Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.600.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.55.16.91:8080
- TCP(HTTP/1.1) p####.nj####.com.####.com:8080
- TCP(TLS/1.0) www.a.sh####.com:443
Запросы DNS:
- 88####.net
- int.d####.s####.####.cn
- p####.nj####.com
- www.b####.com
Запросы HTTP GET:
- p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
- p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_payload_odex/<Package>.jar
- <Package Folder>/app_process_lock/1132.30089999093
- <Package Folder>/app_process_lock/1132.30089999093 (deleted)
- <Package Folder>/app_process_lock/1132.34542065845
- <Package Folder>/app_process_lock/1132.34542065845 (deleted)
- <Package Folder>/app_process_lock/1132.38994132597
- <Package Folder>/app_process_lock/1132.38994132597 (deleted)
- <Package Folder>/app_process_lock/1132.43446199348
- <Package Folder>/app_process_lock/1132.43446199348 (deleted)
- <Package Folder>/app_process_lock/1132.478982661
- <Package Folder>/app_process_lock/1132.478982661 (deleted)
- <Package Folder>/app_process_lock/1132.52350332852
- <Package Folder>/app_process_lock/1132.52350332852 (deleted)
- <Package Folder>/app_process_lock/1132.56802399603
- <Package Folder>/app_process_lock/1132.56802399603 (deleted)
- <Package Folder>/app_process_lock/889.37042982576
- <Package Folder>/app_process_lock/889.37042982576 (deleted)
- <Package Folder>/app_process_lock/889.414950493276
- <Package Folder>/app_process_lock/889.414950493276 (deleted)
- <Package Folder>/app_process_lock/889.459471160793
- <Package Folder>/app_process_lock/889.459471160793 (deleted)
- <Package Folder>/app_process_lock/889.503991828309
- <Package Folder>/app_process_lock/889.503991828309 (deleted)
- <Package Folder>/app_process_lock/889.548512495826
- <Package Folder>/app_process_lock/889.548512495826 (deleted)
- <Package Folder>/app_process_lock/889.593033163343
- <Package Folder>/app_process_lock/889.593033163343 (deleted)
- <Package Folder>/app_process_lock/889.637553830859
- <Package Folder>/app_process_lock/889.637553830859 (deleted)
- <Package Folder>/app_process_lock/889.682074498376
- <Package Folder>/app_process_lock/889.682074498376 (deleted)
- <Package Folder>/app_process_lock/889.726595165892
- <Package Folder>/app_process_lock/889.726595165892 (deleted)
- <Package Folder>/cache/2099142500969B8DDF650881BE2762BA.jar
- <Package Folder>/databases/twsdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/1.txt.tmp
- <SD-Card>/Android/10.txt.tmp
- <SD-Card>/Android/11.txt.tmp
- <SD-Card>/Android/12.txt.tmp
- <SD-Card>/Android/13.txt.tmp
- <SD-Card>/Android/14.txt.tmp
- <SD-Card>/Android/15.txt.tmp
- <SD-Card>/Android/16.txt.tmp
- <SD-Card>/Android/2.txt.tmp
- <SD-Card>/Android/3.txt.tmp
- <SD-Card>/Android/4.txt.tmp
- <SD-Card>/Android/5.txt.tmp
- <SD-Card>/Android/6.txt.tmp
- <SD-Card>/Android/7.txt.tmp
- <SD-Card>/Android/8.txt.tmp
- <SD-Card>/Android/9.txt.tmp
Другие:
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
