Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) nav.cn.ron####.com:80
- TCP(HTTP/1.1) 2####.243.193.48:80
- TCP(HTTP/1.1) d.weixu####.com.####.com:80
- TCP(HTTP/1.1) go.1mi####.cn:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) i####.ish####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(HTTP/1.1) www.ish####.net:80
- TCP(HTTP/1.1) q.c####.com:80
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP 1####.92.22.206:8618
Запросы DNS:
- a####.u####.com
- c####.mm####.com
- c.c####.com
- d.weixu####.com.cn
- fb.u####.com
- go.1mi####.cn
- i####.ish####.com
- i####.ish####.com
- i####.ish####.com
- mt####.go####.com
- nav.cn.ron####.com
- ping####.qq.com
- q14.c####.com
- r.eli####.cn
- s####.cn.ron####.com
- st####.duo####.com
- t####.qq.com
- w.c####.com
- www.ish####.net
Запросы HTTP GET:
- c.c####.com/core.php?web_id=####&l=####&t=####
- c.c####.com/q_stat.php?id=####&l=####
- d.weixu####.com.####.com/2011/gou.jar
- gm.mm####.com/9.gif?abc=####&rnd=####
- i####.ish####.com/bojin/20/bjs.png
- i####.ish####.com/comic/fenxi/fm.jpg
- i####.ish####.com/fating/end/00.png
- i####.ish####.com/fating/end/01.png
- i####.ish####.com/fating/end/02.png
- i####.ish####.com/fating/end/03.png
- i####.ish####.com/fating/end/04.png
- i####.ish####.com/fating/end/05.png
- i####.ish####.com/fating/end/06.png
- i####.ish####.com/fating/end/07.png
- i####.ish####.com/fating/end/08.png
- i####.ish####.com/fating/end/09.png
- i####.ish####.com/fating/end/10.png
- i####.ish####.com/fating/end/11.png
- i####.ish####.com/fating/end/12.png
- i####.ish####.com/fating/end/13.png
- i####.ish####.com/fating/end/14.png
- i####.ish####.com/fating/end/15.png
- i####.ish####.com/fating/end/16.png
- i####.ish####.com/fating/end/17.png
- i####.ish####.com/fating/end/18.png
- i####.ish####.com/fating/end/19.png
- i####.ish####.com/fating/end/20.png
- i####.ish####.com/fating/end/21.png
- i####.ish####.com/fating/end/22.png
- i####.ish####.com/fating/end/23.png
- i####.ish####.com/fating/end/24.png
- i####.ish####.com/fating/end/25.png
- i####.ish####.com/fating/end/26.png
- i####.ish####.com/fating/end/27.png
- i####.ish####.com/fating/end/28.png
- i####.ish####.com/fating/end/29.png
- i####.ish####.com/fating/end/30-31.png
- i####.ish####.com/fating/end/fas.png
- i####.ish####.com/hero/121/yxs.png
- i####.ish####.com/hy/manyue/hys.jpg
- i####.ish####.com/lg/over201/lgs.png
- i####.ish####.com/sbs/60/208.jpg
- i####.ish####.com/toriko/396/mss.jpg
- i####.ish####.com/wt/ting136/00.png
- i####.ish####.com/wt/ting136/01.png
- i####.ish####.com/wt/ting136/02.png
- i####.ish####.com/wt/ting136/03.png
- i####.ish####.com/wt/ting136/04.png
- i####.ish####.com/wt/ting136/05.png
- i####.ish####.com/wt/ting136/06.png
- i####.ish####.com/wt/ting136/07.png
- i####.ish####.com/wt/ting136/08.png
- i####.ish####.com/wt/ting136/09.png
- i####.ish####.com/wt/ting136/10.png
- i####.ish####.com/wt/ting136/11.png
- i####.ish####.com/wt/ting136/12.png
- i####.ish####.com/wt/ting136/13.png?1=####
- i####.ish####.com/wt/ting136/14.png
- i####.ish####.com/wt/ting136/15.png
- i####.ish####.com/wt/ting136/16.png
- i####.ish####.com/wt/ting136/17.png
- i####.ish####.com/wt/ting136/18.png
- i####.ish####.com/wt/ting136/19.png
- i####.ish####.com/wt/ting136/sp.png
- i####.ish####.com/wt/ting136/wts.png
- i####.ish####.com/yz/921/yzs.png
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
- q.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
- t####.qq.com/stats?sId=####
- www.ish####.net/ComicBooks/ReadComicBooksToIso/1464.html
- www.ish####.net/ComicBooks/ReadComicBooksToIso/4667.html
- www.ish####.net/ComicBooks/ReadComicBooksToIsoV1/1464.html
- www.ish####.net/ComicBooks/ReadComicBooksToIsoV1/4667.html
- www.ish####.net/Content/scripts/jq.js
- www.ish####.net/ReadComicBooksToIsoV2/1464
- www.ish####.net/ReadComicBooksToIsoV2/4667
Запросы HTTP POST:
- a####.u####.com/app_logs
- go.1mi####.cn/k1?requestId=####&g=####&ua=####
- go.1mi####.cn/m2?protocol=####&version=####&cid=####
- nav.cn.ron####.com/navipush.json
- www.ish####.net/ComicBooks/GetAllBook?ClassifyId=####&Size=####&PageInde...
- www.ish####.net/ComicBooks/GetChapterList?id=####&PageIndex=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/240848e3b04b07756aa3b5c19c47054795afc0de720bfd3....0.tmp
- /data/data/####/4edf885de354facdb2b969e9c5c826641ef656331a0b842....0.tmp
- /data/data/####/633af6756e2d0907009cf147f4b9c2d0fed2ab18e229015....0.tmp
- /data/data/####/7a0c3d885d167b4a4b7af5a49e28d6573952dea5490ece8....0.tmp
- /data/data/####/84c11312f8e8b2ad5629270463410daa8909f35377a6611....0.tmp
- /data/data/####/9436538365c46aaeb089f83ca4d5e2303620b88c25377ce....0.tmp
- /data/data/####/AppStore.xml
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/Statistics.xml
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/acbeb6ff0a6a30913d77bdc60705ccf8532d36bc55b2ad7....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.isbxxhui.comic_preferences.xml
- /data/data/####/comic.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/e9f1d0fe753b66fe6fd74dd94c98e9008e9ba38ce41ba30....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/fc3ea2ae1e0eb858eb369307566d0b05ead7fb86a3fae70....0.tmp
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/rc_navigation_info.xml
- /data/data/####/recent_list.xml
- /data/data/####/rong_version.db
- /data/data/####/rong_version.db-journal
- /data/data/####/st.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_feedback_user_info.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/restime.dat
Другие:
Загружает динамические библиотеки:
- RongIMLib
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
