Android.DownLoader.2258

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.136.origin
Android.Backdoor.433.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.Backdoor.433.origin

Сетевая активность:

Подключается к:

p####.####.com:8066
c####.####.com
l####.####.cn
p####.####.com
l####.####.cn:88

Запросы HTTP GET:

c####.####.com/s?z####
l####.####.cn/m/7vW52mta4PPv2SPsX1A8G-U73d0WMsNRVxPZJQ
p####.####.com/c/1495005877226
l####.####.cn/t?r=####&p=####

Запросы HTTP POST:

p####.####.com:8066/s/
l####.####.cn/i/lv/v1/5529132479799142222?t=####
l####.####.cn/g?r=####
l####.####.cn/i/ls/v1/5529132479799142222?t=####
l####.####.cn:88/i/nu/v1/5529132479799142222?t=####
p####.####.com/p/1495005878068

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.snail/shared_prefs/lconfig.bak
<Package Folder>/.snail/databases/apk_install_tip.db
<Package Folder>/.snail/shared_prefs/main.prefs
<Package Folder>/.snail/shared_prefs/sconfig
<Package Folder>/shared_prefs/loader_snail.xml
<Package Folder>/.snail/files/ad_data/download_temp/8be0156a-1405-4f0d-b47f-47e563ef15db.a
<Package Folder>/.snail/databases/apk_install_tip.db-journal
<Package Folder>/.snail/databases/apk_install_sc_db
<Package Folder>/files/.snail_data/.8be0156a-1405-4f0d-b47f-47e563ef15db.a.zip
<Package Folder>/.snail/databases/app_stats.db-journal
<Package Folder>/app_hyifue/D6AA8EFBE7379C394CE9CA8FAD263829.jar.tmp
<Package Folder>/.snail/databases/win_ad.db
<Package Folder>/.snail/shared_prefs/extra
<Package Folder>/files/.snail_temp/8be0156a-1405-4f0d-b47f-47e563ef15db.a.de
<Package Folder>/.snail/databases/app_stats.db
<Package Folder>/.snail/shared_prefs/common_cfg.prefs
<Package Folder>/.snail/shared_prefs/locconfig
<Package Folder>/files/qdcycz
<Package Folder>/files/.snail_data/.b3.f5.zip
<Package Folder>/.snail/databases/apk_install_sc_db-journal
<Package Folder>/.snail/databases/statistics.db-journal
<Package Folder>/.snail/databases/win_ad.db-journal
<Package Folder>/.snail/databases/app_track.db
<Package Folder>/.snail/databases/log_temp.db
<Package Folder>/.snail/databases/download.db-journal
<Package Folder>/.snail/databases/app_track.db-journal
<Package Folder>/.snail/shared_prefs/lconfig
<Package Folder>/.snail/shared_prefs/common_rundata.prefs
<Package Folder>/.snail/databases/download.db
<Package Folder>/files/.snail_temp/8be0156a-1405-4f0d-b47f-47e563ef15db.a
<Package Folder>/.snail/files/ad_temp/server_req_hb_response.gz
<Package Folder>/.snail/snail_lib/libsnail_b3_f5_zip.so
<Package Folder>/.snail/files/prop_file/phone_dataer.prop
<Package Folder>/.snail/databases/log_index.db-journal
<Package Folder>/.snail/databases/log_temp.db-journal
<Package Folder>/.snail/files/ad_temp/run_status_hb_response.gz
<Package Folder>/.snail/databases/statistics.db
<Package Folder>/.snail/databases/log_index.db
<Package Folder>/.snail/files/ext4-snail-5
<Package Folder>/.snail/files/ad_temp/run_status_hb_request.gz
<Package Folder>/.snail/shared_prefs/exception
<Package Folder>/.snail/shared_prefs/log_cfg.prefs
<Package Folder>/.snail/shared_prefs/run_status.prefs