Android.Packed.21241

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.1.origin

Сетевая активность:

Подключается к:

s####.####.com
t####.####.com
zn_4slw####.####.com
secur####.####.com
st####.####.com
go####.com
p####.####.net
ctologg####.####.com
e####.com
c####.####.com
e####.####.com
agl####.####.com
w####.####.com
d####.####.net
l####.####.com
s####.####.net
pag####.####.com
tr####.####.com
a####.####.com
b####.####.com

Запросы HTTP GET:

a####.####.com/ad/blank.gif
a####.####.com/redesign/0.347.10/node_modules/espn-lazysizes/lazysizes.js
a####.####.com/redesign/0.347.10/css/shell-mobile.css
w####.####.com/b/ss/wdgespcom,wdgespge/1/JS-1.6.1/s88912018116097?AQB=##...
a####.####.com/redesign/0.347.10/js/espn-critical-mobile.js
e####.com/
secur####.####.com/v60.js
a####.####.com/redesign/assets/img/icons/icon-menu-kentucky-derby.png
a####.####.com/combiner/i?img=/i/teamlogos/leagues/500/mlb.png?w=####&h=...
a####.####.com/test/fancyLogo2.svg
d####.####.net/id?d_visid_ver=####&d_rtbd=####&d_ver=####&d_verify=####&...
a####.####.com/fonts/1.0.38/ESPNIcons/ESPNIcons.ttf
e####.com/null?versionName=####&versionCode=####&channel=####&local=####...
secur####.####.com/cgi-bin/m?rnd=1493728919454&ci=us-903969h&js=1&cg=0&t...
st####.####.com/js/chartbeat_video.js
a####.####.com/combiner/i?img=####&w=####&h=####&transparent=####
a####.####.com/decide/?verbose=####&version=####&lib=####&token=####&dis...
agl####.####.com/stat/cto-espn.js
a####.####.com/combiner/i?img=/i/teamlogos/leagues/500/nfl.png?w=####&h=...
c####.####.com/core/golf/?xhr=####&render=####&device=####&lang=####&reg...
a####.####.com/track/?data=####&ip=####&_=####
d####.####.net/id?d_visid_ver=####&d_rtbd=####&d_ver=####&d_orgid=####&d...
b####.####.com/b?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c7...
w####.####.com/id?AQB=####&vmr=####&&vmh=####&vmf=####&g=####&d_visid_ve...
zn_4slw####.####.com/WRSiteInterceptEngine/Targeting.php?Q_InterceptID=#...
a####.####.com/decide/?verbose=####&version=####&lib=####&token=####&ip=...
a####.####.com/combiner/i?img=####&w=####&h=####&scale=####&cquality=###...
s####.####.com/segments?prop=####&swid=####
w####.####.com/id?AQB=####&vmh=####&vmf=####&g=####&d_visid_ver=####&cal...
a####.####.com/ad/doubleclick/ads.js
d####.####.net/id/rd?d_visid_ver=####&d_rtbd=####&d_ver=####&d_verify=##...
l####.####.com/log?srvc=sz&a=100&silent=1&goto=https://securepubads.g.do...
a####.####.com/redesign/0.347.10/js/espn-defer-mobile.js
a####.####.com/combiner/i?img=####
a####.####.com/redesign/0.347.10/js/espn-analytics.js
a####.####.com/combiner/i?img=/i/teamlogos/leagues/500/nhl.png?w=####&h=...
c####.####.com/core/format/modules/head/i18n?edition-host=####&lang=####...
a####.####.com/combiner/i?img=/i/teamlogos/leagues/500/nba.png?w=####&h=...
tr####.####.com/capmon/GetDE?set=####&param=####&param=####&param=####&p...
secur####.####.com/storageframe.html
secur####.####.com/cgi-bin/m?rnd=1493728911546&ci=us-903969h&js=1&cg=0&t...
zn_4slw####.####.com/WRSiteInterceptEngine/?Q_SIID=####&Q_LOC=####&t=####
c####.####.com/js/310987714.js
go####.com/ads/measurement/l?ebcid=####
c####.####.com/libs/mixpanel-2-latest.min.js
a####.####.com/redesign/0.347.10/css/page.css
e####.####.com/null/?versionName=####&versionCode=####&channel=####&loca...
a####.####.com/redesign/0.347.10/css/index.css
e####.####.com/
a####.####.com/js/omniture/tracking.js
c####.####.com/core/api/v0/nav/index?&device=####&lang=####&region=####&...
a####.####.com/redesign/0.347.10/css/one-feed-v1.css
e####.com/core/l?a=####&t=####
a####.####.com/engage/?data=####&ip=####&_=####
b####.####.com/b2?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c...
a####.####.com/favicon.ico
b####.####.com/beacon.js
e####.com/null/?versionName=####&versionCode=####&channel=####&local=###...
w####.####.com/id?d_visid_ver=####&callback=####&mcorgid=####&mid=####
a####.####.com/combiner/i?img=####&h=####&w=####&scale=####&cquality=####
pag####.####.com/pagead/osd.js
c####.####.com/js/unid.min.js
a####.####.com/combiner/i?img=####&h=####&w=####
t####.####.com/safeframe/1-0-8/html/container.html
p####.####.net/ping?h=####&p=####&u=####&d=####&g=####&g0=####&g1=####&n...
ctologg####.####.com/cto/?e1=####&app=####&pl=####&ru=####&u2=####&u7=##...
a####.####.com/redesign/0.347.10/js/espn-defer-low.js
s####.####.com/apis/v2/scoreboard/header?sport=####&league=####&lang=###...
a####.####.com/redesign/assets/img/logos/logo-espn-82x20.png
c####.####.com/denied/unid.denied.js
pag####.####.com/activeview?avi=####&cid=####&id=####&ti=####&r=####&uc=...
w####.####.com/b/ss/wdgespcom,wdgespge/1/JS-1.6.1/s82613157134037?AQB=##...

Запросы HTTP POST:

s####.####.net/browser/search

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/shared_prefs/TYAnalytics_SharedPref.xml
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/cache/webviewCacheChromium/f_00000c
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/cache/webviewCacheChromium/f_00000e
/data/data/####/cache/webviewCacheChromium/f_00000d
/sdcard/.comzzantbrowser
/data/data/####/cache/webviewCacheChromium/f_00000f
/data/data/####/cache/webviewCacheChromium/f_000019
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/f_000018
/data/data/####/cache/webviewCacheChromium/f_000017
/data/data/####/cache/webviewCacheChromium/f_000016
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/cache/webviewCacheChromium/f_000012
/data/data/####/cache/webviewCacheChromium/f_000014
/data/data/####/cache/tas.cache
/data/data/####/cache/webviewCacheChromium/f_000011
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/cache/webviewCacheChromium/f_000015
/data/data/####/shared_prefs/TYAnalytics_SharedPref.xml.bak
/data/data/####/cache/webviewCacheChromium/f_000013
/data/data/####/databases/browsermain.db
/data/data/####/cache/webviewCacheChromium/f_000010
/data/data/####/files/olmiddleware.jar
/data/data/####/cache/webviewCacheChromium/f_00001d
/data/data/####/app_appcache/ApplicationCache.db-journal
/data/data/####/files/olmiddleware.so
/data/data/####/cache/webviewCacheChromium/f_00001f
/data/data/####/databases/browsermain.db-journal
/data/data/####/cache/webviewCacheChromium/f_00001e
/data/data/####/cache/webviewCacheChromium/f_00001b
/data/data/####/cache/webviewCacheChromium/f_00001c
/data/data/####/cache/webviewCacheChromium/f_00001a
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/data/data/####/cache/webviewCacheChromium/f_000023
/data/data/####/app_icons/WebpageIcons.db-journal
/data/data/####/cache/webviewCacheChromium/f_000021
/data/data/####/cache/webviewCacheChromium/f_000020
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/databases/webview.db-journal
/data/data/####/files/comzzantbrowser
/data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
/data/data/####/shared_prefs/browser_setting.xml.bak
/data/data/####/shared_prefs/browser_setting.xml
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/cache/webviewCacheChromium/f_000022

Другие:

Запускает следующие shell-скрипты:

/system/bin/dexopt --dex 27 44 40 121244 /data/data/####/files/olmiddleware.jar 1229742486 -1473882082 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней