Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- s####.####.com
- clinkad####.com
- startap####.com
- i####.####.com
- googl####.####.net
- d####.####.cn
- d####.####.com
- 6####.####.129
- f####.####.com
- mysearc####.com
- apptr####.com
- 5####.####.252
- pag####.####.com
- c####.####.co
- m####.####.com
- b####.####.com
Запросы HTTP GET:
- apptr####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&affsu...
- googl####.####.net/mads/static/sdk/native/sdk-core-v40.html
- mysearc####.com/static/searchSideBar/full_star.png
- mysearc####.com/styles/searchSideBar/auto_styles.css
- d####.####.com/styles/compressed/fullpage_dynamite_bomb.20170517-0838.mi...
- c####.####.co/tracking/adImpression?d=####
- b####.####.com/b2?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c...
- googl####.####.net/mads/static/mad/sdk/native/production/sdk-core-v40-im...
- b####.####.com/b?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c7...
- i####.####.com/InApp/resources/info_ex_l.png
- d####.####.com/image/fetch/f_auto,q_80,w_48,h_48/http%3A%2F%2Flh3.google...
- 6####.####.129/tracking/adImpression?d=####
- d####.####.com/static/images/fullpage_dynamite_bomb/clock.png
- mysearc####.com/js/searchSideBar/search.js
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.appcache
- d####.####.com/static/images/close-btn-infra.png
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.html
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- d####.####.com/static/images/star_half_big.png
- d####.####.com/styles/compressed/2D_top_apps_play_infra.20170517-0838.mi...
- startap####.com/1.3/gethtmlad?publisherId=####&productId=####&os=####&sd...
- mysearc####.com/?p=####&sourceid=####&app=####&sdkId=####&index=####&tok...
- mysearc####.com/js/jquery-1.7.2.min.js
- 5####.####.252/tracking/adImpression?d=####
- pag####.####.com/activeview?avi=####&id=####&mtos=####&tos=####&p=####&r...
- mysearc####.com/static/searchSideBar/search_icon.png
- d####.####.com/static/images/fullpage_dynamite_bomb/dynamite.png
- mysearc####.com/static/searchSideBar/free-arrow.png
- d####.####.com/static/images/2DOfferwallPlayMarket/drawable-mdpi/top_app...
- mysearc####.com/js/common/common.js
- f####.####.com/s/roboto/v16/Hgo13k-tfSpn0qi1SFdUfSZ2oysoEQEeKwjgmXLRnTc....
- d####.####.com/static/images/star_full_big.png
- mysearc####.com/js/autocomplete/jquery.autocomplete_google.js
- googl####.####.net/mads/static/mad/sdk/native/canary/sdk-core-v40-impl.js
- clinkad####.com/tracking?camp=####&pubid=####&&subpubid=####
- i####.####.com/InApp/resources/info_ex_s.png
- mysearc####.com/static/searchSideBar/half_star.png
- mysearc####.com/styles/searchSideBar/styles-search.css
- mysearc####.com/js/jquery.textchange.min.js
- d####.####.com/static/images/fullpage_dynamite_bomb/explosion.png
- d####.####.com/static/images/2DOfferwallPlayMarket/drawable-mdpi/x_2.png
- mysearc####.com/js/jquery.cookie.js
- d####.####.com/styles/compressed/fullpage_float_window_infra.20170517-08...
- f####.####.com/css?family=####
- startap####.com/1.3/getadsmetadata?publisherId=####&productId=####&os=##...
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.js
- d####.####.com/styles/compressed/banner_rt_2d_rays_infra.20170517-0838.m...
- b####.####.com/beacon.js
- i####.####.com/InApp/resources/info_s.png
- d####.####.com/static/images/star_top_full_big.png
- mysearc####.com/sidebar/landing?p=####&ver=####
- d####.####.com/static/images/banner_rt_2d_rays_base/download_icon_30.png
- d####.####.com/static/images/animapp/ldpi/bg-landscape.jpg
- mysearc####.com/styles/searchSideBar/apps.css
- d####.####.com/image/fetch/f_auto,q_80,w_230,h_230/http%3A%2F%2Flh3.goog...
- f####.####.com/s/roboto/v16/7m8l7TlFO-S3VkhHuR0atywlidHJgAgmTjOEEzwu1L8....
- d####.####.com/image/fetch/f_auto,q_80,w_124,h_124/http%3A%2F%2Flh6.ggph...
- m####.####.com/dir/click?c=####&offerid=####&affid=####&affsub1=####&cid...
- startap####.com/tracking/adImpression?d=####&d=####&d=####
- c####.####.co/tracking/adClick?d=####&ru=####&index=####
- i####.####.com/InApp/resources/info_l.png
- startap####.com/1.3/getads?publisherId=####&productId=####&os=####&sdkVe...
- d####.####.com/static/images/star_top_half_big.png
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gai...
Запросы HTTP POST:
- s####.####.com/cw/interface!u2.action?protocol=####&version=####&cid=####
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/info_ex_l.png
- <Package Folder>/files/half_star.png
- <Package Folder>/files/info_l.png
- <Package Folder>/files/filled_star.png
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/logo.png
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/files/loading.html
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/files/resources.zip
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/databases/downloadswc
- <Package Folder>/files/Roboto-Regular.ttf
- <Package Folder>/files/close_button.png
- <Package Folder>/shared_prefs/apprater.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/files/info_ex_s.png
- <Package Folder>/files/drawable.zip
- <Package Folder>/files/tab_side.png
- <Package Folder>/files/empty_star.png
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/ads-1099439983.jar
- <Package Folder>/files/drawable-hdpi.zip
- <Package Folder>/files/info_s.png
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
