Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.269.origin
Сетевая активность:
Подключается к:
- upl####.####.com
- image####.####.com
- w####.####.com:9001
- p####.####.com
- jia####.####.com
- c####.####.com
- d####.####.com
- w####.####.com
- y####.com
- m####.####.com
- i####.####.cn
- h####.####.com
Запросы HTTP GET:
- h####.####.com/hm.js?a02de45####
- jia####.####.com/ms3a1ece91f2cef630db14798aafed22e01be7dc172fe630fb51322bda.js
- upl####.####.com/image/584a70ed22d64.png
- upl####.####.com/image/57c799c34d922.png
- upl####.####.com/image/57c7c43a209b1.jpg
- upl####.####.com/image/589bbc9642fb3.jpg
- jia####.####.com/xb3a1ece91f3cdf739db14798aafed22e01be7dc172fe630fb51322bda.js
- upl####.####.com/image/589bbcf764bb4.jpg
- p####.####.com/s?pss=####&ti=####&ps=####&drs=####&cfv=####&cpl=####&chi=####&cce=####&cec=####&tlm=####&uc=####&pis=####&sr=####&ccd=####&cja=####&cm...
- d####.####.com/static/js/page.js
- upl####.####.com/image/58082a6d63779.png
- i####.####.cn/iplookup/iplookup.php?format=####
- upl####.####.com/image/57c79a3c7cb03.png
- upl####.####.com/image/57c7c4197ca4f.jpg
- upl####.####.com/image/57c7a9e2a24be.png
- upl####.####.com/image/57c799dad1826.png
- p####.####.com/ex?i=####
- upl####.####.com/image/57c7c1a8df223.png
- upl####.####.com/image/57c974e39ef29.png
- upl####.####.com/image/57c79a0268174.png
- d####.####.com/static/css/style.css
- upl####.####.com/image/583d4c086804f.png
- jia####.####.com/pj3a1ecf93f4c2f231db14798aafed22e01be7dc172fe630fb51322bda.js
- upl####.####.com/image/57c79a0a91f9f.png
- upl####.####.com/image/57c799e6591aa.png
- d####.####.com/?channel=####
- upl####.####.com/image/5808297a0b416.png
- upl####.####.com/image/57c79a2ca300d.png
- d####.####.com/static/js/jquery-1.8.3.min.js
- upl####.####.com/image/57c78f360a1cb.png
- upl####.####.com/image/57c799fa2ae91.png
- c####.####.com/cpro/ui/mi.js
- h####.####.com/hm.js?1####
- upl####.####.com/image/57c773c1a31cc.png
- upl####.####.com/image/57c7c13fe17c6.png
- upl####.####.com/image/58082a8752354.png
- upl####.####.com/image/582bbb22c317d.png
- h####.####.com/hm.gif?pid=####&channel=####&name=####&url=####&rnd=####
- image####.####.com/ui?dri=####&formId=####&src=####&k=####&iurl[]=####&qid=####&tu=####&width=####&height=####&opt=####&v=####&cached=####&pic=####&ex...
- upl####.####.com/image/57c7abb13c004.png
- upl####.####.com/image/57c799cbde376.png
- upl####.####.com/image/57c974cec6bd1.png
- m####.####.com/mobile/170321075812356.html?qid=####
- p####.####.com/ycvm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- image####.####.com/ui?api=####&prot=####&tu=####&pic=####&vn=####&callback=####
- upl####.####.com/image/57c7c17fb23b9.png
- c####.####.com/cpro/ui/cm.js
- upl####.####.com/image/57c7c35fa3445.jpg
- upl####.####.com/image/57c7aaca357d4.png
- upl####.####.com/image/57c7ad844d547.png
- p####.####.com/ycvm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=###...
- upl####.####.com/image/57ca42034be01.png
- upl####.####.com/image/57c97480d8fa6.jpg
- upl####.####.com/image/584f4cbe4c16d.png
- jia####.####.com/ud7e50c7dcf6ceff31934922d9f3a767bf05.js
- upl####.####.com/image/589bbc67966db.jpg
- upl####.####.com/image/57c970ff7d83f.jpg
- upl####.####.com/image/57c7c403b8eec.jpg
- upl####.####.com/image/57c7c1b9622ab.png
- upl####.####.com/image/581aaf4077dd5.jpg
- upl####.####.com/image/57edfcbf386da.png
- upl####.####.com/image/57c97506cdd3a.jpg
- upl####.####.com/image/586075dc5de0b.png
- upl####.####.com/image/57c7c16f1f400.png
- upl####.####.com/image/58082a41e78fb.png
- upl####.####.com/image/57c799f06c8e9.png
- upl####.####.com/image/57c7c153983c2.png
Запросы HTTP POST:
- w####.####.com/api/getCfg.jsp
- w####.####.com/api/uploadInstallApps.jsp
- w####.####.com/api/getInAppFull.jsp
- w####.####.com/api/getAlist.jsp
- w####.####.com/api/getLauncher.jsp
- y####.com/cu.ashx
- w####.####.com/api/getSI.jsp
- w####.####.com/api/getAreaId.jsp
- w####.####.com/api/getFallDown.jsp
- w####.####.com:9001/api/uploadSaleInfo.jsp
- w####.####.com/api/getFloat.jsp
- w####.####.com/api/getStartPop.jsp
- w####.####.com/api/getExit.jsp
- w####.####.com/api/getInAppFloat.jsp
- w####.####.com/api/getSlidingScreen.jsp
- w####.####.com/api/getStartNonFull.jsp
- w####.####.com/api/getStartDialog.jsp
- w####.####.com/api/getStartFull.jsp
- w####.####.com/api/getDtk.jsp
- w####.####.com/api/getSht.jsp
- w####.####.com/api/getNotification.jsp
- w####.####.com/api/getInAppNonFull.jsp
- w####.####.com/api/getStartWin.jsp
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/online.xml.bak
- /sdcard/Android/data/system/cache/.hb/insifhbm_l_hb_t
- /data/data/####/shared_prefs/pp.xml
- /sdcard/Android/data/system/cache/.hb/swhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/exthbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /sdcard/Android/data/system/cache/.hb/sdhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/lauhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/insiohbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/areaInfo.xml
- /sdcard/Android/data/system/cache/.hb/ntbhbm_l_hb_t
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/pp.xml.bak
- /sdcard/Android/data/system/cache/.hb/snfhm_l_hb_t
- /data/data/####/databases/favorite.db-journal
- /data/data/####/shared_prefs/localtime.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /sdcard/Android/data/system/cache/.hb/DtkAdbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/cfghbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/sfhm_l_hb_t
- /data/data/####/databases/baidu_cen-journal
- /sdcard/Android/data/system/cache/.hb/fhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/sdhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/IUhbm_l_hb_t
- /data/data/####/shared_prefs/localtime.xml
- /data/data/####/biz_close.jar
- /data/data/####/shared_prefs/online.xml
- /data/data/####/shared_prefs/device.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /sdcard/Android/data/system/cache/.hb/falhbm_l_hb_t
- /sdcard/device
- /sdcard/Android/data/system/cache/.hb/sihm_l_hb_t
- /data/data/####/files/80.tmp
- /sdcard/Android/data/system/cache/.hb/sihbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/insiwfhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Может автоматически отправлять СМС-сообщения.
