Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.414.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) ff.t####.com.####.com:80
- TCP(HTTP/1.1) 1####.200.221.131:8080
- TCP(HTTP/1.1) m.1####.com:80
- TCP(HTTP/1.1) va####.c####.qini####.com:80
- TCP(HTTP/1.1) f.you####.com:80
- TCP(HTTP/1.1) idu####.qini####.com:80
- TCP(HTTP/1.1) dc.1####.com:80
- TCP(HTTP/1.1) b####.ti####.cn:80
- TCP(HTTP/1.1) www.1####.com:80
- TCP(HTTP/1.1) ers.b####.com:80
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP i3.jiz####.com:7702
- TCP i1.jiz####.com:7701
- TCP i3.jiz####.com:7703
Запросы DNS:
- b####.ti####.cn
- dc.1####.com
- ers.b####.com
- f.you####.com
- ff.t####.com
- hm.b####.com
- i####.1####.com
- i####.a####.com
- i####.a####.com
- i####.a####.com
- i1.jiz####.com
- i2.jiz####.com
- i3.jiz####.com
- lds.1####.com
- m.1####.com
- mt####.go####.com
- my.1####.com
- neta####.g####.gov.cn
- reso####.a####.com
- ser####.1####.com
- www.1####.com
Запросы HTTP GET:
- 1####.200.221.131:8080/spotService/a.jsp?k=####
- b####.ti####.cn/blog/error.jsp?msgid=####
- b####.ti####.cn/post-7357599-119201902-1.shtml
- dc.1####.com/bd?is_opencookie=####&refer=####&sessionid=####&COOKIE_ID=#...
- dc.1####.com/bd?sessionid=####&COOKIE_ID=####&page_on_time=####&duoduoId...
- dc.1####.com/js/dc.js
- ers.b####.com/app/s.js?siteId=####&goTop=####
- f.you####.com/cdn?id=####
- ff.t####.com.####.com/d/44z7.jpg
- idu####.qini####.com/mobile/temp/hotRecommendTotalCount.js
- m.1####.com/lds/
- m.1####.com/lds/temp/hotRecommendTotalCount.js
- ti####.c####.l####.####.com/upload/articleResource/20160615/146597370435...
- ti####.c####.l####.####.com/upload/articleResource/20160706/146779607117...
- ti####.c####.l####.####.com/upload/articleResource/20160706/146779637218...
- ti####.c####.l####.####.com/upload/articleResource/20160706/146779637559...
- va####.c####.qini####.com/upload/articleResource/20170622/1498132249843....
- www.1####.com/baitianhome/resource/image/base_alertbg.png
- www.1####.com/baitianhome/resource/image/logobtm.png
- www.1####.com/dynamic/qq/getImg?src=####&size=####
- www.1####.com/lds/
- www.1####.com/lds/version2/script/common.js?v=####
- www.1####.com/lds/version2/script/jRunner.js
- www.1####.com/lds/version2/script/sidebar.js?v=####
- www.1####.com/lds/version2/style//data.css?v=####
- www.1####.com/lds/version2/style//gamelinks.css
- www.1####.com/lds/version2/style//img_d/items_d.png?v=####
- www.1####.com/lds/version2/style//img_d/items_s.png?v=####
- www.1####.com/lds/version2/style//img_s/bg.jpg
- www.1####.com/lds/version2/style//img_s/bgindex.jpg?2016####
- www.1####.com/lds/version2/style//img_s/fs.jpg
- www.1####.com/lds/version2/style//img_s/gamelinkbtn1.png
- www.1####.com/lds/version2/style//img_s/icon.png
- www.1####.com/lds/version2/style//img_s/mj.jpg
- www.1####.com/lds/version2/style//img_s/sq.jpg
- www.1####.com/lds/version2/style//img_s/tz.jpg
- www.1####.com/lds/version2/style//img_s/zh.jpg
- www.1####.com/lds/version2/style//img_s/zs.jpg
- www.1####.com/lds/version2/style//index.css?v=####
- www.1####.com/lds/version2/style/common.css?v=####
- www.1####.com/lds/version2/style/img_d/items_d.png?v=####
- www.1####.com/lds/version2/style/img_d/items_s.png?v=####
- www.1####.com/lds/version2/style/img_d/nav.png
- www.1####.com/lds/version2/style/img_d/png8_btn.png
- www.1####.com/lds/version2/style/img_s/bg.jpg
- www.1####.com/lds/version2/style/img_s/bottombg.jpg
- www.1####.com/lds/version2/style/img_s/lds.png
- www.1####.com/m/common/common.css
- www.1####.com/m/lds/script//index.js
- www.1####.com/m/lds/script/common.js?2015####
- www.1####.com/m/lds/script/jRunner.js
- www.1####.com/m/lds/style/common.css?2015####
- www.1####.com/m/lds/style/img_d/bottom.png
- www.1####.com/m/lds/style/img_d/ctrBtn.png
- www.1####.com/m/lds/style/img_d/idxTitle.png
- www.1####.com/m/lds/style/img_d/moreBtn.png
- www.1####.com/m/lds/style/img_s/1.jpg
- www.1####.com/m/lds/style/img_s/2.jpg
- www.1####.com/m/lds/style/img_s/3.jpg
- www.1####.com/m/lds/style/img_s/4.jpg
- www.1####.com/m/lds/style/img_s/5.jpg
- www.1####.com/m/lds/style/img_s/adBg.png
- www.1####.com/m/lds/style/img_s/bg.jpg
- www.1####.com/m/lds/style/img_s/bigcw.png
- www.1####.com/m/lds/style/img_s/moreCW.png
- www.1####.com/m/lds/style/img_s/smallcw.png
- www.1####.com/m/lds/style/img_s/title1.png
- www.1####.com/m/lds/style/img_s/topBg.jpg
- www.1####.com/m/lds/style/index.css?2015####
- www.1####.com/manhua/
- www.1####.com/marketnew/common/dest/widget/qqlogin/qqlogin.css
- www.1####.com/marketnew/common/dest/widget/qqlogin/qqlogin.js
- www.1####.com/qq/style/img_s/headframe/5.png
- www.1####.com/resource/404/404.html
- www.1####.com/resource/404/style/css.css
- www.1####.com/resource/404/style/img_d/sp.png
- www.1####.com/resource/404/style/img_s/bg.jpg
- www.1####.com/resource/css/common/commonfoot.css
- www.1####.com/resource/image/a.gif
- www.1####.com/resource/image/b.gif
- www.1####.com/resource/image/c.gif
- www.1####.com/resource/image/commonad/commonad.js?v=####
- www.1####.com/resource/image/commonad/css.css?v=####
- www.1####.com/resource/image/commonad/lds.png
- www.1####.com/resource/js/btst/main.js?43####
- www.1####.com/resource/js/lib/bdStatistic.js
- www.1####.com/resource/js/lib/jquery-mig-min.js
- www.1####.com/resource/js/nav/commonNav.css
- www.1####.com/resource/js/nav/in-dev.js
- www.1####.com/resource/js/nav/in-min.js
- www.1####.com/resource/js/nav/navImgs/gamelist_bg2.jpg
- www.1####.com/resource/js/nav/navImgs/navbg.png
- www.1####.com/resource/js/nav/navImgs/navsp.png
- www.1####.com/resource/js/nav/navImgs/top_bar.png
- www.1####.com/resource/js/plugins/npopnew/npop/npop-dev.js?2014####
- www.1####.com/resource/js/plugins/npopnew/npop/npop-dev.js?201509####
- www.1####.com/resource/js/util/newcommon/common.js
- www.1####.com/resource/js/util/newcommon/common.js?lo####
- www.1####.com/resource/js/util/newcommon/commonpop.js?2013####
- www.1####.com/resource/js/util/newcommon/injectBusiness.js
- www.1####.com/resource/js/util/newcommon/login.js
- www.1####.com/resource/js/util/newcommon/login.js?l####
- www.1####.com/resource/js/util/newcommon/style/login.css?l####
- www.1####.com/resource/js/util/newcommon/ui_navigation.js?l####
- www.1####.com/resource/js/util/newcommon/ui_popuplogin.js?lo####
- www.1####.com/resource/js/util/newcommon/ui_popuploginHTML.js?201706####
- www.1####.com/resource/js/util/newcommon/util.js
- www.1####.com/resource/js/util/newcommon/util.js?l####
- www.1####.com/resource/style/css.css
- www.1####.com/resource/zl/index_images/zl_btlogo.png
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/01569421200619.jar
- /data/data/####/1000.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/a1.db-journal
- /data/data/####/a1.xml
- /data/data/####/a1356507059351895.xml
- /data/data/####/b1356507059351895.xml
- /data/data/####/c1356507059351895.xml
- /data/data/####/d1356507059351895.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f1356507059351895.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/44z7.jpg.data
Другие:
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
