Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 13840272844: <SMS Content>
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.lly####.com:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) www.23####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) ak.im####.com.####.net:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) dp.g.doublec####.net:80
Запросы DNS:
- a.b####.com
- ak2.im####.com
- api.q####.top
- dp.g.doublec####.net
- hm.b####.com
- l####.tbs.qq.com
- p####.zhanz####.b####.com
- pag####.googles####.com
- paoniu5####.0####.b####.com
- www.1####.com
- www.23####.com
- www.ao####.com
- www.go####.com
- www.gst####.com
- www.lly####.com
Запросы HTTP GET:
- dp.g.doublec####.net/apps/domainpark/domainpark.cgi?r=####&client=####&c...
- dp.g.doublec####.net/static/caf/slave.html
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=#...
- hm.b####.com/hm.js?ca7867b####
- pag####.googles####.com/pagead/images/nessie_icon_chevron_white.png
- www.23####.com/
- www.23####.com/include/ajax.php?action=####×tamp=####
- www.23####.com/js/ads/disj.js
- www.23####.com/js/ads/headsj.js
- www.23####.com/js/ads/indexsj.js
- www.23####.com/js/common.js
- www.23####.com/js/function.js
- www.23####.com/templets/naimilu/images/ico.png
- www.23####.com/templets/naimilu/images/js/common.js
- www.23####.com/templets/naimilu/images/js/function.js
- www.23####.com/templets/naimilu/images/js/history.js
- www.23####.com/templets/naimilu/images/js/jquery-1.4.4.min.js
- www.23####.com/templets/naimilu/images/js/jquery.lazyload.js
- www.23####.com/templets/naimilu/images/js/xunlei.js
- www.23####.com/templets/naimilu/images/load.gif
- www.23####.com/templets/naimilu/images/p.png
- www.23####.com/templets/naimilu/images/style.css
- www.23####.com/templets/naimilu/images/xunlei.css
- www.go####.com/adsense/domains/caf.js
- www.go####.com/dp/ads?r=####&client=####&channel=####&hl=####&swp=####&u...
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
- www.lly####.com/
- www.lly####.com/MYOgZ/
- www.lly####.com/favicon.ico
- www.lly####.com/img.aspx?q=####
Запросы HTTP POST:
- l####.tbs.qq.com/ajax?c=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_database/####/http_www.236zzw.com_0.locals...leted)
- <Package Folder>/app_database/####/http_www.236zzw.com_0.locals...ournal
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbs_report_lock.txt
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/WebpageIcons.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/tbs_load_stat_flag.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/tbslog.txt
Другие:
Запускает следующие shell-скрипты:
- getprop ro.product.cpu.abi
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
Осуществляет доступ к информации об отправленых/принятых смс.
