Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cdnapph####.b0.a####.com:80
- TCP(HTTP/1.1) co####.o####.cn:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(HTTP/1.1) cdn.img.h####.####.com:80
- TCP(HTTP/1.1) t####.qq.com:8080
- TCP(HTTP/1.1) i####.uo####.top:80
- TCP(TLS/1.0) ti####.c####.l####.####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) st####.suiyue####.com.####.com:443
- TCP(TLS/1.0) h####.b####.com:443
- TCP t####.qq.com:80
- TCP t####.qq.com:8080
Запросы DNS:
- cdn.app.uo####.top
- cdn.img.h####.top
- co####.o####.cn
- h####.b####.com
- hm.b####.com
- i####.uo####.top
- pi####.qq.com
- qn.cdn.reso####.####.cn
- st####.suiyue####.com
- t####.qq.com
- www.go####.com
Запросы HTTP GET:
- cdn.img.h####.####.com/upload/201711/30/img/20171130182651140.png
- cdnapph####.b0.a####.com/sfile/201711/16/all/cp_V2.9.8.txt
- co####.o####.cn/OACG_Comic.php?m=####&a=####
- co####.o####.cn/qmresource/css/catogory.css?version=####
- co####.o####.cn/qmresource/css/global-sj.css
- co####.o####.cn/qmresource/css/index.css?version=####
- co####.o####.cn/qmresource/css/swiper.css
- co####.o####.cn/qmresource/image/biao1.jpg
- co####.o####.cn/qmresource/image/biao2.jpg
- co####.o####.cn/qmresource/image/biao3.jpg
- co####.o####.cn/qmresource/image/biao4.jpg
- co####.o####.cn/qmresource/image/biao5.jpg
- co####.o####.cn/qmresource/image/biao6.jpg
- co####.o####.cn/qmresource/image/fen_biao.jpg
- co####.o####.cn/qmresource/image/fen_biao1.jpg
- co####.o####.cn/qmresource/image/fen_biao4.jpg
- co####.o####.cn/qmresource/image/fen_cha.jpg
- co####.o####.cn/qmresource/image/fen_sou.png
- co####.o####.cn/qmresource/image/hot.png
- co####.o####.cn/qmresource/image/more.jpg
- co####.o####.cn/qmresource/js/global-sj.js
- co####.o####.cn/qmresource/js/jquery-2.1.4.min.js
- co####.o####.cn/qmresource/js/recommend.js?version=####
- co####.o####.cn/qmresource/js/swiper.js
Запросы HTTP POST:
- i####.uo####.top/gt_ibaf/a/y/y
- i####.uo####.top/nh_kkdn/lzo/ts
- i####.uo####.top/nh_kvz/xrt/p
- i####.uo####.top/oh_kj/hkz/did
- i####.uo####.top/qhf_dkb/z
- i####.uo####.top/slet_iwbi/s/pcj
- i####.uo####.top/uoet_ia/b/dk
- i####.uo####.top/ut_iu/ql/pm
- i####.uo####.top/wbgt_ilq/tv/e
- i####.uo####.top/zlvt_ilv/be/ku/xw
- t####.qq.com/203.205.151.233:80/
- t####.qq.com:8080/203.205.151.233:8080/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/index
- <Package Folder>/cache/V2.9.8.txt
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1510835478205
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/nr.jar
- <Package Folder>/files/vf.jar
- <Package Folder>/shared_prefs/.tpns.xml.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/comic_sp.xml
- <Package Folder>/shared_prefs/count.xml
- <Package Folder>/shared_prefs/device_id.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/tpush.shareprefs.xml
- <Package Folder>/shared_prefs/user_profile_sp.xml
- <Package Folder>/shared_prefs/user_token_sp.xml
- <Package Folder>/shared_prefs/vbz.xml
- <Package Folder>/shared_prefs/webConfig_data.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/b08ffbe76bc53
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
Другие:
Запускает следующие shell-скрипты:
- sh <Package Folder>/lib/libxguardian.so <Package>,2100158372; 55213 203.205.128.130 [{ idx :0, ts :%d, et :2000, si :0, ui : <IMEI> , ky : Axg%lu , mid : 0 , ev :{ ov : 18 , sr : 600*752 , md : <System Property> , lg : en , sv : 2.47 , mf : unknown , apn : %s }}] 0 18
Загружает динамические библиотеки:
- crash_analysis
- tpnsSecurity
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
