Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.1.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) i####.mzst####.com.####.net:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) api.18t####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) mzst####.com.edg####.net:80
- TCP(HTTP/1.1) w####.18t####.com.####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) h####.b####.com.####.com:443
Запросы DNS:
- a####.u####.com
- a2.mzst####.com
- a3.mzst####.com
- a5.mzst####.com
- api.18t####.com
- b####.s####.b####.com
- c####.mm####.com
- c.c####.com
- h####.b####.com
- h####.c####.com
- hm.b####.com
- is1.mzst####.com
- is3.mzst####.com
- is4.mzst####.com
- is5.mzst####.com
- m.18t####.com
- qn.18t####.com
- r####.wx.qq.com
- s11.c####.com
- st####.an####.org
- www.18t####.com
Запросы HTTP GET:
- api.18t####.com/?c=####&a=####&app=####&act=####&vs=####&url=/ap####&a=#...
- api.18t####.com/index.php?c=####&a=####&ids=####&dk=####&ak=####
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?50d28fd####
- hm.b####.com/h.js?ff598de####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?6b0d092####
- i####.mzst####.com.####.net/image/thumb/Purple117/v4/37/2a/c1/372ac113-9...
- i####.mzst####.com.####.net/image/thumb/Purple117/v4/4f/2a/f5/4f2af502-6...
- i####.mzst####.com.####.net/image/thumb/Purple118/v4/b2/e5/b9/b2e5b97c-3...
- i####.mzst####.com.####.net/image/thumb/Purple127/v4/26/74/a6/2674a6c2-e...
- i####.mzst####.com.####.net/image/thumb/Purple127/v4/c2/15/c3/c215c3d4-c...
- mzst####.com.edg####.net/us/r30/Purple20/v4/9b/1d/8a/9b1d8a9a-87ac-d1b0-...
- mzst####.com.edg####.net/us/r30/Purple30/v4/3f/47/ac/3f47ac98-ad2d-506d-...
- mzst####.com.edg####.net/us/r30/Purple60/v4/dd/01/9c/dd019cec-7bd3-880d-...
- mzst####.com.edg####.net/us/r30/Purple60/v4/ea/30/ab/ea30abce-6dbd-d40e-...
- s####.tc.qq.com/open/js/jweixin-1.0.0.js
- t####.c####.q####.####.com//uploads/20141208/14180066722820_water.jpg?im...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2016-11-20/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2016-12-12/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2017-09-25/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2017-11-13/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2017-11-15/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2017-12-25/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2017-12-28/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2018-01-08/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2018-02-01/5...
- t####.c####.q####.####.com/magicbox_images/upload/game_icon/2018-02-02/5...
- t####.c####.q####.####.com/uploads/20150612/v1_1-8_1434097397445025.png
- t####.c####.q####.####.com/uploads/20161028/1477648718885769.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20161031/1477908173536520.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20161107/1478514372639190.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20161108/1478600016165763.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20180105/v1_1-8_1515119500603149.jpg?...
- t####.c####.q####.####.com/uploads/20180109/v1_1-8_1515495070124281.jpg?...
- t####.c####.q####.####.com/uploads/20180326/1522055006194466.png?imageVi...
- t####.c####.q####.####.com/uploads/20180327/1522140518160882.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20180328/1522205249276517.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20180329/1522294967159739.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20180329/1522314975187343.jpg
- t####.c####.q####.####.com/uploads/20180329/1522316722692647.jpg?imageVi...
- t####.c####.q####.####.com/uploads/20180329/v1_1-8_1522307800213379.png?...
- t####.c####.q####.####.com/uploads/20180329/v1_1-8_1522311481694103.jpg?...
- t####.c####.q####.####.com/uploads/20180329/v1_1-8_1522313912994131.png?...
- t####.c####.q####.####.com/uploads/20180329/v1_1-8_1522314998568844.jpg?...
- t####.c####.q####.####.com/uploads/20180329/v1_1-8_1522319804963015.jpg?...
- w####.18t####.com.####.com/
- w####.18t####.com.####.com/?os=####
- w####.18t####.com.####.com/Public/Mobile/css/index.css?t=####
- w####.18t####.com.####.com/Public/Mobile/images/gametest8.png
- w####.18t####.com.####.com/Public/Mobile/images/gametest8_5.png
- w####.18t####.com.####.com/Public/Mobile/images/home_play.png
- w####.18t####.com.####.com/Public/Mobile/images/logo.png?t=####
- w####.18t####.com.####.com/Public/Mobile/images/m18touch.png
- w####.18t####.com.####.com/Public/Mobile/images/menuButton2.png
- w####.18t####.com.####.com/Public/Mobile/images/searchButton2.png
- w####.18t####.com.####.com/Public/Mobile/images/share-icon/wx.png
- w####.18t####.com.####.com/Public/Mobile/js/chw-photoview-mobile.js
- w####.18t####.com.####.com/Public/Mobile/js/com.js?t=####
- w####.18t####.com.####.com/Public/Mobile/js/mobile-detail.js?v=####
- w####.18t####.com.####.com/Public/Mobile/js/touch.js
- w####.18t####.com.####.com/Public/Mobile/js/touchLoad.js
- w####.18t####.com.####.com/Public/Mobile/js/zepto.min.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/fx.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/fx_methods.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/selector.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/zepto.lazyload....
- w####.18t####.com.####.com/Public/css/bootstrap.min.css
- w####.18t####.com.####.com/Public/css/css.css?v=####
- w####.18t####.com.####.com/Public/css/index-mod/index-top-gallery.css
- w####.18t####.com.####.com/Public/css/index-mod/nav-game.css?_n=####
- w####.18t####.com.####.com/Public/css/index-mod/zhuanqu-mod.css?v=####
- w####.18t####.com.####.com/Public/css/part.css
- w####.18t####.com.####.com/Public/css/topBar.css?v=####
- w####.18t####.com.####.com/Public/images/logo-transparent.png?t=####
- w####.18t####.com.####.com/Public/images/qqkj.png
- w####.18t####.com.####.com/Public/images/txwb.png
- w####.18t####.com.####.com/Public/images/xlwb.png
- w####.18t####.com.####.com/Public/js/18touch-guanggao.js?t=####
- w####.18t####.com.####.com/Public/js/Xslider.js
- w####.18t####.com.####.com/Public/js/bootstrap.min.js
- w####.18t####.com.####.com/Public/js/carousel_L.js?v=####
- w####.18t####.com.####.com/Public/js/common.js?v=####
- w####.18t####.com.####.com/Public/js/index-mod/index.js?v=####
- w####.18t####.com.####.com/Public/js/index-mod/nav-game.js
- w####.18t####.com.####.com/Public/js/index-mod/zhuan-mod.js
- w####.18t####.com.####.com/Public/js/jquery.lazyload.min.js
- w####.18t####.com.####.com/Public/js/jquery.min.js
- w####.18t####.com.####.com/Public/js/mobile/common/iscroll.min-5.1.3.js
- w####.18t####.com.####.com/Public/js/sea.js
- w####.18t####.com.####.com/bxzjytbgcjgq.html
- w####.18t####.com.####.com/favicon.ico
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
- z.c####.com/stat.htm?id=4570889&r=http://m.18touch.com/?os=####&lg=####&...
Запросы HTTP POST:
- a####.u####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jiagu.ls
- /data/data/####/JPushSA_Config.xml
- /data/data/####/JPushSA_Config.xml.bak
- /data/data/####/cn.jpush.serverconfig.xml
- /data/data/####/com.touch18.pvz.app_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/index
- /data/data/####/jpush_stat_cache.json
- /data/data/####/libjiagu.so
- /data/data/####/mobclick_agent_online_setting_com.touch18.pvz.app.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/pvz_BannerData.txt
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/3heo3g9fqexfxemqmbli723te
- /data/media/####/4ofviqicigfkl4ubfxex8y5iv
Другие:
Загружает динамические библиотеки:
- jpush181
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
