Android.Packed.21517

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.MobiDash.1.origin

Сетевая активность:

Подключается к:

launche####.####.com
launche####.####.cn
gos####.####.cn
goup####.####.cn
gameser####.####.com

Запросы HTTP GET:

launche####.####.com/gostore/webcontent/function/getAdmobCon.jsp?country...
launche####.####.com/guiAdmob/webcontent/function/getAdmobCon.jsp?countr...

Запросы HTTP POST:

goup####.####.cn/GOClientData/DR?ptl=####&is_zip=####
launche####.####.com/launcherwidget/remdinfo.do?rd=####
goup####.####.cn/GOClientData/DC
launche####.####.cn/golaunchermsg/msgservice.do?funid=####&rd=####
gameser####.####.com/gameservice/common?funid=####&rd=####
goup####.####.cn/GOClientData/DR?ptl=####&is_zip=####&is_response_json=#...
launche####.####.com/guiWallpaper/common?funid=####&rd=####
gos####.####.cn/gostore/entrance

Изменения в файловой системе:

Создает следующие файлы:

/sdcard/GOLauncherEX/autobackup/db/androidheart.db-journal
/sdcard/GOLauncherEX/autobackup/db/launchers.db-journal
/sdcard/GOLauncherEX/autobackup/db/authCache-journal
/sdcard/GOLauncherEX/messagecenter/filterinfo.txt
/sdcard/GOLauncherEX/autobackup/preference/tutorial.xml
/sdcard/GOLauncherEX/autobackup/db/gameapps.db-journal
/sdcard/GOLauncherEX/screenEdit/push/cacheData/sGoDynWallpaperSaveKey
/sdcard/GOLauncherEX/autobackup/db/gameapps.db
/sdcard/GOLauncherEX_ThemeStore/subscription
/sdcard/GOLauncherEX/autobackup/db/client_settings
/sdcard/GOLauncherEX/gotheme/publicCurrentThemePkg
/sdcard/GOLauncherEX/.nomedia
/sdcard/GOLauncherEX/autobackup/db/gostatistics_sdk.db
/sdcard/GOLauncherEX/autobackup/db/webview.db
/sdcard/GOLauncherEX/autobackup/db/GetJarDBApplicationKey
/sdcard/GOLauncherEX/autobackup/db/androidheart.db
/sdcard/GOLauncherEX/autobackup/db/gostatistics_sdk.db-journal
/data/data/####/shared_prefs/PersonalizationService.xml.bak
/sdcard/GOLauncherEX/autobackup/db/GetJarDBApplicationKey-journal
/sdcard/GOLauncherEX/autobackup/db/appgamecenter.db
/data/data/####/shared_prefs/PersonalizationService.xml
/sdcard/GOLauncherEX/statistics/statistics/deviceId.txt
/sdcard/GOLauncherEX/screenEdit/push/cacheData/sGoWallpaperSaveKey
/sdcard/GOLauncherEX/messagecenter/lastupdatetime.txt
/sdcard/GOLauncherEX/autobackup/db/google_analytics.db
/sdcard/.goproduct/goid
/sdcard/GOLauncherEX/autobackup/db/client_settings-journal
/sdcard/GOLauncherEX/autobackup/db/authCache
/sdcard/GOLauncherEX/autobackup/db/appgamecenter.db-journal
/sdcard/GOLauncherEX/install_stamp
/sdcard/GOLauncherEX/autobackup/db/launchers.db
/sdcard/GOLauncherEX/autobackup/db/webview.db-journal
/sdcard/GOLauncherEX/autobackup/db/google_analytics.db-journal

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/dexopt --dex 27 41 40 503120 /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2.zip 2168832 -694199456 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.
/system/bin/dexopt --dex 27 56 40 1355516 /data/data/####/app_apks/shellplugin.apk 1164347513 -613945162 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
/system/bin/dexopt --dex 27 40 40 270828 /data/data/####/app_app_apk/launcherex.dat.jar 1244898618 449528362 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst

Может автоматически отправлять СМС-сообщения.