Android.Xiny.425

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.RemoteCode.110.origin
Android.RemoteCode.93.origin
Android.Xiny.1.origin
Android.Xiny.197
Android.Xiny.232.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.RemoteCode.110.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) r####.adsb####.com:80
TCP(HTTP/1.1) www.univers####.com:80
TCP(HTTP/1.1) clk.ar####.co:80
TCP(HTTP/1.1) trac####.le####.com:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) aws.smarter####.net:80
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) a####.bat####.net:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) camspla####.com:80
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) i.cdn####.com:80
TCP(HTTP/1.1) tra####.tc-cl####.com:80
TCP(HTTP/1.1) t####.confirm####.online:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) bkmsoft####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) js.parking####.net:80
TCP(HTTP/1.1) 1####.243.199.134:80
TCP(HTTP/1.1) tango####.com:80
TCP(HTTP/1.1) koolmed####.com:80
TCP(HTTP/1.1) www.jp####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) ap####.mobisen####.com:80
TCP(HTTP/1.1) parking####.net:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) g####.gl:443
TCP(TLS/1.0) app.ad####.com:443
TCP(TLS/1.0) formula####.com:443
TCP(TLS/1.0) clk.tap####.com:443
TCP(TLS/1.0) c####.roya####.net:443

Запросы DNS:

a####.bat####.net
akw.e####.space
ali.f####.cdn.####.com
ap####.mobisen####.com
api.migh####.com
api.mob####.b####.com
app.ad####.com
aws.smarter####.net
bkmsoft####.com
c####.gowa####.com
c####.roya####.net
c.s####.co
camspla####.com
cl####.ads####.com
clk.ar####.co
clk.tap####.com
ea.sno####.1####.com
en.sno####.1####.com
formula####.com
g####.gl
googl####.g.doublec####.net
i.cdn####.com
js.parking####.net
koolmed####.com
mo.freeind####.com
offer####.online
p####.lead####.com
parking####.net
r####.adsb####.com
s####.mob####.b####.com
t####.confirm####.online
tango####.com
tra####.tc-cl####.com
trac####.le####.com
trac####.suma####.com
www.admobim####.com
www.cu####.com
www.jp####.com
www.mmmmmm####.com
www.univers####.com
www.zfr####.com

Запросы HTTP GET:

a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
ali.f####.cdn.####.com/20171213102849-snowfox_v19i154.jar
ap####.mobisen####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
api.mob####.b####.com/index.php?r=####
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
bkmsoft####.com/hindiloveshayariimages/get_all_products.php?
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (31).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (32).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (33).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (35).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (37).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (38).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (40).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (41).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (42).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (43).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (44).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (45).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (46).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (47).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (48).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (49).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (50).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (51).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (52).png
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (53).png
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (55).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (56).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (59).jpg
bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (60).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (36).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (37).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (38).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (39).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (40).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (41).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (42).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (43).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (44).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (45).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (46).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (47).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (48).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (49).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (50).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (51).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (52).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (53).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (54).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (55).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (56).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (57).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (58).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (59).jpg
bkmsoft####.com/hindiloveshayariimages/image/love_ (60).jpg
bkmsoft####.com/sunstarappstudio/get_all_products.php?
bkmsoft####.com/sunstarappstudio/image/3D Photo Gallery-Photo Manager-Ph...
bkmsoft####.com/sunstarappstudio/image/Blur_Photo_Editor.png
bkmsoft####.com/sunstarappstudio/image/Body Plastic Surgery Photo Editor...
bkmsoft####.com/sunstarappstudio/image/Crorepati live app_banner.png
bkmsoft####.com/sunstarappstudio/image/Ghost_Camera.png
bkmsoft####.com/sunstarappstudio/image/Good Morning Wishes.png
bkmsoft####.com/sunstarappstudio/image/Letter Wallpaper.png
bkmsoft####.com/sunstarappstudio/image/My_name_ringtone_yams.png
bkmsoft####.com/sunstarappstudio/image/Photo Video Maker With Music-Movi...
bkmsoft####.com/sunstarappstudio/image/Steam Photo Editor.png
bkmsoft####.com/sunstarappstudio/image/Video Converter.png
bkmsoft####.com/sunstarappstudio/image/Video song statusWhatsap status v...
bkmsoft####.com/sunstarappstudio/image/Video to mp3 converter-Mp4 to mp3...
bkmsoft####.com/sunstarappstudio/image/Video to mp3_vanila.png
bkmsoft####.com/sunstarappstudio/image/Weather Channel.png
bkmsoft####.com/sunstarappstudio/image/X Collage Photo Editor.png
bkmsoft####.com/sunstarappstudio/image/ad_bodyslimmer.png
bkmsoft####.com/sunstarappstudio/image/adicon_cutpaste.png
bkmsoft####.com/sunstarappstudio/image/adicon_photo_editor.png
bkmsoft####.com/sunstarappstudio/image/adicon_prizma.png
bkmsoft####.com/sunstarappstudio/image/adicon_song_cutter.png
bkmsoft####.com/sunstarappstudio/image/adicon_videotpmp3.png
bkmsoft####.com/sunstarappstudio/image/bit camera.png
bkmsoft####.com/sunstarappstudio/image/blouse_design.png
bkmsoft####.com/sunstarappstudio/image/girlfriend photo editor.png
bkmsoft####.com/sunstarappstudio/image/goodmorningimage1.png
bkmsoft####.com/sunstarappstudio/image/letter wallpaper_sunstar.png
bkmsoft####.com/sunstarappstudio/image/love good morning image.png
bkmsoft####.com/sunstarappstudio/image/mobile_number_tracker_banner.png
bkmsoft####.com/sunstarappstudio/image/video_convertrt_banner.png
c####.gowa####.com/click?transaction_id=wadogo_WAdvPubNativeNewAPI_30359...
c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
camspla####.com/
camspla####.com/styles/forms.css
camspla####.com/styles/layout.css
camspla####.com/styles/navi.css
camspla####.com/styles/tables.css
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
clk.ar####.co/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channel=#...
i.cdn####.com/themes/assets/style.css
i.cdn####.com/themes/registrar/style_namecheap.css
js.parking####.net/assets/scripts/jsparkcaf.js
js.parking####.net/assets/scripts/registrar-caf/243142.js
js.parking####.net/assets/scripts/tier2caf.js
js.parking####.net/scripts/feedmeCaf.php?q=####&ip=####&max=####&hl=####...
js.parking####.net/track.php?domain=####&toggle=####&uid=MTU####
koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/0/
koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/1/
koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/0/
koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/1/
parking####.net/jsparkcaf.php?regcn=####&_v=####&_h=####&_t=####
r####.adsb####.com/c/67e4f89dc239c781?c3=####&c2=####&c1=####
t####.confirm####.online/?utm_medium=####&utm_campaign=####&c3=####&c2=#...
tango####.com/66291_nl_4247_android?rpm=0.2&fallbackUrl=https://formulaw...
tra####.tc-cl####.com/?p=####&media_type=####&click_id=####&pi=####
trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&click_id=...
trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
trac####.suma####.com/aff_r?offer_id=328149&aff_id=3599&url=http://click...
www.cu####.com/20171212103437.201712121030.zip
www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
www.univers####.com/Adminpanel/CategoryJson.php?a####
www.univers####.com/Adminpanel/image/adicon_photo_editor.png
www.univers####.com/Adminpanel/image/adicon_videotpmp3.png

Запросы HTTP POST:

ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/ad/hull_v2
ea.sno####.1####.com:8088/sdk/api/log/record
js.parking####.net/ls.php
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
www.admobim####.com/surl/api2_reg.action?ecy=####
www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.zfr####.com/up.do?enc=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_lib/libmosel.so
<Package Folder>/cache/####/-6065482491758265024
<Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.0.tmp
<Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.1.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.0.tmp
<Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.1.tmp
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ads-1702544704.jar
<Package Folder>/databases/adblib.db
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/mc_cache.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/412293793
<Package Folder>/files/####/412293793.data
<Package Folder>/files/d.dex
<Package Folder>/files/d.dex (deleted)
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/f.zip
<Package Folder>/files/google.db
<Package Folder>/files/lib.dat
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/ob.dex
<Package Folder>/files/ob.zip
<Package Folder>/files/snowfox_v19i.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/D824hunter_config.xml
<Package Folder>/shared_prefs/D824other_config.xml
<Package Folder>/shared_prefs/D824service_config.xml
<Package Folder>/shared_prefs/D824sp_config.xml
<Package Folder>/shared_prefs/D824upgrade_config.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/isupdate.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/songcutter.xml
<Package Folder>/shared_prefs/songcutter.xml.bak
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/t_ini.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/Android/####/-1062533969.tmp
<SD-Card>/Android/####/-1086172752.tmp
<SD-Card>/Android/####/-1104036827.tmp
<SD-Card>/Android/####/-1145160013.tmp
<SD-Card>/Android/####/-1337003050.tmp
<SD-Card>/Android/####/-1439710467.tmp
<SD-Card>/Android/####/-1468339618.tmp
<SD-Card>/Android/####/-1496968769.tmp
<SD-Card>/Android/####/-1525597920.tmp
<SD-Card>/Android/####/-1554227071.tmp
<SD-Card>/Android/####/-1564193885.tmp
<SD-Card>/Android/####/-1582856222.tmp
<SD-Card>/Android/####/-1611485373.tmp
<SD-Card>/Android/####/-1625934241.tmp
<SD-Card>/Android/####/-1640114524.tmp
<SD-Card>/Android/####/-1668743675.tmp
<SD-Card>/Android/####/-1687893651.tmp
<SD-Card>/Android/####/-1697372826.tmp
<SD-Card>/Android/####/-1741293962.tmp
<SD-Card>/Android/####/-1842361681.tmp
<SD-Card>/Android/####/-30729599.tmp
<SD-Card>/Android/####/-335305928.tmp
<SD-Card>/Android/####/-437385515.tmp
<SD-Card>/Android/####/-456042742.tmp
<SD-Card>/Android/####/-484671893.tmp
<SD-Card>/Android/####/-541930195.tmp
<SD-Card>/Android/####/-555181129.tmp
<SD-Card>/Android/####/-599188497.tmp
<SD-Card>/Android/####/-627817648.tmp
<SD-Card>/Android/####/-633003976.tmp
<SD-Card>/Android/####/-656446799.tmp
<SD-Card>/Android/####/-809869145.tmp
<SD-Card>/Android/####/-91933070.tmp
<SD-Card>/Android/####/-962233324.tmp
<SD-Card>/Android/####/1001733394.tmp
<SD-Card>/Android/####/1022991165.tmp
<SD-Card>/Android/####/1051620316.tmp
<SD-Card>/Android/####/1080249467.tmp
<SD-Card>/Android/####/1089931412.tmp
<SD-Card>/Android/####/1113732709.tmp
<SD-Card>/Android/####/1118560563.tmp
<SD-Card>/Android/####/1147195418.tmp
<SD-Card>/Android/####/1175824569.tmp
<SD-Card>/Android/####/1233077167.tmp
<SD-Card>/Android/####/1261706318.tmp
<SD-Card>/Android/####/1340004261.tmp
<SD-Card>/Android/####/1347593771.tmp
<SD-Card>/Android/####/1396925414.tmp
<SD-Card>/Android/####/1435943698.tmp
<SD-Card>/Android/####/1710090789.tmp
<SD-Card>/Android/####/1738719940.tmp
<SD-Card>/Android/####/1767349091.tmp
<SD-Card>/Android/####/1795978242.tmp
<SD-Card>/Android/####/1796613605.tmp
<SD-Card>/Android/####/1824607393.tmp
<SD-Card>/Android/####/1853236544.tmp
<SD-Card>/Android/####/1881865695.tmp
<SD-Card>/Android/####/1910494846.tmp
<SD-Card>/Android/####/1939123997.tmp
<SD-Card>/Android/####/1967753148.tmp
<SD-Card>/Android/####/1977435093.tmp
<SD-Card>/Android/####/202427731.tmp
<SD-Card>/Android/####/231056882.tmp
<SD-Card>/Android/####/259686033.tmp
<SD-Card>/Android/####/288315184.tmp
<SD-Card>/Android/####/316944335.tmp
<SD-Card>/Android/####/34119042.tmp
<SD-Card>/Android/####/345573486.tmp
<SD-Card>/Android/####/374202637.tmp
<SD-Card>/Android/####/402831788.tmp
<SD-Card>/Android/####/418845980.tmp
<SD-Card>/Android/####/431460939.tmp
<SD-Card>/Android/####/460090090.tmp
<SD-Card>/Android/####/540860186.tmp
<SD-Card>/Android/####/628605191.tmp
<SD-Card>/Android/####/885713867.tmp
<SD-Card>/Android/####/935554585.tmp
<SD-Card>/Android/####/978977308.tmp
<SD-Card>/Android/####/994362014.tmp
<SD-Card>/Android/####/dev_f53bc04.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid
<SD-Card>/Android/####/ua.dat
<SD-Card>/LogN/####/sp
<SD-Card>/Write On Photo/image1510835503036.png
<SD-Card>/Write On Photo/image1510835529254.png
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.cgt.esv.Fz
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chmod 777 <Package Folder>/bmosel
dd if <Package Folder>/lib/libmosel.so of <Package Folder>/bmosel
dd if=<Package Folder>/lib/libmosel.so of=<Package Folder>/bmosel
sh

Загружает динамические библиотеки:

libmosel

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней