card>/gamecenter/####/-992303027.tmp
- <SD-Card>/gamecenter/####/1126550716.tmp
- <SD-Card>/gamecenter/####/1143346786.tmp
- <SD-Card>/gamecenter/####/1435942180.tmp
- <SD-Card>/gamecenter/####/1455954781.tmp
- <SD-Card>/gamecenter/####/1474373139.tmp
- <SD-Card>/gamecenter/####/1591659517.tmp
- <SD-Card>/gamecenter/####/1627085527.tmp
- <SD-Card>/gamecenter/####/174839070.tmp
- <SD-Card>/gamecenter/####/1763833954.tmp
- <SD-Card>/gamecenter/####/1821177595
- <SD-Card>/gamecenter/####/1822563555.tmp
- <SD-Card>/gamecenter/####/1945800777.tmp
- <SD-Card>/gamecenter/####/2036027974.tmp
- <SD-Card>/gamecenter/####/2067905191.tmp
- <SD-Card>/gamecenter/####/2090218045.tmp
- <SD-Card>/gamecenter/####/2102879445.tmp
- <SD-Card>/gamecenter/####/459514664.tmp
- <SD-Card>/gamecenter/####/547059200.tmp
- <SD-Card>/gamecenter/####/762575289.tmp
- <SD-Card>/gamecenter/####/77950559.tmp
- <SD-Card>/gamecenter/####/810854577.tmp
- <SD-Card>/gamecenter/####/814359891.tmp
- <SD-Card>/gamecenter/####/<Package>.png
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 777 /storage/emulated/0/gamecenter/.cache/advertise
- chmod 777 /storage/emulated/0/gamecenter/.cache/apk
- chmod 777 /storage/emulated/0/gamecenter/.cache/icon
- chmod 777 /storage/emulated/0/gamecenter/.cache/image
- chmod 777 /storage/emulated/0/gamecenter/.cache/imgeloader
- chmod 777 /storage/emulated/0/gamecenter/.cache/qstore
