Техническая информация
Вредоносные функции:
Загружает из Интернета следующие детектируемые угрозы:
- Android.RemoteCode.8274
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p####.q####.c####.####.net:80
- TCP(HTTP/1.1) tb.s####.org:80
- TCP(HTTP/1.1) dx.s####.org:99
- TCP(HTTP/1.1) err.s####.org.####.com:80
- TCP(HTTP/1.1) iqiy####.com.edges####.net:80
- TCP(HTTP/1.1) www.s####.org:80
- TCP(HTTP/1.1) www.12####.com:80
- TCP(HTTP/1.1) m.y####.com:80
- TCP(TLS/1.0) 64.2####.162.113:443
- TCP(TLS/1.0) iqiy####.com.edges####.net:443
- TCP(TLS/1.0) img.bfz####.com:443
- TCP(TLS/1.0) vip.kuaikan####.com:443
- TCP(TLS/1.0) p####.q####.c####.####.net:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) 3fam####.svi####.cn:443
- TCP(TLS/1.0) i0.h####.com:443
- TCP(TLS/1.0) pic.rmb.bdst####.####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 64.2####.164.113:443
- UDP 64.2####.162.113:443
Запросы DNS:
- cm####.moe.sb
- dx.s####.org
- err.s####.org
- i0.h####.com
- img.bfz####.com
- m.y####.com
- p####.google####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.iqiy####.com
- p####.q####.cn
- pic.rmb.bdst####.com
- tb.s####.org
- vip.ffzy-p####.com
- vip.kuaikan####.com
- www.12####.com
- www.google####.com
- www.s####.org
Запросы HTTP GET:
- dx.s####.org:99//api.php/provide/vod/?time=####&ac=####&ids=####
- dx.s####.org:99/index.php/vod/show/id/38.html?fis####
- dx.s####.org:99/soft/videoloadin.gif
- dx.s####.org:99/悠享直播.apk
- err.s####.org.####.com/mgtv/cache/wwwroot/03d0ca07f29e24ebb53aeebb8aa745...
- err.s####.org.####.com/mgtv/cache/wwwroot/b5bc158bf33175b7d3d15a02d1bb7d...
- i0.h####.com:443/bfs/bangumi/image/93058565dd81e44c622f616ab0d9606509bf3...
- i0.h####.com:443/bfs/bangumi/image/c07f1e1c0108a20bea6fe41fd973bf93f2c2b...
- i0.h####.com:443/bfs/bangumi/image/d2a777b093bf14def1ad79f3111c12454825a...
- img.bfz####.com:443/upload/vod/20230424-26/5d12110513f0e31cc7b7903ed64a7...
- iqiy####.com.edges####.net/image/20190810/5c/39/v_116045248_m_601_m4_195...
- iqiy####.com.edges####.net/image/20210915/4b/97/v_148244294_m_601_m8_579...
- iqiy####.com.edges####.net:443/image/20140708/d8/50/v_107288850_m_601_26...
- iqiy####.com.edges####.net:443/image/20200908/cb/2d/v_50010398_m_601_m11...
- iqiy####.com.edges####.net:443/image/20211125/b0/85/v_162931657_m_601_m3...
- iqiy####.com.edges####.net:443/image/20220727/8b/fe/v_168443217_m_601_m2...
- m.y####.com/050E00005F78344D14187C07C9D2E234
- p####.q####.c####.####.net/vcover_vt_pic/0/mzc00200pqtcb9u1577440590/220
- p####.q####.c####.####.net:443/vcover_vt_pic/0/6xdld1aune0g04m1550560750/0
- pic.rmb.bdst####.####.com:443/bjh/723320a40cba30221e508071e0dac847.jpeg
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/HnVrGTTX.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/LE22CA0A.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/YfBTKWuh.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/bA5Y3Drd.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/dYA6DaMr.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/hb3nBOU5.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/khN67GUP.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/psMBHwtZ.ts
- vip.kuaikan####.com:443/20230406/ykDJaSJ6/hls/y5UVo6DA.ts
- www.12####.com/
- www.s####.org/xsd.apk
- www.s####.org/zb/boot.asp?act=####
Запросы HTTP POST:
- err.s####.org.####.com/mgtv/back.php?url=/v.####
- err.s####.org.####.com/mgtv/hnzy.php?url=####
- tb.s####.org/api.php?app=####&act=####
- tb.s####.org/app/tvapi/api.php
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.x (deleted)
- /data/data/####/20f1a70f63924c73a9acb38a2bfe6ee3
- /data/data/####/20f1a70f63924c73a9acb38a2bfe6ee3.ts
- /data/data/####/3578c686a95fc782c0b846d29eec4ab1.m3u8
- /data/data/####/6c29a8184f93cc07f3f9c5c852db2df1.m3u8
- /data/data/####/76b48afa47f5bc2fc0c6de4e2895be2e.ts
- /data/data/####/7c908a59b890569da3b1cb98b154d305.ts
- /data/data/####/9c8bd8b32e56ddf715f3229086667974.ts
- /data/data/####/a383253e44756f339bb241c8445c64c2.ts
- /data/data/####/c31f40e3e7fd62033fbe13237cedffd4
- /data/data/####/c7d1884922b750385f78bb637c4c1eba.ts
- /data/data/####/d0ef6462a1c34ad03910a204d3147480.ts
- /data/data/####/d4748831ff1b703fd77008ac6c0152ea.ts
- /data/data/####/proc_auxv
- /data/data/####/xUtils.db-journal
- /data/media/####/-1009624427
- /data/media/####/-1228778183.tmp
- /data/media/####/-1228778183.tmp (deleted)
- /data/media/####/-137946773
- /data/media/####/-1468535862
- /data/media/####/-1838391689
- /data/media/####/-1838391689.tmp (deleted)
- /data/media/####/-698545962
- /data/media/####/-698545962.tmp
- /data/media/####/-709257350.tmp
- /data/media/####/-790503756
- /data/media/####/-790503756.tmp
- /data/media/####/-790503756.tmp (deleted)
- /data/media/####/-854222397
- /data/media/####/.nomedia
- /data/media/####/1295008138
- /data/media/####/1335582122
- /data/media/####/1335582122.tmp
- /data/media/####/1wt5.apk
- /data/media/####/2031550979
- /data/media/####/205046655
- /data/media/####/279860holist.txt
- /data/media/####/796949172
- /data/media/####/JILU.ini
- /data/media/####/bfdz.txt
- /data/media/####/com.audiovisual.live
- /data/media/####/msg.txt
- /data/media/####/videoloadin.gif
- /data/media/####/电影.txt
- /data/misc/####/primary.prof
Другие:
Загружает динамические библиотеки:
- libijkffmpeg
- libijkplayer
- libijksdl
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
Запрашивает разрешение на отображение системных уведомлений.
