Техническая информация
Вредоносные функции:
Загружает из Интернета следующие детектируемые угрозы:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p1.070####.com:80
- TCP(HTTP/1.1) l####.le####.cn:80
- TCP(HTTP/1.1) 42.2####.73.142:80
- TCP(HTTP/1.1) f####.070####.com:80
- TCP(HTTP/1.1) d1jy####.jiuya####.com:81
Запросы DNS:
- app.jiuya####.com
- d1jy####.jiuya####.com
- down####.jiuya####.com
- f####.070####.com
- mt####.go####.com
- p1.070####.com
- z####.le####.cn
Запросы HTTP GET:
- 42.2####.73.142/Wgq/Tpl/Public/css/base.css
- 42.2####.73.142/Wgq/Tpl/Public/css/style.css?t=####
- 42.2####.73.142/Wgq/Tpl/Public/css/swiper.min.css
- 42.2####.73.142/Wgq/Tpl/Public/images/lhhtc.png?t=####
- 42.2####.73.142/Wgq/Tpl/Public/images/tiyan-img.png
- 42.2####.73.142/Wgq/Tpl/Public/js/jquery-1.9.1.min.js
- 42.2####.73.142/Wgq/Tpl/Public/js/jquery.cookie.js
- 42.2####.73.142/Wgq/Tpl/Public/js/main.js?t=####
- 42.2####.73.142/Wgq/Tpl/Public/js/swiper.min.js
- 42.2####.73.142/index.php/Index/index/gameid/829?from=####&tgid=####&ask...
- d1jy####.jiuya####.com:81/_c/products/jy/v81000/3rongyao_chc0101000.apk
- d1jy####.jiuya####.com:81/down.php?p=L3Byb####&tgid=####&isdownmb=####
- f####.070####.com/?tgid=####&appid=####
- f####.070####.com/Wpage/Tpl/Public/hi01_m/css/style.css
- f####.070####.com/Wpage/Tpl/Public/hi01_m/css/style.css?t=####
- f####.070####.com/Wpage/Tpl/Public/hi01_m/css/swiper.min.css
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/banner01_new.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/button01.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/button02.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/i-bj.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/img05.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/mengb-an.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/title01.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/images/title02.png
- f####.070####.com/Wpage/Tpl/Public/hi01_m/js/jquery-1.9.1.min.js
- f####.070####.com/Wpage/Tpl/Public/hi01_m/js/jquery-1.9.1.min.js?v=####
- f####.070####.com/Wpage/Tpl/Public/hi01_m/js/swiper.min.js
- f####.070####.com/Wpage/Tpl/Public/hi01_m/js/swiper.min.js?v=####
- f####.070####.com/index.php/Ddsy?isload=####&tgid=####
- f####.070####.com/index.php/Index/down/?appid=####&tgid=####&type=####
- f####.070####.com/index.php/index/aboutus?page=####
- l####.le####.cn/?tgid=####
- p1.070####.com/2016/08/01/579ebf924ae9b.png
- p1.070####.com/2016/08/01/579ec17e745df.jpg
- p1.070####.com/2016/08/01/579ec1878daf3.jpg
- p1.070####.com/2016/08/01/579ec19436031.jpg
- p1.070####.com/2016/08/01/579ec19a003f8.jpg
- p1.070####.com/2016/08/01/579ec19f97b40.jpg
- p1.070####.com/2016/08/01/579ec1cd8d501.png
- p1.070####.com/2016/08/01/579ec1deb7158.png
- p1.070####.com/2016/08/01/579ec1ee4f9ba.png
- p1.070####.com/2016/08/01/579ec1f65c16d.png
- p1.070####.com/2016/08/01/579ec2071cc34.png
- p1.070####.com/2016/08/12/57ad6787efd1f.jpg
- p1.070####.com/2016/08/12/57ad67a928aaf.jpg
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/3rongyao_chc0101000.apk
Другие:
Отрисовывает собственные окна поверх других приложений.
