Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- t####.####.com
- clinkad####.com
- set####.####.com
- analy####.####.com
- trac####.####.com
- a####.####.net
- l####.####.com
- r####.####.com
- c####.####.com
- d####.####.com
- e####.####.com
- lo####.####.net
- c####.gift:20001
- gl####.####.com
- cdn####.####.com
- lo####.####.com
- baiduli####.####.org
- pocketm####.####.org
- a####.####.com
- n####.####.com
Запросы HTTP GET:
- e####.####.com/cfimp/_F4zDzfXucwn6KVgu7A--sgeDz3wuvyynqiGZMnrea-d_NDtY6a59IHa7yhbPRvS0rHBvTrX2KBwFmCv94qs1iE8A75Uwk21IlozJyuTgVy0p8OBEv-WjqloEZDU6WQhB...
- r####.####.com/common/2016/07/20/03/04/com.bol.shop1468955040.89_1200X627.JPEG
- l####.####.com/uDoOCyMgmXlDBjD5u5lY-sCNbXiP3XMBboU-yvhfSwZlK3su5P2v_pxtdzx2htZnoAki=w144
- a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local=####&recommend_id=####&from_sdk=####&aid=####&click_route=####&sequence=####
- r####.####.com/common/2016/09/23/21/35/d41d8cd98f00b204e9800998ecf8427e_201609232135021474637702788_128X128.png
- n####.####.com/impression?k=####&p=####&q=####&x=####
- n####.####.com/onlyImpression?k=####&p=####
- a####.####.net/stat/v2/imp?aff_id=####&ak_id=####&local=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&ad_num=####&only_impression=####&ping_mode=####&native_info=####&tnum=##...
- cdn####.####.com/cdn-adn/html/common/2016/09/19/19/35/d41d8cd98f00b204e9800998ecf8427e_201609191935031474284903659_128X128.png
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gaid=####&aid=####
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=##...
- r####.####.com/common/2016/04/26/15/35/d41d8cd98f00b204e9800998ecf8427e_201604261535051461656105299_128X128.png
- t####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=####&aff_sub3=####
- a####.####.net/call/v2/ad/click_callback?ads_id=####&aff_id=####&ak_id=####&local=####&recommend_id=####&from_sdk=####&aid=####&click_route=####&seque...
- r####.####.com/common/2016/04/01/04/37/d41d8cd98f00b204e9800998ecf8427e_201604010435051459456505356_128X128.png
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&ad_source_id=####&sign=####&ad_num=####&ping_mode=####&ad_type=####&ttc_ids=####&p...
- lo####.####.com/android/v1/impression?adtype=####&country=####&pn=####&user_id=####&ran=####&platform=####&gaid=####&tz=####&osv=####&dt=####&nt=####&...
- a####.####.net/nat_clk/343440375/3978192?devad_id=####&gid=####&sid=####
- pocketm####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub3=####&aff_sub=####&aff_sub2=####
- r####.####.com/common/2015/12/22/03/03/d41d8cd98f00b204e9800998ecf8427e_201512220302111450724531873_128X128.png
- cdn####.####.com/cdn-adn/html/common/2015/12/22/03/43/d41d8cd98f00b204e9800998ecf8427e_201512220341591450726919873_128X128.png
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####&req_ads_num=####&r...
- l####.####.com/WMr397uLUSC2qD24vIMAYaZnPMWzikSc54QNAPPDrwJDEOYfyEuLwv00xv7V-zoNtYru=w144
- cdn####.####.com/cdn-adn/offersync/16/12/07/05/35/58472f07382ab.png
- l####.####.com/TXjlIhRpxABei6zzByyPMqjSNqJX5EuTCyA9RXgMHeYgsQxZqGv4br9n5daKj_bHhLg=w144
- cdn####.####.com/cdn-adn/html/common/2015/12/22/02/49/d41d8cd98f00b204e9800998ecf8427e_201512220248031450723683200_128X128.png
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_type=####&sign=####&ad_num=####&ping_mode=####&only_impression=####&offset=###...
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&prod=####&clickId=####&segId=####
- l####.####.com/fcUSAeWUsLdctiztDcBLZOntkN90TWSurAjTtf8VI2JUsqFmqvIEpePwrR8bPfbN9php=w144
- t####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- c####.####.com/export/58a509f95a50e/76801/1783693/3c705aac20460da8?timestamp=####&rewards=####&bundleId=####&applicationUserId=####&deviceOs=####&devi...
- r####.####.com/common/2016/01/12/20/35/d41d8cd98f00b204e9800998ecf8427e_201601122035061452602106636_128X128.png
- cdn####.####.com/cdn-adn/offersync/17/01/13/15/35/5878832d3f7fb.png
- cdn####.####.com/cdn-adn/offersync/16/12/01/23/35/5840432895214.png
- l####.####.com/4K2N7aQE9Lso8dZBiHmn9RSIgj1qYUydADhbF_GUZHzj2UZP6Cr73IwO9PC5mcJb_g=w144
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&aff_sub6=####&aff_sub7=####&aff_sub8=####&google_adv_id=####&sub_affiliate_id=#...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
- l####.####.com/sy1zNHDNfGfOl2RCSdweAY5Rwj-0LtVLIIprwOzIDAUbp09s2_YdiAOuyKmfAwynzQ=w144
- d####.####.com/click?k=####&p=####&q=####¬ice=####
- l####.####.com/XejlngMx43PdGfSBnq3cK4ZHlBDxW2DACy1jkscE-kSnUj6EEBnMyrtxyMn71aO_xuc=w144
- trac####.####.com/click/12331142?app_key=####&gaid=####&idfa=####&pb=####
- cdn####.####.com/cdn-adn/html/common/2015/12/22/02/51/d41d8cd98f00b204e9800998ecf8427e_201512220250311450723831629_128X128.png
- n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&or...
- t####.####.com/c/SPqDjrPSIoiSFU4NS06wDaOJI1SQh-JWy8M8sHbHNFY/CF?placement=####&subid1=####&subid2=####&subid3=####&subid4=####&subid5=####&m.androidid...
- baiduli####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- l####.####.com/LOCT737ire9zmN74a9QPCl9_HHzJxCJY0f4RPkeNVMrxR2TXDF2kJgIvULRQp-wYmMI=w144
- r####.####.com/common/2016/04/18/15/35/d41d8cd98f00b204e9800998ecf8427e_201604181535051460964905113_128X128.png
- set####.####.com/appwall/setting?app_id=####&unit_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_...
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&aff_sub=####&mb_subid=####&mb_devid=####&mb_gaid=####
- r####.####.com/common/2015/12/22/03/36/d41d8cd98f00b204e9800998ecf8427e_201512220335281450726528618_128X128.png
- cdn####.####.com/cdn-adn/offersync/16/10/14/22/33/5800ecb9160ed.png
- a####.####.net/applnk/826227844
- s####.####.com/srv/click/?pid=####&p1=####&p2=####
- c####.gift:20001/api/v2/ad/get?dml=####&dt=####&nt=####&mcc=####&aid=####&lang=####&adnum=####&img_rule=####&icc=####&token=####&sv=####&mnc=####&isde...
- pocketm####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...
- baiduli####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=####&google_aid=####
- r####.####.com/common/2016/01/18/16/35/d41d8cd98f00b204e9800998ecf8427e_201601181635081453106108848_128X128.png
- l####.####.com/WZWxKkLnUk043l1eFyIZWIxk4xeSVQROA2qsOQ4gO-4cyscxeG6W0G3iEpI4Leastg=w144
Запросы HTTP POST:
- a####.####.net/native/v2/recommend
- analy####.####.com/
- n####.####.com/onlyImpression?k=####&p=####
- lo####.####.net/android/v2/click_redirect
- lo####.####.net/debug/v2/android
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/picasso-cache/33a3d1c0e16407ba1e9d9070ecb0c33e.0.tmp
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- /sdcard/.mobvista700/download/886831196
- /data/data/####/cache/picasso-cache/1d3fe71b3ccf9f51ea7980a1bda7bfad.1.tmp
- /sdcard/.mobvista700/download/-186130867
- /data/data/####/cache/picasso-cache/032569bef5d3301e04435020dce9a2b6.0.tmp
- /data/data/####/cache/picasso-cache/17a171318ca58ed8825c38ceb67a8598.1.tmp
- /sdcard/.mobvista700/download/-1378962212.temp
- /data/data/####/shared_prefs/postTime.xml
- /data/data/####/cache/picasso-cache/1b0dbb7c461411fea8026982c38600a9.0.tmp
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/cache/picasso-cache/800c0d60c7ccf9852a2acd9b064b18ae.1.tmp
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /sdcard/.mobvista700/download/2110439132
- /data/data/####/cache/picasso-cache/33a3d1c0e16407ba1e9d9070ecb0c33e.1.tmp
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/picasso-cache/032569bef5d3301e04435020dce9a2b6.1.tmp
- /data/data/####/shared_prefs/sharedpreferences_batmobi_offers.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/AdjustIoActivityState
- /sdcard/.mobvista700/download/-1258090394.temp
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-318719124.zip
- /sdcard/.mobvista700/download/1935700492
- /sdcard/.mobvista700/download/1859896854
- /data/data/####/files/mobclick_agent_cached_####
- /sdcard/.mobvista700/download/1586849521
- /sdcard/.mobvista700/download/2105717695.temp
- /data/data/####/cache/picasso-cache/669aae5f27e1296ba92a2469f110bfb5.1.tmp
- /data/data/####/files/asdfg
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/cache/picasso-cache/49cfca7831b5a18b4596a4a889a3d8a9.1.tmp
- /data/data/####/cache/picasso-cache/ee8108acdce6cc77a658548a9096a71f.0.tmp
- /data/data/####/files/AdjustIoPackageQueue
- /sdcard/.mobvista700/download/1043746455
- /sdcard/.mobvista700/download/-901927780
- /data/data/####/cache/picasso-cache/49cfca7831b5a18b4596a4a889a3d8a9.0.tmp
- /data/data/####/shared_prefs/mydata.xml
- /sdcard/.mobvista700/download/-1630196418
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/picasso-cache/7c7621b216f012f6a01b5993e5b803cd.1.tmp
- /data/data/####/shared_prefs/TOKEN.xml
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-1154545547.zip
- /sdcard/.mobvista700/download/122012224
- /data/data/####/cache/picasso-cache/846a2ab0f4f63b8aa8b23a991ed3348c.0.tmp
- /data/data/####/cache/picasso-cache/1d3fe71b3ccf9f51ea7980a1bda7bfad.0.tmp
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- /data/data/####/databases/bat_statistics.db-journal
- /sdcard/.mobvista700/download/-945101289
- /data/data/####/cache/picasso-cache/7c7621b216f012f6a01b5993e5b803cd.0.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/.mobvista700/download/-347635513
- /data/data/####/cache/picasso-cache/831d3f715122883a36249a09955f94ac.1.tmp
- /data/data/####/cache/picasso-cache/831d3f715122883a36249a09955f94ac.0.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/app_app_apk/lite.dat.jar
- /data/data/####/shared_prefs/sharedpreferences_batmobi_settings.xml
- /data/data/####/cache/picasso-cache/1b0dbb7c461411fea8026982c38600a9.1.tmp
- /data/data/####/cache/picasso-cache/17a171318ca58ed8825c38ceb67a8598.0.tmp
- /data/data/####/shared_prefs/xinxi.xml
- /sdcard/.mobvista700/download/772399561
- /data/data/####/cache/picasso-cache/ee8108acdce6cc77a658548a9096a71f.1.tmp
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- /data/data/####/cache/picasso-cache/800c0d60c7ccf9852a2acd9b064b18ae.0.tmp
- /sdcard/.mobvista700/download/-1926068599
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/cache/picasso-cache/669aae5f27e1296ba92a2469f110bfb5.0.tmp
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/picasso-cache/846a2ab0f4f63b8aa8b23a991ed3348c.1.tmp
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/app_bin/daemon -p #### -s com.xinjia.skycleaner.LockServicesky -t 120
Может автоматически отправлять СМС-сообщения.
