Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.371.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.371.origin
Сетевая активность:
Подключается к:
- mor####.####.net
- googl####.####.net
- p####.####.com
- d####.####.com
- f####.####.com
- mi####.####.net
- a####.####.com
- pag####.####.com
Запросы HTTP GET:
- mi####.####.net/moreapp/1469203595008_2c8a97_r.png
- mi####.####.net/moreapp/1464866930703_849c67_s.jpg
- mi####.####.net/moreapp/1466590799525_08f8b1_s.jpg
- mi####.####.net/moreapp/1466590787125_81dd27_r.png
- a####.####.com/a4d7bfeed0556e351450428584122.dex
- mi####.####.net/moreapp/1464087965831_0c49f1_r.png
- mi####.####.net/moreapp/1467112531518_cc11ec_r.png
- p####.####.com/s/18E2tH
- mi####.####.net/moreapp/1468410409006_01b275_s.jpg
- mi####.####.net/moreapp/1465204771463_2ed91d_r.png
- mi####.####.net/moreapp/1468551935393_c0e782_r.png
- mi####.####.net/moreapp/1464690363847_d58665_r.png
- mi####.####.net/moreapp/1464260246572_6d73de_s.jpg
- mi####.####.net/moreapp/1466136428828_ba04c9_r.png
- mi####.####.net/moreapp/1463161726881_060a53_r.png
- mi####.####.net/moreapp/1470414965580_0b6c60_r.png
- mi####.####.net/moreapp/1467343748517_47e15c_r.png
- mi####.####.net/moreapp/1466749329490_2f0096_s.jpg
- mi####.####.net/moreapp/1464075142770_71d832_r.png
- mi####.####.net/moreapp/1470414983563_15e080_s.jpg
- mi####.####.net/moreapp/1467371140728_23e959_s.jpg
- mi####.####.net/moreapp/1468410333593_19ab63_r.png
- mi####.####.net/moreapp/1464178799446_68a6c4_r.png
- mi####.####.net/moreapp/1464355435246_52baf9_r.png
- mi####.####.net/moreapp/1469203553037_05c247_s.jpg
- mi####.####.net/moreapp/1466153838943_6e3dcb_s.jpg
- mi####.####.net/moreapp/1464179177997_b9d0c0_s.jpg
- googl####.####.net/mads/static/sdk/native/sdk-core-v40.html
- mi####.####.net/moreapp/1447907770353_ffbe3f_s.jpg
- mi####.####.net/moreapp/1464346162334_9057ca_s.jpg
- mi####.####.net/moreapp/1463756210732_e606ba_s.jpg
- googl####.####.net/mads/static/mad/sdk/native/canary/sdk-core-v40-impl.js
- mi####.####.net/moreapp/1469203540012_2e1e0d_r.png
- mi####.####.net/moreapp/1464946595073_c674a2_r.png
- mi####.####.net/moreapp/1464260230306_9f13d4_r.png
- mi####.####.net/moreapp/1466153821530_c0fc8b_r.png
- mi####.####.net/moreapp/1465204136243_960105_r.png
- mi####.####.net/moreapp/1464690369527_39d5de_s.jpg
- mi####.####.net/moreapp/1473257121306_363ced_r.png
- mi####.####.net/moreapp/1472831014673_f20982_s.jpg
- mi####.####.net/moreapp/1463763875075_172215_r.png
- mi####.####.net/moreapp/1469203606104_bb913a_s.jpg
- mi####.####.net/moreapp/1472831026370_17ab5e_r.png
- mi####.####.net/moreapp/1468601474735_f1692a_s.jpg
- f####.####.com/update.html?version=####
- pag####.####.com/activeview?avi=####&id=####&mtos=####&tos=####&p=####&r...
- googl####.####.net/mads/static/mad/sdk/native/production/sdk-core-v40-im...
- mi####.####.net/moreapp/1468586479983_191e66_s.jpg
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.appcache
- mi####.####.net/moreapp/1468601437980_b19d28_r.png
- mi####.####.net/moreapp/1468585313964_f03a8a_r.png
- mi####.####.net/moreapp/1467341739789_457d8e_r.jpg
- mi####.####.net/moreapp/1464257322765_a657ad_s.jpg
- mi####.####.net/moreapp/1471867692096_94843e_r.png
- mi####.####.net/moreapp/1463380930557_981643_r.png
- mi####.####.net/moreapp/1463161743060_b9aba1_s.jpg
- mi####.####.net/moreapp/1467341751119_b386ae_s.jpg
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.js
- mi####.####.net/moreapp/1465975627655_dca56c_r.png
- mi####.####.net/moreapp/1464866907411_c5d936_r.png
- mi####.####.net/moreapp/1464775224778_f0acc0_s.jpg
- mi####.####.net/moreapp/1468635925104_187c7a_s.jpg
- mi####.####.net/moreapp/1474707584948_bb2022_r.png
- mi####.####.net/moreapp/1465975602575_cae9ca_s.jpg
- mi####.####.net/moreapp/1467112549354_319790_s.jpg
- mi####.####.net/moreapp/1468635910079_805300_r.png
- mi####.####.net/moreapp/1474707589472_06ca7b_s.jpg
- mi####.####.net/moreapp/1464257344684_aa23d8_r.png
- mi####.####.net/moreapp/1464097615592_6e2210_s.jpg
- mi####.####.net/moreapp/1464946618796_514ffd_s.jpg
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.html
- mi####.####.net/moreapp/1466136448747_7885f1_s.jpg
- mi####.####.net/moreapp/1466749302653_f84d99_r.png
- mi####.####.net/moreapp/1465204252955_e8fd85_s.jpg
- mi####.####.net/moreapp/1467371123123_25e4cf_r.jpg
- mi####.####.net/moreapp/1467343778654_0fb5e8_s.jpg
- mi####.####.net/moreapp/1473257108250_ef1cd8_s.jpg
- mi####.####.net/moreapp/1464339030651_fad017_r.png
Запросы HTTP POST:
- mor####.####.net/NoCropWeb/external/getMaxFontId.do
- d####.####.com/aap.do
- f####.####.com/adCenter/seo/get
- mor####.####.net/pbweb/app/getAppConfig.do
- f####.####.com/adCenter/ad/get
- f####.####.com/adCenter/app/get
- a####.####.com/app_logs
- a####.####.com/AdlayoutBossWeb/platform/getRcAdvConrol.do
- mor####.####.net/pbweb/app/getAndroidAppList.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/ads1057597726.jar
- <Package Folder>/shared_prefs/font_update.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/applicationstart.xml
- <Package Folder>/files/mobclick_agent_cached_<Package>234
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/app_pref.xml
- <Package Folder>/shared_prefs/app_init.xml
- <Package Folder>/files/gaClientId
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsData_G758HJM6NPXQ8X2G4C3V_158
- <Package Folder>/databases/dbname-journal
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/cache/ddcp.dex
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/dbname
- <Package Folder>/shared_prefs/ad_preference.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/databases/photocollage.db-journal
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/databases/db_more_apps-journal
- <Package Folder>/shared_prefs/ddspname.xml
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/more_apps.xml
- <Package Folder>/shared_prefs/font_update.xml.bak
- <Package Folder>/files/.flurrydatasenderblock.4a5178cd-b07a-4928-9a8e-00debf50aee0
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/http_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/shared_prefs/send_perf.xml
- <Package Folder>/shared_prefs/sharedPreferencesName.xml
- <Package Folder>/shared_prefs/custom_ad_preference.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.flurryagent.72dde080
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_0
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/databases/photocollage.db
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
