Android.Packed.22255

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.HiddenAds.101.origin
Android.HiddenAds.67.origin

Сетевая активность:

Подключается к:

trac####.####.com
clinkad####.com
set####.####.com
r####.####.com
lo####.####.net
s####.####.com
u####.####.com
i####.####.com
pl####.####.com
real####.####.org
p####.####.com
ma####.####.com
gl####.####.com
m####.####.com
a####.####.org
o####.####.com
a####.####.net
up####.####.com
api####.####.com
cdn####.####.com
a####.####.com
pass####.####.com
t####.####.com
t####.####.info
se####.####.com
udeli####.####.com
d####.####.com
mobotoo####.####.com
con####.####.com
n####.####.com

Запросы HTTP GET:

trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
p####.####.com/frontend/cardList.htm?isrecmd=####&ran=####&ismsg=####&is...
i####.####.com/sound_on.png
i####.####.com/sound_off.png
mobotoo####.####.com/mobotoolpush/whitelist.json?tag=####&language=####&...
t####.####.com/agentapi/click?cid=####&aid=####&mb_mac=####&mb_devid=###...
up####.####.com/mu3/app/20170415/09/1492218060239/icon/icon_o.png
a####.####.net/api/v2/template/get?slot_id=####&update_time=####
p####.####.com/notification/android/message.json?pname=####&version=####...
mobotoo####.####.com/mobotoolpush/downloadsilent.json?version_name=####&...
i####.####.com/1380229154.js
pass####.####.com/android/v2/getDoSignInfo.htm?uid=####&versionCode=####...
d####.####.com/M01/01/AA/CvJMDVkcNv6AXk2-AAP-y3A0ROc859.zip
r####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
a####.####.org/rule?platform=####&os_version=####&package_name=####&app_...
up####.####.com/mu3/game/20161112/00/1478882027637/icon/icon_o.png
d####.####.com/onlyImpression?k=####&p=####
cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6543ca78b3.png
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
mobotoo####.####.com/mobotoolpush/addispsort.json?facebook=####&language...
gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&a...
i####.####.com/jquery-1.9.1.min.js
i####.####.com/c9c3c487a8f9a695f64c934acaa4fe777f561b3a_768x1024_opt_v1....
o####.####.com/ipo/api/gray/status?appvc=####&os=####&appvn=####&avn=###...
a####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub4=####&aff_sub####...
mobotoo####.####.com/mobotoolpush/textoperation.json?version_name=####&n...
s####.####.com/ads-service/ads/service/getAdlist.do?adnum=####&adid=####...
r####.####.com/nad?v1=####&model=####&dx=####&dy=####&accept=####&slot_c...
n####.####.com/mu/mobotoolpush_admin/icon/1493377391/clash
r####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...
mobotoo####.####.com/mobotoolpush/notibarpush.json?version_name=####&adi...
i####.####.com/jquery.knob.js
i####.####.com/c2f25c6ce7c78de71762df875f6d44f61cea57e0_570x320_opt_v1.mp4
a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=#...
cdn####.####.com/cdn-adn/html/common/2016/02/22/22/03/com.qihoo.security...
m####.####.com/trackid/relay2475/2668/lm_pubtransid=9813302131871910&lm_...
a####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
up####.####.com/mu3/game/20170420/23/1492702658031/icon/icon_o.png
set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
real####.####.org/realtime?platform=####&os_version=####&package_name=##...
mobotoo####.####.com/mobotoolpush/deskiconpush.json?version_name=####&ad...
d####.####.com/impression?k=####&p=####&q=####&x=####
a####.####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pro...
udeli####.####.com/adClick/1.0/?campaign=####&supplier=####&appName=####...
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod...
a####.####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&sd...
n####.####.com/https://s3-ap-southeast-1.amazonaws.com/spider.test.voga3...
t####.####.info/click?_type=####&sdk_redir=####&campid=####&sub_channel=...
clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gai...

Запросы HTTP POST:

se####.####.com/android/upgradeAppInfo.htm
pass####.####.com/android/v2/getUserInfo.htm
ma####.####.com/android/requestForUpdate.htm
ma####.####.com/json/map
a####.####.com/detail/getOfferListNew?enc=####
se####.####.com/social/getPraiseNum.htm
lo####.####.net/debug/v2/android
se####.####.com/frontend/allmixhotword.htm
s####.####.com/ads-service/ads/service/getListAd.do
con####.####.com/log/log_apps
r####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
se####.####.com/android/requestForUpdate.htm
ma####.####.com/frontend/adentry.htm
se####.####.com/getList.htm
api####.####.com/v3/log/init
r####.####.com/device?api_key=####
ma####.####.com/json/list
se####.####.com/moboapi/switch.htm
ma####.####.com/json/multimap
se####.####.com/initRequestDomain.htm
se####.####.com/frontend/playhotword.htm
s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
se####.####.com/getWeather.htm
s####.####.com/ads-service/ads/service/referUpload.do
pl####.####.com/ad_dex.php
se####.####.com/getUpMessage.htm
a####.####.com/detail/getPrStrategy?product=####&adid=####&appVer=####&d...
ma####.####.com/android/checkIn.htm
p####.####.com/getShowWindow.htm

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/cache/picasso-cache/a5ba553928c8194a8f15520824c19664.1.tmp
<Package Folder>/databases/mobogenie_music.db
<Package Folder>/cache/picasso-cache/60c4f0d916516dc37a1c7ec7939fc587.1.tmp
<Package Folder>/databases/mobvista.msdk.db-journal
<Package Folder>/shared_prefs/install.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
<Package Folder>/shared_prefs/mobvista.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30274-0001-0844-C7BBED1D4C01SessionUser.cls_temp
<Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/files/DaemonServer
<Package Folder>/shared_prefs/ACCS_SDK.xml.bak
<Package Folder>/shared_prefs/SSPPrefe.xml
<Package Folder>/cache/picasso-cache/16fc0cbba4a44427f2ed65849978c0fe.1.tmp
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/databases/mobogenie.db-journal
<Package Folder>/cache/picasso-cache/f00a62111d03902e07c9abcbc16ef76b.0.tmp
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1114554156.zip
<Package Folder>/cache/picasso-cache/ddad7629177028de6ccb1e9b4e52539a.0.tmp
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/cache/picasso-cache/297879fd7a99bae188bde1a14c4fc6d9.0.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
<Package Folder>/cache/picasso-cache/714762c7e4e207def97c882776bb2b71.0.tmp
<Package Folder>/databases/mobogenie_update.db
<Package Folder>/shared_prefs/apsad.xml.bak
<Package Folder>/databases/cc.db
<Package Folder>/cache/picasso-cache/b684a1df8e6e9cf3ecfd65d14240b55a.0
<Package Folder>/databases/mobogenie.db
<Package Folder>/databases/accs.db-journal
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/SCORE_PRE.xml
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/cache/picasso-cache/b684a1df8e6e9cf3ecfd65d14240b55a.1
<Package Folder>/shared_prefs/SETTING_DOMAIN.xml.bak
<Package Folder>/shared_prefs/aps.xml.bak
<Package Folder>/cache/picasso-cache/a5ba553928c8194a8f15520824c19664.0.tmp
<Package Folder>/databases/trackreferrer.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/SUBSCRIBE_AD.xml.bak
<Package Folder>/cache/picasso-cache/ecd2fe9a42b6b6fbaca8e3ccd22b194c.1.tmp
<Package Folder>/cache/picasso-cache/19a7349543a590c6f780f2c1c2b6a714.1.tmp
<Package Folder>/cache/picasso-cache/e18de9851c6fce70b2656cc0684eeea9.1.tmp
<Package Folder>/cache/picasso-cache/8cb16216ed44392abe0fe2d5b3fd8238.0.tmp
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/SETTING_PRE.xml.bak
<Package Folder>/shared_prefs/SUBSCRIBE_AD.xml
<Package Folder>/cache/picasso-cache/b66cfe876ddf822ea56bcd0a36ff6179.0.tmp
<Package Folder>/cache/picasso-cache/2059e716def740632c3fc5a2fb76d9fc.0.tmp
<Package Folder>/cache/picasso-cache/eaff1385719d6a36d89413c760d51987.0.tmp
<Package Folder>/cache/picasso-cache/297879fd7a99bae188bde1a14c4fc6d9.1
<Package Folder>/cache/picasso-cache/60c4f0d916516dc37a1c7ec7939fc587.0.tmp
<Package Folder>/.mbj/dex/classes.zip
<Package Folder>/cache/picasso-cache/b71a94aba07459017877e5a1109e906e.1.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30347-0001-0860-C7BBED1D4C01SessionDevice.cls_temp
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/cache/picasso-cache/a9412cf8e19ce1d974da7adbc0e8b6d1.1
<Package Folder>/cache/picasso-cache/a9412cf8e19ce1d974da7adbc0e8b6d1.0
<Package Folder>/eudemon
<Package Folder>/cache/picasso-cache/a22cc786c79c4467ada02f7c4573814e.1.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30274-0001-0844-C7BBED1D4C01SessionDevice.cls_temp
<Package Folder>/cache/picasso-cache/e18de9851c6fce70b2656cc0684eeea9.0.tmp
<Package Folder>/shared_prefs/self_adextend.xml.bak
<Package Folder>/cache/picasso-cache/b66cfe876ddf822ea56bcd0a36ff6179.1.tmp
<Package Folder>/files/google.db
<Package Folder>/cache/picasso-cache/16fc0cbba4a44427f2ed65849978c0fe.0.tmp
<Package Folder>/shared_prefs/share_date.xml
<Package Folder>/shared_prefs/SCORE_PRE.xml.bak
<Package Folder>/files/rk.jar
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/cache/picasso-cache/f00a62111d03902e07c9abcbc16ef76b.1
<Package Folder>/cache/picasso-cache/eb7ef3d726c1cc212daeae52017e2279.1
<Package Folder>/cache/picasso-cache/eb7ef3d726c1cc212daeae52017e2279.0
<Package Folder>/cache/picasso-cache/ddad7629177028de6ccb1e9b4e52539a.1.tmp
<Package Folder>/cache/picasso-cache/714762c7e4e207def97c882776bb2b71.1.tmp
<Package Folder>/shared_prefs/USERINFO.xml
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/watch_server
<Package Folder>/cache/picasso-cache/1af4863706fa9a6e133c368c3cce7bf6.1.tmp
<Package Folder>/shared_prefs/FirstNewUninstallTime.xml
<Package Folder>/files/uninstall
<Package Folder>/databases/download_file.db-journal
<Package Folder>/cache/picasso-cache/1af4863706fa9a6e133c368c3cce7bf6.0.tmp
<Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/cache/picasso-cache/e2d648d7b861ebd195cf8db3165080eb.1.tmp
<Package Folder>/shared_prefs/MobogeniePrefsFile.xml
<Package Folder>/cache/picasso-cache/06412384bd500638162d0ba15dc9f81a.0.tmp
<Package Folder>/shared_prefs/SETTING_DOMAIN.xml
<Package Folder>/cache/picasso-cache/ecd2fe9a42b6b6fbaca8e3ccd22b194c.0.tmp
<Package Folder>/cache/picasso-cache/b71a94aba07459017877e5a1109e906e.0.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30347-0001-0860-C7BBED1D4C01BeginSession.cls_temp
<Package Folder>/files/agoo.pid
<Package Folder>/cache/picasso-cache/a64e4940b33d43d5a587d9716add3915.0.tmp
<Package Folder>/shared_prefs/PUSH_PRE.xml
<Package Folder>/cache/picasso-cache/43e97d49c2bb5b902b834a41852276f6.1.tmp
<Package Folder>/cache/picasso-cache/06412384bd500638162d0ba15dc9f81a.1.tmp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30274-0001-0844-C7BBED1D4C01SessionOS.cls_temp
<Package Folder>/cache/picasso-cache/43aadefe45661e86665877a1790d7f62.0.tmp
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
<Package Folder>/cache/picasso-cache/e2d648d7b861ebd195cf8db3165080eb.0.tmp
<Package Folder>/cache/picasso-cache/5ed52be3ef960ac70b55f0ef60b724d5.0.tmp
<Package Folder>/shared_prefs/PUSH_PRE.xml.bak
<Package Folder>/cache/picasso-cache/1fd8b9dfb254e2bc62e6e3cf6781ed7f.1.tmp
<Package Folder>/databases/self_ad_db-journal
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/ct_default.xml
<Package Folder>/cache/picasso-cache/43e97d49c2bb5b902b834a41852276f6.0.tmp
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/databases/self_ad_db
<Package Folder>/shared_prefs/dcSharedPreferences.dat.xml
<Package Folder>/shared_prefs/share_date.xml.bak
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes472640957.zip
<Package Folder>/shared_prefs/<Package>_ui_preferences.xml
<Package Folder>/cache/picasso-cache/a22cc786c79c4467ada02f7c4573814e.0.tmp
<Package Folder>/databases/ztrack.db-journal
<Package Folder>/shared_prefs/postTime.xml
<Package Folder>/shared_prefs/FLOAT_WINDOW.xml
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
<Package Folder>/databases/cc.db-journal
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/TOKEN.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/clean_version_sp.xml
<Package Folder>/files/mobclick_agent_cached_<Package>302132
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30347-0001-0860-C7BBED1D4C01SessionOS.cls_temp
<Package Folder>/cache/picasso-cache/8cb16216ed44392abe0fe2d5b3fd8238.1.tmp
<Package Folder>/cache/picasso-cache/eaff1385719d6a36d89413c760d51987.1.tmp
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/shared_prefs/self_adextend.xml
<Package Folder>/cache/picasso-cache/2059e716def740632c3fc5a2fb76d9fc.1
<Package Folder>/cache/picasso-cache/a9fce330ff4ac4b13901ed70e01d5747.1
<Package Folder>/databases/message_accs_db
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml
<Package Folder>/shared_prefs/clean.xml
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/mobogenie_update.db-journal
<Package Folder>/cache/picasso-cache/5ed52be3ef960ac70b55f0ef60b724d5.1.tmp
<Package Folder>/shared_prefs/SSPPrefe.xml.bak
<Package Folder>/cache/picasso-cache/c22328892326f208cf9ff0a189640e52.0
<Package Folder>/cache/picasso-cache/c22328892326f208cf9ff0a189640e52.1
<Package Folder>/shared_prefs/SETTING_PRE.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/cache/picasso-cache/43aadefe45661e86665877a1790d7f62.1.tmp
<Package Folder>/databases/trackreferrer.db
<Package Folder>/cache/picasso-cache/a64e4940b33d43d5a587d9716add3915.1.tmp
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
<Package Folder>/shared_prefs/MobogeniePrefsFile.xml.bak
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30274-0001-0844-C7BBED1D4C01SessionApp.cls_temp
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30274-0001-0844-C7BBED1D4C01BeginSession.cls_temp
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/0def24353a3d8f0f7144f3755d8f7744.xml
<Package Folder>/cache/picasso-cache/d149467676fd959a5a11be2498d059cc.1
<Package Folder>/cache/picasso-cache/d149467676fd959a5a11be2498d059cc.0
<Package Folder>/databases/mobogenie_music.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/strategy_sp.xml
<Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA30347-0001-0860-C7BBED1D4C01SessionApp.cls_temp
<Package Folder>/cache/picasso-cache/a9fce330ff4ac4b13901ed70e01d5747.0
<Package Folder>/shared_prefs/last_know_location.xml
<Package Folder>/cache/picasso-cache/19a7349543a590c6f780f2c1c2b6a714.0.tmp
<Package Folder>/shared_prefs/ACCS_BIND.xml
<Package Folder>/files/cwd
<Package Folder>/cache/picasso-cache/journal.tmp
<Package Folder>/cache/picasso-cache/1fd8b9dfb254e2bc62e6e3cf6781ed7f.0.tmp
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.q.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/databases/MsgLogStore.db-journal

Другие:

Запускает следующие shell-скрипты:

chmod 755 /data/data/####/files/watch_server
chmod 755 /data/user/0/<Package>/files/watch_server
/data/data/####/files/cwd 0
<error:2>
sh <Package Folder>/files/uninstall 0 http://m.mobogenie.com/en/uninstall/uninstall.html?channel_id=1032&uuid=26cd8bc4-3a36-43ef-b0d0-03e323667e6a&android=81399a04b6199337&imei=<IMEI>&versionCode=302132&versionName=3.2.13.2&site=GL
cat /proc/cpuinfo
/data/data/####/files/uninstall 0 http://m.mobogenie.com/en/uninstall/uninstall.html?channel_id=1032&uuid=26cd8bc4-3a36-43ef-b0d0-03e323667e6a&android=81399a04b6199337&imei=####&versionCode=302132&versionName=3.2.13.2&site=GL
/data/user/0/####/files/watch_server /data/user/0/#### http://redirect.mobogenie.com?pn=####&v=302132&an=####&lc=en_US&tag=mobogenie com.android.browser/com.android.browser.BrowserActivity 0
sh
/data/data/####/files/watch_server /data/data/#### http://redirect.mobogenie.com?pn=####&v=302132&an=####&lc=en_US&tag=mobogenie com.android.browser/com.android.browser.BrowserActivity 0
chmod 755 <Package Folder>/files/watch_server
chmod 755 /data/user/0/####/files/watch_server
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.
<dexopt>
chmod 500 <Package Folder>/files/DaemonServer

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней