Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- t####.####.com
- u####.####.com
- c####.####.net
- 7x####.####.com
- a####.####.net
- 1####.####.187
- gl####.####.com
- baiduli####.####.org
- 1####.####.106:8004
- m####.####.com
- traffic####.####.com
- a####.####.com
- apptr####.com
Запросы HTTP GET:
- t####.####.com/c/ks4QD-R4401dQAYST05Yea6gTZGHOcAkIK39EUrSLJU/CF?subid1=####&subid2=####&placement=####&m.gaid=####&m.idfa=####
- baiduli####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=####&placement=####&google_aid=####&ios_ifa=####
- 7x####.####.com/sl_conf.txt
- u####.####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- t####.####.com/agentapi/click?cid=####&aid=####&postback=####&sub_id=####&did=####&im=####&gaid=####
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&channel=####&from_sdk=####&aid=####&oid=####&ads_id_list=####&req_ads_num=####&res_ad...
- traffic####.####.com/badlinkid?url=####&attempt=####
- traffic####.####.com/click?aid=####&linkid=####&s1=####&s2=####
- a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local=####&channel=####&recommend_id=####&from_sdk=####&aid=####&click_route=####&s...
- 1####.####.106:8004/m/umeng:5583848f67e58ea3a9002694/61/Ahbg6rL-NaQozbMJkF7rV62d__tNAz_HkR1efxfGYYID?s=MDUzN####&c=####&pm=####&sv=####&ov=####
- 1####.####.187/slauncher/slauncher_config.txt
- c####.####.net/batmobi/sdk/20161017175024.png
- 1####.####.187/personal_ads/get_offer.php?application=####&country=####&placement_id=####&aid=####
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&channel=####&from_sdk=####&aid=####&placement_id=####&oid=####&ads_id_list=####&req_a...
- u####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&aff_sub6=####&aff_sub7=####&aff_sub8=####&google_adv_id=####&sub_affiliate_id=#...
- t####.####.com/c/ehig0UK7HEhD2UIyT06jhZ62thlWBEx2GD_iCh5LAcQ/CF?subid1=####&placement=####&subid3=####&m.gaid=####
- t####.####.com/api/v4/click?campaign_id=####&publisher_id=####&publisher_slot=####&sub_1=####&pub_gaid=####&pub_idfa=####&pub_aid=####
- u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- baiduli####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- a####.####.net/native/v2/recommend?pversion=####&request_id=####&appkey=####&channel=####&ua=####&adv_id=####&aid=####&local=####&lang=####&sys_name=#...
- a####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&chn=####
- u####.####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- m####.####.com/dir/click?c=####&device_id=####&gaid=####&idfa=####&offerid=####&guid=####&affid=####&affsub1=####&hash=####&cid=####&uuid=####&ref=###...
- apptr####.com/dir/redirect?c=####&offerId=####&affid=####&guid=####&hash=####&cid=####&affsub1=####&device_id=####&gaid=####&idfa=####
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- baiduli####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=####&google_aid=####
- traffic####.####.com/badlinkid?url=####
Запросы HTTP POST:
- a####.####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&sv=####&p=####&t=####&u=####&nsgs=####
- a####.####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&sv=####&p=####&t=####&u=####&dd=####&nsgs=####
- m####.####.com/v2/register
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/databases/gameApps.db
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/shared_prefs/charging_version_name.xml
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/cleanup_widget_pref.xml.bak
- /data/data/####/databases/launcher.db-journal
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/shared_prefs/charging_mobi_offer_shareperence_name.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/shared_prefs/class ####.ay.xml
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/UTMCBase.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/asdfg
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/shared_prefs/cleanup_widget_pref.xml
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1452756019.zip
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/shared_prefs/UTMCLog1417210380.xml.bak
- /data/data/####/shared_prefs/multidex.version.xml
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/databases/sort_favorite.db-journal
- /data/data/####/files/DaemonServer
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/batfiles/20161017175024.png
- /data/data/####/shared_prefs/####.lockScreen.xml
- /data/data/####/files/agoo.pid
- /data/data/####/shared_prefs/UTMCConf1417210380.xml
- /data/data/####/shared_prefs/####.prefs.xml.bak
- /data/data/####/shared_prefs/####.prefs.xml
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- /data/data/####/databases/bat_statistics.db-journal
- /data/data/####/shared_prefs/PhoneUtil.xml
- /data/data/####/cache/widgetpreviews.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/gaClientId
- /data/data/####/shared_prefs/sharedpreferences_batmobi_offers.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/app_app_apk/launcher.dat.jar
- /data/data/####/shared_prefs/s_update.xml
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/files/launcher.preferences
- /data/data/####/shared_prefs/sharedpreferences_batmobi_settings.xml
- /data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- /data/data/####/files/mobclick_agent_cached_####61
- /data/data/####/shared_prefs/UTMCLog1417210380.xml
- /data/data/####/shared_prefs/yeah_shareperence_name.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/DaemonServer
Другие:
Запускает следующие shell-скрипты:
- sh
Может автоматически отправлять СМС-сообщения.
