Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.5.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) publish####.b####.com.####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) cpu.b####.com:80
- TCP(HTTP/1.1) g####.bdst####.com:80
- TCP(HTTP/1.1) www.a.sh####.com:80
- TCP(HTTP/1.1) mobads-####.b####.com:80
- TCP(HTTP/1.1) fex.bdst####.com:80
- TCP(HTTP/1.1) cac####.b####.com:80
- TCP(TLS/1.0) wn.pos.b####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) si####.jom####.com:443
- TCP(TLS/1.0) c####.b####.com:443
- TCP(TLS/1.0) publish####.b####.com.####.com:443
Запросы DNS:
- a####.u####.com
- a.s####.top
- b.s####.top
- c####.b####.com
- cac####.b####.com
- cpu.b####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- fex.bdst####.com
- g####.bdst####.com
- g####.bdst####.com
- hm.b####.com
- l####.tbs.qq.com
- mobads-####.b####.com
- publish####.b####.com
- t10.b####.com
- t11.b####.com
- t12.b####.com
- wn.pos.b####.com
- www.b####.com
- www.go####.com
Запросы HTTP GET:
- cac####.b####.com/log.gif?entry=####&ctid=####&log_type=####&req_id=####...
- cac####.b####.com/log.gif?entry=0&ctid=E14D8E8A538C4746A16B077136460720&...
- cac####.b####.com/log.gif?site_id=####&event_id=####&session_id=####&rse...
- cpu.b####.com/1001/e866cfb0
- cpu.b####.com/1001/e866cfb0?chk=####
- cpu.b####.com/1003/e866cfb0
- cpu.b####.com/1003/e866cfb0?chk=####
- cpu.b####.com/1021/e866cfb0
- cpu.b####.com/1021/e866cfb0/detail/34269627/video?position_id=####
- cpu.b####.com/1021/e866cfb0/detail/35836572222/image?pvid=####&rt=####&r...
- cpu.b####.com/1021/e866cfb0/detail/36675596/video?pvid=####&rt=####&rts=...
- cpu.b####.com/1021/e866cfb0/detail/36675596/video?rts=####&from=####
- cpu.b####.com/1021/e866cfb0?chk=####
- cpu.b####.com/img/avatar/6.jpg
- cpu.b####.com/img/close-content.png
- cpu.b####.com/img/icons.png
- cpu.b####.com/img/image_default.jpg
- cpu.b####.com/redirect?pvid=####&rt=####&rts=####&logid=####&expinfos=##...
- fex.bdst####.com/hunter/alog/alog.mobile.min.js?v=####
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/13e1467b-da12-4d8c...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/278fae5c-d5fb-40cc...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/3f473932-a7aa-48a4...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/50e41950-8fbb-4431...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/55ed9bf4-834a-47e9...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/7c3ebafc-8eb5-439c...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/81bb4ee7-4140-43b9...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/8a1da38f-9655-4948...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/8e1089cf-36e9-4dec...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/b52aee42-82cc-41e3...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/bbe3b3f7-2043-46f6...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/c23ba6e8-2b3c-440f...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/dcfc5468-247a-49fb...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/df176df6-2913-45b8...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/f9e3ee33-8102-4de9...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/image/cms/428dcfd3...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/image/cms/499c2185...
- g####.bdst####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/image/cms/a076f5ea...
- g####.bdst####.com/9aQTbzqaKgQFm2e88IuM_a/static/2018011565906/img/close...
- g####.bdst####.com/9aQTbzqaKgQFm2e88IuM_a/static/2018011565906/img/icons...
- g####.bdst####.com/9aQTbzqaKgQFm2e88IuM_a/static/2018011565906/js/common...
- g####.bdst####.com/9aQTbzqaKgQFm2e88IuM_a/static/2018011565906/js/defaul...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=793&ep=2171,2171&e...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=793&ep=27323,27324...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=800x600&vl=793&et=0&ja=0&ln=e...
- hm.b####.com/hm.js?7e45c71####
- mobads-####.b####.com/dz.zb?type=####&ad_id=####&media=####&s=####&table...
- publish####.b####.com.####.com/025c4e4f-3501-488e-8909-fcb86587c553.jpeg...
- publish####.b####.com.####.com/06a56d29-1986-4552-8c31-5c4b4663176e.jpeg...
- publish####.b####.com.####.com/07ffda67-8096-487f-9955-dedb447c3f54.jpeg...
- publish####.b####.com.####.com/08114d22-a450-4a04-8840-5d5fe6ecf0af.png@...
- publish####.b####.com.####.com/1086a84f-a481-47f5-970b-1a8837f31c3b.jpeg...
- publish####.b####.com.####.com/13445746-b60c-49c9-8707-e97d46526090.jpeg...
- publish####.b####.com.####.com/1555921e-5c70-4e0a-9828-14b18736aedc.jpeg...
- publish####.b####.com.####.com/1908574b-0764-4d0b-baa9-6d1e1b2fa3f2.jpeg...
- publish####.b####.com.####.com/1c368d17-7d96-48a3-97da-eaeaf5924275.jpeg...
- publish####.b####.com.####.com/1c375ef9-ca85-431f-a2a8-4d72891cf15d.jpeg...
- publish####.b####.com.####.com/1cb3820a-e691-46fd-809d-b8f430be1a81.jpeg...
- publish####.b####.com.####.com/1f8713d2-760f-4bd7-a015-af73f4523504.jpeg...
- publish####.b####.com.####.com/238614ee-f163-46cb-b625-02dbdacf0012.jpeg...
- publish####.b####.com.####.com/2632cbc9-822f-4ccb-b4c4-7de6f00db7dc.jpeg...
- publish####.b####.com.####.com/324839c8-8890-4fdf-8266-5a281162fffa.jpeg...
- publish####.b####.com.####.com/32e42d75-e98c-49ee-9bf3-37098c34b7e4.jpeg...
- publish####.b####.com.####.com/405bc340-ea36-4506-9602-ce7710eafc11.jpeg...
- publish####.b####.com.####.com/41eaf94c-ecef-48c7-9411-53bab1e762e6.jpeg...
- publish####.b####.com.####.com/43c7dfdc-39e7-46a7-b61c-cd33ae24eaef.jpeg...
- publish####.b####.com.####.com/4a743304-824a-4f2d-8380-1449ae86cc4b.jpeg...
- publish####.b####.com.####.com/4eeb2bf6-cc51-4308-a5b5-23bf031d9a2b.jpeg...
- publish####.b####.com.####.com/4f361440-8b87-4309-ae11-44a4735ffef8.jpeg...
- publish####.b####.com.####.com/510f2863-e95b-4c89-86ec-e1c5cfb7135e.jpeg...
- publish####.b####.com.####.com/51fcd5e5-86b0-4454-8398-319514d13696.jpeg...
- publish####.b####.com.####.com/5311ebba-1bec-4cf6-845e-7a18a41f0503.jpeg...
- publish####.b####.com.####.com/53200e69-4423-4543-b4ec-3b64fc18e7d9.jpeg...
- publish####.b####.com.####.com/5762d055-1698-42ea-a162-3150bf8cd42a.jpeg...
- publish####.b####.com.####.com/5a04e7bc-9ed4-4166-8e09-bf39cda6d1da.png@...
- publish####.b####.com.####.com/5e869814-32fb-480d-950b-498720eb2cef.jpeg...
- publish####.b####.com.####.com/5fbe7bcf-164c-44c8-9ed9-bd9173edf2e6.jpeg...
- publish####.b####.com.####.com/60273d53-7506-4013-985d-1c0f03d762ad.jpeg...
- publish####.b####.com.####.com/6247f3ea-dd56-4f65-8257-b3232b3c91a7.jpeg...
- publish####.b####.com.####.com/64ce3074-098e-45f1-9005-e03b00ddf3e4.jpeg...
- publish####.b####.com.####.com/67eae199-6541-40fa-9270-918ea1a612c5.jpeg...
- publish####.b####.com.####.com/6822e2b0-70e5-4e1c-9169-29785c42cf4c.jpeg...
- publish####.b####.com.####.com/6b00d34d-8ab0-4d1f-904d-75d85e456589.jpeg...
- publish####.b####.com.####.com/6fb1fff7-9488-4338-8713-a1096a0daa86.jpeg...
- publish####.b####.com.####.com/6fcd1498-6ce6-430b-8a2f-1639cf7725c5.jpeg...
- publish####.b####.com.####.com/70afd5ec-7e8b-4ef0-9a33-bb9330589be2.jpeg...
- publish####.b####.com.####.com/7210284f-6489-4064-a2be-06378fe796f1.jpeg...
- publish####.b####.com.####.com/7d47c064-501b-45e1-935d-db1c508aaa6f.jpeg...
- publish####.b####.com.####.com/7da7e771-e952-4f60-b521-715b25ddde85.png@...
- publish####.b####.com.####.com/7e1522cc-efe7-49d3-aa6d-a41480f8aa33.jpeg...
- publish####.b####.com.####.com/7fa9570c-3629-4e67-8da9-064daf6b1905.jpeg...
- publish####.b####.com.####.com/816c6d9f-b971-476c-bfda-3b3b4e5b64a4.png@...
- publish####.b####.com.####.com/850fc293-b017-4482-8d2a-db1bc128727c.jpeg...
- publish####.b####.com.####.com/855b3486-ea96-44bb-92a4-fe4e7daefdee.jpeg...
- publish####.b####.com.####.com/86fe0b89-e86b-4cb3-aa85-e47e8f70be64.jpeg...
- publish####.b####.com.####.com/8db3027a-1e04-477f-b59a-497657e22699.jpeg...
- publish####.b####.com.####.com/9035eb13-61bd-4922-a95b-7d11af8b40cb.jpeg...
- publish####.b####.com.####.com/94b5c19f-81d7-408e-9daa-1ca4dd0f157e.png@...
- publish####.b####.com.####.com/976ba2c3-b3c0-4b6d-aa68-fc8ae62a8bdc.jpeg...
- publish####.b####.com.####.com/99a26e2b-a591-4fe1-a5a1-3c347f4aa872.jpeg...
- publish####.b####.com.####.com/9a5d42fb-74d9-42e0-895a-a2db0e08a3c1.jpeg...
- publish####.b####.com.####.com/9ae85211-1260-4222-bd02-e700be486977.jpeg...
- publish####.b####.com.####.com/9d4f3680-25c8-47e7-964d-9ec555b3c90c.jpeg...
- publish####.b####.com.####.com/9e043dd3-8055-4ef0-85c2-51c08aca4eb9.jpeg...
- publish####.b####.com.####.com/9e54ce2e-1c5b-400b-bf4f-d8bb685aa70d.jpeg...
- publish####.b####.com.####.com/9f4206f5-42ac-43dc-b7d4-d371ab7704d1.jpeg...
- publish####.b####.com.####.com/a1fc0eba-1973-4c8a-a5d1-930a5a3804f0.jpeg...
- publish####.b####.com.####.com/a46ea29c-57da-4113-9945-f5554c96f62b.jpeg...
- publish####.b####.com.####.com/a933c419-d3e7-4edd-b063-0fbfea4864bc.jpeg...
- publish####.b####.com.####.com/ab9ddc1e-0ecc-4c25-9056-1df0ac276a86.jpeg...
- publish####.b####.com.####.com/b4ed618b-1472-4d12-8b2b-1be0ff85e2a5.png@...
- publish####.b####.com.####.com/b8e3436b-b20f-4140-a725-a3c5f13f51fa.png@...
- publish####.b####.com.####.com/bb6422d8-47b5-4f7c-8c17-c2997fc464c8.jpeg...
- publish####.b####.com.####.com/bc3365cf-61bb-49c2-b599-02f894c6a58a.jpeg...
- publish####.b####.com.####.com/c241a329-1cda-4462-998b-808c95140308.jpeg...
- publish####.b####.com.####.com/c26c23de-1d41-4035-8563-72ddf5c9461d.jpeg...
- publish####.b####.com.####.com/c2c377f7-48b1-4274-85ac-525dbdb7ab10.jpeg...
- publish####.b####.com.####.com/c48df9eb-dd48-49eb-a4ba-3d5a67a7b0b0.jpeg...
- publish####.b####.com.####.com/c491f21e-4375-4995-a7e7-a8c0270fe81c.jpeg...
- publish####.b####.com.####.com/c5372aa1-c924-4012-92ee-badd369d2120.jpeg...
- publish####.b####.com.####.com/c6d2032a-2d96-4d79-9486-b30dbe8eb985.jpeg...
- publish####.b####.com.####.com/ca53de14-05ef-4735-9d0e-d184c9278e6e.jpeg...
- publish####.b####.com.####.com/ca9b8975-dce7-4a69-b542-56c623cd608a.jpeg...
- publish####.b####.com.####.com/cb4e5447-6081-4b8b-b831-c05eda60286e.jpeg...
- publish####.b####.com.####.com/cc5bd036-754f-402b-b65e-c319d86121c9.jpeg...
- publish####.b####.com.####.com/ccce6594-b715-42af-9f75-8e6a68b78321.jpeg...
- publish####.b####.com.####.com/cd5dbc3e-9e26-4b31-9964-a0514c9d0849.jpeg...
- publish####.b####.com.####.com/ce8fd4da-5a75-41bb-97b6-bd75f9c6f1b0.jpeg...
- publish####.b####.com.####.com/ceaa578a-342c-4e1e-947d-b9ccb7b4c853.jpeg...
- publish####.b####.com.####.com/d8eba97d-38cd-4165-9743-3d027d1cfa91.jpeg...
- publish####.b####.com.####.com/d989dd92-b36d-4676-bf04-20764cabea94.png@...
- publish####.b####.com.####.com/db2b835f-bf99-4d9d-8a79-654bbc611f13.jpeg...
- publish####.b####.com.####.com/dc85b794-b0d2-404d-8a3e-4f3a57527d8d.jpeg...
- publish####.b####.com.####.com/dd18419f-2945-4b50-9deb-7607822014da.jpeg...
- publish####.b####.com.####.com/de121e59-4b4d-4902-bbfe-42904d793b24.jpeg...
- publish####.b####.com.####.com/dea6ef4f-ee69-4605-ad02-d8a790bf9f2e.jpeg...
- publish####.b####.com.####.com/e619419f-2c64-4daf-88d5-29d6641b7b4f.jpeg...
- publish####.b####.com.####.com/ea3fd271-2726-42fb-9b5c-7ce76713a2e6.jpeg...
- publish####.b####.com.####.com/efa29312-db52-450e-aa6c-2e834cb2d97d.jpeg...
- publish####.b####.com.####.com/f06c7859-2c8c-4476-8672-3b4fb7c9758f.jpeg...
- publish####.b####.com.####.com/f0e33bcc-e7a8-4be9-8c01-af145b886bd6.jpeg...
- publish####.b####.com.####.com/f51de6c0-1be9-438f-bc37-8d17301627b7.jpeg...
- publish####.b####.com.####.com/f526b0ff-6486-42f2-a7b8-336621c839e2.jpeg...
- publish####.b####.com.####.com/f79c73e7-c0f9-4991-8c7e-c6ded7ef696d.jpeg...
- publish####.b####.com.####.com/faa499d8-93dc-4366-ac0e-86a5bc043d2b.jpeg...
- publish####.b####.com.####.com/fca4ed10-ae06-4cc5-a430-d695809d540b.jpeg...
- publish####.b####.com.####.com/fd8a2cd7-13c6-46d3-b929-d7e01bbb37f6.jpeg...
- www.a.sh####.com/favicon.ico
Запросы HTTP POST:
- a####.u####.com/app_logs
- cpu.b####.com/1021/e866cfb0/ads/35836572222/image
- cpu.b####.com/dig/get
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/index
- <Package Folder>/databases/database.db
- <Package Folder>/databases/database.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/-1942991396.jar
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
Другие:
Запускает следующие shell-скрипты:
- cat /proc/version
- getprop ro.product.cpu.abi
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
