Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- mo####.####.com
- i####.####.com
- d####.####.cn
- o####.####.com
- mobads-####.####.com
- a####.####.com
Запросы HTTP GET:
- i####.####.com/game/2016/03/28/d1ec0df56fbce03330182b94e105c874_100_100....
- i####.####.com/game/2016/04/12/92c85a667fc7e05d3dfe3120ae3f1c91_534_320....
- i####.####.com/game/2016/04/12/e49fd534e445438676fc304468bff661_100_100....
- mo####.####.com/ads/pa/8/__xadsdk__remote__8.58.jar
- i####.####.com/game/2016/04/12/54cf653a9ccc89dfb64f1342e8962cdb_534_320....
- i####.####.com/game/2015/07/21/240645380b08bd76dbba6bb61e4f73c9_175_175....
- a####.####.com/moapi/game_ad.php?cpu=####&brand=####&model=####&kyxversi...
- i####.####.com/article/2015/08/11/5e977c917bd9748e8aa454197b442743.png
- i####.####.com/article/2015/08/11/7139bb23a67bb46217b1276fe03b31c9.png
- i####.####.com/game/2015/02/13/a29353b9a6843702b448301737c8bb49_175_175....
- i####.####.com/vert/2016/05/17/6660e423dc6d52468abc00dbb4097bb5.jpg
- a####.####.com/moapi/game_app_detail.php?cpu=####&brand=####&appid=####&...
- mo####.####.com/ads/pa/8/__pasys_remote_banner.php??bdr=####&os=####&v=#...
- i####.####.com/vert/2017/01/06/fb20feb5f562d83be97194e995dd4aca.png
- i####.####.com/game/2015/09/23/d41ab78fcf4216aded282a987842bc76_175_175....
- i####.####.com/game/2016/04/12/92c85a667fc7e05d3dfe3120ae3f1c91_1_1.webp
- i####.####.com/game/2016/04/12/54cf653a9ccc89dfb64f1342e8962cdb_1_1.webp
- mo####.####.com/cpro/ui/mads.php?code2=####
- i####.####.com/game/2016/04/12/489aca916b9a7846498757cd2d64a566_534_320....
- i####.####.com/game/2015/10/29/e303659d946a5e5d12d12891d9a1e280_175_175....
- i####.####.com/vert/2016/03/28/fb5143ef5e5510bfe1fbaba710ba2891.jpg
- a####.####.com/moapi/game_rank_list.php?pagesize=####&model=####&order=#...
- i####.####.com/game/2016/04/12/8b6b72a825f76addf5bb10ed465363dc_100_100....
- i####.####.com/game/2016/04/12/1658dcbdf0d99e4a324a09f872c9484f_534_320....
- i####.####.com/article/2015/08/11/fdd0de15024c2f8c23c197ac55d46608.png
- a####.####.com/moapi/search_word_recommend.php?cpu=####&brand=####&model...
- i####.####.com/vert/2016/04/12/d61540d4cbdf9521a7a0588c90843752.jpg
- i####.####.com/game/2015/10/08/e619644d60c54eb69e36a117943aae25_175_175....
- i####.####.com/article/2015/08/13/e63379cd3e00a07696d81147ac655c82.png
- i####.####.com/game_type/2015/09/09/9d063a8270df5ea221b43d4f5293cd3d.png
- a####.####.com/moapi/home_hotgame.php?cpu=####&brand=####&model=####&kyx...
- i####.####.com/game/2016/03/25/2dc010cbf94a431236fa7ec94a99aa0e_100_100....
- i####.####.com/game/2016/04/12/fa070b17c9a2be05c1fb42b3550fec5c_100_100....
- i####.####.com/game/2015/06/08/857b77d9d12299c72a8e675613716b2a_175_175....
- i####.####.com/game/2016/04/12/489aca916b9a7846498757cd2d64a566_1_1.webp
- a####.####.com/mzw4m/mzw_time.php
- i####.####.com/game/2015/06/12/21c4bd71da31f2333c23de60998c4a21_175_175....
- i####.####.com/game/2016/05/17/a6c9d26cd4ac8d8198151ca1a7d39a8b_175_175....
- a####.####.com/moapi/games.php?tid=####&key=####
- i####.####.com/game/2016/04/12/1658dcbdf0d99e4a324a09f872c9484f_1_1.webp
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- a####.####.com/moapi/game_category.php?cpu=####&brand=####&model=####&ky...
- i####.####.com/game/2015/05/19/52318a9b006268d7fb8b963363094133_175_175....
Запросы HTTP POST:
- a####.####.com/moapi/applist_update.php
- a####.####.com/countapi/mo_count.php?number=####
- a####.####.com/api/check_app_update
- mobads-####.####.com/brwhis.log
- o####.####.com/v2/get_update_time
- s####.####.com/cw/cp.action?requestId=####&g=####
- o####.####.com/v2/check_config_update
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/cache/img/282992107
- <Package Folder>/files/cache/img/633806180.tmp
- <Package Folder>/files/cache/img/1352266808.tmp
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/cache/img/-860444813
- <Package Folder>/files/cache/img/1179890831
- <Package Folder>/databases/kuaiyouxi_mobile_downloads.db-journal
- <Package Folder>/files/cache/img/-325046624.tmp
- <Package Folder>/files/cache/img/664047774.tmp
- <Package Folder>/files/cache/img/-149279035
- <Package Folder>/files/cache/servers/57f1bbaf1e4dc48f3b710ac7e06924e2
- <Package Folder>/files/cache/img/79307797.tmp
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__7cfe57a5-fb52-49ca-89f8-82b6fa619200.jar
- <Package Folder>/files/cache/img/282992107.tmp
- <Package Folder>/files/cache/img/-325046624
- <Package Folder>/files/cache/img/-899046298
- <Package Folder>/files/cache/img/-1587650768
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/cache/img/7501801.tmp
- <Package Folder>/files/cache/img/1725982496.tmp
- <Package Folder>/files/cache/img/1269708353
- <Package Folder>/files/cache/img/1986918358
- <Package Folder>/files/cache/servers/b79a279854d698c68e0ee68c48c34ac7
- <Package Folder>/files/cache/img/589312008
- <Package Folder>/files/cache/img/-65501058.tmp
- <Package Folder>/files/cache/img/-149279035.tmp
- <Package Folder>/files/cache/img/1601837430
- <Package Folder>/files/cache/img/2063012270.tmp
- <Package Folder>/files/cache/img/1269708353.tmp
- <Package Folder>/files/cache/img/1876602244.tmp
- <Package Folder>/files/cache/img/1441418508
- <Package Folder>/files/cache/img/1179890831.tmp
- <Package Folder>/files/cache/img/-1794510143.tmp
- <Package Folder>/files/cache/img/-480754624.tmp
- <Package Folder>/files/cache/img/1081638366.tmp
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/files/cache/img/589312008.tmp
- <Package Folder>/files/cache/img/1986918358.tmp
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/cache/img/-1587650768.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/cache/img/1081638366
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/cache/img/-860444813.tmp
- <Package Folder>/files/cache/img/664047774
- <Package Folder>/files/cache/img/-65501058
- <Package Folder>/files/gamefilter/10d4caf760dbba4144125a0262fd062a
- <Package Folder>/shared_prefs/__xadsdk_downloaded__version__.xml
- <Package Folder>/files/cache/img/528354593.tmp
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/files/cache/img/-899046298.tmp
- <Package Folder>/files/cache/img/1690136208
- <Package Folder>/files/cache/img/1806014299.tmp
- <Package Folder>/files/cache/servers/28fb4db8f28e9ca447f441257888f52d
- <Package Folder>/files/cache/img/-1764950153
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/files/cache/img/-1764950153.tmp
- <Package Folder>/shared_prefs/com.baidu.mobads.loader.xml
- <Package Folder>/files/cache/img/1690136208.tmp
- <Package Folder>/files/cache/img/2063012270
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/cache/img/1156590435
- <Package Folder>/files/cache/servers/b4f526c862f298dcbba8a31145963bbc
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/cache/img/633806180
- <Package Folder>/files/cache/img/-2000622378
- <Package Folder>/files/cache/img/528354593
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/cache/img/1552429025.tmp
- <Package Folder>/files/cache/img/79307797
- <Package Folder>/files/cache/img/-2000622378.tmp
- <Package Folder>/shared_prefs/kyx_coc_preferences.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- <Package Folder>/files/cache/img/1806014299
- <Package Folder>/files/cache/img/1552429025
- <Package Folder>/files/cache/servers/db48a675dbd0a19ce5e7ee09a54f21ab
- <Package Folder>/files/cache/servers/d1ab849da80187d41c94eb0825bf834e
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/cache/img/1441418508.tmp
- <Package Folder>/files/cache/img/-1794510143
- <Package Folder>/files/cache/img/1876602244
- <Package Folder>/shared_prefs/mzw_time.xml
- <Package Folder>/files/cache/img/-480754624
- <Package Folder>/files/cache/img/1725982496
- <Package Folder>/files/cache/img/7501801
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/shared_prefs/__x_adsdk_agent_header__.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- getprop ro.board.platform
Может автоматически отправлять СМС-сообщения.
