Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690133603: auto##7678681384##mpc_yxhezi_and_203631511##该短信用于360游戏注册/登录
Сетевая активность:
Подключается к:
- a####.####.cn
- and####.####.com
- c####.####.com
- d####.####.com:8083
- h####.####.com
- h####.####.net
- l####.####.com
- m####.####.cn
- p####.####.cn
- p####.####.com
- s####.####.cn
- sdka####.####.net
- serv####.####.net
Запросы HTTP GET:
- a####.####.cn/10/popup/activity?appid=####&nonce=####&rkey=####&signid=#...
- and####.####.com/group/?method=####&n=####
- c####.####.com/jszip/3.1.3/jszip.js?150002####
- h####.####.com/swgxhb_app/xiaohuoban/quick/libs/modules/egret/egret.web....
- h####.####.net/static/lib/libQuickSDKH5_To_Client.js?150002####
- m####.####.cn/list/get?product=####&source=####&version=####
- p####.####.com/t0178c548e210e9c425.png
- s####.####.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####
- serv####.####.net/12281405850900087067099373977709-12.html
Запросы HTTP POST:
- d####.####.com:8083/
- l####.####.com/ajax?c=####&k=####
- p####.####.cn/update/update.php?p=####
- sdka####.####.net/v1/api/init
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/<IMEI>_qSdk_ex.log
- <Package Folder>/files/####/QHA_JSON_PERSISTER_02522a2b2726fb0a03bb19f2d8d9524d
- <Package Folder>/files/####/Y29tLmJpZ2dlci5zd2d4aGIucWlob28=.tick.lock
- <Package Folder>/files/frameso
- <Package Folder>/files/statistics.log (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Pay_config.xml
- <Package Folder>/shared_prefs/QH_DeviceSDK.xml
- <Package Folder>/shared_prefs/QH_SDK_M2.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml.bak
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml.bak
- <Package Folder>/shared_prefs/com_qk.xml
- <Package Folder>/shared_prefs/coolcloud_config.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml.bak
- <Package Folder>/shared_prefs/iapppay_config.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/q_p2_plib_plugin_lib_sp.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml.bak
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml.bak
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml.bak
- <Package Folder>/shared_prefs/sdk_apk_info.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml.bak
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <SD-Card>/360/####/02522a2b2726fb0a03bb19f2d8d9524d
- <SD-Card>/360/####/Y29tLmJpZ2dlci5zd2d4aGIucWlob28=
- <SD-Card>/360/####/Y29tLmJpZ2dlci5zd2d4aGIucWlob28= (deleted)
- <SD-Card>/360/####/brm
- <SD-Card>/360/####/brm (deleted)
- <SD-Card>/360/####/dcsdid.dat
- <SD-Card>/360/.deviceId
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/2srnjblqxn03998ej90uotas2.0.tmp
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/UcQkDir/<Package>.qk.channeltype.txt
- <SD-Card>/UcQkDir/<Package>.qkflag.12.txt
- <SD-Card>/UcQkDir/qk.dvid.txt
Другие:
Запускает следующие shell-скрипты:
- chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image
- getprop ro.product.cpu.abi
