Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) fic####.b0.upa####.com:80
- TCP(HTTP/1.1) 2####.243.193.48:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) yes.yuchan####.com.cn:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
Запросы DNS:
- 7u####.c####.z0.####.com
- a####.u####.com
- cgi.con####.qq.com
- d.xiongj####.com.cn
- fic####.b0.upa####.com
- imgc####.qq.com
- mi.g####.qq.com
- mo####.b####.com
- pi####.qq.com
- qzones####.g####.cn
- r.eli####.cn
- regi####.xm####.xi####.com
- s####.e.qq.com
- yes.yuchan####.com.cn
Запросы HTTP GET:
- cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
- d.xiongj####.com.####.com/jfile/gou.jar
- fic####.b0.upa####.com/biaoqing/jinguanzhang/2245/02.gif
- fic####.b0.upa####.com/biaoqing/jinguanzhang/2316/01.gif
- fic####.b0.upa####.com/biaoqing/jinguanzhang/3075/00.jpg
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
Запросы HTTP POST:
- pi####.qq.com/mstat/report
- s####.e.qq.com/activate
- s####.e.qq.com/getad
- s####.e.qq.com/launch
- s####.e.qq.com/msg
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_e_qq_com_dex/gdt_plugin.dex (deleted)
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/cache/####/ApplicationCache.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/index
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/__pasys_remote_banner.jar.tm
- <Package Folder>/files/__pasys_remote_banner.tmp.jar
- <Package Folder>/files/com.tencent.open.config.json.1104577307
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/BuglySdkInfos.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/ApplicationCache.db
- <SD-Card>/Android/####/ApplicationCache.db-journal
- <SD-Card>/Download/####/4.8_gou.jar.tmp
- <SD-Card>/Tencent/####/.mid.txt
- <SD-Card>/Tencent/####/1.app.log
- <SD-Card>/dt/restime.dat
- <SD-Card>/jinguanzhang/####/03ceaebef976b12db0e07f2745c112ec
- <SD-Card>/jinguanzhang/####/050ac5b87bebfd69d5200aeb2b05aa46
- <SD-Card>/jinguanzhang/####/1c975c99e5a1ba3dbdcc2fd98658882f
- <SD-Card>/jinguanzhang/####/3675c4a328a99546f9d31386455f18b9
- <SD-Card>/jinguanzhang/####/39208b29fb85e19b5e21e4439f178cf5
- <SD-Card>/jinguanzhang/####/591e7349f9af0ecfda4eeb1525719e11
- <SD-Card>/jinguanzhang/####/5e5acc4e92e282f70fc8fee913c2102d
- <SD-Card>/jinguanzhang/####/67578f595ba7bb49be135b0ace93d848
- <SD-Card>/jinguanzhang/####/696cf49399b76d6b208bdfcb6af10cfa
- <SD-Card>/jinguanzhang/####/6d01bbf4bc0fbc5baa5a449a66dda7ac
- <SD-Card>/jinguanzhang/####/74419159273c07a158defdfb1af44699
- <SD-Card>/jinguanzhang/####/8a004e71d217a61897f36c294334b057
- <SD-Card>/jinguanzhang/####/8d7ecd3582a275da9350e9ad40f90962
- <SD-Card>/jinguanzhang/####/971c49f502d709d4a24c3794dc877385
- <SD-Card>/jinguanzhang/####/a7cac4190f4fb4fdc5631eec9fe6d416
- <SD-Card>/jinguanzhang/####/bf3172c01c9f2539428468500083ec29
- <SD-Card>/jinguanzhang/####/bf5e9ddad430f649b30d78215e1ffb7c
- <SD-Card>/jinguanzhang/####/c9b76245234d7e61237b263912dd6554
- <SD-Card>/jinguanzhang/####/d4ac805b4bbb0ee407fb7e0ee33f694b
- <SD-Card>/jinguanzhang/####/e4531d0d4ccf96b976f89af21ad7baec
- <SD-Card>/jinguanzhang/####/e45d9850c39339eb7d6cd854b1038907
- <SD-Card>/jinguanzhang/####/e777774209a08a35e0813756bad41cec
- <SD-Card>/jinguanzhang/####/e787c2862f4063551f19ec006756d4e7
- <SD-Card>/jinguanzhang/####/eb8d52d005a756938246d65e64b3a863
- <SD-Card>/jinguanzhang/####/fb29fe7a846ea2daba5281e4a3c0cb6e
- <SD-Card>/jinguanzhang2/favor.json
- <SD-Card>/jinguanzhang2/recent.json
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Загружает динамические библиотеки:
- MtaNativeCrash
- show
- xhymy
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
