Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- set####.####.com
- o####.####.com
- d####.####.com
- mobotoo####.####.com
- a####.####.com
Запросы HTTP GET:
- a####.####.com/client/newwallpaper/hottest.do?pageSize=####&version=####&country=####&language=####
- mobotoo####.####.com/mobotoolpush/addispsort.json?facebook=####&language=####&googleplay=####&channel=####&pkgname=####&os_version=####&country=####&v...
- s####.####.com/lunbotu/329/1333333811/lunbo_1460735067916.jpg
- s####.####.com/lunbotu/696/1433472200/lunbo_1460735003354.jpg
- s####.####.com/thumbnail/304/741878810/thumbnail_1463477921052.png
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
- d####.####.com/wallpaper/img/658/54a3c085e4b0e2c794bc3dd2/1420017797756/wallpaper_s.jpg
- a####.####.com/client/newtheme/hottest.do?pageSize=####&language=####&density=####&version=####&country=####
- o####.####.com/ipo/api/gray/status?appvc=####&os=####&appvn=####&avn=####&did=####&pn=####&lc=####&chn=####
- s####.####.com/lunbotu/619/285363813/lunbo_1460734848121.png
- s####.####.com/lunbotu/516/181056064/lunbo_1460734566915.png
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...
- s####.####.com/thumbnail/643/819436183/thumbnail_1463141769057.png
- a####.####.com/client/v2/resource/app/list.json?&country=####&language=####&channel=####&pageNum=####&launcherVersionCode=####&pageSize=####&appType=#...
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.com/check_config_update
- a####.####.com/client/resource/carouselAd/list.do?&country=####&language=####&channel=####&pageNum=####&pageSize=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_eaab716a-92d4-4639-b770-8d1281df1606_1485415967906.tap
- /data/data/####/files/.cma_theme/app_icon/drawable/jp_naver_line_android_jp_naver_line_android_activity_splashactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_quicksearchbox_com_android_quicksearchbox_searchactivity.png
- /data/data/####/app_app_apk/lite.dat.jar
- /data/data/####/files/.cma_theme/app_icon/drawable/com_mobogenie_com_mobogenie_activity_startactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A6430141-0001-09B4-098218F10275SessionApp.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_bdc38bbf-841a-4afd-aa9d-ac08049eb417_1485415963707.tap
- /data/data/####/files/.cma_theme/app_icon/drawable/com_instagram_android_com_instagram_android_activity_maintabactivity.png
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_facebook_orca_com_facebook_orca_auth_startscreenactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A62703BA-0001-094A-098218F10275SessionOS.cls_temp
- /data/data/####/shared_prefs/32b7c79dc228de426ce9c9352eb018be.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_music_com_android_music_musicbrowseractivity.png
- /data/data/####/shared_prefs/configs.xml.bak
- /sdcard/clauncher.cyou.inc/elegant/volley/json/-1410281047983817538
- /data/data/####/files/.cma_theme/dock_icon/drawable/ic_allapps.png
- /data/data/####/files/www.sss.file
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/spf_beha.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_camera_com_android_camera_camera.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B02E9-0001-087F-098218F10275SessionDevice.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-11358165581862618439
- /data/data/####/shared_prefs/install.xml
- /data/data/####/files/adapt.db
- /data/data/####/shared_prefs/c2dm.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_google_android_apps_maps_com_google_android_maps_mapsactivity.png
- /data/data/####/shared_prefs/trending_config.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B02E9-0001-087F-098218F10275SessionUser.cls_temp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61C00D2-0001-0867-098218F10275SessionApp.cls_temp
- /data/data/####/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_deskclock_com_android_deskclock_deskclock.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B002F-0001-083A-098218F10275SessionDevice.cls_temp
- /data/data/####/files/cmawidgets.xml.tmp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-888756017840290277
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61C00D2-0001-0867-098218F10275SessionUser.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A62703BA-0001-094A-098218F10275SessionUser.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_cyou_cma_clauncher_com_cyou_cma_beauty_center_beautycenterentrance.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B02E9-0001-087F-098218F10275SessionApp.cls_temp
- /data/data/####/files/launcher.preferences
- /data/data/####/shared_prefs/PersistedSetToDoSet.xml
- /data/data/####/files/flag_all_app
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_contacts_com_android_contacts_activities_dialtactsactivity.png
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/shared_prefs/workspace_row_column.xml
- /data/data/####/shared_prefs/SDKIDFA.xml
- /data/data/####/databases/mobvista.msdk.db-journal
- /sdcard/clauncher.cyou.inc/elegant/volley/image/16259287321950282321
- /data/data/####/shared_prefs/dcSharedPreferences.dat.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B002F-0001-083A-098218F10275SessionApp.cls_temp
- /data/data/####/files/umeng_it.cache
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/files/temp_notification_wallpaper_image
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_music_com_android_music_videobrowseractivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_contacts_com_android_contacts_activities_peopleactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_mms_com_android_mms_ui_conversationlist.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_viber_voip_com_viber_voip_welcomeactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_bsb_hike_com_bsb_hike_ui_homeactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61C00D2-0001-0867-098218F10275SessionOS.cls_temp
- /data/data/####/shared_prefs/installation.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61C00D2-0001-0867-098218F10275BeginSession.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B02E9-0001-087F-098218F10275SessionOS.cls_temp
- /data/data/####/shared_prefs/com.crashlytics.prefs.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_twitter_android_com_twitter_android_startactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B002F-0001-083A-098218F10275SessionOS.cls_temp
- /data/data/####/files/.cma_theme/customize_mat/drawable/default_customize_cover.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1625928701-102958160
- /data/data/####/databases/elegant.db-journal
- /data/data/####/files/.cma_theme/app_icon/drawable/com_ucmobile_intl_com_ucmobile_main_ucmobile.png
- /data/data/####/shared_prefs/FBAdPrefs.xml
- /data/data/####/shared_prefs/32b7c79dc228de426ce9c9352eb018be.xml.bak
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A6430141-0001-09B4-098218F10275BeginSession.cls_temp
- /data/data/####/shared_prefs/push_local_config.xml
- /data/data/####/shared_prefs/com.crashlytics.sdk.android:answers:settings.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-8887530111504108357
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_settings_com_android_settings_settings.png
- /data/data/####/databases/000.db-journal
- /data/data/####/code_cache/secondary-dexes/tmp-####-1.apk.classes1961962704.zip
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_providers_downloads_ui_com_android_providers_downloads_ui_downloadlist.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- /data/data/####/shared_prefs/strategy_sp.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-11358196551775230262
- /data/data/####/files/.cma_theme/customize_mat/drawable/default_customize_mat.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B02E9-0001-087F-098218F10275BeginSession.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_sgiggle_production_com_sgiggle_production_startup.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61C00D2-0001-0867-098218F10275SessionDevice.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_91061a8e-2e89-468d-82dc-b91f1d8ed3f0_1485415967029.tap
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_gallery3d_com_android_gallery3d_app_gallery.png
- /data/data/####/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.Fabric/io.fabric.sdk.android:fabric/com.crashlytics.settings.json
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_browser_com_android_browser_browseractivity.png
- /data/data/####/files/.cma_theme/info.prop
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_calendar_com_android_calendar_allinoneactivity.png
- /data/data/####/shared_prefs/dcSharedPreferences.dat.xml.bak
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A62703BA-0001-094A-098218F10275BeginSession.cls_temp
- /data/data/####/shared_prefs/dataTrans.xml
- /data/data/####/shared_prefs/configs.xml
- /data/data/####/files/.cma_theme/wallpaper/drawable/wallpaper.jpg
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A62703BA-0001-094A-098218F10275SessionDevice.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A6430141-0001-09B4-098218F10275SessionDevice.cls_temp
- /data/data/####/files/watch_server
- /data/data/####/files/.cma_theme/app_icon/drawable/com_skype_polaris_com_skype_raider_main.png
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/io.fabric.sdk.android:fabric:io.fabric.sdk.android.Onboarding.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/json/9088968231963602097
- /data/data/####/files/.cma_theme/app_icon/drawable/com_cyou_cma_clockscreen_com_cyou_cma_clockscreen_activity_splashactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_tencent_mm_com_tencent_mm_ui_launcherui.png
- /data/data/####/databases/ztrack.db-journal
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A61B002F-0001-083A-098218F10275BeginSession.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A62703BA-0001-094A-098218F10275SessionApp.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_whatsapp_com_whatsapp_main.png
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/.cma_theme/app_icon/drawable/com_facebook_katana_com_facebook_katana_loginactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A6430141-0001-09B4-098218F10275SessionOS.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_email_com_android_email_activity_welcome.png
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/spf_stat.xml
- /data/data/####/shared_prefs/spf_theme.xml
- /data/data/####/shared_prefs/PersistedMapTagLastSeenMap.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_calculator2_com_android_calculator2_calculator.png
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/watch_server
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/watch_server /data/data/#### http://survey.dolphin.com/plugin/index.html?pn=####&v=76&an=####&lc=en_US&tag=cyou com.android.browser/com.android.browser.BrowserActivi
Может автоматически отправлять СМС-сообщения.
