Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.15.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Loki.15.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.net
- analy####.####.com
- baiduli####.####.org
- cdn####.####.com
- d####.####.com
- fk-gray####.####.com
- l####.####.com
- n####.####.com
- pocketm####.####.org
- sc####.####.com
- set####.####.com
- trac####.####.com
Запросы HTTP GET:
- a####.####.com/link/buy/android/com.bol.shop/e1?clinkID=####&pubID=####&...
- a####.####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&directi...
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- a####.####.net/applnk/826227844?src_section_id=####
- a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local...
- baiduli####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6543ca78b3.png
- d####.####.com/click?k=####&p=####&q=####¬ice=####
- fk-gray####.####.com/impression?k=####&p=####&q=####&x=####
- l####.####.com/QZHdj5S_52HYQumqDR82tdxT7T7qU5mjIwP6cfWY6cQB29MZwG2PzIQob...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
- pocketm####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- sc####.####.com/v1/scheme/app?model=####&mcc=####&os_v=####&direction=##...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
Запросы HTTP POST:
- a####.####.com/app_logs
- analy####.####.com/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/06412384bd500638162d0ba15dc9f81a.0.tmp
- <Package Folder>/cache/####/06412384bd500638162d0ba15dc9f81a.1.tmp
- <Package Folder>/cache/####/135d7cc35b7fb2066c8f87aeaf8116c7.0.tmp
- <Package Folder>/cache/####/135d7cc35b7fb2066c8f87aeaf8116c7.1.tmp
- <Package Folder>/cache/####/43aadefe45661e86665877a1790d7f62.0.tmp
- <Package Folder>/cache/####/43aadefe45661e86665877a1790d7f62.1.tmp
- <Package Folder>/cache/####/6092930c1089734cad603fdd3751958b.0.tmp
- <Package Folder>/cache/####/6092930c1089734cad603fdd3751958b.1.tmp
- <Package Folder>/cache/####/7a3971333e67312887d69dddcf637444.0.tmp
- <Package Folder>/cache/####/7a3971333e67312887d69dddcf637444.1.tmp
- <Package Folder>/cache/####/7abffd154080da7ab2f9f19b073d76e8.0.tmp
- <Package Folder>/cache/####/7abffd154080da7ab2f9f19b073d76e8.1.tmp
- <Package Folder>/cache/####/7d05a43868eb995cb7607a0ee5bbbb75.0.tmp
- <Package Folder>/cache/####/7d05a43868eb995cb7607a0ee5bbbb75.1.tmp
- <Package Folder>/cache/####/900cc05a57decf63bff11bb415a91d88.0.tmp
- <Package Folder>/cache/####/900cc05a57decf63bff11bb415a91d88.1
- <Package Folder>/cache/####/a1d3f1b775d02a0a6ffd6711f04a2f59.0.tmp
- <Package Folder>/cache/####/a1d3f1b775d02a0a6ffd6711f04a2f59.1.tmp
- <Package Folder>/cache/####/b092a8b5325c88f39592e90eb7e1fcc3.0.tmp
- <Package Folder>/cache/####/b092a8b5325c88f39592e90eb7e1fcc3.1.tmp
- <Package Folder>/cache/####/c4b4de2b0e8bbceac8a7f7ecfac1ddac.0.tmp
- <Package Folder>/cache/####/c4b4de2b0e8bbceac8a7f7ecfac1ddac.1.tmp
- <Package Folder>/cache/####/ed892f0e929a2ddfcbf83e02c59c177c.0.tmp
- <Package Folder>/cache/####/ed892f0e929a2ddfcbf83e02c59c177c.1.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/bat_statistics.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/mobpower.db-journal
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/AdjustIoActivityState
- <Package Folder>/files/AdjustIoPackageQueue
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/exid.dat
- <Package Folder>/files/librzKXgueSDvKSXJOpbootstrap.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/TOKEN.xml
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/com.mobpower.xml
- <Package Folder>/shared_prefs/com.mobpower.xml.bak
- <Package Folder>/shared_prefs/ct_default.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/mobvista.xml.bak
- <Package Folder>/shared_prefs/my.xml
- <Package Folder>/shared_prefs/share_date.xml
- <Package Folder>/shared_prefs/share_date.xml.bak
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_offers.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_settings.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.mobvista700/####/-1350595721.temp
- <SD-Card>/.mobvista700/####/-1377858248.temp
- <SD-Card>/.mobvista700/####/-1444640728.temp
- <SD-Card>/.mobvista700/####/-1458188283.temp
- <SD-Card>/.mobvista700/####/-1529022244.temp
- <SD-Card>/.mobvista700/####/-1827446003
- <SD-Card>/.mobvista700/####/-1967094216.temp
- <SD-Card>/.mobvista700/####/-43076249.temp
- <SD-Card>/.mobvista700/####/-82653802.temp
- <SD-Card>/.mobvista700/####/-898324802
- <SD-Card>/.mobvista700/####/-987532175.temp
- <SD-Card>/.mobvista700/####/1175407175
- <SD-Card>/.mobvista700/####/1292402785.temp
- <SD-Card>/.mobvista700/####/1308659314.temp
- <SD-Card>/.mobvista700/####/1369952422
- <SD-Card>/.mobvista700/####/1379238200.temp
- <SD-Card>/.mobvista700/####/1880935128.temp
- <SD-Card>/.mobvista700/####/1920493326.temp
- <SD-Card>/.mobvista700/####/1942953378.temp
- <SD-Card>/.mobvista700/####/200440155.temp
- <SD-Card>/.mobvista700/####/2103913252.temp
- <SD-Card>/.mobvista700/####/2132926088
- <SD-Card>/.mobvista700/####/425647060.temp
- <SD-Card>/.mobvista700/####/965947873.temp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
