Android.Packed.28119

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Spy.447

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) moboapp####.com:80
TCP(HTTP/1.1) androi####.b####.com:80
TCP(HTTP/1.1) c####.b####.com:80
TCP(HTTP/1.1) up####.mobilea####.b####.com:80
TCP(HTTP/1.1) mbrowse####.wsh####.com:80
TCP(HTTP/1.1) js.mob####.b####.com:80
TCP(HTTP/1.1) m####.space:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) s####.appre####.b####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) con####.face####.net:80
TCP(HTTP/1.1) img.p####.b####.####.net:80
TCP(HTTP/1.1) mobile-####.b####.com:80
TCP(HTTP/1.1) www.google-####.com:80
TCP(HTTP/1.1) busi####.moboma####.b####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) p####.everest####.net:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) t####.appsf####.com:443
TCP(TLS/1.0) odr.moo####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) cm.g.doublec####.net:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) api.appsf####.com:443

Запросы DNS:

androi####.b####.com
api.appsf####.com
busi####.moboma####.b####.com
c####.b####.com
cm.g.doublec####.net
con####.face####.net
d####.fl####.com
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
img.p####.b####.com
js.mob####.b####.com
m####.space
mobile-####.b####.com
moboapp####.com
odr.moo####.com
p####.everest####.net
pag####.googles####.com
s####.appre####.b####.com
s####.g.doublec####.net
s####.mob####.b####.com
s.mobile-####.b####.com
t####.appsf####.com
tpc.googles####.com
u####.b####.com
up####.mobilea####.b####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com

Запросы HTTP GET:

androi####.b####.com/index.php/Applist/GetAppOperationList?_branch=####&...
androi####.b####.com/index.php/Applist/GetRecommendedList?_branch=####&p...
androi####.b####.com/index.php/Guid/GetGuidTab?_branch=####&simCode=####
androi####.b####.com/index.php/Home/getHomeAppInfo?group_name=####&_bran...
androi####.b####.com/index.php/Tag/getTagDetail?group_name=####&_branch=...
androi####.b####.com/index.php/ToolBox/getItems?_branch=####&picsize=####
androi####.b####.com/index.php/Update/UpdateDesc2?_branch=####
androi####.b####.com/setting/mobomarket_client_config
androi####.b####.com/setting/mobomarket_fb_config?_branch=####&fbVer=####
busi####.moboma####.b####.com/business/getConf?time_stamp=####&product=#...
con####.face####.net/en_US/fbevents.js
con####.face####.net/signals/config/465448196962873?v=####
js.mob####.b####.com/jssdk/0/mmobomarKCIY.js
js.mob####.b####.com/jssdk/log.json?_dt=####&_dn=####&_KEYname1=####&_KE...
js.mob####.b####.com/jssdk/star2.png
js.mob####.b####.com/jssdk/statistics.php?link=&uuid=web|8edaa72cf444423...
m####.space/api/openOffer?asid=####&sp=####&de=####&pi=####&la=####&uu=#...
mbrowse####.wsh####.com/mbrowser/guanxing/Deeplink/js/com.baidu.browser....
mobile-####.b####.com/mbrowser/deeplink/getLinkedApps?pack=####
moboapp####.com/
moboapp####.com/free-download-pokémon-go-4295346244.html
moboapp####.com/static/mobowap/common/mod_96dd55b.js
moboapp####.com/static/mobowap/common/rem_9a14f18.js
moboapp####.com/static/mobowap/common/swiper.min_2bafffa.css
moboapp####.com/static/mobowap/common/swiper.min_5b7e281.js
moboapp####.com/static/mobowap/common/template-native-debug_b715686.js
moboapp####.com/static/mobowap/detail/down-01_22e7283.png
moboapp####.com/static/mobowap/detail/fb_99614e0.png
moboapp####.com/static/mobowap/detail/page_detail_2f2ba72.js
moboapp####.com/static/mobowap/detail/right-01_3dca7ab.png
moboapp####.com/static/mobowap/detail/twitter_e512718.png
moboapp####.com/static/mobowap/general_list/jquery-1.9.1.min_310236f.js
moboapp####.com/static/mobowap/general_list/page_92f5054.js
moboapp####.com/static/mobowap/general_list/style_46e6c91.css
moboapp####.com/static/mobowap/general_list/swipe_5b7b8cd.js
moboapp####.com/static/mobowap/pkg/common_0.5_z_b1ebfe6.png
moboapp####.com/static/mobowap/pkg/common_043116a.js
moboapp####.com/static/mobowap/pkg/common_0fe9a53.css
moboapp####.com/static/mobowap/pkg/detail_b6f8c6a.css
moboapp####.com/static/mobowap/pkg/iconseachbar_0.5_z_c6288a7.png
moboapp####.com/static/mobowap/pkg/iconseachbar_3f6c35a.css
moboapp####.com/static/mobowap/widget/bannerApp/bannerApp_a78cca9.css
moboapp####.com/static/mobowap/widget/botlist/botlist_ac8d742.css
moboapp####.com/static/mobowap/widget/cate/cate_e2e11de.css
moboapp####.com/static/mobowap/widget/colApp/brand-app-download_b8b6952....
moboapp####.com/static/mobowap/widget/colApp/colApp_70a37e0.css
moboapp####.com/static/mobowap/widget/crumb/crumb_e81f606.css
moboapp####.com/static/mobowap/widget/footer/footer_32a7143.css
moboapp####.com/static/mobowap/widget/linelist_detail/linelist-download_...
moboapp####.com/static/mobowap/widget/linelist_detail/linelist_detail_e4...
moboapp####.com/static/mobowap/widget/listheader/Previous_right_ca3e5f2....
moboapp####.com/static/mobowap/widget/listheader/listheader_c0a70f2.css
moboapp####.com/static/mobowap/widget/listheader/more_right_34e3073.png
moboapp####.com/static/mobowap/widget/loadbar/loadbar_9d3647f.js
moboapp####.com/static/mobowap/widget/loadbar/loadbar_c259747.css
moboapp####.com/static/mobowap/widget/navtab/navtab_2bb0359.css
moboapp####.com/static/mobowap/widget/pullup/pullup_5e9bff3.js
moboapp####.com/static/mobowap/widget/pullup/pullup_f50f2ed.css
moboapp####.com/static/mobowap/widget/rankrow/1_3aac799.png
moboapp####.com/static/mobowap/widget/rankrow/2_89ffbad.png
moboapp####.com/static/mobowap/widget/rankrow/3_2359b4b.png
moboapp####.com/static/mobowap/widget/rankrow/brand-new-download_f94deb3...
moboapp####.com/static/mobowap/widget/rankrow/linelist-download-new_c768...
moboapp####.com/static/mobowap/widget/rankrow/rankrow_d989c0a.css
moboapp####.com/static/mobowap/widget/related_3app/app-relate-hot_362f7e...
moboapp####.com/static/mobowap/widget/related_swiper/related_swiper_ee74...
moboapp####.com/static/mobowap/widget/rowApp/brand-new-download_f94deb3....
moboapp####.com/static/mobowap/widget/rowApp/linelist-download-new_c7683...
moboapp####.com/static/mobowap/widget/rowApp/rowApp_f52d15e.css
moboapp####.com/static/mobowap/widget/specialApp/HOT_bc0e5ce.png
moboapp####.com/static/mobowap/widget/specialApp/brand-new-download_f94d...
moboapp####.com/static/mobowap/widget/specialApp/linelist-download-new_c...
moboapp####.com/static/mobowap/widget/specialApp/specialApp_d4cd892.css
moboapp####.com/static/mobowap/widget/store/icons/icons_130ea55.css
moboapp####.com/static/mobowap/widget/store/store_smallbrief/gravatar_d3...
moboapp####.com/static/mobowap/widget/store/store_smallbrief/store_small...
moboapp####.com/static/mobowap/widget/store/title/home_d55f45a.png
moboapp####.com/static/mobowap/widget/store/title/title_ca60ba3.css
moboapp####.com/static/mobowap/widget/store_share/detail/app_09993bb.png
moboapp####.com/static/mobowap/widget/store_share/detail/download_14e60c...
moboapp####.com/static/mobowap/widget/store_share/detail/like_9465bbc.png
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20170828/r20170110/show_ads_impl.js
s####.mob####.b####.com/cgi-bin-py/mobojs.cgi?ty=####&_KEYname1=####&_KE...
up####.mobilea####.b####.com/cgi-bin/get_mobileassist_mobile_update_info...
www.google-####.com/analytics.js
www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...

Запросы HTTP POST:

androi####.b####.com/index.php/Applist/CheckAppUpdateList?_branch=####&c...
c####.b####.com/batsdk/api_int/newsync2
s####.appre####.b####.com/cgi-bin-py-appstore/appstore_report_msg.cgi?ty...

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/index
<Package Folder>/databases/baidu_androidStore.db-journal
<Package Folder>/databases/downloads.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/com.baidu.browser.inter
<Package Folder>/files/####/deeplink.html
<Package Folder>/files/.FlurrySenderIndex.info.AnalyticsData_JP...CR_159
<Package Folder>/files/.FlurrySenderIndex.info.AnalyticsMain
<Package Folder>/files/.flurryagent.3a4e6cb
<Package Folder>/files/.flurrydatasenderblock.cc46fc89-b692-434...bd7dea
<Package Folder>/files/.jiagu.ls
<Package Folder>/files/146c3423b680ef9802cd1bcd9969aee2
<Package Folder>/files/2613d8e22d9ff51dc4b8314dd1e5c3b5
<Package Folder>/files/AF_INSTALLATION
<Package Folder>/files/action
<Package Folder>/files/basicdata
<Package Folder>/files/libjiagu.so
<Package Folder>/files/libprocmox_v1_4.so
<Package Folder>/shared_prefs/<Package>.push_sync.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/AdsBusiness-report.xml
<Package Folder>/shared_prefs/appsflyer-data.xml
<Package Folder>/shared_prefs/appsflyer-data.xml.bak
<Package Folder>/shared_prefs/batsdk_app_life.xml
<Package Folder>/shared_prefs/batsdk_crash_switch.xml
<Package Folder>/shared_prefs/batsdk_user_info.xml
<Package Folder>/shared_prefs/bd.xml
<Package Folder>/shared_prefs/bindcache.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/config.xml.bak
<Package Folder>/shared_prefs/deeplink_shared_preference.xml
<Package Folder>/shared_prefs/statistic.xml
<SD-Card>/Android/####/-1103974333.0.tmp
<SD-Card>/Android/####/-1307755972.0.tmp
<SD-Card>/Android/####/-1472005365.0.tmp
<SD-Card>/Android/####/-1746078731.0.tmp
<SD-Card>/Android/####/-1780652251.0.tmp
<SD-Card>/Android/####/-1963360410.0.tmp
<SD-Card>/Android/####/-1969793935.0.tmp
<SD-Card>/Android/####/-2057066155.0.tmp
<SD-Card>/Android/####/-2106248.0.tmp
<SD-Card>/Android/####/-365634796.0.tmp
<SD-Card>/Android/####/-662095355.0.tmp
<SD-Card>/Android/####/-967460456.0.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1203586534.0.tmp
<SD-Card>/Android/####/1280290265.0.tmp
<SD-Card>/Android/####/1314062668.0.tmp
<SD-Card>/Android/####/1430188327.0.tmp
<SD-Card>/Android/####/1478041753.0.tmp
<SD-Card>/Android/####/1540107902.0.tmp
<SD-Card>/Android/####/1941218582.0.tmp
<SD-Card>/Android/####/648785671.0.tmp
<SD-Card>/Android/####/750140431.0.tmp
<SD-Card>/Android/####/796665745.0.tmp
<SD-Card>/Android/####/996091251.0.tmp
<SD-Card>/Android/####/journal.tmp
<SD-Card>/baidu/####/channel
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/libprocmox_v1_4.so <Package Folder> /data/app-lib/<Package>-1 82c73a2dd158cfeb2e534fe7688aa652 http://sync.appreport.baidu.com/cgi-bin-py-appstore/appstore_report_get_msg.cgi?type=uninstall&userId=712BB04CA8706FBC33CA1E7E3BF38D54|598153950705653&channel=appdiscover15_in_BD_APK&subChannel=&currChannel=appdiscover15_in_BD_APK&appVer=200&appVerName=3.0.4.8231&networkType=UNKNOWN&networkCountryIos=us&model=<System Property>&verRelease=4.3.1&screenHight=752&screenWidth=600&unInstallTime=1501849360765&countryIso=us 1
su

Загружает динамические библиотеки:

bdpush_V2_3
libjiagu
procmoi_v1_4

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding

Использует повышенные привилегии.

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней