Android.DownLoader.3019

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.20

Загружает из Интернета следующие детектируемые угрозы:

Android.Xiny.20

Сетевая активность:

Подключается к:

2####.####.35
andsn####.####.com
d####.####.cn
e####.####.cn
gaand####.####.net
m####.####.com
m####.####.com:8757

Запросы HTTP GET:

2####.####.35/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/lvs.jar?wsiphost...
d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
m####.####.com/sdk.html

Запросы HTTP POST:

andsn####.####.com/g/zxcvb/ad/reportInstall.g?sid=####
e####.####.cn/cw/cp.action?requestId=####&g=####
gaand####.####.net/g/d?crc=####
m####.####.com:8757/sdk.html

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/databases/TDGAtcagentgame.db
<Package Folder>/databases/TDGAtcagentgame.db-journal
<Package Folder>/databases/downloadswc
<Package Folder>/databases/downloadswc-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/monetization_parameters.xml
<Package Folder>/files/monetization_parameters_sha256.txt
<Package Folder>/files/mysql
<Package Folder>/shared_prefs/2e13b92fd1e4af6743dce6f664663c54TX_CTRO_2C|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/CtrAppPaid.xml
<Package Folder>/shared_prefs/CtrAppPaid.xml.bak
<Package Folder>/shared_prefs/CtrAppPaid.xml.bak (deleted)
<Package Folder>/shared_prefs/W_Key.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/shared_prefs/a.xml.bak
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/st.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/timerhanlder_preferences.xml
<Package Folder>/shared_prefs/updateFileInfo.file.xml
<Package Folder>/shared_prefs/updateFileInfo.file.xml.bak
<SD-Card>/.tcookieid
<SD-Card>/.tdga_log_<Package>
<SD-Card>/Download/####/4.6_lvs.jar.tmp
<SD-Card>/dt/restime.dat