Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.570.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) t####.cn:80
- TCP(HTTP/1.1) m.y####.cc:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) api.s####.b####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) cdn####.gs.a.####.com:80
- TCP(HTTP/1.1) www.ta####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) i####.doub####.com:80
- TCP(HTTP/1.1) www.y####.cc:80
- TCP(HTTP/1.1) s.3####.cn:80
- TCP(HTTP/1.1) photoc####.gs.a.####.com:80
- TCP(HTTP/1.1) 25####.com:80
- TCP(HTTP/1.1) js.q####.com:80
- TCP(HTTP/1.1) s5.q####.com:80
- TCP(HTTP/1.1) js.pass####.qih####.com:80
- TCP(HTTP/1.1) tu####.tupi####.com:80
- TCP(HTTP/1.1) img1-do####.b0.a####.com:80
- TCP(HTTP/1.1) img.wu####.cn:80
- TCP(HTTP/1.1) weib####.g####.sina####.com:80
- TCP(HTTP/1.1) 1####.w####.cname####.com:80
- TCP(HTTP/1.1) img.zxzi####.com:80
- TCP(HTTP/1.1) 1####.151.64.71:80
- TCP(HTTP/1.1) m.ta####.com:80
- TCP(HTTP/1.1) 23.2####.21.192:1808
- TCP(HTTP/1.1) gs.a.s####.com:80
- TCP(TLS/1.0) i####.c####.com.####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) m.ta####.com:443
- TCP(TLS/1.0) gdv.a.s####.com:443
- TCP(TLS/1.0) gs.a.s####.com:443
- TCP(TLS/1.0) gd.a.s####.com:443
- TCP y1.ey####.com:7071
- TCP y1.ey####.com:7073
- TCP y1.ey####.com:7072
Запросы DNS:
- 25####.com
- api.s####.b####.com
- c####.mm####.com
- c.c####.com
- chan####.itc.cn
- chan####.s####.com
- dy####.com
- e.chan####.s####.com
- h5.m.ta####.com
- i####.c####.com
- i####.doub####.com
- i####.doub####.com
- img.wu####.cn
- img.zxzi####.com
- js.pass####.qih####.com
- js.q####.com
- l####.tbs.qq.com
- m.ta####.com
- m.y####.cc
- mt####.go####.com
- p####.zhanz####.b####.com
- phot####.s####.com
- phot####.tv.s####.com
- s.3####.cn
- s19.c####.com
- s5.q####.com
- t####.cn
- tu####.tupi####.com
- ww1.sin####.cn
- www.ta####.com
- www.y####.cc
- y1.ey####.com
- y2.ey####.com
- y3.ey####.com
- z8.c####.com
Запросы HTTP GET:
- 1####.w####.cname####.com/gx.php
- 1####.w####.cname####.com/xdysqgx.php
- 25####.com/?Agent=####
- 25####.com/Wap/Register?Agent=####
- 25####.com/cl/tpl/MobileNew/Skins/common/css/ionic.css
- 25####.com/cl/tpl/MobileNew/Skins/common/css/style.css
- 25####.com/cl/tpl/MobileNew/Skins/common/images/check-ok.png
- 25####.com/cl/tpl/MobileNew/Skins/common/js/common.js
- 25####.com/cl/tpl/MobileNew/Skins/common/js/ionic.bundle.js
- 25####.com/cl/tpl/MobileNew/Skins/common/js/jquery.js
- 25####.com/cl/tpl/MobileNew/Skins/common/js/zhuce.js
- 25####.com/cl/tpl/MobileNew/Skins/red/style.css
- 25####.com/cl/tpl/MobileNew/layer_mobile/layer.js
- 25####.com/cl/tpl/MobileNew/layer_mobile/need/layer.css
- 25####.com/cl/tpl/MobileNew/layer_mobile/need/layer.css?2####
- 25####.com/cl/tpl/VipCenter/common/js/jquery-1.8.3.min.js
- 25####.com/favicon.ico
- api.s####.b####.com/s.gif?l=####
- cdn####.gs.a.####.com/kis/fengmian/1211/1211981/1211981_ver_big_20170519...
- cdn####.gs.a.####.com/kis/fengmian/1213/1213405/1213405_ver_big_20170831...
- gdv.a.s####.com/api/2/config/get/cyss0qF25?callback=####
- gdv.a.s####.com/api/2/topic/comments?callback=####&client_id=####&page_s...
- gdv.a.s####.com/api/2/user/info?callback=####&client_id=####&login_termi...
- gdv.a.s####.com/api/3/topic/liteload?callback=jQuery17020009995088912547...
- gdv.a.s####.com/api/3/topic/liteload?callback=jQuery1708236993835307658_...
- gdv.a.s####.com/debug/cookie?callback=####
- gdv.a.s####.com/debug/cookie?callback=####&_=####
- gdv.a.s####.com/debug/cookie?callback=####&setCook####&_=####
- gdv.a.s####.com/debug/cookie?setCook####&callback=####&Fri Aug####
- gdv.a.s####.com/stat/event?clientid=####&uuid=####&topicId=####&type=####
- gdv.a.s####.com/stat/uvstat?callback=####&client_id=####&uuid=####&platf...
- gdv.a.s####.com/upload/version-v3.js?1533944####
- gs.a.s####.com//mdevp/extensions/longloop/002/longloop.js?_=####
- gs.a.s####.com/mdevp/extensions/mobile-cmt-advert/013/mobile-cmt-advert.js
- gs.a.s####.com/mdevp/extensions/mobile-cmt-box/051/mobile-cmt-box.js
- gs.a.s####.com/mdevp/extensions/mobile-cmt-float-bar/024/mobile-cmt-floa...
- gs.a.s####.com/mdevp/extensions/mobile-cmt-header/047/mobile-cmt-header.js
- gs.a.s####.com/mdevp/extensions/mobile-cmt-list/065/mobile-cmt-list.js
- gs.a.s####.com/mdevp/extensions/mobile-enter/043/mobile-enter.js
- gs.a.s####.com/mdevp/extensions/mobile-icp-tips/018/mobile-icp-tips.js
- gs.a.s####.com/mdevp/extensions/mobile-login-box/021/mobile-login-box.js
- gs.a.s####.com/mdevp/extensions/mobile-skin/025/mobile-skin.js
- gs.a.s####.com/mdevp/extensions/mobile-task/015/mobile-task.js
- gs.a.s####.com/mdevp/extensions/mobile-user-center/046/mobile-user-cente...
- gs.a.s####.com/v3/v20180807932/src/adapter.min.js
- gs.a.s####.com/v3/v20180807932/src/start.min.js
- i####.doub####.com/view/movie_poster_cover/lpst/public/p2388802662.jpg
- i####.doub####.com/view/movie_poster_cover/lpst/public/p2440731686.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2510687913.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2517726751.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2519070834.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2519696600.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2520805931.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2521648155.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2523437806.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2526297221.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2527484082.jpg
- i####.doub####.com/view/photo/s_ratio_poster/public/p2529497043.jpg
- img.wu####.cn/webyy/scripts/swfobject.js
- img.zxzi####.com/images/upload/vod/2018-06-07/201806071528371641.jpg
- img1-do####.b0.a####.com/view/photo/s_ratio_poster/public/p2514692888.jpg
- img1-do####.b0.a####.com/view/photo/s_ratio_poster/public/p2523632248.jpg
- img1-do####.b0.a####.com/view/photo/s_ratio_poster/public/p2524347579.jpg
- img1-do####.b0.a####.com/view/photo/s_ratio_poster/public/p2529206747.jpg
- js.pass####.qih####.com/11.0.1.js?879ff4f####
- js.q####.com/dagg/images/slider-arrow.png
- js.q####.com/dagg/js/jquery.SuperSlide.2.1.1.js
- m.ta####.com/?sprefer=####
- m.y####.cc/
- m.y####.cc/?m=####
- m.y####.cc/favicon.ico
- m.y####.cc/inc/ajax.php?ac=####&tab=####&id=####
- m.y####.cc/inc/timming.php?t=####
- m.y####.cc/js/jquery.js
- m.y####.cc/template/sj/ads/shoujineiye1.js
- m.y####.cc/template/sj/ads/shoujineiye2.js
- m.y####.cc/template/sj/ads/shoujineiye3.js
- m.y####.cc/template/sj/ads/shoujineiye4.js
- m.y####.cc/template/sj/ads/shoujineiyepiaofu.js
- m.y####.cc/template/sj/css/CSS3style.css
- m.y####.cc/template/sj/css/download.css
- m.y####.cc/template/sj/css/style.css
- m.y####.cc/template/sj/images/duomi-bg.png
- m.y####.cc/template/sj/images/load.gif
- m.y####.cc/template/sj/images/logo.png
- m.y####.cc/template/sj/images/p.png
- m.y####.cc/template/sj/js/common.js
- m.y####.cc/template/sj/js/function.js
- m.y####.cc/template/sj/js/home.js
- m.y####.cc/template/sj/js/jquery-1.4.4.min.js
- m.y####.cc/template/sj/js/jquery.lazyload.js
- m.y####.cc/template/sj/js/jquery.superslide.js
- m.y####.cc/template/sj/js/push.js
- m.y####.cc/template/sj/js/topinfo.js
- m.y####.cc/template/sj/js/video.js
- m.y####.cc/template/sj/xl/anew.js
- m.y####.cc/template/sj/xl/thunderbatch.js
- m.y####.cc/template/sj/xl/webthunderdetect.js
- photoc####.gs.a.####.com/img/kis/fengmian/1208/1208824/1208824_ver_big_2...
- photoc####.gs.a.####.com/img/kis/fengmian/1213/1213647/1213647_ver_big_2...
- photoc####.gs.a.####.com/img/kis/fengmian/1215/1215172/1215172_ver_big_2...
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?l=####
- s####.jom####.com/s.gif?r=http://m.yy92.cc/&l=/m.yy92.cc/?m=####
- s.3####.cn/so/zz.gif?url=####&sid=####&token=####
- s.3####.cn/so/zz.gif?url=http://m.yy92.cc/?m=####&sid=####&token=####
- s5.q####.com/static/ab77b6ea7f3fbf79.js
- t####.cn/RgAr5FF
- tu####.tupi####.com/pic/upload/vod/2017-04-22/201704221492839023.jpg
- weib####.g####.sina####.com/large/006n7HgYgy1ftu9t1mxyaj31hc0b41kx.jpg
- weib####.g####.sina####.com/large/006n7HgYgy1ftu9t1un8wj31hc0b4kbs.jpg
- weib####.g####.sina####.com/large/006n7HgYgy1ftu9t25xuej31hc0b4kib.jpg
- weib####.g####.sina####.com/large/006n7HgYly1ftu9vejtjzj31hc0b4qr1.jpg
- www.ta####.com/
- www.y####.cc/aqy.php?pic=####
- www.y####.cc/webyy.htm
Запросы HTTP POST:
- l####.tbs.qq.com/ajax?c=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/001.jar
- /data/data/####/356507059351895yd.db-journal
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/WebpageIcons.db-journal
- /data/data/####/aypa0000.xml
- /data/data/####/ayqa0000.xml
- /data/data/####/ayqb0000.xml
- /data/data/####/core_info
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/index
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yysa.xml
- /data/data/####/yysa356507059351895.xml
- /data/data/####/yysb356507059351895.xml
- /data/data/####/yysc356507059351895.xml
Другие:
Запускает следующие shell-скрипты:
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- cstrw3450ypguiljkcgdue564
Использует следующие алгоритмы для шифрования данных:
- RSA-ECB-NoPadding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
