Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) zhusho####.gam####.cn:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) i####.gam####.cn.####.com:80
- TCP(HTTP/1.1) hm.bd.5####.net:80
- TCP(HTTP/1.1) aserver####.m.ta####.com:80
- TCP(HTTP/1.1) btla####.b####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) su####.itc.cn.####.com:80
Запросы DNS:
- 0d077ef####.cdn.so####.com
- a####.u####.com
- btla####.b####.com
- chan####.s####.com
- feed####.u####.com
- hm.b####.com
- hm.bd.5####.net
- i####.gam####.cn
- m####.gam####.cn
- mf####.gam####.cn
- pl####.y####.com
- su####.itc.cn
- uce####.gam####.cn
- zhusho####.gam####.cn
Запросы HTTP GET:
- aserver####.m.ta####.com/jsapi
- aserver####.m.ta####.com/unifull/css/unifull.min.css
- btla####.b####.com/baitong/wap/app/abanner.php
- btla####.b####.com/baitong/wap/app/css/bn.css
- btla####.b####.com/baitong/wap/app/js/swipe.js
- btla####.b####.com/baitong/wap/app/js/zepto.js?2####
- gdv.a.s####.com/api/2/topic/load?page_size=50&style=&hot_size=1&topic_so...
- gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
- hm.b####.com/hm.js?a6dafb1####
- i####.gam####.cn.####.com/2014/05/14/127-1405141114050.jpg
- i####.gam####.cn.####.com/2014/12/05/127-1412050921300.jpg
- i####.gam####.cn.####.com/2016/02/29/127-1602291121310.jpg
- i####.gam####.cn.####.com/2016/05/13/127-1605131349360.jpg
- i####.gam####.cn.####.com/2016/05/26/127-160526114I80.jpg
- i####.gam####.cn.####.com/2016/05/26/127-1605261155220.jpg
- i####.gam####.cn.####.com/2016/06/01/127-1606011033160.jpg
- i####.gam####.cn.####.com/2016/06/08/127-16060Q452160.jpg
- i####.gam####.cn.####.com/2016/06/08/127-16060Q455440.jpg
- i####.gam####.cn.####.com/2016/06/14/127-1606140959180.jpg
- i####.gam####.cn.####.com/2016/06/21/127-1606211125040.jpg
- i####.gam####.cn.####.com/2016/06/29/127-1606291415360.jpg
- i####.gam####.cn.####.com/2016/07/02/127-160F2103P30.jpg
- i####.gam####.cn.####.com/2016/07/04/127-160F41412290.jpg
- i####.gam####.cn.####.com/2016/07/05/127-160F51436280.jpg
- i####.gam####.cn.####.com/2016/07/15/127-160G51414540.jpg
- i####.gam####.cn.####.com/2016/07/28/127-160HQ443260.jpg
- i####.gam####.cn.####.com/2016/07/30/285-160I01223130.jpg
- i####.gam####.cn.####.com/2016/07/30/285-160I01235300.jpg
- i####.gam####.cn.####.com/2016/08/04/127-160P4135K10.jpg
- i####.gam####.cn.####.com/2016/08/05/127-160P51409230.jpg
- i####.gam####.cn.####.com/2016/08/08/127-160PQ433360.jpg
- i####.gam####.cn.####.com/2016/08/12/127-160Q21405570.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q3161T50.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31620510.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31J1320.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31J2410.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31J5470.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31J6430.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31JI20.jpg
- i####.gam####.cn.####.com/2016/08/13/127-160Q31JR50.jpg
- i####.gam####.cn.####.com/2016/08/17/127-160QG416150.jpg
- i####.gam####.cn.####.com/2016/08/17/127-160QG421350.jpg
- i####.gam####.cn.####.com/2016/08/19/127-160Q91444030.jpg
- i####.gam####.cn.####.com/avatar.php?size=####&uid=####
- i####.gam####.cn.####.com/c_zoom,w_200/fac494264beff70ed91fedf32783552b_...
- i####.gam####.cn.####.com/images/noavatar_middle.gif
- i####.gam####.cn.####.com/js/jquery.min.js
- su####.itc.cn.####.com/avatarimg/497397415_1471579375101_c55
- zhusho####.gam####.cn/index.php?m=####&a=####&aid=####
- zhusho####.gam####.cn/index.php?m=####&a=####&id=####&umengchannel=####
- zhusho####.gam####.cn/index.php?m=####&a=####&page=####&typeid=####&flag...
- zhusho####.gam####.cn/index.php?m=####&a=####&pageSize=####&page=####&ty...
Запросы HTTP POST:
- a####.u####.com/app_logs
- btla####.b####.com/baitong/index.php?r=####&m=####&ad_type=####&clientty...
- hm.bd.5####.net/3sfwe/9a67/p9c
- hm.bd.5####.net/3sfwe/9a67/q9c
- hm.bd.5####.net/3sfwe/9a67/s9c
- hm.bd.5####.net/3sfwe/9a67/t9c
- hm.bd.5####.net/3sfwe/9a67/w9c
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/-1558902304-201487099
- <Package Folder>/cache/####/-1558902304-201487100
- <Package Folder>/cache/####/-1558902304-201487102
- <Package Folder>/cache/####/-495319897259370286
- <Package Folder>/cache/####/1003943842-1526781676
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/databases/jonesislandassist.db-journal
- <Package Folder>/databases/trinea_android_common.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/497397415_1471579375101_c55
- <Package Folder>/files/avatar.php?size=middle&uid=1682153
- <Package Folder>/files/ih.sd.bv.av.jar
- <Package Folder>/files/mobclick_agent_cached_<Package>30
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/TrineaAndroidCommon.xml
- <Package Folder>/shared_prefs/_mgewfs_r.xml
- <Package Folder>/shared_prefs/jonesislandassist.xml
- <Package Folder>/shared_prefs/register.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/uuid.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/baidu/.cuid
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_07...00_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_07...30_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_08...10_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_08...20_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_08...30_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_08...50_jpg
- <SD-Card>/jonesislandassist/####/http___img1_gamedog_cn_2016_08...70_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2014_0...50_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2014_1...00_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...10_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...20_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...30_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...40_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...50_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...60_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...70_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...80_jpg
- <SD-Card>/jonesislandassist/####/http___mimg1_gamedog_cn_2016_0...90_jpg
Другие:
Загружает динамические библиотеки:
- MD5_v1
- base64encoder_v1_4
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- DES
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
