Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
- Android.DownLoader.675.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ff.t####.com.####.com:80
- TCP(HTTP/1.1) ssl.ss####.cn:80
- TCP(HTTP/1.1) opencdn####.jom####.com:80
- TCP(HTTP/1.1) ssls####.jom####.com:80
- TCP(HTTP/1.1) box.jom####.com:80
- TCP(HTTP/1.1) rt####.pae.b####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) www.think####.cn:80
- TCP(HTTP/1.1) sv.bdst####.com.####.com:80
- TCP(HTTP/1.1) f.you####.com:80
- TCP(HTTP/1.1) na.ac.upqian####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP s1.u####.com:7701
- TCP s1.u####.com:7702
- TCP s1.u####.com:7703
Запросы DNS:
- an.ca.15####.cn
- dup.baidust####.com
- f.you####.com
- ff.t####.com
- g####.bdst####.com
- g0.b####.com
- m####.b####.com
- m.b####.com
- na.ac.upqian####.com
- pos.b####.com
- rt####.pae.b####.com
- s.bdst####.com
- s1.u####.com
- s2.u####.com
- s3.u####.com
- ss####.cn
- ssl.ss####.cn
- sv.bdst####.com
- v####.pae.b####.com
- www.think####.cn
- xiongz####.b####.com
Запросы HTTP GET:
- box.jom####.com/common/openjs/openBox.js?_v=####
- f.you####.com/cdn?id=####
- ff.t####.com.####.com/d/44z7.jpg
- ff.t####.com.####.com/d/451c.jpg
- ff.t####.com.####.com/d/451k.jpg
- opencdn####.jom####.com/mms/graph/static/resource/sdk/v1.11.14/mms-wise.js
- pos.b####.com/ccem?psi=&di=u3637425&dri=0&dis=0&dai=1&ps=0x0&enu=encodin...
- rt####.pae.b####.com/api/comment/thumblist?comment_id=####&cb=####
- rt####.pae.b####.com/data/recommendvideo?srcid=####&word=####&pn=####&si...
- ssl.ss####.cn/ssllq/ok121realweather.jsp?cid=####
- ssls####.jom####.com/5foUcz3n1MgCo2Kml5_Y_D3/graph/static/resource/sdk/m...
- sv.bdst####.com.####.com/static/growthbox/rmbgrowthbox.js
- wap.n.sh####.com/rec?platform=####&ms=####&lsAble=####&rset=####&word=##...
- wap.n.sh####.com/s?word=####
- wap.n.sh####.com/se/static/ala_atom/app/realtime/bundle_32d0764.js
- wap.n.sh####.com/se/static/ala_atom/app/recommend_list/bundle_2652849.js
- wap.n.sh####.com/se/static/ala_atom/app/rel_ugc/bundle_788e415.js
- wap.n.sh####.com/se/static/ala_atom/app/vid_hor/bundle_f470319.js
- wap.n.sh####.com/se/static/ala_atom/app/www_normal/bundle_7ad200c.js
- wap.n.sh####.com/se/static/amd_modules/@baidu/better-scroll_1fb0c24.js
- wap.n.sh####.com/se/static/amd_modules/@baidu/fusion-components/dist/b-p...
- wap.n.sh####.com/se/static/amd_modules/@baidu/fusion-components/dist/b-s...
- wap.n.sh####.com/se/static/amd_modules/@baidu/fusion-components/dist/b-t...
- wap.n.sh####.com/se/static/amd_modules/@baidu/fusion-components/dist/dep...
- wap.n.sh####.com/se/static/amd_modules/@baidu/invoke-box_7a867fc.js
- wap.n.sh####.com/se/static/amd_modules/@baidu/jssdk_a1fd01e.js
- wap.n.sh####.com/se/static/amd_modules/@baidu/login_9922967.js
- wap.n.sh####.com/se/static/amd_modules/@baidu/vsl/dist/vsl-atom-directiv...
- wap.n.sh####.com/se/static/amd_modules/@baidu/web-animations-js_f5bffd3.js
- wap.n.sh####.com/se/static/amd_modules/@searchfe/user-agent_4125833.js
- wap.n.sh####.com/se/static/atom/atom_9126189.js
- wap.n.sh####.com/se/static/atom/search-ui/v1.2.63/core_4576403.js
- wap.n.sh####.com/se/static/atom/search-ui/v1.2.63/enhance_e01a0d6.js
- wap.n.sh####.com/se/static/atom/search-ui/v1.2.65/core_288672b.js
- wap.n.sh####.com/se/static/atom/search-ui/v1.2.65/enhance_8c535f3.js
- wap.n.sh####.com/se/static/atom/search-ui/v2/Tombstone/ImgTombstone.css_...
- wap.n.sh####.com/se/static/atom/search-ui/v2/core_1f6c2e8.js
- wap.n.sh####.com/se/static/atom/search-ui/v2/enhance_116ae48.js
- wap.n.sh####.com/se/static/atom/search-ui/v2/few_236c201.js
- wap.n.sh####.com/se/static/font/pmd/cicon_d568818.ttf
- wap.n.sh####.com/se/static/js/base/ala/invokeApp_aa941bf.js
- wap.n.sh####.com/se/static/js/bundles/ala-util_1783b42.js
- wap.n.sh####.com/se/static/js/bundles/performance_3d792a5.js
- wap.n.sh####.com/se/static/js/bundles/player_10f8eb5.js
- wap.n.sh####.com/se/static/js/dep/fingerprint2.min_c6eb516.js
- wap.n.sh####.com/se/static/js/log/exp_db2b53e.js
- wap.n.sh####.com/se/static/js/log/taiji_behavior_84e8fa7.js
- wap.n.sh####.com/se/static/js/log/taiji_device_e2f4d3c.js
- wap.n.sh####.com/se/static/js/modules/advanced_filter/advanced_filter_a7...
- wap.n.sh####.com/se/static/js/modules/baiduappFixedButton_4edbe08.js
- wap.n.sh####.com/se/static/js/modules/device_data_dep/h5_support_info_4f...
- wap.n.sh####.com/se/static/js/modules/device_data_dep/murmur3_e901bf7.js
- wap.n.sh####.com/se/static/js/modules/device_data_dep/support_fonts_ac84...
- wap.n.sh####.com/se/static/js/modules/device_data_dep/zoom_info_abaf8bb.js
- wap.n.sh####.com/se/static/js/modules/doodle_a62dc29.js
- wap.n.sh####.com/se/static/js/modules/feedback/feedbackBtn_874cbb2.js
- wap.n.sh####.com/se/static/js/modules/historyRec_c91ebd6.js
- wap.n.sh####.com/se/static/js/modules/invoke/fnProvider_f7cfe6c.js
- wap.n.sh####.com/se/static/js/modules/invoke/recInvokeBox_8113988.js
- wap.n.sh####.com/se/static/js/modules/invoke/serverDataFactory_690a36e.js
- wap.n.sh####.com/se/static/js/modules/invoke/setInvokeCookie_839ea4d.js
- wap.n.sh####.com/se/static/js/modules/safariicon/safariicon_d1dec0d.js
- wap.n.sh####.com/se/static/js/modules/vsl/vslNewUtil_9b32cc9.js
- wap.n.sh####.com/se/static/js/modules/vsl/vslUtil_2dbd992.js
- wap.n.sh####.com/se/static/js/modules/zbiosCommunicate_b7e66e5.js
- wap.n.sh####.com/se/static/nextpage/m/scripts/amd_modules/@baidu/xzh-sdk...
- wap.n.sh####.com/se/static/nextpage/m/scripts/apm_config_e654666.js
- wap.n.sh####.com/se/static/nextpage/m/scripts/local-modules_25f0274.js
- wap.n.sh####.com/se/static/nextpage/m/scripts/packages_b4b293a.js
- wap.n.sh####.com/se/static/nextpage/p/app_components_se-video/video/scri...
- wap.n.sh####.com/se/static/nextpage/p/base/scripts/pack_3a785b8.js
- wap.n.sh####.com/se/static/nextpage/p/video_page/scripts/pack_4714f71.js
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/fusion-components/d...
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/get-app-info_452761...
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/invoker-app_24b09ab...
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/rpo-wise_628bd9a.js
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/union-h5-video_0d89...
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/union-video_de1559f...
- wap.n.sh####.com/se/static/sf/app/amd_modules/@baidu/view-image_3471a6f.js
- wap.n.sh####.com/se/static/sf/app/js/uiamd/bdbox/base_9d29def.js
- wap.n.sh####.com/se/static/sf/app/js/uiamd/bdbox/util_6b35279.js
- wap.n.sh####.com/se/static/wiseatom/feedback/pack_c003b83.js
- wap.n.sh####.com/se/static/wiseatom/pagenav/pack_9fa6b87.js
- wap.n.sh####.com/se/static/wiseatom/personalcenter/pack_bc18b69.js
- wap.n.sh####.com/se/static/wiseatom/relative/pack_5d54384.js
- wap.n.sh####.com/sf?pd=video_page&sign=584751738957714508&word=奔驰车主车顶维权&...
- wap.n.sh####.com/static/ecom/iphone_icons/iconfont_f0823fb.ttf
- wap.n.sh####.com/static/ecom/js/wise/search_tab/ck_24815f4.js
- wap.n.sh####.com/static/ecom/js/wise/search_tab/fc_base_ab405a5.js
- wap.n.sh####.com/static/ecom/js/wise/search_tab/init_fb1b413.js
- wap.n.sh####.com/static/ecom/js/wise/search_tab/styles/tuiguang_4d6da13.js
- wap.n.sh####.com/static/ecom/js/wise/search_tab/variables_5cef5fb.js
- wap.n.sh####.com/static/searchbox/openjs/share.js?v=####
- wap.n.sh####.com/sugrec?callback=####&type=####&ishome=####&prod=####&fr...
- www.think####.cn/weather/weather.aspx?uid=####&cid=####&l=####&p=####&a=...
Запросы HTTP POST:
- na.ac.upqian####.com/_c/i.jsp
- ssl.ss####.cn/ssllq/ok121a2.jsp
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1556616548821si.jar
- /data/data/####/1556616549673si.jar
- /data/data/####/_acosscwapz.xml
- /data/data/####/_cocosscwapr.xml
- /data/data/####/com.qsair.sscwap_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/fsscwap.jar
- /data/data/####/index
- /data/data/####/po_download.db-journal
- /data/data/####/sscwapoc.jar
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/wt.db-journal
- /data/data/####/yoappInfo_pre.xml
- /data/data/####/yoconf_pre.xml
- /data/data/####/yoinfo_pre.xml
- /data/data/####/yotrategy_pre.xml
- /data/media/####/44z7.jpg.data
- /data/media/####/451c.jpg.data
- /data/media/####/451k.jpg.data
Другие:
Запускает следующие shell-скрипты:
- getprop ro.product.cpu.abi
Использует следующие алгоритмы для шифрования данных:
- DES
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
