Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- im####.####.com
- startap####.com
- i####.####.com
- d####.####.cn
- i####.starta
- mysearc####.com
- 5####.####.69
- e####.####.mobi
- b####.####.com
Запросы HTTP GET:
- e####.####.mobi/1.3/gethtmlad?publisherId=####&productId=####&os=####&sd...
- im####.####.com/styles/compressed/banner_rt_2d_rays_infra.20170517-0838....
- im####.####.com/styles/compressed/animate.min.20170517-0838.min.css
- mysearc####.com/static/searchSideBar/full_star.png
- mysearc####.com/styles/searchSideBar/auto_styles.css
- im####.####.com/static/images/star_empty_big.png
- mysearc####.com/styles/searchSideBar/apps.css
- i####.####.com/InApp/resources/info_ex_l.png
- mysearc####.com/js/searchSideBar/search.js
- im####.####.com/styles/compressed/fullpage-ios-big.20170517-0838.min.css
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- im####.####.com/image/fetch/f_auto,q_80,w_230,h_230/http%3A%2F%2Flh3.goo...
- startap####.com/1.3/gethtmlad?publisherId=####&productId=####&os=####&sd...
- mysearc####.com/?p=####&sourceid=####&app=####&sdkId=####&index=####&tok...
- mysearc####.com/js/jquery-1.7.2.min.js
- i####.starta/tracking/adImpression?d=####
- mysearc####.com/static/searchSideBar/search_icon.png
- mysearc####.com/static/searchSideBar/free-arrow.png
- mysearc####.com/static/searchSideBar/half_star.png
- mysearc####.com/js/common/common.js
- 5####.####.69/tracking/adImpression?d=####
- i####.####.com/InApp/resources/info_ex_s.png
- mysearc####.com/styles/searchSideBar/styles-search.css
- mysearc####.com/js/jquery.textchange.min.js
- mysearc####.com/js/autocomplete/jquery.autocomplete_google.js
- im####.####.com/static/images/star_half_big.png
- startap####.com/1.3/getadsmetadata?publisherId=####&productId=####&os=##...
- im####.####.com/image/fetch/f_auto,q_80,w_256,h_256/http%3A%2F%2Flh3.goo...
- b####.####.com/b2?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c...
- b####.####.com/beacon.js
- i####.####.com/InApp/resources/info_s.png
- mysearc####.com/sidebar/landing?p=####&ver=####
- im####.####.com/image/fetch/f_auto,q_80,w_48,h_48/http%3A%2F%2Flh3.googl...
- im####.####.com/static/images/star_full_big.png
- im####.####.com/static/images/close-btn-infra.png
- im####.####.com/static/images/banner_rt_2d_rays_base/download_icon_30.png
- mysearc####.com/js/jquery.cookie.js
- i####.####.com/InApp/resources/info_l.png
- startap####.com/1.3/getads?publisherId=####&productId=####&os=####&sdkVe...
- b####.####.com/b?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c7...
Запросы HTTP POST:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- e####.####.mobi/ProtocolGW/protocol/eula
- s####.####.com/cw/cp.action?requestId=####&g=####
- e####.####.mobi/ProtocolGW/protocol/eulastatus
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/com.startapp.android.eula.xml
- <Package Folder>/shared_prefs/com.startapp.android.search.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/offline_eula_footer.html
- <Package Folder>/files/error.zip
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/tab_side.png
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/files/error.html
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/databases/downloadswc
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/hdpi.zip
- <Package Folder>/shared_prefs/com.startapp.android.eula.xml.bak
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/eula.zip
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
