Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- c####.####.com
- s####.####.com
- d####.####.cn
- u####.####.com
Запросы HTTP GET:
- u####.####.com/cleanmaster_lite//controller/config/app.ini
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- u####.####.com/cleanmaster_lite//controller/config/promotion.ini
- u####.####.com/cleanmaster_lite/controller/config//main_cfg.ini
- c####.####.com/api/GetCloudMsgEx?phonelanguage=####&cmlanguage=####&mcc=...
- u####.####.com/cleanmaster_lite//controller/CloudCfg.php?phonelanguage=#...
- u####.####.com/cleanmaster_lite//controller/config/switch.ini
- u####.####.com/cleanmaster_lite//controller/config/junk.ini
- u####.####.com/cleanmaster_lite//controller/config/gp_rate.ini
- u####.####.com/cleanmaster_lite_cn/getversions.php?phonelanguage=####&cm...
- u####.####.com/cleanmaster_lite//controller/config/rootguidetxt.ini
- u####.####.com/cleanmaster_lite//controller/config/task.ini
Запросы HTTP POST:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856228.ich
- <Package Folder>/shared_prefs/<Package>.update.UpdateManager.xml.bak
- <Package Folder>/files/infoc_1/cmlite_act_unknown_1495005901229.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856201.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856346.ich
- <Package Folder>/databases/temp_collect.db-journal
- <Package Folder>/databases/diskcache.db-journal
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855216.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856263.ich
- <Package Folder>/files/appcpu2_hf_en.db.bak
- <Package Folder>/app_files/cloud_config/junk.new
- <Package Folder>/app_files/cloud_config/task.new
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856365.ich
- <Package Folder>/files/kfmt.dat
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856287.ich
- <Package Folder>/files/infoc_1/cmlite_standby_dataindoor_1495005854079.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856363.ich
- <Package Folder>/updatedata/versions_get.dwn
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/infoc_1/cmlite_standby_enumerror_1495005855116.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855234.ich
- <Package Folder>/shared_prefs/misc.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855179.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855182.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855169.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855153.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855188.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855226.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856301.ich
- <Package Folder>/files/infoc_1/cmlite_boost_device_1495005856390.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856292.ich
- <Package Folder>/app_files/cloud_config/main_cfg.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855145.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856256.ich
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855172.ich
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/appcpu2_hf_en.db.lzma
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855203.ich
- <Package Folder>/databases/cleanmaster_process_list.db-journal
- <Package Folder>/app_files/cloud_config/rootguidetxt.new
- <Package Folder>/app_files/cloud_config/promotion.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855231.ich
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/misc.xml.bak
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856235.ich
- <Package Folder>/app_files/cloud_config/switch.new
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856170.ich
- <Package Folder>/updatedata/cloud_string_res_2.dwn
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855170.ich
- <Package Folder>/files/infoc_1/cmlite_standby_enumerror_1495005855125.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855175.ich
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856386.ich
- <Package Folder>/shared_prefs/cleancloud_pref.xml
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856377.ich
- <Package Folder>/files/infoc_1/cmlite_main_click_1495005856567.ich
- <Package Folder>/updatedata/ips_versions.dwn
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856387.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856197.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855220.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855185.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856199.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855191.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855149.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855228.ich
- <Package Folder>/app_files/cloud_config/app.new
- <Package Folder>/files/kctrl.dat
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855135.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855155.ich
- <Package Folder>/bspatch
- <Package Folder>/shared_prefs/<Package>_ui_preferences.xml
- <Package Folder>/files/infoc_1/cmlite_hardware_status_1495005858711.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855187.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856232.ich
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856336.ich
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/infoc_1/cmlite_standby_query_1495005856125.ich
- <Package Folder>/updatedata/cloud_string_res_2.dwn.default
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855167.ich
- <Package Folder>/files/infoc_1/cmlite_boost_app_1495005856230.ich
- <Package Folder>/app_files/cloud_config/gp_rate.new
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855222.ich
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/infoc_1/cmlite_act_unknown_1495005856632.ich
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855164.ich
- <Package Folder>/files/AppEventsLogger.persistedsessioninfo
- <Package Folder>/shared_prefs/<Package>.update.UpdateManager.xml
- <Package Folder>/files/infoc_1/cmlite_standby_procdetail_1495005855235.ich
- <Package Folder>/updatedata/ips_versions_cn.dwn
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
