Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- trac####.####.com
- di####.aw
- tmgonli####.nl
- ce####.####.org
- api-ce####.####.org
- s####.####.com
- u####.####.com
- i####.####.com
- h####.com
- t####.####.net
- google-####.com
- p####.####.com
- a22667e####.####.net
- d####.####.net
- c6ba1cd####.####.com
- c####.####.org
- gl####.####.com
- a####.####.io
- teleg####.####.nl
- a####.####.com
- a932365####.####.net
- t####.####.com
- speakt####.com
- cloudfr####.####.com
- c####.####.com
- d####.####.com
- 0a951e0####.####.com
- j####.####.net
- offert####.com
Запросы HTTP GET:
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- tmgonli####.nl/blur/telegraaf.nl.css
- h####.com/js/bundles/partner-article.js?squizard?bust=####
- c####.####.org/v2/content/list-0-0-0-NL-5-0-1.json?1495005####
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=...
- t####.####.com/site/31436?dt=####&r=####&sig=####&bkca=####
- di####.aw/wp-content/uploads/2017/04/Segun-Michelle-de-Groot-directora-d...
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- c####.####.org/v2/content/list-1-0-0-NL-1-0-1.json?1495005####
- offert####.com/d/21968308e36f2c15b34?sub=####&sub2=####
- google-####.com/ga.js
- tmgonli####.nl/consent/consent/?return=####&clienttime=####&version=####...
- h####.com/article/58e7098b66f6003903b7e796?view=####
- a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
- t####.####.com/sync?prtid=####&yahid=####
- c####.####.org/v2/content/article1-46757188-af5008cd8c4fa3bae48802e5b726...
- c####.####.org/v2/content/list-1-0-0-NL-3-0-1.json?1495005####
- c####.####.org/v2/system/version-1-96.json
- ce####.####.org/v3/system/countrys.json
- t####.####.com/site/31435?id=####&redir=####
- api-ce####.####.org/v3/commentlist-46757188-af5008cd8c4fa3bae48802e5b726...
- t####.####.com/req?v=####&id=####&acc=####&tit=####
- p####.####.com/aa/y8a2thbi7v8xdodcoa82
- speakt####.com/d/21968308e36f2c15b34?sub=####&sub2=####
- h####.com/content?url=####
- tmgonli####.nl/blur/telegraaf.nl.jpg
- teleg####.####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e...
- h####.com/article/58e6ae8366f6003903a94a92?view=####
- h####.com/css/fonts/roboto-v15-latin-regular.ttf
- teleg####.####.nl/reportage/27954197/__Kabinetsplannen_in_ijskast__.html...
- h####.com/js/bundles/cookies.js
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####&verify=####
- u####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
- c6ba1cd####.####.com/58e7098b66f6003903b7e796_500x333.jpg
- t####.####.com/sync?prtid=####&admid=####
- cloudfr####.####.com/x.png
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/32212852418/
- h####.com/css/fonts/roboto-v15-latin-500.ttf
- p####.####.com/ct/upi/pid/DuqQKWX7?redir=####&_test=####
- c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
- t####.####.com/sync?prtid=####&aolid=####
- ce####.####.org/v2/content/recommend-af5008cd8c4fa3bae48802e5b7263808-NL...
- teleg####.####.nl/data/files/css/css_d756fdcc4702a1af90653fabc4386324.css
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- teleg####.####.nl/javascript/analyticsfunctions.7f145f3298ebd5bb16896b24...
- a22667e####.####.net/test.png
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####
- teleg####.####.nl/css/main.21b2b0ec3365314b5a2e17b97235cc29.css
- a####.####.com/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=##...
- api-ce####.####.org/v2/content/getItemDetails-46757188.json
- u####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
- i####.####.com/s
- h####.com/js/jquery.js
- teleg####.####.nl/javascript/jquery-1.11e0a4effa969b585c6a296a6545cf23.8...
- p####.####.com/ul_cb/aa/y8a2thbi7v8xdodcoa82
- c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
- c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
- t####.####.com/38645a54-e22a-423a-ac19-3d3ab0c47678?app_id=####&cid=####
- p####.####.com/upi/pid/DuqQKWX7?redir=####
- d####.####.net/ibs:dpid=822&dpuuid=32212852418&redir=https%3A//sync.navd...
- teleg####.####.nl/javascript/jquery/jquery.3291194034b434bb51afaa5aabd23...
- c####.####.org/2017-05-02/a58184d0c91bbef500c711bd1d4ad0b3.jpg
- tmgonli####.nl/consent/img/pressed.png
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- teleg####.####.nl/graphics/videopage/play25.474a26e5402cfd0d640965345065...
- tmgonli####.nl/cc1495005908262.js
- teleg####.####.nl/static/gerichtonline/bpreview.13ece81274f2222c471795aa...
- ce####.####.org/v3/system/initcountrytopic.json
- t####.####.com/tm42098.js
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&clickId=####&s...
- c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- c####.####.org/v2/system/startimg-NL.json
- tmgonli####.nl/consent/img/not_pressed.png
- teleg####.####.nl/s/27954197
- di####.aw/wp-content/banners/728x90-presstiza.gif
- t####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
- c####.####.com/index.php?service=####&pub=####&offer_id=####&subpub=####
- a####.####.io/latest?base=####
- teleg####.####.nl/javascript/new/sticky-widget.486e830c26a47dda60094744a...
- a####.####.com/ajax/libs/jquery/1.8.2/jquery.min.js
- teleg####.####.nl/javascript/consentWrapper.473cf9b5cbf5671e57fa7a424723...
- a932365####.####.net/test.png
- c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
- tmgonli####.nl/consent/script/consent.js
- c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
- teleg####.####.nl/javascript/tg-search.370200d6eb28e931de24c8f22da433a.js
- tmgonli####.nl/blur/telegraaf.nl.js
- tmgonli####.nl/blur/telegraaf.nl.logo.png
- c####.####.com/cms?partner_id=####
- c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
- c####.####.org/v2/system/languages.json
- teleg####.####.nl/css/siteColors.5c46a3e419ee4eb7ccf8a00dd7aa9652.css
- di####.aw/wp-content/banners/728x90-diario.gif
- 0a951e0####.####.com/58e6ae8366f6003903a94a92_500x356.jpg
- api-ce####.####.org/v2/content/getItemDetails-46765833.json
- c####.####.com/dp/navegg.php?pid=####&uid=####
- teleg####.####.nl/data/files/js/js_68deeb279453631cef643d2060c701ae.js
- t####.####.com/agentapi/click?cid=####&aid=####&postbac####
- teleg####.####.nl/javascript/ads/showads.75977793993735b23353a9c8fa0a76e...
- c####.####.org/v2/content/list-0-0-0-NL-3-0-1.json?1495005####
- teleg####.####.nl/javascript/all-scripts.7c05874763404c80cde78fa37fbc375...
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####
- t####.####.com/utag/tmggroup/telegraaf-web/prod/utag.sync.js
- speakt####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&su...
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&adv...
- c####.####.org/v2/content/article1-46765833-af5008cd8c4fa3bae48802e5b726...
- c####.####.org/v2/system/models-96.json
- teleg####.####.nl/javascript/store.522208ff3eab3e86c018e7e9956887bc.min.js
- c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
- c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1495005####
- h####.com/css/partner-article.css?bust=####
- teleg####.####.nl/javascript/new/common.23176cb1df0ca0bc60b460083c9ceb2.js
- c####.####.org/v2/content/list-0-0-0-NL-2-0-1.json?1495005####
- j####.####.net/gateway/gw.js?csid=####
- a####.####.com/offers/click/8/112318/?aff_sub=####&source=####
- api-ce####.####.org/v3/commentlist-46765833-af5008cd8c4fa3bae48802e5b726...
Запросы HTTP POST:
- a####.####.com/api/ads/fetch?_s=####
- ce####.####.org/auth/gather
- a####.####.com/api/ads/connect
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes907992822.zip
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/validatorFile
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/files/.yflurryfreqcap.-3604fbe1ac7f4f1c
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/files/.yflurryadlog.-3604fbe1ac7f4f1c
- <Package Folder>/shared_prefs/417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/files/.yflurrydatasenderblock.6c3938b1-8b79-40b9-8669-17b2a7826098
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/files/.yflurryreport.-3604fbe1ac7f4f1c
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/sessions/sessionFile
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/v2_local_login.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1702844642.zip
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/shared_prefs/com.amazonaws.android.auth.xml
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_XS7MGCQYH4WTKK82VNTC_216
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1218512822.zip
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
