Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106584211: 5fd3bec6c0a86a407150640058138763本条免费短信用于快速登录，请勿修改
Сетевая активность:
Подключается к:
- a####.####.com
- o####.####.com
- w####.####.com
- zd####.com
Запросы HTTP GET:
- w####.####.com/r/405458225/405458821/index.htm?vt=####&cm=####
- zd####.com/ebook/client_new_subject_image/1490354508.jpg
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/bookshelf.xml
- <Package Folder>/files/mobclick_agent_cached_<Package>
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/iqiyoo.xml
- <Package Folder>/shared_prefs/iqiyoo.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <SD-Card>/Android/####/-1454572331.tmp
- <SD-Card>/Android/####/-2134150256.tmp
- <SD-Card>/Android/####/-2135073777.tmp
- <SD-Card>/Android/####/-2135997298.tmp
- <SD-Card>/Android/####/-2136920819.tmp
- <SD-Card>/Android/####/-2137844340.tmp
- <SD-Card>/Android/####/-2138767861.tmp
- <SD-Card>/Android/####/-339448966.tmp
- <SD-Card>/Android/####/-652032582
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1112857009.tmp
- <SD-Card>/Android/####/1150680410.tmp
- <SD-Card>/Android/####/1467252769.tmp
- <SD-Card>/Android/####/1468176290.tmp
- <SD-Card>/Android/####/1470946853.tmp
- <SD-Card>/Android/####/1471870374.tmp
- <SD-Card>/Android/####/1494034878.tmp
- <SD-Card>/Android/####/1494958399
- <SD-Card>/Android/####/1499576004.tmp
- <SD-Card>/Android/####/1500499525.tmp
- <SD-Card>/Android/####/181906881.tmp
- <SD-Card>/Android/####/2125723242.tmp
- <SD-Card>/Android/####/2126646763
- <SD-Card>/Android/####/2131264368.tmp
- <SD-Card>/Android/####/2132187889.tmp
- <SD-Card>/Android/####/296423485.tmp
- <SD-Card>/Android/####/432222089.tmp
- <SD-Card>/Android/####/433145610.tmp
- <SD-Card>/Android/####/435916173.tmp
- <SD-Card>/Android/####/436839694.tmp
- <SD-Card>/Android/####/558723172.tmp
- <SD-Card>/Android/####/60925630.tmp
- <SD-Card>/Android/####/843294388.tmp
- <SD-Card>/osmanthus/####/14.iqijpg
- <SD-Card>/osmanthus/####/15.iqijpg
- <SD-Card>/osmanthus/####/25.iqijpg
- <SD-Card>/osmanthus/####/387294573.iqi
- <SD-Card>/osmanthus/####/401276739.iqi
- <SD-Card>/osmanthus/####/403071214.iqi
- <SD-Card>/osmanthus/####/405121195.iqi
- <SD-Card>/osmanthus/####/405458821.iqi
- <SD-Card>/osmanthus/####/412197363.iqi
- <SD-Card>/osmanthus/####/449353484.iqi
- <SD-Card>/osmanthus/####/450565574.iqi
- <SD-Card>/osmanthus/####/chapter.xml
- <SD-Card>/osmanthus/####/cmbook.json
- <SD-Card>/osmanthus/####/fontstyle.json
- <SD-Card>/osmanthus/####/image_recommendation.xml
- <SD-Card>/osmanthus/####/index.xml
- <SD-Card>/osmanthus/####/monthly.json
- <SD-Card>/osmanthus/####/subject_publish.json
- <SD-Card>/osmanthus/bookshelf.xml
- <SD-Card>/osmanthus/ch.iqi
- <SD-Card>/osmanthus/member.txt
- <SD-Card>/osmanthus/notify.json
- <SD-Card>/osmanthus/question.json
