Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Duad.2.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- c####.####.com
- g####.####.net
- sta####.####.com
- and####.####.com
- r####.####.com
- d321wy3####.####.net
- a####.####.com
Запросы HTTP GET:
- g####.####.net/prod/upload/adunion/images/f42/170_170_b1376b76b3df4262.png
- g####.####.net/prod/upload/adunion/images/87b/1200_628_f40fec8dea378fa8.jpeg
- g####.####.net/prod/upload/adunion/images/b33/170_170_e42950162f296436.png
- g####.####.net/prod/upload/adunion/images/f1e/170_170_2cb943404a214bf8.png
- g####.####.net/prod/upload/adunion/images/73d/170_170_2084cb0e51fc5a8e.png
- g####.####.net/prod/upload/adunion/images/fc9/170_170_8ab597a0066d631b.png
- sta####.####.com/contents/videos_screenshots/2569000/2569446/preview.jpg
- g####.####.net/prod/upload/adunion/images/648/170_170_44502c240c44c9b8.png
- g####.####.net/prod/upload/adunion/images/291/170_170_6d307c828431f119.png
- g####.####.net/prod/upload/adunion/images/ed8/170_170_90aa93639ee570d8.png
- g####.####.net/prod/upload/adunion/images/0eb/417_628_bf82d19709a7f26e.jpeg
- sta####.####.com/contents/videos_screenshots/2839000/2839825/preview.jpg
- sta####.####.com/contents/videos_screenshots/2258000/2258412/preview_hq.mp4.jpg
- g####.####.net/prod/upload/adunion/images/3ac/170_170_8ca0180e5304a2a0.png
- g####.####.net/prod/upload/adunion/images/dae/170_170_076ed69922e61c09.png
- g####.####.net/prod/upload/adunion/images/c0d/1200_628_959346f813e837cb.jpeg
- g####.####.net/prod/upload/adunion/images/d89/800_400_4f3f8c423fab58e7.jpeg
- g####.####.net/prod/upload/adunion/images/7da/170_170_f9916e14557a9e35.png
- c####.####.com/index.php?service=####&pub=####&campaign_id=####&uc_tran####
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/667/1200_628_d17459ef1ccbc141.jpeg
- g####.####.net/prod/upload/adunion/images/362/170_170_d1463272379bc47d.png
- sta####.####.com/contents/videos_screenshots/2451000/2451341/preview.jpg
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- sta####.####.com/contents/videos_screenshots/2774000/2774228/preview.jpg
- g####.####.net/prod/upload/adunion/images/cbf/796_416_28207ee371b2237e.jpeg
- g####.####.net/prod/upload/adunion/images/9ee/796_416_5f9fd7bfed86464f.jpeg
- sta####.####.com/contents/videos_screenshots/2563000/2563635/preview.jpg
- g####.####.net/prod/upload/adunion/images/0b0/1200_628_0a2f6d76d6af5ae4.jpeg
- g####.####.net/prod/upload/adunion/images/2e6/1200_628_934730c105767704.jpeg
- g####.####.net/prod/upload/adunion/images/c8e/800_400_8fe2cef5ca4a7dde.jpeg
- g####.####.net/prod/upload/adunion/images/813/170_170_3e0f352d99d9bc8d.png
- d321wy3####.####.net/apps/20161103/com_my_heroesofutopia-7588.apk
- g####.####.net/prod/upload/adunion/images/556/170_170_02012c1dbc9b5315.png
- g####.####.net/prod/upload/adunion/images/4af/170_170_ab2cd1cf0174fcdb.png
- g####.####.net/prod/upload/adunion/images/32d/796_415_07ca0e59e98334a6.jpeg
- sta####.####.com/contents/videos_screenshots/2790000/2790227/preview.jpg
- g####.####.net/prod/upload/adunion/images/878/170_170_3949543610e5e0f4.png
- g####.####.net/prod/upload/adunion/images/3ad/170_170_ce1c97c2a6a249f5.png
- g####.####.net/prod/upload/adunion/images/08f/1200_628_95230142b7245187.jpeg
- g####.####.net/prod/upload/adunion/images/6a5/798_417_2e47b16d8c49962c.jpeg
- g####.####.net/prod/upload/adunion/images/f40/170_170_851a41a3e7c2e9c2.png
- g####.####.net/prod/upload/adunion/images/74e/170_170_13d621603fca6863.png
- sta####.####.com/contents/videos_screenshots/2601000/2601476/preview.jpg
- g####.####.net/prod/upload/adunion/images/4a3/170_170_bd449e7a0911dfc4.png
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=###...
- sta####.####.com/contents/videos_screenshots/2599000/2599154/preview_hq.mp4.jpg
- g####.####.net/prod/upload/adunion/images/1f7/170_170_247d470acd8fcfbb.png
- sta####.####.com/contents/videos_screenshots/2839000/2839648/preview.jpg
- g####.####.net/prod/upload/adunion/images/978/170_170_cf81804c9fe3d1d8.png
- g####.####.net/prod/upload/adunion/images/ff9/170_170_a964e30d748dd608.png
- g####.####.net/prod/upload/adunion/images/9a2/170_170_dc6e2964b14fd9bd.png
- g####.####.net/prod/upload/adunion/images/fa3/170_170_5130d28d99229203.png
- g####.####.net/prod/upload/adunion/images/1fd/170_170_40f6cf4d761b294a.png
- g####.####.net/prod/upload/adunion/images/b89/170_170_93f0c1e09596695f.png
- g####.####.net/prod/upload/adunion/images/fb5/170_170_08277f83edf9172d.png
- g####.####.net/prod/upload/adunion/images/9f7/1200_628_a042ce9c88087356.jpeg
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####...
- g####.####.net/prod/upload/adunion/images/211/170_170_d150af084604cbdf.png
Запросы HTTP POST:
- and####.####.com/rqd/async
- r####.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&ls...
- a####.####.com/app_logs
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&l...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/pl.apk
- /data/data/####/cache/picasso-cache/e48334ab600cf3bebc8ed17ba433ec52.1.tmp
- /data/data/####/cache/picasso-cache/e48334ab600cf3bebc8ed17ba433ec52.0.tmp
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/cache/picasso-cache/43c8fa137a40a43f19d049268aa8a8f5.0.tmp
- /data/data/####/mix.dex
- /data/data/####/cache/picasso-cache/bf207c9365c15e667678b87457f0a2d2.0.tmp
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/picasso-cache/591fbf42bbb7f06d1619106b22a7eeb5.0.tmp
- /data/data/####/cache/picasso-cache/dc97496f6422550673ad27f82242410d.1.tmp
- /data/data/####/files/pl.apk.tmp.tmp
- /data/data/####/files/AdjustIoActivityState
- /data/data/####/cache/picasso-cache/1903103d15f66b4f274320f9201f73b3.1.tmp
- /data/data/####/databases/_nohttp_cookies_db.db
- /data/data/####/cache/picasso-cache/journal
- /data/data/####/databases/gfad.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/picasso-cache/43c8fa137a40a43f19d049268aa8a8f5.1.tmp
- /data/data/####/cache/picasso-cache/bf207c9365c15e667678b87457f0a2d2.1.tmp
- /data/data/####/cache/picasso-cache/1903103d15f66b4f274320f9201f73b3.0.tmp
- /data/data/####/files/AdjustIoPackageQueue
- /data/data/####/Plugin/com.speed.top/dalvik-cache/base-1.dex
- /data/data/####/cache/picasso-cache/ddb764e4ee1e52402287b7a1521a24a9.0.tmp
- /data/data/####/cache/picasso-cache/ddb764e4ee1e52402287b7a1521a24a9.1.tmp
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/Plugin/com.speed.top/Signature/Signature_0.key
- /data/data/####/tx_shell/libshella-2.7.2.0.so
- /data/data/####/cache/picasso-cache/0ddfc023ebff761bba9f82934444b8cf.1.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/picasso-cache/d5ee6b5b80f03cc34504dd327c9a7368.1.tmp
- /data/data/####/cache/picasso-cache/dc97496f6422550673ad27f82242410d.0.tmp
- /data/data/####/databases/_nohttp_cookies_db.db-journal
- /data/data/####/cache/picasso-cache/d5ee6b5b80f03cc34504dd327c9a7368.0.tmp
- /data/data/####/Plugin/com.speed.top/apk/base-1.apk
- /data/data/####/cache/picasso-cache/a8786b466caf6a1d40b180d2943ba5b6.1.tmp
- /data/data/####/cache/picasso-cache/a8786b466caf6a1d40b180d2943ba5b6.0.tmp
- /data/data/####/files/security_info
- /data/data/####/daemon.t.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/picasso-cache/591fbf42bbb7f06d1619106b22a7eeb5.1.tmp
- /data/data/####/files/local_crash_lock
- /sdcard/gpopp/cc063be2aa24dea3657dad75355d12cf.tmp
- /data/data/####/cache/picasso-cache/0ddfc023ebff761bba9f82934444b8cf.0.tmp
- /data/data/####/files/native_record_lock
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/tx_shell/libshella-2.7.2.0.so
Другие:
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
