Android.Packed.20467

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.1.origin

Сетевая активность:

Подключается к:

u####.####.com
cou####.####.top
c####.####.org
ce####.####.org
e####.####.com
e####.####.com:8088
1####.####.98:8019
m####.####.com
1####.####.98
a####.####.com

Запросы HTTP GET:

c####.####.org/v2/content/list-0-46834273-46831236-0-23-0-1.json
1####.####.98/m/umeng:58eb5c26c8957657a0000583/600/AmxEDvvtYxMVY81P8bzof...
a####.####.com/2017/03/16/16291628.dex
c####.####.org/v2/content/list-0-0-0-NL-6-0-1.json?1485415####
c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1485415####
1####.####.98:8019/m/umeng:58eb5c26c8957657a0000583/600/AmxEDvvtYxMVY81P...
c####.####.org/v2/content/list-1-46834273-46831236-0-23-0-1.json
c####.####.org/2017-04-11/922d4250344d6ee508b4c4344bb1e1dd.jpg!240
ce####.####.org/v3/system/initcountrytopic.json
c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
c####.####.org/2017-04-11/8708128e0b79bbe560aa4d54c5e592e1.jpg!240
c####.####.org/v2/system/models-99.json
c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
c####.####.org/v2/content/list-0-0-0-NL-2-0-1.json?1485415####
c####.####.org/v2/content/list-0-0-0-0-23-0-1.json?1485415####
cou####.####.top/api/push/getsilentpushcfg2.json?push_ver=####&commonk####
u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
c####.####.org/2017-04-11/3c484b460e72773cb0b63ea1ea002395.jpg!240
ce####.####.org/v3/system/countrys.json
c####.####.org/v2/system/startimg-NL.json
c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
ce####.####.org/v2/content/recommend-551a738f15a6ccdf7c750058aec4b81d-NL...
cou####.####.top/i?app_key=####&timestamp=####&sdk_version=####&begin_se...
a####.####.com/2017/03/16/162846737.so
c####.####.org/2017-04-11/83fc704c87bf08c18c81e3d273405769.jpg!240
c####.####.org/v2/content/list-0-0-0-NL-18-0-1.json?1485415####
cou####.####.top/api/push/getpushcfg2.json?push_ver=####&commonk####
cou####.####.top/api/push/getswitcher?commonk####
c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
c####.####.org/v2/system/version-1-99.json
a####.####.com/2017/03/16/162833859.so
c####.####.org/2017-04-11/4178cb7dcf8cb387238deea29673d4d4.png!240
c####.####.org/2017-04-07/ae3d6e9c70b70fcee791b4e1d2fe5c08.jpg!240
c####.####.org/2017-04-11/649dce526ad55da5ca89a6a1e2cb9eba.jpg!240
u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
c####.####.org/2017-03-10/29a6ece9e262b02f06eaf47fd9892870.jpg
c####.####.org/v2/system/languages.json
c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
a####.####.com/2017/03/16/162908592.dat
c####.####.org/2017-04-07/75a98456c0ad8586ce36e080ef39fc66.jpg!240
c####.####.org/v2/content/list-0-0-0-NL-5-0-1.json?1485415####
c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
c####.####.org/2017-04-11/1d3647b74f7100ed7ab3345029cdd24e.jpg!240
a####.####.com/2017/03/16/162928889.so
c####.####.org/v2/content/list-0-0-0-NL-3-0-1.json?1485415####

Запросы HTTP POST:

e####.####.com/ping
cou####.####.top/api/push/getpush?id=####&push_ver=####&time=####&common...
cou####.####.top/android_md_log/req?commonk####
ce####.####.org/auth/gather
e####.####.com:8088/sdk/api/ad/hull
cou####.####.top/api/push/getsilentpush.json?push_ver=####&time=####&com...
e####.####.com/sdk/api/log/record
a####.####.com/ad-service/ad/mark
a####.####.com/app_logs
e####.####.com/sdk/api/regclient
m####.####.com/v2/register
cou####.####.top/android/check_version?commonk####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/.jiagu.lock
/sdcard/Android/data/####/files/logdata/delay_20170126073046756_551a738f15a6ccdf7c750058aec4b81d_s.dat
/data/data/####/shared_prefs/AGOO_HOST.xml
/sdcard/AuthP/push_stat.dat
/data/data/####/databases/MsgLogStore.db-journal
/data/data/####/databases/snowfoxad_msg.db-journal
/sdcard/Android/data/####/cache/uil-images/2yusinm2rkywdc11qxg0n4lup.0.tmp
/data/data/####/files/.yflurryreport.-19a1baa3c3b56721
/data/data/####/files/AppEventsLogger.persistedevents
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
/sdcard/Android/data/####/cache/uil-images/7bm49evedwkg5wrg69xpl4qsi.0.tmp
/data/data/####/shared_prefs/ContextData.xml
/data/data/####/shared_prefs/jg_app_update_settings_random.xml
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/shared_prefs/configLookPath.xml
/data/data/####/shared_prefs/multidex.version.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_68ZGVS9TVHMTQ54WBGK9_216
/sdcard/.DataStorage/ContextData.xml
/sdcard/####/WelcomeImg/29a6ece9e262b02f06eaf47fd9892870.jpg
/data/data/####/databases/webview.db-journal
/sdcard/AuthPush/hstype.txt
/data/data/####/shared_prefs/PhoneUtil.xml
/data/data/####/dex_cache/base2761118578.zip
/sdcard/Android/data/####/cache/uil-images/37way6sghmg4qdb8n1u9aeax2.0
/data/data/####/app_jgls/.log.ls
/data/data/####/shared_prefs/Alvin2.xml
/sdcard/Android/data/####/cache/uil-images/79bjplrvi8jpxp6agp3ub9uc6.0.tmp
/data/data/####/files/.yflurryadlog.-19a1baa3c3b56721
/sdcard/Android/data/####/.snowfoxmsg/dev_4861173f.txt
/data/data/####/files/lookDL/dlLookCore-1140376591.tmp
/data/data/####/shared_prefs/COUNTLY_STORE.xml
/sdcard/Android/data/####/cache/uil-images/684wxuckp94syhkowv43oeefo.0.tmp
/data/data/####/files/lookDL/dlLookCore1406615494.tmp
/data/data/####/shared_prefs/com.google.android.gms.appid.xml
/data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
/data/data/####/shared_prefs/Game_recommend.xml
/sdcard/Android/data/####/cache/uil-images/3w1nciday7eocv14qexy2zcqf.0
/data/data/####/files/mesosphere.so
/data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
/sdcard/AuthP/push_look.lck
/sdcard/AuthP/push_config.dat
/data/data/####/shared_prefs/Prophet.xml
/data/data/####/dex_cache/MultiDex.lock
/data/data/####/shared_prefs/umeng_message_state.xml
/sdcard/Android/data/####/.snowfoxmsg/imei.txt
/data/data/####/shared_prefs/Game_recommend.xml.bak
/data/data/####/no_backup/com.google.android.gms.appid-no-backup
/data/data/####/files/lookDL/dlLookPlugin.dat2003196202.tmp
/sdcard/.UTSystemConfig/Global/Alvin2.xml
/data/data/####/files/lookDL/base2-1140376591.tmp
/data/data/####/files/.yflurryfreqcap.-19a1baa3c3b56721
/data/data/####/files/.jglogs/.jg.ac
/data/data/####/files/####.dex
/data/data/####/files/umeng_it.cache
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/files/.jglogs/.jg.ic
/data/data/####/databases/push_look.db
/data/data/####/databases/google_app_measurement_local.db
/data/data/####/databases/snowfoxad_msg.db
/data/data/####/shared_prefs/v2_local_login.xml
/data/data/####/shared_prefs/openudid_prefs.xml
/data/data/####/shared_prefs/BSModelForPlaced.xml
/data/data/####/files/.yflurrydatasenderblock.5b353b9d-b656-4b9d-9308-887587b57565
/data/data/####/.jiagu/libjiagu.so
/data/data/####/shared_prefs/MASTER_DATA.xml
/sdcard/Android/data/####/cache/uil-images/1lzdn8uz1ri3nfdbkocanb5be.0.tmp
/data/data/####/databases/db_snowfox.db-journal
/data/data/####/databases/UmengLocalNotificationStore.db-journal
/data/data/####/shared_prefs/AGOO_CONNECT.xml
/sdcard/Android/data/####/cache/uil-images/51h3k49h0mz5r87rfwrx1f7x9.0.tmp
/data/data/####/shared_prefs/AppStore.xml.bak
/data/data/####/databases/Zuoyoo_db
/sdcard/Android/data/.nomedia
/data/data/####/shared_prefs/AppStore.xml
/data/data/####/shared_prefs/coolook.minisite.xml
/data/data/####/databases/Zuoyoo_db-journal
/data/data/####/files/####.so
/data/data/####/dex_cache/base2.zip
/sdcard/AuthP/silence.dat
/data/data/####/app_jgls/.log.lock
/sdcard/Android/data/####/cache/uil-images/7e2r4c4cilxkb58gnecubo2ml.0
/data/data/####/shared_prefs/updateVer.xml
/data/data/####/shared_prefs/CountryRelevant.xml.bak
/data/data/####/shared_prefs/test.xml
/data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
/sdcard/Android/data/####/cache/uil-images/5lxhyicy8khrucm0n4s3z5fn9.0.tmp
/data/data/####/shared_prefs/sp_cache.xml
/sdcard/Android/data/####/cache/uil-images/5c6332yi8f1fqqqdqvvsomj1i.0.tmp
/data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
/sdcard/Android/data/####/cache/uil-images/71kwxwrfi7100dwjfthap1597.0.tmp
/data/data/####/databases/db_snowfox.db
/sdcard/Android/data/####/cache/uil-images/3lxxlhgl50nztjn8peksp4ahd.0.tmp
/data/data/####/files/DaemonServer
/data/data/####/databases/google_app_measurement_local.db-journal
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/CountryRelevant.xml
/data/data/####/files/lib.dat
/sdcard/AuthP/push_silentcfg.dat
/data/data/####/shared_prefs/snowfoxprf.xml
/data/data/####/shared_prefs/Module_Switch_DATA.xml
/data/data/####/files/####.dat
/data/data/####/shared_prefs/GATHER.xml.bak
/data/data/####/shared_prefs/pushdatas.xml
/data/data/####/files/.imprint
/data/data/####/files/.jglogs/.jg.ri
/sdcard/Android/data/####/cache/uil-images/4c7zakscy76w9l2k357qva8rp.0.tmp
/sdcard/Android/data/####/cache/uil-images/6iesspr5711axr89uipkspnu1.0.tmp
/data/data/####/files/mesosphere.jar
/data/data/####/files/snowfox_v18.jar
/data/data/####/shared_prefs/configLookPath.xml.bak
/data/data/####/files/lookDL/com.look.dlplugin.apk-250065669.tmp
/data/data/####/files/agoo.pid
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
/data/data/####/files/lookDL/dlLookPlugin.dat1069890000.tmp
/data/data/####/databases/push_look.db-journal
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/files/snowfox_v18.so
/sdcard/Android/data/####/cache/uil-images/15uyque0dulq4g2vt9v9skwu6.0.tmp
/sdcard/Android/data/####/cache/uil-images/1gppl943he8232lhikoa6hn6.0
/data/data/####/files/lookDL/dlLookCore.dat-1625031902.tmp
/sdcard/Android/data/####/cache/uil-images/journal.tmp
/sdcard/Android/data/####/files/logdata/delay_20170126073051207_551a738f15a6ccdf7c750058aec4b81d_b.dat
/data/data/####/shared_prefs/GATHER.xml

Присваивает атрибут 'исполняемый' для следующих файлов:

/data/data/####/.jiagu/libjiagu.so
/data/data/####/files/DaemonServer

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
sh

Использует специальную библиотеку для скрытия исполняемого байткода.

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней