Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.76.origin
- Android.RemoteCode.71.origin
Сетевая активность:
Подключается к:
- c####.####.rocks
- o####.rocks
- affshar####.com
- prelan####.net
- cu####.com
- o####.####.com
- admobim####.com
- zfr####.com
- 2####.####.68
- topphon####.mobi
- mmmmmm####.com
- mobilep####.com
- boom####.####.com
- a####.####.com
Запросы HTTP GET:
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.squishy.js
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/step1.html
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/index.css
- boom####.####.com/tl?a=####&o=####&s2=####
- topphon####.mobi/?sl=####&data1=####&data2=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/script.js
- affshar####.com/Bq-V3slYUQ/?l1=####
- cu####.com/20170512125901.NewExpDex_5.1.9_05121258.zip
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&...
- o####.rocks/?a=####&c=####&s2=####
- c####.####.rocks/?a=####&c=####&s2=####&ckmreqid=####&E=####&ckmguid=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.min.js
Запросы HTTP POST:
- admobim####.com/surl/api_status.action
- 2####.####.68/logsp.do
- mmmmmm####.com/osp/rego_datalog.action
- admobim####.com/surl/api2_reg.action
- mmmmmm####.com/osp/oaen_reg.action
- zfr####.com/up.do
- o####.####.com/check_config_update
- a####.####.com/app_logs
- mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####&cid...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/ob.zip
- <Package Folder>/shared_prefs/service_config.xml.bak
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/sp_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/shared_prefs/other_config.xml.bak
- <Package Folder>/shared_prefs/CrPreUtil.xml
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/shared_prefs/kokId.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml.bak
- <Package Folder>/shared_prefs/service_config.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/files/d.zip
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/shared_prefs/hunter_config.xml
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/shared_prefs/LoginPreUtil.xml.bak
- <Package Folder>/shared_prefs/t_ini.xml.bak
- <Package Folder>/shared_prefs/other_config.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/sp_config.xml.bak
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/m_cfg.xml.bak
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/files/dtemp.apk
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/OfferPreUtil.xml.bak
- <Package Folder>/databases/localstorage/file__0.localstorage-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/upgrade_config.xml.bak
- <Package Folder>/shared_prefs/upgrade_config.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/databases/my.db
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
