Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) s8.q####.com:80
- TCP(HTTP/1.1) cm.pos.b####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) aserver####.m.ta####.com:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) wc.find####.cc.####.com:80
- TCP(HTTP/1.1) i####.2####.com:80
- TCP(HTTP/1.1) www.2####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) s.3####.cn:80
- TCP(HTTP/1.1) ggse####.2####.com.####.net:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) map####.y####.com.cn:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) js.pass####.qih####.com:80
- TCP(HTTP/1.1) m.d####.com:80
- TCP(HTTP/1.1) s.un####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.c####.b####.com:80
- TCP(HTTP/1.1) gg####.2####.com.####.net:80
- TCP(HTTP/1.1) i4.w####.com:80
- TCP(HTTP/1.1) em.b####.com:80
- TCP(TLS/1.0) 2####.58.212.174:443
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) ss0.bdst####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) mbd.n.sh####.com:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) c####.b####.com:443
- TCP(TLS/1.0) t####.jom####.com:443
- TCP(TLS/1.0) ch####.jom####.com:443
- TCP(TLS/1.0) www.a.sh####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) d####.zuoyexi####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) ss2.b####.com:443
- TCP(TLS/1.0) ss0.b####.com:443
- TCP(TLS/1.0) g####.bdst####.com:443
- TCP(TLS/1.0) si####.jom####.com:443
- TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443
Запросы DNS:
- a####.u####.com
- api.s####.b####.com
- c####.b####.com
- c####.b####.com
- c####.baidust####.com
- c####.baidust####.com
- cambria####.cdn.bc####.com
- cm.miao####.atm.####.com
- cm.pos.b####.com
- d####.zuoyexi####.com
- dup.baidust####.com
- ec####.b####.com
- em.b####.com
- ext.b####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- g####.bdst####.com
- gg####.2####.com
- ggse####.2####.com
- hm.b####.com
- i####.2####.com
- i4.w####.com
- js.pass####.qih####.com
- m.b####.com
- m.d####.com
- m.gho####.com
- map####.y####.com.cn
- mo####.b####.com
- mobads-####.b####.com
- p####.zhanz####.b####.com
- pos.b####.com
- s.3####.cn
- s.bdst####.com
- s.c####.b####.com
- s.un####.com
- s8.q####.com
- sp0.b####.com
- sp1.b####.com
- ss0.b####.com
- ss0.bdst####.com
- ss1.b####.com
- ss2.b####.com
- ss3.b####.com
- t.go.s####.com
- t11.b####.com
- t12.b####.com
- t9.b####.com
- ti####.b####.com
- un####.50####.org
- wc.find####.cc
- wn.pos.b####.com
- www.2####.com
- www.gho####.com
Запросы HTTP GET:
- aserver####.m.ta####.com/cm.gif?dspid=####
- c####.baidust####.com/cpro/expire/time2.js
- c####.baidust####.com/cpro/ui/cm.js
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- c####.baidust####.com/cpro/ui/pr.js
- c####.baidust####.com/sync.htm?cproid=####
- cm.pos.b####.com/pixel?dspid=####
- cm.pos.b####.com/pixel?sspid=####&local_cookie=####&ver=####&ext=####
- cm.pos.b####.com/youku?mzid=####
- em.b####.com/pixel?media_sign=####&media_site=####
- gd.a.s####.com/cm.gif?ver=####&mid=####&uid=####
- gg####.2####.com.####.net/bvzdlc.js
- gg####.2####.com.####.net/jewnmnmfn.js
- gg####.2####.com.####.net/jewnmnmgk.js
- gg####.2####.com.####.net/kfxononho.js
- gg####.2####.com.####.net/lgypopoop.js
- gg####.2####.com.####.net/mhzqpqpid.js
- gg####.2####.com.####.net/niarqrqhh.js
- gg####.2####.com.####.net/ojbsrsrik.js
- gg####.2####.com.####.net/ojbsrsrlg.js
- ggse####.2####.com.####.net/dgbxfpf?gdh=####&vhc=####&ch=####&kst=####&z...
- ggse####.2####.com.####.net/eranun?gdh=####&vhc=####&ch=####&kst=####&ch...
- ggse####.2####.com.####.net/m.html?mediaid=####&cookie_version=####&time...
- ggse####.2####.com.####.net/mlbq/bdg?c=####
- ggse####.2####.com.####.net/mlbq/em?c=####
- hm.b####.com/hm.gif?si=####&et=####&nv=####&st=####<=####&su=####&v=##...
- hm.b####.com/hm.gif?si=####&et=####&nv=####&st=####<=####&v=####&rnd=#...
- hm.b####.com/hm.gif?si=####&et=####&nv=####&st=####&su=####&v=####&rnd=#...
- hm.b####.com/hm.gif?si=2b82abe1ac836ebe765eb9c81c8db1cf&et=0&nv=1&st=3&s...
- hm.b####.com/hm.js?4aa2af3####
- i####.2####.com/appsimg
- i####.2####.com/duoteimg/css/qqzt/m/global.css
- i####.2####.com/duoteimg/css/qqzt/m/home.css
- i####.2####.com/duoteimg/images/m/top_ad.png
- i####.2####.com/duoteimg/images/qqzt/m/icon90-s21b858e716.png
- i####.2####.com/duoteimg/js/baidu_js_push.js
- i####.2####.com/duoteimg/js/interface/googletj.js
- i####.2####.com/duoteimg/js/qqzt/m/common.js
- i####.2####.com/duoteimg/js/qqzt/m/zepto.js
- i####.2####.com/duoteimg/softImg/soft/19/1477653262_65.jpg
- i####.2####.com/duoteimg/softImg/soft/23/1474526212_96.png
- i####.2####.com/duoteimg/softImg/soft/45/1524452713_67.png
- i####.2####.com/duoteimg/techImg/201702/duote_14_13-13-09.jpg
- i####.2####.com/duoteimg/techImg/201702/duote_14_13-13-53.jpg
- i####.2####.com/duoteimg/techImg/201702/duote_14_13-14-42.jpg
- i####.2####.com/duoteimg/techImg/201702/duote_14_13-16-33.jpg
- i####.2####.com/duoteimg/techImg/201702/duote_14_13-17-26.jpg
- i####.2####.com/zhushouimg/img/logo/102/68102/0853373980.png
- i####.2####.com/zhushouimg/img/logo/209/23209/0805054970.png
- i####.2####.com/zhushouimg/img/logo/327/49327_1447145662.png
- i####.2####.com/zhushouimg/img/logo/386/54386/1800211380.png
- i####.2####.com/zhushouimg/img/logo/441/45441_1487066352.png
- i####.2####.com/zhushouimg/img/logo/441/45441_1487066352.png?148706####
- i####.2####.com/zhushouimg/img/logo/519/102519/1712564350.png
- i####.2####.com/zhushouimg/img/logo/533/102533/0946299460.jpg
- i####.2####.com/zhushouimg/img/logo/533/102533_1485049647.png?148504####
- i####.2####.com/zhushouimg/img/logo/60/78160/1111107700.png
- i####.2####.com/zhushouimg/img/logo/645/174645_1459851070.png?145985####
- i####.2####.com/zhushouimg/img/logo/690/30690/1105056520.png
- i####.2####.com/zhushouimg/img/logo/736/63736_1487814185.png?148781####
- i####.2####.com/zhushouimg/img/logo/736/63736_1519866228.png?151986####
- i####.2####.com/zhushouimg/img/logo/795/33795/1803004600.png
- i####.2####.com/zhushouimg/img/logo/83/78183/1816342270.png
- i####.2####.com/zhushouimg/img/logo/990/990/0859364770.jpg
- i####.2####.com/zhushouimg/img/logo/990/990/0921022380.jpg
- i4.w####.com/item/1508/21/55d6af11a5296_wx.jpg
- js.pass####.qih####.com/11.0.1.js?5e46ee7####
- m.d####.com/assets/css/qqzt/m/fenzu.css?_vtim=####
- m.d####.com/assets/css/qqzt/m/global.css?_vtim=####
- m.d####.com/assets/css/qqzt/m/swiper.min.css
- m.d####.com/assets/css/qqzt/m/touxiang.css?_vtim=####
- m.d####.com/assets/js/clickDownAjax3.min.js
- m.d####.com/assets/js/clickDownAjax3.min.js}}
- m.d####.com/assets/js/m/view_inside.js
- m.d####.com/assets/js/qqzt/m/sildeFocusPlugin.js?_vtim=####
- m.d####.com/assets/js/qqzt/m/swiper.min.js
- m.d####.com/qqfenzu/
- m.d####.com/qqfenzu/61318.html
- m.d####.com/qqfenzu/qinglu.html
- m.d####.com/qqfenzu/shanggan.html
- m.d####.com/qqhot/
- m.d####.com/qqtouxiang/
- m.d####.com/qqtouxiang/77763.html
- m.d####.com/qqtupian/images/qqzt/logo-v.png
- m.d####.com/qqtupian/qqTxImg/1408598471_80.jpg
- m.d####.com/qqtupian/qqTxImg/1467281637_54.jpg
- m.d####.com/qqtupian/qqTxImg/1488358287_91.jpg
- m.d####.com/qqtupian/qqTxImg/1488422614_62.jpg
- m.d####.com/qqtupian/qqTxImg/1488422734_37.jpg
- m.d####.com/qqtupian/qqTxImg/1488422821_96.jpg
- m.d####.com/qqtupian/qqTxImg/1488422855_93.jpg
- m.d####.com/qqtupian/qqTxImg/2/0bfc8630b733285c505df073ef49c11d.jpg
- m.d####.com/qqtupian/qqTxImg/2013/04/22/13667716330.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-19-52.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-20-44.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-20-56.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-22-53.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-23-11.jpg
- m.d####.com/qqtupian/techImg/201704/duote_30_06-23-21.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/29/1498667543322.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/29/1498668079366.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/30/1498753988850.png
- m.d####.com/qqtupian/zixunImg/local/2017/06/30/1498754297314.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/30/1498754332213.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/30/1498754415973.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/06/30/1498754463458.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013089340.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013090308.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013091227.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013092852.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013093413.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013094291.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013095413.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013096818.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013097849.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013098738.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013099793.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013100339.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013102758.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499013103664.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/03/1499014057558.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/07/27/1501087008357.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/08/02/150160517374.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/09/14/15053571883285.png
- m.d####.com/qqtupian/zixunImg/local/2017/09/18/15057042117037.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/09/27/15064805896477.jpg
- m.d####.com/qqtupian/zixunImg/local/2017/12/05/15124511615268.jpg
- m.d####.com/qqtupian/zixunImg/local/2018/01/02/15148746435392.jpg
- map####.y####.com.cn/s/mapping/?baidu_error=####×tamp=####
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/__pasys.apk
- mo####.b####.com/ads/pa/__pasys.php
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525572573750=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525572604099=####
- pos.b####.com/fclm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/s?hei=100&wid=414&di=u3191991<u=http://www.2345.com/wmlv...
- pos.b####.com/s?hei=125&wid=414&di=u3191980<u=http://www.2345.com/wmlv...
- pos.b####.com/s?hei=230&wid=414&di=u3191967<u=http://www.2345.com/wmlv...
- pos.b####.com/s?hei=249&wid=414&di=u3191985<u=http://www.2345.com/wmlv...
- pos.b####.com/s?hei=42&wid=414&di=u3191981<u=http://www.2345.com/wmlvy...
- pos.b####.com/s?hei=63&wid=414&di=u3191966<u=http://www.2345.com/wmlvy...
- pos.b####.com/s?hei=70&wid=414&di=u3191971<u=http://www.2345.com/wmlvy...
- pos.b####.com/s?hei=80&wid=414&di=u3191974<u=http://www.2345.com/wmlvy...
- pos.b####.com/sync_pos.htm?cproid=####
- pos.b####.com/sync_pos.htm?cproid=####&t=####
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?r=####&l=####
- s.3####.cn/so/zz.gif?url=####&sid=####&token=####
- s.c####.b####.com/s.htm?cproid=####&t=####
- s8.q####.com/static/ab77b6ea7f3fbf79.js
- si####.jom####.com/it/u=1009855213,1309102982&fm=76
- si####.jom####.com/it/u=1093256568,3222516913&fm=76
- si####.jom####.com/it/u=1128731,1946245551&fm=76
- si####.jom####.com/it/u=1215462276,222977235&fm=76
- si####.jom####.com/it/u=1427648914,1616939950&fm=76
- si####.jom####.com/it/u=145486076,4125360639&fm=76
- si####.jom####.com/it/u=1623924059,2572797564&fm=76
- si####.jom####.com/it/u=2382476851,3907509204&fm=76
- si####.jom####.com/it/u=270731245,4132842335&fm=76
- si####.jom####.com/it/u=298150342,2244281372&fm=76
- si####.jom####.com/it/u=310430596,1718297552&fm=76
- si####.jom####.com/it/u=3178021051,3590130913&fm=76
- si####.jom####.com/it/u=3280280684,3595811120&fm=76
- si####.jom####.com/it/u=339992906,3121063281&fm=76
- si####.jom####.com/it/u=3409019002,3768345488&fm=76
- si####.jom####.com/it/u=3579939806,3905522705&fm=76
- si####.jom####.com/it/u=3606463135,3924348194&fm=76
- si####.jom####.com/it/u=3609535856,4134694241&fm=76
- si####.jom####.com/it/u=361369288,3328287106&fm=76
- si####.jom####.com/it/u=3827600797,658374964&fm=76
- si####.jom####.com/it/u=3845021669,3837824368&fm=76
- si####.jom####.com/it/u=3896866955,4048995204&fm=76
- si####.jom####.com/it/u=3993547036,812737853&fm=76
- si####.jom####.com/it/u=4033504357,3963916803&fm=76
- si####.jom####.com/it/u=4039932086,4200631450&fm=76
- si####.jom####.com/it/u=410054634,2181761146&fm=76
- si####.jom####.com/it/u=4152773564,218954384&fm=76
- si####.jom####.com/it/u=4186380538,4137924750&fm=76
- si####.jom####.com/it/u=4227726776,4266894164&fm=76
- si####.jom####.com/it/u=449110377,2198935438&fm=76
- si####.jom####.com/it/u=496607051,3444542821&fm=76
- si####.jom####.com/it/u=509827831,3061346639&fm=76
- si####.jom####.com/it/u=516125518,956644989&fm=76
- si####.jom####.com/it/u=615814197,4109253156&fm=76
- si####.jom####.com/it/u=787429698,2521929105&fm=76
- si####.jom####.com/it/u=900007534,1149963132&fm=76
- si####.jom####.com/it/u=980188043,2499827922&fm=76
- wc.find####.cc.####.com/2011/rio.jar
- wn.pos.b####.com/adx.php?c=####
- www.2####.com/wmlvy/m/baidu_u3191966.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191967.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191971.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191974.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191980.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191981.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191985.html?tid=####
- www.2####.com/wmlvy/m/baidu_u3191991.html?tid=####
- www.2####.com/wmlvy/m/page_u3191966.html?tid=####
- www.2####.com/wmlvy/m/page_u3191967.html?tid=####
- www.2####.com/wmlvy/m/page_u3191971.html?tid=####
- www.2####.com/wmlvy/m/page_u3191974.html?tid=####
- www.2####.com/wmlvy/m/page_u3191980.html?tid=####
- www.2####.com/wmlvy/m/page_u3191981.html?tid=####
- www.2####.com/wmlvy/m/page_u3191985.html?tid=####
- www.2####.com/wmlvy/m/page_u3191991.html?tid=####
Запросы HTTP POST:
- a####.u####.com/app_logs
- s.un####.com/cw/cp.action?requestId=####&g=####
- s.un####.com/cw/interface!u2.action?protocol=####&version=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/CachedGeoposition.db
- /data/data/####/CachedGeoposition.db-journal
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/__pasys.apk.beforesign.tm
- /data/data/####/__pasys_remote_banner.jar.beforesign.tm
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/f_000043
- /data/data/####/http_m.ghost64.com_0.localstorage-journal
- /data/data/####/http_mobads.baidu.com_0.localstorage-journal
- /data/data/####/https_m.baidu.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/mobclick_agent_online_setting_com.moon.hao4.mh346.xml
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/3.6_rio.jar.tmp
- /data/media/####/assetstime.dat
Другие:
Загружает динамические библиотеки:
- ke
Использует следующие алгоритмы для расшифровки данных:
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
