Android.Locker.3077

Техническая информация

Вредоносные функции:

Устанавливает свой пароль на экран блокировки.

Сетевая активность:

Подключается к:

startap####.com
i####.####.com
r####.####.com
d####.####.com
2####.####.174
spykem####.####.org

Запросы HTTP GET:

r####.####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVersion=#...
spykem####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=####&aff_sub3=####&params=####&index=####
i####.####.com/InApp/resources/info_ex_l.png
d####.####.com/static/images/close-btn-infra.png
2####.####.174/tracking/adImpression?d=####&position=####&clientSessionId=####&ts=####&afh=####
d####.####.com/static/images/star_half_big.png
d####.####.com/styles/compressed/fullscreen_appstore_material_infra.20170221-1235.min.css
d####.####.com/image/fetch/f_auto,q_80,w_124,h_124/http%3A%2F%2Flh3.googleusercontent.com%2FRQzvpw0t4RgmldNgn_iNkZglJVHC-0z9l1l2xXFMgHIdtICyerCN0o-X-j...
d####.####.com/static/images/star_empty_big.png
d####.####.com/static/images/star_full_big.png
2####.####.174/tracking/adImpression?d=####&clientSessionId=####&ts=####&afh=####
d####.####.com/image/fetch/f_auto,q_80,w_48,h_48/http%3A%2F%2Flh3.googleusercontent.com%2F18PABPsyRQJ4AF2hwhaVSd5lKR6yIXMdLrIsmkttut9H7QezriWjTL3Ombuf...
startap####.com/1.4/trackdownload?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVers...
i####.####.com/InApp/resources/info_ex_s.png
startap####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVersion=...
d####.####.com/styles/compressed/banner_rt_2d_rays_infra.20170221-1235.min.css
2####.####.174/tracking/adClick?d=####&lu=####&index=####&clientSessionId=####&displayDuration=####&ts=####&afh=####
i####.####.com/InApp/resources/info_s.png
d####.####.com/static/images/banner_rt_2d_rays_base/download_icon_30.png
i####.####.com/1.4/getadsmetadata?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVers...
d####.####.com/styles/compressed/fullpage_float_window_slider_all.20170221-1235.min.css
i####.####.com/InApp/resources/info_l.png

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/StartappMetadata
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/files/startapp_ads/ads/1565317145
/data/data/####/shared_prefs/com.startapp.android.publish.xml.bak
/data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
/data/data/####/files/startapp_ads/keys/1565317145
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
/data/data/####/files/startapp_ads/keys/_1410597251
/data/data/####/shared_prefs/com.startapp.android.publish.xml
/data/data/####/files/startapp_ads/ads/_1410597251
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/files/shared_prefs_sdk_ad_prefs
/data/data/####/cache/webviewCacheChromium/index