Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 2####.243.193.48:80
- TCP(HTTP/1.1) s.ny####.com:80
- TCP(HTTP/1.1) gm.ny####.com.####.com:80
- TCP(HTTP/1.1) dlap####.top:80
Запросы DNS:
- b.ny####.com
- c.ny####.com
- dlap####.top
- gm.ny####.com
- kp.ny####.com
- p.ny####.com
- s.ny####.com
Запросы HTTP GET:
- gm.ny####.com.####.com/download/advert/QQyueduyishengyueduhuoban/2601.jpg
- gm.ny####.com.####.com/download/advert/chaowentianxiashiyouwozhuda/26026...
- gm.ny####.com.####.com/download/advert/sirendingzhijingxuantuijianzhuanj...
- gm.ny####.com.####.com/download/advert/yikuangexingyuedukuailetucaodexin...
- gm.ny####.com.####.com/download/apks/txxw/7272.png
- gm.ny####.com.####.com/download/apks/txxw/TencentNew_15_43.apk
- gm.ny####.com.####.com/download/sci/1.png
- gm.ny####.com.####.com/download/sci/2.png
- gm.ny####.com.####.com/download/sci/3.png
- gm.ny####.com.####.com/download/sci/4.png
- gm.ny####.com.####.com/download/sci/5.png
- gm.ny####.com.####.com/download/sci/7.png
Запросы HTTP POST:
- dlap####.top/adself.php?action=####&version=####
- s.ny####.com/admin/bcp.action?requestId=####
- s.ny####.com/admin/nbad.action?z=####
- s.ny####.com/admin/sc.action?requestId=####
- s.ny####.com/admin/scs.action?requestId=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/databases/b.db
- <Package Folder>/databases/b.db-journal
- <Package Folder>/databases/cs.db
- <Package Folder>/databases/cs.db-journal
- <Package Folder>/files/1510835468764.jar
- <Package Folder>/files/1510835468821.jar
- <Package Folder>/files/1510835468837.jar
- <Package Folder>/files/1510835468857.jar
- <Package Folder>/files/1510835468882.jar
- <Package Folder>/files/1510835469120.jar
- <Package Folder>/files/1510835469198.jar
- <Package Folder>/files/1510835469276.jar
- <Package Folder>/files/1510835476912.jar
- <Package Folder>/files/1510835477049.jar
- <Package Folder>/files/1510835477188.jar
- <Package Folder>/files/1510835480720.jar
- <Package Folder>/files/1510835519375.jar
- <Package Folder>/files/1510835519376.jar
- <Package Folder>/files/1510835519385.jar
- <Package Folder>/files/1510835519568.jar
- <Package Folder>/files/1510835519569.jar
- <Package Folder>/files/1510835519671.jar
- <Package Folder>/files/1510835519736.jar
- <Package Folder>/files/com.pacixne.az.jar
- <Package Folder>/shared_prefs/StartCount.xml
- <Package Folder>/shared_prefs/StartIntervalTime.xml
- <Package Folder>/shared_prefs/appversion.xml
- <Package Folder>/shared_prefs/appversion.xml.bak
- <Package Folder>/shared_prefs/bad.xml
- <Package Folder>/shared_prefs/bae.xml
- <Package Folder>/shared_prefs/bag.xml
- <Package Folder>/shared_prefs/bah.xml
- <Package Folder>/shared_prefs/baj.xml
- <Package Folder>/shared_prefs/bim.xml
- <Package Folder>/shared_prefs/cdf.xml
- <Package Folder>/shared_prefs/cfa.xml
- <Package Folder>/shared_prefs/cfj.xml
- <Package Folder>/shared_prefs/cfr.xml
- <Package Folder>/shared_prefs/cft.xml
- <Package Folder>/shared_prefs/cix.xml
- <Package Folder>/shared_prefs/eid.xml
- <Package Folder>/shared_prefs/fislog.xml
- <Package Folder>/shared_prefs/ioa.xml
- <Package Folder>/shared_prefs/jid.xml
- <Package Folder>/shared_prefs/judgeshowad.xml
- <Package Folder>/shared_prefs/ltime.xml
- <Package Folder>/shared_prefs/momf.xml
- <Package Folder>/shared_prefs/pid.xml
- <Package Folder>/shared_prefs/pim.xml
- <Package Folder>/shared_prefs/prs.xml
- <Package Folder>/shared_prefs/ptm.xml
- <Package Folder>/shared_prefs/refile.xml
- <Package Folder>/shared_prefs/scc.xml
- <Package Folder>/shared_prefs/sdn.xml
- <Package Folder>/shared_prefs/setShowAdCount.xml
- <Package Folder>/shared_prefs/setalarm.xml
- <Package Folder>/shared_prefs/sid.xml
- <Package Folder>/shared_prefs/sim.xml
- <Package Folder>/shared_prefs/sps.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/uux.xml
- <Package Folder>/shared_prefs/za85bac93.xml
- <SD-Card>/Android/####/1f3.DAT
- <SD-Card>/Android/####/bfe.DAT
- <SD-Card>/bfe/####/0.png.dat
- <SD-Card>/bfe/####/1.png.dat
- <SD-Card>/bfe/####/1f3.txt
- <SD-Card>/bfe/####/1f3sha.dat
- <SD-Card>/bfe/####/<Package>0.png
- <SD-Card>/bfe/####/<Package>1.png
- <SD-Card>/bfe/####/<Package>2.png
- <SD-Card>/bfe/####/TencentNew_15_43.apk
- <SD-Card>/bfe/####/bfe.png.dat
- <SD-Card>/bfe/####/bfenam.dat
Другие:
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
