Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) wx.q####.cn:80
- TCP(HTTP/1.1) manhua1####.cd####.com:80
- TCP(HTTP/1.1) si####.us####.cdnetw####.net:80
- TCP(HTTP/1.1) mang####.manhu####.com:80
- TCP(HTTP/1.1) cdn.img.fly####.####.com:80
- TCP(HTTP/1.1) tel.ava####.manhu####.com:80
- TCP(HTTP/1.1) mhfm12####.cd####.com:80
- TCP(HTTP/1.1) q.q####.cn:80
- TCP(TLS/1.0) st####.suiyue####.com.####.com:443
- TCP(TLS/1.0) w####.che####.top:443
Запросы DNS:
- cdn.img.fly####.top
- clu####.manhu####.com
- mang####.manhu####.com
- manhua1####.cd####.com
- mhfm12####.cd####.com
- mhfm22####.cd####.com
- mhfm32####.cd####.com
- mhfm42####.cd####.com
- mhfm52####.cd####.com
- mhfm62####.cd####.com
- mhfm72####.cd####.com
- mhfm82####.cd####.com
- mhfm92####.cd####.com
- q.q####.cn
- st####.suiyue####.com
- t####.sin####.cn
- tel.ava####.manhu####.com
- w####.che####.top
- wx.q####.cn
Запросы HTTP GET:
- cdn.img.fly####.####.com/upload/201708/4/img/20170804163317464.png
- cdn.img.fly####.####.com/upload/201711/28/img/20171128171551888.png
- cdn.img.fly####.####.com/upload/201711/29/img/20171129172413161.png
- cdn.img.fly####.####.com/upload/201712/29/img/20171229134026631.png
- mang####.manhu####.com/notification/getMessagesTotal?gat=####&gak=####&g...
- mang####.manhu####.com/v1/manga/getDetail?mangaDetailVersion=####&mangaI...
- mang####.manhu####.com/v1/manga/getHotComment?userId=####&mangaId=####&g...
- mang####.manhu####.com/v1/manga/getSections?mangaId=####&gat=####&gak=##...
- mang####.manhu####.com/v1/manga/getWatcher?mangaId=####&gat=####&gak=###...
- mang####.manhu####.com/v1/manga/recommend?version=####&mangaId=####&type...
- mang####.manhu####.com/v1/public/getAds?version=####&mangaId=####&type=#...
- mang####.manhu####.com/v1/public/getAdstrategy?mangaId=####&viewName=###...
- mang####.manhu####.com/v1/public/getBaseurl?gat=####&gak=####&gsm=####&g...
- mang####.manhu####.com/v1/public/getGlobalConfig?gat=####&gak=####&gsm=#...
- mang####.manhu####.com/v1/public/getHome?version=####&isPromote=####&gat...
- mang####.manhu####.com/v1/public/getPublishConfig?gat=####&gak=####&gsm=...
- mang####.manhu####.com/v1/public/getUpgradeInfo?version=####&type=####&s...
- mang####.manhu####.com/v1/user/getMessage?version=####&gat=####&gak=####...
- manhua1####.cd####.com/userfile/5/avatars/2017/9/2/162526871/1/ece1d0e82...
- mhfm12####.cd####.com/15/14147/20170717170710_180x240_32.jpg
- mhfm12####.cd####.com/22/21077/20171226133810_180x240_18.jpg
- mhfm12####.cd####.com/22/21077/20171226133810_480x210_32.jpg
- mhfm12####.cd####.com/22/21445/20170816114127_480x210.jpg
- mhfm12####.cd####.com/22/21445/20170816114127_480x369.jpg
- mhfm12####.cd####.com/22/21606/20171013135027_180x240.jpg
- mhfm12####.cd####.com/23/22314/20160322132005_180x240.jpg
- mhfm12####.cd####.com/3/2396/2396.jpg
- mhfm12####.cd####.com/34/33991/20171019173846_480x210_59.jpg
- mhfm12####.cd####.com/34/33991/20171215092202_180x240_24.jpg
- mhfm12####.cd####.com/36/35941/20170823101656_180x240.jpg
- mhfm12####.cd####.com/38/37169/20170818133854_180x240_24.jpg
- mhfm12####.cd####.com/38/37756/20170729170645_180x240.jpg
- mhfm12####.cd####.com/39/38034/20171101203204_180x240_30.jpg
- mhfm12####.cd####.com/39/38071/20170821153349_180x240.jpg
- mhfm12####.cd####.com/39/38071/20170821153349_480x369.jpg
- mhfm12####.cd####.com/39/38427/20170918142258_180x240_22.jpg
- mhfm12####.cd####.com/39/38820/20171013131028_180x240.jpg
- mhfm12####.cd####.com/41/40373/20180118112642_180x240.jpg
- mhfm12####.cd####.com/6/5389/5389.jpg
- mhfm12####.cd####.com/9/8171/8171.jpg
- mhfm12####.cd####.com/tag/manhuaren2/djsf_icon.png
- mhfm12####.cd####.com/tag/manhuaren2/djsf_more_icon.png
- q.q####.cn/qqapp/1102042292/966061AEF711D5B6B77C8B162CD52233/40
- si####.us####.cdnetw####.net/crop.0.0.664.664.1024/006azdrdjw8f09bttwei1...
- tel.ava####.manhu####.com/12/2016/12/10/a4c7f2c6a4d74fae.jpg
- wx.q####.cn/mmopen/nKxibVS33NGaiafWaHeiabVrbwO3BkiahKK8eIq5dX7r2EtJFbMBi...
- wx.q####.cn/mmopen/nKxibVS33NGayF9mCD3Drvf1mnuHmLsJ9oI4MLKbrOzj03jQiaX9I...
Запросы HTTP POST:
- mang####.manhu####.com/v1/public/getStartPageAds3?gat=####&gak=####&gsm=...
- mang####.manhu####.com/v1/user/createAnonyUser2?gat=####&gak=####&gsm=##...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_config/config
- <Package Folder>/cache/####/-fGecIfrOKQ2_rvTYZZL8onY-eE.-30993729.tmp
- <Package Folder>/cache/####/5ilotasorrm0i9uygCHQt799dag.-1225273030.tmp
- <Package Folder>/cache/####/F1p6yKjx5F_RIJ0OtYsoj7BFi4c.1876794723.tmp
- <Package Folder>/cache/####/Gtf5xtf_nahVTLwfX9xWN7MSkyk.-1924183999.tmp
- <Package Folder>/cache/####/HjwU6avBJ-xNkOlDNXa3vPrbBkI.-518569289.tmp
- <Package Folder>/cache/####/IWXyoB3pCBtjgZJjzErjuyf_x9k.1957175794.tmp
- <Package Folder>/cache/####/MhSy80UF1o1wZZcbRBJS-QCpQYk.-616367763.tmp
- <Package Folder>/cache/####/N-hp4WozNBUnZ1V_OGi_4PokKeY.-236027429.tmp
- <Package Folder>/cache/####/OvaO5uovF9HQSFbFmM-68D8GYic.-1795910242.tmp
- <Package Folder>/cache/####/PwNirYpaFnKCXnrwgjRLjcSZdKs.-1268620132.tmp
- <Package Folder>/cache/####/S68Oz0A1T1nOedFUlTCnwPjZByw.-1339733764.tmp
- <Package Folder>/cache/####/SrR5pSr_fs_LLjHnhzFuKmINWFc.-2123529333.tmp
- <Package Folder>/cache/####/UKuMjxtjsixx9oBhiWDQwDQPjWo.1778083415.tmp
- <Package Folder>/cache/####/WBsncOODem2FX13sIbTWy_rKNu0.-718029786.tmp
- <Package Folder>/cache/####/XWTtuXyVABTqbRRNGvl59RorATw.1560395087.tmp
- <Package Folder>/cache/####/_k322RtLOORZcaOJGvPm4l-uU5M.-1556555066.tmp
- <Package Folder>/cache/####/aKEfgLe9-FQOajiw_lLJG6aTjeM.-946637445.tmp
- <Package Folder>/cache/####/b9RVl3H8v-XmGedQR5mUnH59h2o.1564668139.tmp
- <Package Folder>/cache/####/e8aw8-uy9qwvm34FXxvJpE68OLQ.-39537299.tmp
- <Package Folder>/cache/####/faD5nrAFb4PESWpPiwbq4q01vfg.1866634829.tmp
- <Package Folder>/cache/####/h1P-0_7nmMwMsYnV76awHsk_F8w.867068438.tmp
- <Package Folder>/cache/####/jl_JC6AZ-xM0vMiY9C6EX64PbHQ.-50022124.tmp
- <Package Folder>/cache/####/lHspJNKaBP1bhGwE9IAZAvIelc0.-1488755812.tmp
- <Package Folder>/cache/####/mdZ6uI24udgxs5hj7rCGNumTu04.1811520507.tmp
- <Package Folder>/cache/####/rw0t9y7Fe-G0vAEV-wzjwo129JQ.1543014067.tmp
- <Package Folder>/cache/####/sdmda7Rp21ySAqe8NOAGgT8qXv4.-1133135836.tmp
- <Package Folder>/cache/####/uSwF3utKYXWcUz9YTWxGKn4c3sI.1758531941.tmp
- <Package Folder>/cache/####/z7nTtOuu3fkm913Bgi_Z6EmXcZ8.420122681.tmp
- <Package Folder>/cache/####/zbKD9lS58Dm_WilL5gp60mgjRLs.-1040415134.tmp
- <Package Folder>/cache/GlobalConfigBean
- <Package Folder>/cache/detailactivity_looking21445
- <Package Folder>/cache/detailactivity_looking38071
- <Package Folder>/cache/detailactivity_mangadetail21445
- <Package Folder>/cache/detailactivity_mangadetail38071
- <Package Folder>/cache/detailactivity_recommend21445
- <Package Folder>/cache/detailactivity_recommend38071
- <Package Folder>/cache/homefragment_getHome
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/cartoon.db
- <Package Folder>/databases/cartoon.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/x_h.db-journal
- <Package Folder>/files/68164081
- <Package Folder>/files/GlobalConfigBean
- <Package Folder>/files/key_get_start_page_ads
- <Package Folder>/files/mhr_anony_user
- <Package Folder>/files/mobclick_agent_cached_<Package>8
- <Package Folder>/files/sync_time
- <Package Folder>/files/tc.jar
- <Package Folder>/files/zd.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/ar.xml
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/isfirst.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/sv.xml (deleted)
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/24b21b6a6a3b5
- <SD-Card>/Android/####/8037297323f14
- <SD-Card>/Android/####/a1b663bc2b4ad
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/b8ac660157a9e
Другие:
Запускает следующие shell-скрипты:
- cat /sys/class/net/wlan0/address
Загружает динамические библиотеки:
- bitmaps
- memchunk
- static-webp
- webp
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
