Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- set####.####.com
- o####.####.com
- d####.####.com
- mobotoo####.####.com
- cdn####.####.com
- n####.####.com
- a####.####.com
Запросы HTTP GET:
- a####.####.com/client/newwallpaper/hottest.do?pageSize=####&version=####&country=####&language=####
- mobotoo####.####.com/mobotoolpush/addispsort.json?facebook=####&language=####&googleplay=####&channel=####&pkgname=####&os_version=####&country=####&v...
- d####.####.com/wallpaper/img/567/58b6a232e4b05d7b7e6a0a17/1488364082349/wallpaper.jpg
- d####.####.com/wallpaper/img/901/58b6a253e4b05d7b7e6a0a1d/1488364115342/wallpaper.jpg
- d####.####.com/wallpaper/img/737/58b6a13fe4b05d7b7e6a05a1/1488363839956/wallpaper_s.jpg
- d####.####.com/wallpaper/img/628/58b69ebce4b05d7b7e69abb4/1488363196265/wallpaper_s.jpg
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=##...
- d####.####.com/wallpaper/img/663/58b6a1e1e4b05d7b7e6a0a0f/1488364001226/wallpaper_s.jpg
- d####.####.com/wallpaper/img/937/58b6a287e4b05d7b7e6a0a21/1488364167960/wallpaper.jpg
- s####.####.com/lunbotu/619/285363813/lunbo_1460734848121.png
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/15/58c6551bcbe58.png
- s####.####.com/lunbotu/329/1333333811/lunbo_1460735067916.jpg
- s####.####.com/lunbotu/696/1433472200/lunbo_1460735003354.jpg
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c6548a0fd68.png
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&ad_num=####&only_impression=####&ping_mode=####&tnum=####&ttc_ids=####&o...
- d####.####.com/onlyImpression?k=####&p=####
- d####.####.com/wallpaper/img/729/58b6a23ce4b05d7b7e6a0a19/1488364092686/wallpaper_s.jpg
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c65482b410d.png
- a####.####.com/client/newtheme/hottest.do?pageSize=####&language=####&density=####&version=####&country=####
- d####.####.com/wallpaper/img/567/58b6a232e4b05d7b7e6a0a17/1488364082349/wallpaper_s.jpg
- d####.####.com/wallpaper/img/937/58b6a287e4b05d7b7e6a0a21/1488364167960/wallpaper_s.jpg
- cdn####.####.com/cdn-adn/dmp/16/11/14/23/17/5829d5a1e19a1.JPEG
- s####.####.com/lunbotu/516/181056064/lunbo_1460734566915.png
- d####.####.com/wallpaper/img/350/58b69ee9e4b05d7b7e69abb6/1488363241989/wallpaper_s.jpg
- d####.####.com/wallpaper/img/729/58b6a23ce4b05d7b7e6a0a19/1488364092686/wallpaper.jpg
- d####.####.com/wallpaper/img/359/58b6a2bae4b05d7b7e6a0a27/1488364218769/wallpaper_s.jpg
- d####.####.com/wallpaper/img/379/58b6a2d4e4b05d7b7e6a0a2b/1488364244803/wallpaper_s.jpg
- d####.####.com/wallpaper/img/679/58b6a25ee4b05d7b7e6a0a1f/1488364126206/wallpaper.jpg
- d####.####.com/wallpaper/img/875/58b6a29ce4b05d7b7e6a0a23/1488364188831/wallpaper.jpg
- d####.####.com/wallpaper/img/83/58b6a17ae4b05d7b7e6a05a3/1488363898740/wallpaper_s.jpg
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
- d####.####.com/wallpaper/img/325/58b6a189e4b05d7b7e6a05a5/1488363913621/wallpaper_s.jpg
- d####.####.com/wallpaper/img/875/58b6a29ce4b05d7b7e6a0a23/1488364188831/wallpaper_s.jpg
- cdn####.####.com/cdn-adn/html/common/2016/02/22/22/03/com.qihoo.security1456149668.2_1200X627.JPEG
- d####.####.com/wallpaper/img/691/58b6a208e4b05d7b7e6a0a13/1488364040388/wallpaper_s.jpg
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&only_impression=####&ad_num=####&ping_mode=####&ttc_ids=####&tnum=####&o...
- cdn####.####.com/cdn-adn/html/common/2016/07/24/04/04/com.playrix.fishdomdd.gplay1469304241.92_1200X627.JPEG
- d####.####.com/wallpaper/img/673/58b6a1eee4b05d7b7e6a0a11/1488364014306/wallpaper_s.jpg
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6543ca78b3.png
- d####.####.com/wallpaper/img/891/58b6a246e4b05d7b7e6a0a1b/1488364102709/wallpaper.jpg
- cdn####.####.com/cdn-adn/html/common/2016/02/23/00/08/es.socialpoint.MonsterLegends1456157185.41_1200X627.JPEG
- d####.####.com/wallpaper/img/658/54a3c085e4b0e2c794bc3dd2/1420017797756/wallpaper_s.jpg
- o####.####.com/ipo/api/gray/status?appvc=####&os=####&appvn=####&avn=####&did=####&pn=####&lc=####&chn=####
- d####.####.com/wallpaper/img/117/58b6a2abe4b05d7b7e6a0a25/1488364203746/wallpaper_s.jpg
- d####.####.com/wallpaper/img/93/58b6a221e4b05d7b7e6a0a15/1488364065302/wallpaper_s.jpg
- d####.####.com/wallpaper/img/369/58b6a2c7e4b05d7b7e6a0a29/1488364231590/wallpaper_s.jpg
- d####.####.com/wallpaper/img/117/58b6a2abe4b05d7b7e6a0a25/1488364203746/wallpaper.jpg
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...
- d####.####.com/impression?k=####&p=####&q=####&x=####
Запросы HTTP POST:
- a####.####.com/app_logs
- o####.####.com/check_config_update
- a####.####.com/client/newwallpaper/lastest.do?pageSize=####&type=####&language=####&country=####
- a####.####.com/client/resource/carouselAd/list.do?&country=####&language=####&channel=####&pageNum=####&pageSize=####
- a####.####.com/client/targetcountry/list.do?language=####&country=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_mms_com_android_mms_ui_conversationlist.png
- /sdcard/.mobvista700/download/-388989307
- /sdcard/clauncher.cyou.inc/elegant/volley/json/-1371436213-500552621
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1882922577734829570
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_quicksearchbox_com_android_quicksearchbox_searchactivity.png
- /data/data/####/app_app_apk/lite.dat.jar
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60185-0001-085C-8B5440F83A64BeginSession.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/jp_naver_line_android_jp_naver_line_android_activity_splashactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B800F1-0001-08F3-8B5440F83A64SessionOS.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-2012184040257696875
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1383837400-878638595
- /sdcard/clauncher.cyou.inc/elegant/volley/image/793378259902855808
- /sdcard/.mobvista700/download/965947873.temp
- /data/data/####/shared_prefs/dcSharedPreferences.dat.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-4957252361636377669
- /sdcard/.mobvista700/download/-1377858248.temp
- /data/data/####/shared_prefs/PersistedSetToDoSet.xml
- /data/data/####/files/mobclick_agent_cached_####78
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
- /data/data/####/shared_prefs/32b7c79dc228de426ce9c9352eb018be.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_music_com_android_music_musicbrowseractivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_b0c7b654-455e-4019-9e1d-3ab1881012e9_1485416651904.tap
- /data/data/####/files/.cma_theme/dock_icon/drawable/ic_allapps.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_browser_com_android_browser_browseractivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60192-0001-0876-8B5440F83A64SessionOS.cls_temp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/spf_beha.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1324513444-625743816
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-4089953761241395658
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_camera_com_android_camera_camera.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1991787598222085827
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-11358165581862618439
- /data/data/####/files/gaClientId
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60192-0001-0876-8B5440F83A64SessionDevice.cls_temp
- /sdcard/.mobvista700/download/-898324802
- /data/data/####/files/adapt.db
- /data/data/####/shared_prefs/c2dm.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D802BB-0001-0A02-8B5440F83A64SessionDevice.cls_temp
- /data/data/####/shared_prefs/install.xml
- /data/data/####/shared_prefs/trending_config.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60192-0001-0876-8B5440F83A64SessionApp.cls_temp
- /data/data/####/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_deskclock_com_android_deskclock_deskclock.png
- /data/data/####/files/cmawidgets.xml.tmp
- /data/data/####/files/file
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B402B5-0001-0819-8B5440F83A64SessionDevice.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_google_android_apps_maps_com_google_android_maps_mapsactivity.png
- /sdcard/.mobvista700/download/-2775558
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D8022A-0001-09F4-8B5440F83A64SessionOS.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B402B5-0001-0819-8B5440F83A64BeginSession.cls
- /data/data/####/files/.cma_theme/app_icon/drawable/com_cyou_cma_clauncher_com_cyou_cma_beauty_center_beautycenterentrance.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B800F1-0001-08F3-8B5440F83A64SessionApp.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_mobogenie_com_mobogenie_activity_startactivity.png
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B800F1-0001-08F3-8B5440F83A64BeginSession.cls_temp
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B402B5-0001-0819-8B5440F83A64SessionOS.cls_temp
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/files/flag_all_app
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60192-0001-0876-8B5440F83A64BeginSession.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/19130220582078128780
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_contacts_com_android_contacts_activities_dialtactsactivity.png
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/shared_prefs/workspace_row_column.xml
- /data/data/####/shared_prefs/SDKIDFA.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-12601193901116738888
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60185-0001-085C-8B5440F83A64SessionApp.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/16259287321950282321
- /sdcard/.mobvista700/download/-1331407292
- /sdcard/clauncher.cyou.inc/elegant/volley/json/1347844627-1909152979
- /sdcard/clauncher.cyou.inc/elegant/volley/image/326126761-562776009
- /data/data/####/files/umeng_it.cache
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1584760093-354177664
- /data/data/####/files/.cma_theme/app_icon/drawable/com_ucmobile_intl_com_ucmobile_main_ucmobile.png
- /data/data/####/files/temp_notification_wallpaper_image
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_music_com_android_music_videobrowseractivity.png
- /sdcard/.mobvista700/download/1880935128.temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-163739173815275813
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B800F1-0001-08F3-8B5440F83A64SessionDevice.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1609836964-1448643392
- /data/data/####/files/.cma_theme/app_icon/drawable/com_viber_voip_com_viber_voip_welcomeactivity.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-321734582-1285464517
- /data/data/####/shared_prefs/installation.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60185-0001-085C-8B5440F83A64SessionDevice.cls_temp
- /sdcard/.mobvista700/download/-1174155579.temp
- /data/data/####/shared_prefs/com.crashlytics.prefs.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_instagram_android_com_instagram_android_activity_maintabactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_twitter_android_com_twitter_android_startactivity.png
- /data/data/####/files/.cma_theme/info.prop
- /data/data/####/files/.cma_theme/customize_mat/drawable/default_customize_cover.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1625928701-102958160
- /data/data/####/databases/elegant.db-journal
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D802BB-0001-0A02-8B5440F83A64BeginSession.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1178652976-1886642739
- /data/data/####/files/.cma_theme/app_icon/drawable/com_facebook_orca_com_facebook_orca_auth_startscreenactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_bsb_hike_com_bsb_hike_ui_homeactivity.png
- /data/data/####/shared_prefs/FBAdPrefs.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_whatsapp_com_whatsapp_main.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-10451211031301266691
- /data/data/####/shared_prefs/push_local_config.xml
- /data/data/####/shared_prefs/com.crashlytics.sdk.android:answers:settings.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_settings_com_android_settings_settings.png
- /data/data/####/databases/000.db-journal
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_providers_downloads_ui_com_android_providers_downloads_ui_downloadlist.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- /data/data/####/shared_prefs/strategy_sp.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-11358196551775230262
- /data/data/####/files/.cma_theme/customize_mat/drawable/default_customize_mat.png
- /data/data/####/files/launcher.preferences
- /data/data/####/files/.cma_theme/app_icon/drawable/com_sgiggle_production_com_sgiggle_production_startup.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B402B5-0001-0819-8B5440F83A64SessionApp.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1364831877-101207113
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_gallery3d_com_android_gallery3d_app_gallery.png
- /data/data/####/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/shared_prefs/quick_charging.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1694134574486332097
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_calendar_com_android_calendar_allinoneactivity.png
- /data/data/####/shared_prefs/dcSharedPreferences.dat.xml.bak
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-1725179473668085183
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8B60185-0001-085C-8B5440F83A64SessionOS.cls_temp
- /data/data/####/shared_prefs/CountryInfo.xml
- /data/data/####/shared_prefs/dataTrans.xml
- /data/data/####/shared_prefs/configs.xml
- /data/data/####/files/.cma_theme/wallpaper/drawable/wallpaper.jpg
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_5ffded9b-0076-44e0-b303-bc44b9648199_1485416630373.tap
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D802BB-0001-0A02-8B5440F83A64SessionApp.cls_temp
- /data/data/####/files/watch_server
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-230604493-1208841484
- /data/data/####/files/.cma_theme/app_icon/drawable/com_skype_polaris_com_skype_raider_main.png
- /data/data/####/files/.imprint
- /data/data/####/databases/webview.db-journal
- /sdcard/clauncher.cyou.inc/elegant/volley/image/1020909871-8391876
- /sdcard/clauncher.cyou.inc/elegant/volley/json/9088968231963602097
- /data/data/####/files/.cma_theme/app_icon/drawable/com_cyou_cma_clockscreen_com_cyou_cma_clockscreen_activity_splashactivity.png
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D8022A-0001-09F4-8B5440F83A64BeginSession.cls_temp
- /sdcard/clauncher.cyou.inc/elegant/volley/image/-100526270-1885395445
- /data/data/####/files/.cma_theme/app_icon/drawable/com_tencent_mm_com_tencent_mm_ui_launcherui.png
- /data/data/####/databases/ztrack.db-journal
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/code_cache/secondary-dexes/tmp-####-1.apk.classes-583589093.zip
- /data/data/####/shared_prefs/32b7c79dc228de426ce9c9352eb018be.xml.bak
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D802BB-0001-0A02-8B5440F83A64SessionOS.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_facebook_katana_com_facebook_katana_loginactivity.png
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_email_com_android_email_activity_welcome.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/762333360-443467087
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D8022A-0001-09F4-8B5440F83A64SessionDevice.cls_temp
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_contacts_com_android_contacts_activities_peopleactivity.png
- /sdcard/clauncher.cyou.inc/elegant/volley/image/15199950492135282937
- /data/data/####/shared_prefs/spf_stat.xml
- /data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889A8D8022A-0001-09F4-8B5440F83A64SessionApp.cls_temp
- /data/data/####/shared_prefs/spf_theme.xml
- /data/data/####/shared_prefs/PersistedMapTagLastSeenMap.xml
- /data/data/####/files/.cma_theme/app_icon/drawable/com_android_calculator2_com_android_calculator2_calculator.png
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/watch_server
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/watch_server /data/data/#### http://survey.dolphin.com/plugin/index.html?pn=####&v=78&an=####&lc=en_US&tag=cyou com.android.browser/com.android.browser.BrowserActivi
Может автоматически отправлять СМС-сообщения.
