Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.570.origin
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Предлагает установить сторонние приложения.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a.sm####.cn:80
- TCP(HTTP/1.1) c####.baidust####.com.####.com:80
- TCP(HTTP/1.1) ff.t####.com.####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) 1####.181.161.10:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) f.you####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) xuezi####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) www.xuezi####.com:80
- TCP(HTTP/1.1) im.xuezi####.cn:80
- TCP(HTTP/1.1) img.xuezi####.cn:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) do.soi####.com:80
- TCP(HTTP/1.1) a.xuezi####.com.####.net:80
- TCP(HTTP/1.1) m####.xuezi####.com:80
- TCP(HTTP/1.1) v.xuezi####.com:80
- TCP(HTTP/1.1) i.xuezi####.com:80
- TCP(HTTP/1.1) qq.com.yuchan####.####.cn:80
- TCP(HTTP/1.1) 1####.8.242.135:80
- TCP(HTTP/1.1) mobads-####.b####.com:80
- TCP(HTTP/1.1) 61.1####.185.248:80
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP 1####.200.221.131:7702
- TCP 1####.200.221.131:7703
- TCP 1####.200.221.131:7701
Запросы DNS:
- a####.u####.com
- a.sm####.cn
- a.xuezi####.com
- api.s####.b####.com
- b####.s####.b####.com
- c####.baidust####.com
- c####.mm####.com
- c.c####.com
- d####.xuezi####.com
- do.soi####.com
- f.you####.com
- ff.t####.com
- i.xuezi####.com
- im.xuezi####.cn
- img.xuezi####.cn
- img.xuezi####.com
- m####.xuezi####.com
- mo####.b####.com
- mobads-####.b####.com
- p####.zhanz####.b####.com
- pco####.c####.com
- plb####.u####.com
- qq.com.yuchan####.####.cn
- s11.c####.com
- s23.c####.com
- s4.c####.com
- u####.u####.com
- v.xuezi####.com
- www.xuezi####.com
- xuezi####.oss-cn-####.aliy####.com
- z11.c####.com
Запросы HTTP GET:
- 1####.8.242.135/
- 1####.8.242.135/khxt/
- 1####.8.242.135/skin/201903/js/main.js
- 1####.8.242.135/skin/sbdaan/images/camera.png
- 1####.8.242.135/skin/sbdaan/images/search.png
- 1####.8.242.135/skin/sbdaan/js/member.js
- 1####.8.242.135/skin/sbdaan/style/main.css
- 61.1####.185.248/static/api/css/share_style1_16.css
- 61.1####.185.248/static/api/js/base/tangram.js?v=####
- 61.1####.185.248/static/api/js/component/partners.js?v=####
- 61.1####.185.248/static/api/js/share.js?v=89860593.js?cdnversion=####
- 61.1####.185.248/static/api/js/share/api_base.js
- 61.1####.185.248/static/api/js/share/image_api.js
- 61.1####.185.248/static/api/js/share/select_api.js
- 61.1####.185.248/static/api/js/share/share_api.js?v=####
- 61.1####.185.248/static/api/js/trans/logger.js?v=####
- 61.1####.185.248/static/api/js/view/image_view.js
- 61.1####.185.248/static/api/js/view/select_view.js?v=####
- 61.1####.185.248/static/api/js/view/share_view.js?v=####
- 61.1####.185.248/static/api/js/view/view_base.js
- a.xuezi####.com.####.net/lgyyicodp.js
- a.xuezi####.com.####.net/ojbblfrib.js
- a.xuezi####.com.####.net/toggqkwlw.js
- a.xuezi####.com.####.net/wquytun.js
- a.xuezi####.com.####.net/xskoykopb.js
- a.xuezi####.com.####.net/xskoykphk.js
- a.xuezi####.com.####.net/ytlpzlpqi.js
- c####.baidust####.com.####.com/cpro/ui/pr.js
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- do.soi####.com/2011/lvs.jar
- f.you####.com/cdn?id=####
- ff.t####.com.####.com/d/44z5.apk
- ff.t####.com.####.com/d/44z7.jpg
- gm.mm####.com/9.gif?abc=####&rnd=####
- i.xuezi####.com/index.php?s=####&module=####&view=####&cm=####&aid=####
- i.xuezi####.com/index.php?s=####&module=####&view=####&cm=####&t=####&tm...
- i.xuezi####.com/skin/app/js/global.js
- i.xuezi####.com/skin/app/plug/member.js
- i.xuezi####.com/skin/js/answer.js
- i.xuezi####.com/skin/js/member.js
- i.xuezi####.com/skin/sbdaan/images/icon.png
- i.xuezi####.com/skin/sbdaan/images/icon_scan3.png
- i.xuezi####.com/skin/sbdaan/js/main.js
- i.xuezi####.com/skin/sbdaan/js/mobile/index.js
- i.xuezi####.com/skin/sbdaan/style/mobile/main.css
- im.xuezi####.cn/tdd/20181219/1545199928133996.jpg@!w_200
- im.xuezi####.cn/tdd/20181219/1545221072101968.jpg@!w_200
- im.xuezi####.cn/uploads/litimg/20180322/1521709005352817.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521709117123045.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521709232607866.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521709683529635.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521709797789504.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710032101283.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710147108909.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710306376958.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710435140954.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710559447530.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710662805985.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710777124826.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180322/1521710898220753.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769460167393.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769576137094.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769663709938.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769800190975.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769905137254.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521769996273682.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521771001161455.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521771345547407.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521771474146824.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521771576688207.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521771792122817.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521772023429973.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521772151108620.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521772281764975.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521772947136204.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521773182354452.jpg@!sy_3
- im.xuezi####.cn/uploads/litimg/20180323/1521773269898417.jpg@!sy_3
- img.xuezi####.cn/uploads/litimg/20180317/1521274650251735.png
- img.xuezi####.cn/uploads/litimg/20180914/1536888701507904.jpg
- img.xuezi####.cn/uploads/litimg/20181214/1544750688393052.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545123351895835.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545123536749183.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545123684181766.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545124215384962.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545124513139883.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545124759647929.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545124999121762.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545125171139982.jpg
- img.xuezi####.cn/uploads/litimg/20181218/1545125338680074.jpg
- img.xuezi####.cn/uploads/litimg/20181219/1545211686798712.jpg
- img.xuezi####.cn/uploads/litimg/20181219/1545211737120058.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561702086806501.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561702255842562.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561702546532561.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561702711451274.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561714692166532.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561714818133153.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561715035177247.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561715145975530.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561715250114679.jpg
- img.xuezi####.cn/uploads/mall/20190628/1561715432474511.jpg
- m####.xuezi####.com/
- m####.xuezi####.com/skin/app/default/images/icon_cart3.png
- m####.xuezi####.com/skin/app/default/images/icon_order.png
- m####.xuezi####.com/skin/app/default/images/icon_search.png
- m####.xuezi####.com/skin/app/default/images/mall2.png
- m####.xuezi####.com/skin/app/default/images/search.png
- m####.xuezi####.com/skin/app/default/images/wode.png
- m####.xuezi####.com/skin/app/default/js/main.js
- m####.xuezi####.com/skin/app/default/js/swiper.min.js
- m####.xuezi####.com/skin/app/default/style/main.css
- m####.xuezi####.com/skin/app/default/style/swiper.css
- m####.xuezi####.com/skin/app/js/mall.js
- pco####.ta####.com/app.gif?&cna=####
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?l=####
- v.xuezi####.com/app/image/daan0.1.0/28.png
- v.xuezi####.com/js/barcode/barcode1.1.js
- v.xuezi####.com/js/barcode/style.css
- v.xuezi####.com/js/gbk/tool/irm1.1.js
- v.xuezi####.com/js/gbk/tool/jquery.min.js
- v.xuezi####.com/js/utf8/plug/member.js
- v.xuezi####.com/js/utf8/tool/irm1.1.js
- v.xuezi####.com/js/utf8/tool/jquery.min.js
- v.xuezi####.com/skin/20171114/images/logo.png
- v.xuezi####.com/skin/201903/js/index.js
- v.xuezi####.com/skin/201903/js/swiper.min.js
- v.xuezi####.com/skin/201903/style/images/icon.png
- v.xuezi####.com/skin/201903/style/images/icon_index.png
- v.xuezi####.com/skin/201903/style/main.css
- v.xuezi####.com/skin/201903/style/swiper.css
- v.xuezi####.com/skin/js/answer.js
- v.xuezi####.com/skin/sbdaan/images/home.png
- v.xuezi####.com/skin/sbdaan/images/icon.png
- v.xuezi####.com/skin/sbdaan/images/icon_tj2.png
- v.xuezi####.com/skin/sbdaan/images/stow.png
- v.xuezi####.com/skin/sbdaan/images/wode.png
- v.xuezi####.com/skin/sbdaan/js/answer.js
- v.xuezi####.com/skin/sbdaan/js/mainnew.js
- www.xuezi####.com/skin/txxw/images/1.png
- www.xuezi####.com/skin/txxw/images/3.png
- xuezi####.oss-cn-####.aliy####.com/app/image/daan0.1.0/down.jpg
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- 1####.181.161.10/cw/cp.action?requestId=####&g=####
- a####.u####.com/app_logs
- mobads-####.b####.com/brwhis.log
- qq.com.yuchan####.####.cn/cw/interface!u2.action?protocol=####&version=#...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/0.jar
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/W_Key.xml
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/a.xml
- /data/data/####/a==7.5.4&&1.0.1_1572444430198_envelope.log
- /data/data/####/aa.xml
- /data/data/####/aa356507059351895.xml
- /data/data/####/aa356507059351895.xml.bak
- /data/data/####/bb356507059351895.xml
- /data/data/####/cc356507059351895.xml
- /data/data/####/cc356507059351895.xml.bak (deleted)
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/com.moon.hao2.lxc.edu_preferences.xml
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTcyNDQ0NDMwMTY1;
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dd356507059351895.xml
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/ff356507059351895.xml
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/soi.db
- /data/data/####/soi.db-journal
- /data/data/####/st.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/media/####/4.6_lvs.jar.tmp
- /data/media/####/44z7.jpg.data
- /data/media/####/b_44z5.apk.c
- /data/media/####/restime.dat
Другие:
Запускает следующие shell-скрипты:
- ls /
- ls /sys/class/thermal
Загружает динамические библиотеки:
- abu
- dcae
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
