Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\360apk\shell\open\command] '' = '"%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360ApkInstaller.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ZHUSHOU360\Shell\Open\Command] '' = '"%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileMgr.exe" -e %1'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileM...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileL...
Запускает на исполнение:
- '%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileMgr.exe' -child 2d0 12 2dc
- '%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileMgr.exe'
- '%HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileLink.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\sites.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\SoftUpdateM.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\np360MMPlugin.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\mcommu.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\MiniUI.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\Utils\SomPlugin.dll
- %APPDATA%\360mobilemgr\DB\SoftMgrCfgM.db
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\360mobilemgr\DB\SoftMgrCfgM.db-journal
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\SomPlugin.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\safemon\wdefence.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360Login.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MMAssisEx.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\Utils\360ExpData.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\Utils\360ExpClient.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360ExpData.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileWifi.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\AsyncWorkFlow.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\CommuBridge.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\ApkHelper.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360NetUL.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360UData.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getOpenPlatformTree[1].1180&t=2016101204
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getlogov2[1].1180&m=ed0017b5909ec31d537c5030d7ab1b60
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\360mm[1].json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\CheckUpdate[1].ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\360mm[1].json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pmobi[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hotquery[1].1180&t=1476271063
- %APPDATA%\yiwanzhushou\log\360MobileMgr.log
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mobi[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\app_photopath[1].ini
- %APPDATA%\360mobilemgr\ini\other_photo.ini
- %APPDATA%\360mobilemgr\DB\SoftMgrM.db-journal
- %APPDATA%\360mobilemgr\DB\SoftMgrM.db
- %HOMEPATH%\.android\adbkey
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\.android\adbkey.pub
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dywplugin[1].json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\hot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\getAppMoveList[1].1180
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\cloudControl[1].1180
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\todayhot3[1].html
- %APPDATA%\360Login\GlobleAccount.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\mobileloader.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\mobiletpicfg.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\mobileadapt.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\Config.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\deviceid.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\apk\360mobilemgr.apk
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\InstIdRules.dat
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\MobileInfo100.dat
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\adbfile.dat
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\apk\360mobilemgr.apk
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\mgraccountcfg.cf
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\firstpagecache3.png
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\LoginBanner.png
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\UIbkg\BrowserBg.png
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\LoginBK.jpg
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\UIbkg\BrowserBg.png
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\ExplorerEntry.ico
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\adb_usb.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\browseradapt.ini
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\updatecfg.xml
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\结束某程序.bat
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\TreeCtrl.xml
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\tool\aapt.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\tool\aapt.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileSrv.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileLoader.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileMgr.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360Base.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360emu.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360ExpClient.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360Common.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\360Base64.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360BrowserExt.dll
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360ApkInstaller.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360APMon.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\skin.uiz
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\管理我的手机.lnk
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileBase.tpi
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MMFeedback.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileCheck.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MobileLink.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MMSetupDrv64.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MMProxy.exe
- %HOMEPATH%\Local Settings\Temp、\360手机助手2.5.1.1180\mobilemgr\360MMSetupDrv32.exe
Удаляет следующие файлы:
- %APPDATA%\360mobilemgr\DB\SoftMgrM.db-journal
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\360mobilemgr\DB\SoftMgrCfgM.db-journal
Подменяет следующие файлы:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1
Сетевая активность:
Подключается к:
- 's.##0.cn':80
- 're#.##update.com':80
- 'www.36##an.com':80
- 'so###.360safe.com':80
- 'zs###.#obilem.360.cn':80
- 'in##.###ll.mobilem.360.cn':80
- 'localhost':1038
- 'localhost':1044
- 'www.36#.cn':80
TCP:
Запросы HTTP GET:
- http://s.##0.cn/zhushou/pmobi.html?ve#########################################################################################################################################
- http://in###.##all.mobilem.360.cn/cnxh/getlogov2/?t=###################################################################### via zs###.#obilem.360.cn
- http://in###.##all.mobilem.360.cn/intf/getOpenPlatformTree?ve######################### via zs###.#obilem.360.cn
- http://www.36##an.com/hotquery?fm##################################
- http://so###.360safe.com/mobi.html?ty#############################################################################################################################################
- http://in###.##all.mobilem.360.cn/html/app_photopath.ini?t=########## via zs###.#obilem.360.cn
- http://in##.###ll.mobilem.360.cn/html/update/360mm.json?ve##################################
- http://in###.##all.mobilem.360.cn/intf/cloudControl?ve################ via zs###.#obilem.360.cn
- http://zs###.#obilem.360.cn/html/todayhot3.html?sd#####################
- http://in##.###ll.mobilem.360.cn/html/data/dywplugin.json?t=########################
- http://re#.##update.com/360MM/CheckUpdate.ini?ve#########################################################################################################################################
- http://in##.###ll.mobilem.360.cn/intf/getAppMoveList?ap###############
- http://in###.##all.mobilem.360.cn/index/hot?t=########## via zs###.#obilem.360.cn
UDP:
- DNS ASK s.##0.cn
- DNS ASK re#.##update.com
- DNS ASK www.36##an.com
- DNS ASK so###.360safe.com
- DNS ASK www.36#.cn
- DNS ASK in##.###ll.mobilem.360.cn
- DNS ASK in###.##all.mobilem.360.cn
- DNS ASK zs###.#obilem.360.cn
Другое:
Ищет следующие окна:
- ClassName: 'QH360MMAutoUpdateOpenTip' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'QH360MobileSrvMainWindowClass' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '360MobileManagerMidClass' WindowName: ''
- ClassName: '360MMTipClass' WindowName: ''
- ClassName: '360MobileManagerClass' WindowName: ''
- ClassName: '' WindowName: '360????-????'
- ClassName: 'QPopLayeredWindow' WindowName: ''
- ClassName: '' WindowName: '360手机助手-升级提醒'
