Android.DownLoader.3696

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Xiny.20

Загружает из Интернета следующие детектируемые угрозы:

Android.Xiny.20

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) img.cool####.cn:80
TCP(HTTP/1.1) pdl.eleve####.net.####.com:80
TCP(HTTP/1.1) a.sm####.cn:80
TCP(HTTP/1.1) s.un####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) mo####.eleve####.net:8888

Запросы DNS:

a####.u####.com
a.sm####.cn
img.cool####.cn
mo####.eleve####.net
oc.u####.com
pdl.eleve####.net
s.un####.com

Запросы HTTP GET:

img.cool####.cn/2011/hyjwan.jar
pdl.eleve####.net.####.com/www/2/APK/24/57/48/485724.apk
pdl.eleve####.net.####.com/www/2/IMAGE/01/34/12/2/2123401.jpg
pdl.eleve####.net.####.com/www/2/IMAGE/02/34/12/2/2123402.jpg
pdl.eleve####.net.####.com/www/2/IMAGE/03/34/12/2/2123403.jpg
pdl.eleve####.net.####.com/www/2/IMAGE/17/76/61/2/2617617.jpg
pdl.eleve####.net.####.com/www/2/IMAGE/33/10/42/3/3421033.jpg
pdl.eleve####.net.####.com/www/2/IMAGE/58/44/43/3/3434458.jpg
pdl.eleve####.net.####.com/www/2/QIHU_IMG/08/32/24/9/9243208.png
pdl.eleve####.net.####.com/www/2/QIHU_IMG/13/16/13/8/8131613.png
pdl.eleve####.net.####.com/www/IMAGE/00/04/44/440400.jpg
pdl.eleve####.net.####.com/www/IMAGE/04/15/50/501504.jpg
pdl.eleve####.net.####.com/www/IMAGE/08/67/54/546708.jpg
pdl.eleve####.net.####.com/www/IMAGE/10/15/50/501510.jpg
pdl.eleve####.net.####.com/www/IMAGE/10/27/55/552710.jpg
pdl.eleve####.net.####.com/www/IMAGE/10/66/58/586610.jpg
pdl.eleve####.net.####.com/www/IMAGE/13/15/50/501513.jpg
pdl.eleve####.net.####.com/www/IMAGE/15/50/60/605015.jpg
pdl.eleve####.net.####.com/www/IMAGE/18/30/55/553018.jpg
pdl.eleve####.net.####.com/www/IMAGE/21/01/82/820121.jpg
pdl.eleve####.net.####.com/www/IMAGE/22/15/50/501522.jpg
pdl.eleve####.net.####.com/www/IMAGE/28/15/50/501528.jpg
pdl.eleve####.net.####.com/www/IMAGE/33/62/82/826233.jpg
pdl.eleve####.net.####.com/www/IMAGE/34/15/50/501534.jpg
pdl.eleve####.net.####.com/www/IMAGE/40/15/50/501540.jpg
pdl.eleve####.net.####.com/www/IMAGE/42/70/71/717042.jpg
pdl.eleve####.net.####.com/www/IMAGE/47/15/50/501547.jpg
pdl.eleve####.net.####.com/www/IMAGE/48/13/55/551348.jpg
pdl.eleve####.net.####.com/www/IMAGE/64/20/59/592064.jpg
pdl.eleve####.net.####.com/www/IMAGE/74/21/73/732174.jpg
pdl.eleve####.net.####.com/www/IMAGE/74/83/60/608374.jpg
pdl.eleve####.net.####.com/www/IMAGE/76/92/22/229276.jpg
pdl.eleve####.net.####.com/www/IMAGE/77/14/50/501477.jpg
pdl.eleve####.net.####.com/www/IMAGE/84/14/50/501484.jpg
pdl.eleve####.net.####.com/www/IMAGE/87/87/60/608787.jpg
pdl.eleve####.net.####.com/www/IMAGE/90/14/50/501490.jpg
pdl.eleve####.net.####.com/www/IMAGE/99/14/50/501499.jpg
pdl.eleve####.net.####.com/www/QIHU_IMG/40/02/13/130240.png
pdl.eleve####.net.####.com/www/QIHU_IMG/49/78/17/177849.png

Запросы HTTP POST:

a####.u####.com/app_logs
a.sm####.cn/cw/cp.action?requestId=####&g=####
mo####.eleve####.net:8888/appstore/appDetail
mo####.eleve####.net:8888/appstore/appStoreUpdate
mo####.eleve####.net:8888/appstore/frame
mo####.eleve####.net:8888/appstore/recommend
mo####.eleve####.net:8888/appstore/section
mo####.eleve####.net:8888/as/sessionId
mo####.eleve####.net:8888/dataCollect/am
mo####.eleve####.net:8888/massistSearch/appStorePreKeywords
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
s.un####.com/cw/interface!u2.action?protocol=####&version=####&cid=####

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/INSTALL.xml
/data/data/####/W_Key.xml
/data/data/####/a.xml
/data/data/####/channel_pref.xml
/data/data/####/com.jinpin.appzx.db-journal
/data/data/####/com.jinpin.appzx_preferences.xml
/data/data/####/downloadswc
/data/data/####/downloadswc-journal
/data/data/####/mobclick_agent_cached_com.jinpin.appzx6009
/data/data/####/mobclick_agent_online_setting_com.jinpin.appzx.xml
/data/data/####/short_cut_flag.xml
/data/data/####/st.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/media/####/.xy
/data/media/####/4.3_hyjwan.jar.tmp
/data/media/####/Frame_9_
/data/media/####/HTTPcc.thedream.qinsmoon7
/data/media/####/HTTPcom.RunnerGames.game.YooNinja_Full_Amazon12
/data/media/####/HTTPcom.aonesoft.AuntyRun1
/data/media/####/HTTPcom.changyou.kongfupanda46
/data/media/####/HTTPcom.droidhen.game.speedhiker.me9
/data/media/####/HTTPcom.gameloft.android.GAND.GloftSMIF11100
/data/media/####/HTTPcom.hlgames.DemonHunter25
/data/media/####/HTTPcom.iava.kof99gfan412
/data/media/####/HTTPcom.mmpay.ltfjdz11
/data/media/####/HTTPcom.qygame.CandyPlanet1320
/data/media/####/HTTPcom.sg.bjjs.qihu400
/data/media/####/HTTPcom.shzxkj.tom.pkrzsg47
/data/media/####/HTTPcom.sxiaoao.feijidazhan41
/data/media/####/HTTPcom.sxiaoao.gradius12
/data/media/####/HTTPcom.sxiaoao.moto3dOnline39
/data/media/####/HTTPcom.yujoe.mcqmjjyq.qihu1803210439
/data/media/####/HTTPorg.cocos2d.fishingjoy3.yz111
/data/media/####/HTTPwan.mainactivity2
/data/media/####/ITEM21019
/data/media/####/ITEM58019
/data/media/####/ITEM69019
/data/media/####/ITEM73019
/data/media/####/comsxiaoaofeijidazhan_41.tmp
/data/media/####/data_collect.path
/data/media/####/detail_10016174_mpzs_0
/data/media/####/detail_10151485_2200123459_0
/data/media/####/ex_com+sxiaoao+feijidazhan41
/data/media/####/http+pdl+elevensky+net+www+2+IMAGE+01+34+12+2+2123401+jpg
/data/media/####/http+pdl+elevensky+net+www+2+IMAGE+02+34+12+2+2123402+jpg
/data/media/####/http+pdl+elevensky+net+www+2+IMAGE+03+34+12+2+2123403+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+04+15+50+501504+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+10+15+50+501510+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+10+66+58+586610+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+13+15+50+501513+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+15+50+60+605015+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+22+15+50+501522+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+28+15+50+501528+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+34+15+50+501534+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+40+15+50+501540+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+47+15+50+501547+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+64+20+59+592064+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+74+83+60+608374+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+77+14+50+501477+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+84+14+50+501484+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+90+14+50+501490+jpg
/data/media/####/http+pdl+elevensky+net+www+IMAGE+99+14+50+501499+jpg
/data/media/####/recommend_0_11
/data/media/####/recommend_0_8
/data/media/####/recommend_0_9
/data/media/####/recommend_10016174_10
/data/media/####/recommend_10151485_10
/data/media/####/restime.dat

Другие:

Загружает динамические библиотеки:

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней