Android.Packed.19369

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.511.origin

Сетевая активность:

Подключается к:

1####.####.67
googl####.####.net
c####.####.org
y####.####.cn
d####.####.com
mi####.####.net
mor####.####.net
a####.####.com

Запросы HTTP GET:

mi####.####.net/moreapp/1464866930703_849c67_s.jpg
mi####.####.net/moreapp/1447830683663_7b439e_s.jpg
mi####.####.net/moreapp/1467112531518_cc11ec_r.png
mi####.####.net/moreapp/1413345219144_a4bb55_r.jpg
mi####.####.net/moreapp/1467371140728_23e959_s.jpg
mi####.####.net/moreapp/1461320957511_e4574b_r.png
mi####.####.net/moreapp/1464355435246_52baf9_r.png
mi####.####.net/moreapp/1469203553037_05c247_s.jpg
c####.####.org/strategy/dev_root2
mi####.####.net/moreapp/1463763875075_172215_r.png
mi####.####.net/moreapp/1468601474735_f1692a_s.jpg
mi####.####.net/moreapp/1468586479983_191e66_s.jpg
mi####.####.net/moreapp/1468585313964_f03a8a_r.png
mi####.####.net/moreapp/1464097615592_6e2210_s.jpg
mi####.####.net/moreapp/1471867692096_94843e_r.png
mi####.####.net/moreapp/1468635925104_187c7a_s.jpg
mi####.####.net/moreapp/1463161726881_060a53_r.png
mi####.####.net/moreapp/1464257344684_aa23d8_r.png
mi####.####.net/moreapp/1466749302653_f84d99_r.png
mi####.####.net/moreapp/1464339030651_fad017_r.png
mi####.####.net/moreapp/1469203595008_2c8a97_r.png
mi####.####.net/moreapp/1413345059718_bfd0a1_r.jpg
mi####.####.net/moreapp/1461919410676_457183_r.png
mi####.####.net/moreapp/1463161743060_b9aba1_s.jpg
mi####.####.net/moreapp/1467343748517_47e15c_r.png
mi####.####.net/moreapp/1470414983563_15e080_s.jpg
mi####.####.net/moreapp/1461920888537_12e255_s.jpg
mi####.####.net/moreapp/1413533074938_3994c6_r.jpg
mi####.####.net/moreapp/1464346162334_9057ca_s.jpg
googl####.####.net/mads/static/sdk/native/sdk-core-v40.js
mi####.####.net/moreapp/1464260230306_9f13d4_r.png
mi####.####.net/moreapp/1408695357498_4bd30c_s.jpg
mi####.####.net/moreapp/1469203606104_bb913a_s.jpg
c####.####.org/strategy/sul18
mi####.####.net/moreapp/1465975627655_dca56c_r.png
mi####.####.net/moreapp/1463467537637_818334_r.png
mi####.####.net/moreapp/1463756210732_e606ba_s.jpg
mi####.####.net/moreapp/1467341751119_b386ae_s.jpg
mi####.####.net/moreapp/1463632660681_598c86_s.jpg
mi####.####.net/moreapp/1468601437980_b19d28_r.png
mi####.####.net/moreapp/1414484796659_8a5009_s.jpg
mi####.####.net/moreapp/1466590787125_81dd27_r.png
mi####.####.net/moreapp/1415861665694_aaee10_r.jpg
mi####.####.net/moreapp/1463716977127_7c0635_s.jpg
c####.####.org/strategy/larger4.3
mi####.####.net/moreapp/1447831281807_75a866_s.jpg
mi####.####.net/moreapp/1465204771463_2ed91d_r.png
mi####.####.net/moreapp/1464257322765_a657ad_s.jpg
mi####.####.net/moreapp/1466749329490_2f0096_s.jpg
mi####.####.net/moreapp/1463732908413_50110a_r.png
mi####.####.net/moreapp/1468410333593_19ab63_r.png
mi####.####.net/moreapp/1470414965580_0b6c60_r.png
mi####.####.net/moreapp/1444722449983_f44bdd_r.png
mi####.####.net/moreapp/1469203540012_2e1e0d_r.png
mi####.####.net/moreapp/1413345175312_1cbcce_r.jpg
c####.####.org/strategy/loss_4.3
mi####.####.net/moreapp/1473257121306_363ced_r.png
mi####.####.net/moreapp/1468410409006_01b275_s.jpg
mi####.####.net/moreapp/1464075150381_26ded9_s.jpg
mi####.####.net/moreapp/1467341739789_457d8e_r.jpg
mi####.####.net/moreapp/1447913082110_1791b8_s.jpg
mi####.####.net/moreapp/1463380930557_981643_r.png
mi####.####.net/moreapp/1464775224778_f0acc0_s.jpg
mi####.####.net/moreapp/1418385981148_2f83f5_r.jpg
mi####.####.net/moreapp/1467112549354_319790_s.jpg
mi####.####.net/moreapp/1474707589472_06ca7b_s.jpg
c####.####.org/strategy/dev_root
mi####.####.net/moreapp/1466136448747_7885f1_s.jpg
mi####.####.net/moreapp/1466590799525_08f8b1_s.jpg
mi####.####.net/moreapp/1464075142770_71d832_r.png
mi####.####.net/moreapp/1442461295497_ec8c78_r.png
mi####.####.net/moreapp/1468551935393_c0e782_r.png
mi####.####.net/moreapp/1462536432480_d42a8d_s.jpg
mi####.####.net/moreapp/1464690363847_d58665_r.png
mi####.####.net/moreapp/1408695339602_ef8340_r.jpg
mi####.####.net/moreapp/1464260246572_6d73de_s.jpg
mi####.####.net/moreapp/1466136428828_ba04c9_r.png
mi####.####.net/moreapp/1461312845130_8f6d32_s.jpg
mi####.####.net/moreapp/1465204136243_960105_r.png
mi####.####.net/moreapp/1414484811492_8882a0_r.jpg
mi####.####.net/moreapp/1463380983268_af67d7_r.png
mi####.####.net/moreapp/1466153838943_6e3dcb_s.jpg
mi####.####.net/moreapp/1464179177997_b9d0c0_s.jpg
mi####.####.net/moreapp/1447907770353_ffbe3f_s.jpg
mi####.####.net/moreapp/1415864359245_184e45_s.jpg
mi####.####.net/moreapp/1464946595073_c674a2_r.png
mi####.####.net/moreapp/1466153821530_c0fc8b_r.png
mi####.####.net/moreapp/1464690369527_39d5de_s.jpg
mi####.####.net/moreapp/1472831014673_f20982_s.jpg
mi####.####.net/moreapp/1415276967260_3b2fae_r.jpg
mi####.####.net/moreapp/1447830557975_2b6ea5_s.jpg
mi####.####.net/moreapp/1472831026370_17ab5e_r.png
c####.####.org/strategy/symlink-adbd
mi####.####.net/moreapp/1413366167066_a6130a_s.jpg
mi####.####.net/moreapp/1463632654554_2e6971_r.png
mi####.####.net/moreapp/1462364262668_101d37_s.jpg
mi####.####.net/moreapp/1464087965831_0c49f1_r.png
mi####.####.net/moreapp/1464866907411_c5d936_r.png
mi####.####.net/moreapp/1474707584948_bb2022_r.png
mi####.####.net/moreapp/1465975602575_cae9ca_s.jpg
mi####.####.net/moreapp/1464946618796_514ffd_s.jpg
mi####.####.net/moreapp/1468635910079_805300_r.png
mi####.####.net/moreapp/1464178799446_68a6c4_r.png
mi####.####.net/moreapp/1463033654134_93f58c_s.jpg
mi####.####.net/moreapp/1465204252955_e8fd85_s.jpg
mi####.####.net/moreapp/1467371123123_25e4cf_r.jpg
mi####.####.net/moreapp/1467343778654_0fb5e8_s.jpg
mi####.####.net/moreapp/1473257108250_ef1cd8_s.jpg

Запросы HTTP POST:

d####.####.com/aap.do
y####.####.cn/ct/sdpae/ug
1####.####.67/log/interface.html
1####.####.67/strategy/interface.html
y####.####.cn/ct/grt/feshf/r
mor####.####.net/pbweb/app/getAppConfig.do
mor####.####.net/AdlayoutBossWeb/platform/getRcAdvConrolNew.do
a####.####.com/app_logs
y####.####.cn/ct/gvetv/aluu
mor####.####.net/pbweb/app/getAndroidAppList.do

Изменения в файловой системе:

Создает следующие файлы:

/sdcard/.rcplatform/imageCache/-450884628.tmp
/sdcard/.rcplatform/imageCache/1548171349
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/Matrix
/sdcard/.rcplatform/imageCache/-1501938168.tmp
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/wsroot.sh
/sdcard/.rcplatform/imageCache/636027266.tmp
/sdcard/.rcplatform/imageCache/-611729900.tmp
/sdcard/.rcplatform/imageCache/1257734821.tmp
/data/data/####/shared_prefs/custom_ad_preference.xml
/data/data/####/cache/webviewCacheChromium/data_3
/sdcard/.rcplatform/imageCache/385821133.tmp
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/sdcard/.rcplatform/imageCache/383096458.tmp
/data/data/####/app_f7835219-392c-4927-91dd-30fdf3ac4cbb/install-recovery.sh
/sdcard/.rcplatform/imageCache/-638764677.tmp
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/.rcplatform/imageCache/-123652009.tmp
/sdcard/.rcplatform/imageCache/164940830.tmp
/sdcard/.rcplatform/imageCache/-1207207099
/sdcard/.rcplatform/imageCache/-244131347.tmp
/sdcard/.rcplatform/imageCache/1794010250.tmp
/sdcard/.rcplatform/imageCache/-1537637458.tmp
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/.rcplatform/imageCache/1204367357
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/wsroot.sh
/sdcard/.rcplatform/imageCache/-1089197670.tmp
/sdcard/.rcplatform/imageCache/1548289963
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/fileWork
/data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/su
/sdcard/.rcplatform/imageCache/-861951100.tmp
/data/data/####/databases/t_u.db-journal
/sdcard/.rcplatform/imageCache/235841040.tmp
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/su
/sdcard/.rcplatform/imageCache/-800663955.tmp
/data/data/####/shared_prefs/fbna_home_preference.xml
/data/data/####/files/.imprint
/sdcard/.rcplatform/imageCache/-1264080913
/sdcard/.rcplatform/imageCache/1295436677.tmp
/sdcard/.rcplatform/imageCache/1472662536.tmp
/sdcard/.rcplatform/imageCache/-1106948383.tmp
/sdcard/.rcplatform/imageCache/-1693555374.tmp
/sdcard/.rcplatform/imageCache/1755488268.tmp
/sdcard/.rcplatform/imageCache/1567553796.tmp
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/wsroot.sh
/sdcard/.rcplatform/imageCache/842693551.tmp
/data/data/####/app_subox_download/eca525ce-754b-4d48-a0c9-bb56748b4377
/data/data/####/shared_prefs/adbanner_preference.xml
/data/data/####/shared_prefs/clear_master_log.xml
/sdcard/.rcplatform/imageCache/-2046370534.tmp
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/debuggerd
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/install-recovery.sh
/sdcard/.rcplatform/imageCache/1288045517.tmp
/data/data/####/app_subox_download/0818599c-ccaf-4a2f-af1f-c033ea67946c
/sdcard/.rcplatform/imageCache/-1409015358.tmp
/data/data/####/cache/webviewCacheChromium/index
/sdcard/.rcplatform/imageCache/1124654264.tmp
/data/data/####/databases/db_more_apps-journal
/data/data/####/shared_prefs/dsi.xml
/sdcard/.rcplatform/imageCache/1826234379
/sdcard/.rcplatform/imageCache/1678345530
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/root3
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/Matrix
/sdcard/.rcplatform/imageCache/935006216.tmp
/sdcard/.rcplatform/imageCache/1203254381.tmp
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/app_f7835219-392c-4927-91dd-30fdf3ac4cbb/pidof
/sdcard/.rcplatform/imageCache/1307262303.tmp
/data/data/####/files/.flurryagent.187c9e3
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/supolicy
/data/data/####/app_f7835219-392c-4927-91dd-30fdf3ac4cbb/ddexe
/sdcard/.rcplatform/imageCache/-1552033243.tmp
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/sdcard/.rcplatform/imageCache/2114554159
/sdcard/.rcplatform/imageCache/-2136572638.tmp
/sdcard/.rcplatform/imageCache/689641861.tmp
/sdcard/.rcplatform/imageCache/-1748010465.tmp
/sdcard/.rcplatform/imageCache/-50927786.tmp
/sdcard/.rcplatform/imageCache/1774666318.tmp
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/toolbox
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/device.db
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/pidof
/sdcard/.rcplatform/imageCache/1375246713
/data/data/####/files/umeng_it.cache
/sdcard/.rcplatform/imageCache/1451675071.tmp
/sdcard/.rcplatform/imageCache/1565002856.tmp
/sdcard/.rcplatform/imageCache/458118776.tmp
/data/data/####/shared_prefs/applicationstart.xml
/sdcard/.rcplatform/imageCache/-333651980.tmp
/data/data/####/app_c4ef1efa-d004-40f6-86c3-aaf49bb00f06/eh.jar
/data/data/####/app_anonymous_files/anonymous_core.so
/data/data/####/app_f7835219-392c-4927-91dd-30fdf3ac4cbb/supolicy
/sdcard/.rcplatform/imageCache/-778754193.tmp
/sdcard/.rcplatform/imageCache/1274700115.tmp
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/debuggerd
/data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
/sdcard/.rcplatform/imageCache/-90779240
/sdcard/.rcplatform/imageCache/-1503381316.tmp
/data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/debuggerd
/sdcard/.rcplatform/imageCache/-1503516108.tmp
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/pidof
/sdcard/.rcplatform/imageCache/-1474675454.tmp
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/fileWork
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/toolbox
/sdcard/.rcplatform/imageCache/-1412714332.tmp
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/ddexe
/sdcard/.rcplatform/imageCache/-1594465574.tmp
/sdcard/.rcplatform/imageCache/1924839031.tmp
/data/data/####/app_subox/b18a021d11a3004d25017230b681476b
/data/data/####/shared_prefs/kr.xml
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/toolbox
/sdcard/.rcplatform/imageCache/294154858.tmp
/sdcard/.rcplatform/imageCache/-336288103.tmp
/sdcard/.rcplatform/imageCache/1702009660.tmp
/data/data/####/files/SUBOXLOG_
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/fileWork
/sdcard/.rcplatform/imageCache/283498381.tmp
/sdcard/.rcplatform/imageCache/-1912909232.tmp
/sdcard/.rcplatform/imageCache/-224805273
/data/data/####/app_subox_download/d140b181-18f4-437d-b03c-a636bcce3470
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/install-recovery.sh
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/su
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/ddexe
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/supolicy
/sdcard/.rcplatform/imageCache/-356731211
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/pidof
/sdcard/.rcplatform/imageCache/-156709794.tmp
/sdcard/.rcplatform/imageCache/-906057274.tmp
/data/data/####/shared_prefs/commentattention.xml
/sdcard/.rcplatform/imageCache/-485362697
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/wsroot.sh
/sdcard/.rcplatform/imageCache/500686732
/data/data/####/cache/ads1609280947.jar
/sdcard/.rcplatform/imageCache/-1210796261
/sdcard/.rcplatform/imageCache/399927323.tmp
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/.rcplatform/imageCache/1797672641.tmp
/sdcard/.rcplatform/imageCache/428003506.tmp
/sdcard/.rcplatform/imageCache/-266860563
/sdcard/.rcplatform/imageCache/1470162209
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/Matrix
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/install-recovery.sh
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/supolicy
/data/data/####/shared_prefs/more_apps.xml
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/fileWork
/sdcard/.rcplatform/imageCache/-2056408224
/sdcard/.rcplatform/imageCache/-82849396.tmp
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/pidof
/sdcard/.rcplatform/imageCache/1657340780
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/debuggerd
/sdcard/.rcplatform/imageCache/1015645679.tmp
/sdcard/.rcplatform/imageCache/-341874841.tmp
/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/su
/sdcard/.rcplatform/imageCache/423819196.tmp
/sdcard/.rcplatform/imageCache/-176629517.tmp
/sdcard/.rcplatform/imageCache/-849050647
/data/data/####/app_subox_download/de3ed4ca-c80b-42ef-810d-fbbd2dca05ae
/sdcard/.rcplatform/imageCache/1342633600
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/ddexe
/sdcard/.rcplatform/imageCache/1169768261.tmp
/data/data/####/shared_prefs/kr.xml.bak
/data/data/####/shared_prefs/ad_preference.xml
/sdcard/.rcplatform/imageCache/1484195290.tmp
/sdcard/.rcplatform/imageCache/-785714158.tmp
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/supolicy
/sdcard/.rcplatform/imageCache/-108345660.tmp
/sdcard/.rcplatform/imageCache/355894418.tmp
/sdcard/.rcplatform/imageCache/-1540760399
/sdcard/.rcplatform/imageCache/-2057583693.tmp
/sdcard/.rcplatform/imageCache/1588461607.tmp
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/toolbox
/data/data/####/files/nq.jar
/data/data/####/app_f7835219-392c-4927-91dd-30fdf3ac4cbb/debuggerd
/sdcard/.rcplatform/imageCache/-1708160176.tmp
/sdcard/.rcplatform/imageCache/1274710076
/data/data/####/databases/webview.db-journal
/data/data/####/files/mobclick_agent_cached_####1016
/data/data/####/shared_prefs/fbna_share_preference.xml
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/ddexe
/data/data/####/app_subox_download/35f430f1-5047-4e66-bd74-693763c29ce3
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/install-recovery.sh
/sdcard/.rcplatform/imageCache/392933282
/sdcard/.rcplatform/imageCache/449454130.tmp
/data/data/####/app_subox_download/a55fa2bd-510d-4a28-a807-aaf0cbaff23e
/sdcard/.rcplatform/imageCache/-405836110.tmp
/data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/Matrix
/sdcard/.rcplatform/imageCache/638855498.tmp
/sdcard/.rcplatform/imageCache/-1380753148.tmp

Присваивает атрибут 'исполняемый' для следующих файлов:

/data/data/####/app_0a42d11c-00cd-400b-9531-b6e56074ed37/Matrix
/data/data/####/app_c729c1fa-67a6-4dd1-89e3-7c9f6e638c65/Matrix
/data/data/####/app_16335bfc-4356-48f4-95e1-6647d01c1cef/Matrix
/data/data/####/app_6b097ee3-532a-455e-a69d-51c69abc2c87/Matrix

Другие:

Запускает следующие shell-скрипты:

sh
cat proc/meminfo

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней