Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Click.234
Загружает из Интернета следующие детектируемые угрозы:
- Android.Click.234
Сетевая активность:
Подключается к:
- a####.####.com
- cu####.com
- i####.####.com
- s####.####.co
- zfr####.com
Запросы HTTP GET:
- a####.####.com/adbux?v=####&tp=####&os=####&bdr=####&pk=####&id=####
- a####.####.com/v30/userconfig/update?lang=####&applang=####&quickread=##...
- cu####.com/20170720122225.ExpDex_5.2.0_201707201221.zip
- i####.####.com/avatar/invincible.jpg
Запросы HTTP POST:
- a####.####.com/app_logs
- s####.####.co/log?mos=####&mver=####&net=####&appname=####&dcid=####&tem...
- zfr####.com/up.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/10d8d8f966e87553f61545bcf32a727ea22b0b956d395ccaf5df91777b7490c2.0.tmp
- <Package Folder>/cache/####/1ca192e9d2630b2f49b8aa01bc44bcfbee64945e071a3adce6f847e8f5e2a6fc.0.tmp
- <Package Folder>/cache/####/2a2799952568d97317ddaca047dc727ebf4fcd6d62988921f30d84db03739015.0.tmp
- <Package Folder>/cache/####/43fef0cc7488875d19369007190c4019da22f352da6a7b83bb6e7a28ce124464.0.tmp
- <Package Folder>/cache/####/466dea8467c15e744ea0ca2b0610ebd455d25c499fad31cc7d99b8437390005c.0.tmp
- <Package Folder>/cache/####/5016edaacca1f549a34fd3b07141985bfbf9927e0c663bacb1c078f8445f15cf.0.tmp
- <Package Folder>/cache/####/559ab9627927027f3ae305eeed32ab026a73704f265db2b3fa41e4ec2f0050c1.0.tmp
- <Package Folder>/cache/####/57a0c792cd6872a4a8412d8a59fe310fc5b1be12a5bf1b026b04cc6cc5bf2eda.0.tmp
- <Package Folder>/cache/####/70fe7dc225d9b9d9d6ec5abdb14a5ed16fd79f1d2898a13085d223ee0b989574.0.tmp
- <Package Folder>/cache/####/737b6c6a1035ef7838791075a632a4e70adbfa08ac3918602fb9ace7cd9dd7b3.0.tmp
- <Package Folder>/cache/####/7444ad3dca6a2568e29d5d131788bc76498adb6d75726f427e65588ced162d4f.0.tmp
- <Package Folder>/cache/####/7bd01e03e1c2296f69b38b8b55e07e21d82296c8de750e22664382a2ab3ddda7.0.tmp
- <Package Folder>/cache/####/7f7178704aa6d9c2b17c03c745ca887ad336b425c7526722e463335e71842816.0.tmp
- <Package Folder>/cache/####/8341a94d77118288ba4120004c3d187c1440fa2f73aea9d589127c2ec40a8526.0.tmp
- <Package Folder>/cache/####/98a9843bb54bdcf5ceec1b32699b4cde70c88a50f8e031b5f5980f118471533b.0.tmp
- <Package Folder>/cache/####/b547018c79cab3d0423958548e4d4d731a0f4b5f2512e65485764e30c520336c.0.tmp
- <Package Folder>/cache/####/ba9a622530af71f3246b9ee5cde54fe67828409aada3008b476eb83ff39cc5fb.0.tmp
- <Package Folder>/cache/####/d57d0987fb81817a493372378241d8df1961c188f7e58d6313b0badc6805bfee.0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/e1bf474ac623df4b0aa2c4fecc8dc6061aa8c75bc5d539b71edd2852be89bbbe.0.tmp
- <Package Folder>/cache/####/e1bf6b76eed67522160a7f8c26a5a7d86f3363a1c0e3f90508a1a5e17754908f.0.tmp
- <Package Folder>/cache/####/e3922b16be77974069d3650a404b7cb58240626d5078be22b1deaef6ba5670a4.0.tmp
- <Package Folder>/cache/####/f725815d8ca13c45731291545d4cdd22126daf3696900542e2d068a279a286d0.0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/rozbuzz-db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/b.jar
- <Package Folder>/files/b.tmp.jar
- <Package Folder>/files/d.zip
- <Package Folder>/files/dtemp.apk
- <Package Folder>/files/exid.dat
- <Package Folder>/files/gaClientId
- <Package Folder>/files/ob.zip
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/SharedPrefsStrList.xml
- <Package Folder>/shared_prefs/SharedPrefsStrList.xml.bak
- <Package Folder>/shared_prefs/cn_rs.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/dailynews.xml
- <Package Folder>/shared_prefs/dailynews.xml.bak
- <Package Folder>/shared_prefs/dailynews.xml.bak (deleted)
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/m_cfg.xml.bak
- <Package Folder>/shared_prefs/m_cfg.xml.bak (deleted)
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/shared_prefs/t_ini.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- ps
