Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.414.origin
Сетевая активность:
Подключается к:
- mo####.####.com
- h####.####.com
- i####.####.com
- 1####.####.131:8080
- f####.####.com
- a####.####.com
Запросы HTTP GET:
- 1####.####.131:8080/spotService/a.jsp?k=####
- mo####.####.com/ads/css/min/main.css
- mo####.####.com/ads/index.htm
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=8b0c2c67ab...
- mo####.####.com/ads/js/ads.trunk.js
- mo####.####.com/ads/pa/__pasys_remote_banner.jar
- i####.####.com/channel/listjson?pn=####&rn=####&tag1=####&tag2=####&tag3...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=b501e2165f...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=f732c51462...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=a8d2562d08...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=6bbb13e7d7...
- h####.####.com/image/w%3D1280%3Bcrop%3D0%2C0%2C1280%2C800/sign=2abcf809e...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=b32fd624ab...
- mo####.####.com/ads/ads.appcache
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=22a96c015e...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=c9d767cab0...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=ae5051d04d...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=c7528c1eb5...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=eb76c431fe...
- mo####.####.com/ads/js/c.js
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=6b8bec6554...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=3251c8a8a3...
- mo####.####.com/cpro/ui/mads.php?code2=####&b1493729371540=####
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=233bb11236...
- f####.####.com/f/3wtp.jpg
- f####.####.com/f/wf0215.dat
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=66205674e9...
- mo####.####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####&...
- h####.####.com/image/h%3D800%3Bcrop%3D0%2C0%2C1280%2C800/sign=a75889e995...
Запросы HTTP POST:
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/####/cache/6wbx28l2bcd7ujpz7af3hg9sb.tmp
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/####/cache/u3qwur9sdaaack1kd433qklf.tmp
- /sdcard/Android/data/####/cache/65nh0q9xs964xjj141p2n0okc.tmp
- /data/data/####/shared_prefs/^_`ab.xml
- /sdcard/Android/data/####/cache/400zhrojtkblyprque31x9pw5
- /sdcard/Android/data/####/cache/7a4l5ho8igek33plq0jr0ppyc.tmp
- /sdcard/Android/data/####/cache/5i5ous2h6ckvkaq74rju7wq1p.tmp
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/01493729364696.jar
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /sdcard/Android/data/####/cache/2ly9w40ktmmwrzjx4eex7jzi3.tmp
- /data/data/####/app_database/ApplicationCache.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/a1.db-journal
- /data/data/####/shared_prefs/c1356507059351895.xml
- /data/data/####/files/__pasys_remote_banner.tmp.jar
- /data/data/####/shared_prefs/1001.xml
- /data/data/####/files/.imprint
- /sdcard/Android/data/####/cache/3fbmvric4srz6dv46rwfwso4e.tmp
- /sdcard/Android/data/####/cache/76hyb7hdlama349fbhdab4k2e.tmp
- /sdcard/Android/data/####/cache/69z88ic94pmz42cc60v5c6vdx.tmp
- /data/data/####/files/__pasys_remote_banner.jar.tm
- /sdcard/Android/data/####/cache/qppju1v2m2je937kdg5lg1bd.tmp
- /sdcard/Android/data/####/cache/1ayuxqmho8t0yjlq58vk6d7fa.tmp
- /data/data/####/shared_prefs/b1356507059351895.xml
- /sdcard/w/i_356507059351895/3wtp.jpg.data
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/Android/data/####/cache/31d195e5kglyflv0sroivdnea.tmp
- /data/data/####/shared_prefs/a1356507059351895.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/a1356507059351895.xml.bak
- /sdcard/Android/data/####/cache/6e10mm49ye6o16hppbzjdlkqg.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/a1.xml
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/app_database/localstorage/http_mobads.baidu.com_0.localstorage-journal
- /sdcard/Android/data/####/cache/w92rjmq3mmb4hthcz5jysg7l.tmp
- /sdcard/Android/data/####/cache/73pjzu8crmp4at44l1ksrptj3.tmp
- /data/data/####/databases/OrmliteLoginDemo.db-journal
- /sdcard/Android/data/####/cache/4pms5mjvw3du3i1f6xcyqu8ol.tmp
- /data/data/####/shared_prefs/c1356507059351895.xml.bak
- /data/data/####/shared_prefs/d1356507059351895.xml
- /sdcard/w/i_356507059351895/_c.dat
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 82 40 151388 /data/data/####/files/01493729364696.jar 1244682541 1076145822 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/frame
- /system/bin/dexopt --dex 27 53 40 423232 /data/data/####/files/__pasys_remote_banner.jar 1155157530 870506478 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system
Может автоматически отправлять СМС-сообщения.
