Adware.Waps.1149

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Waps.5.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 1####.40.227.46:8080
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) u####.umengc####.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) im####.w####.cn.####.com:80
TCP(HTTP/1.1) bi.vip.wando####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) 1####.55.106.17:8080
TCP(HTTP/1.1) api.m.ta####.com:80
TCP 1####.11.61.13:80
TCP 1####.205.203.79:80

Запросы DNS:

a####.m.ta####.com
a####.u####.com
ads####.wando####.com
ads.w####.cn
app.w####.cn
fb.u####.com
im####.w####.cn
msg.umengc####.com
oc.u####.com
u####.umengc####.com
u####.umengc####.com

Запросы HTTP GET:

a####.m.ta####.com/rest/abtest?ak=####&av=####&c=####&v=####&s=####&d=##...
api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
app.w####.cn/action/miniad/ad?app_id=####&udid=####&imsi=####&net=####&b...
im####.w####.cn.####.com/appfile/adsfile/11bff27be6c574cfb5bc785f38f92df...
im####.w####.cn.####.com/appfile/adsfile/f52de1a2b2412d433970839fb658ea6...
im####.w####.cn.####.com/appfile/stuff/25dbb4ac59b1be19d5147cac77adea55/...
im####.w####.cn.####.com/appfile/stuff/7d8ce836b6fffa3d22796f8d8c044830/...
im####.w####.cn.####.com/appfile/stuff/820049845f781d8960d8574f63fe5694/...
im####.w####.cn.####.com/appfile/stuff/97b46bc449e7fa73f91c4bdeff7d21e7/...
im####.w####.cn.####.com/appfile/stuff/9ba31bb7edd0cbe16b2bc6f39b7797e9/...
im####.w####.cn.####.com/appfile/stuff/a5c07a14c10dc674037a9141d6f70ff3/...
im####.w####.cn.####.com/appfile/stuff/b2d619fa19e36718e2c10a22e03a4a6b/...
im####.w####.cn.####.com/appfile/stuff/bc7fcd97089361c283090e3e2d56ec9a/...
im####.w####.cn.####.com/appfile/stuff/f3f7c04b1f8cd7e022595ae961e29a0b/...
im####.w####.cn.####.com/appfile/stuff/f738d9ddb4196c834c92a7136d0b5e88/...
u####.umengc####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=##...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####...

Запросы HTTP POST:

a####.m.ta####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&s...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
app.w####.cn/action/user_info
bi.vip.wando####.com/network/v2/init
msg.umengc####.com/v2/register
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/.jiagu.ls
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppSettings.xml
/data/data/####/AppStore.xml
/data/data/####/CacheTime.dat
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MsgLogStore.db-journal
/data/data/####/PaySettings.xml
/data/data/####/PhoneUtil.xml
/data/data/####/ShowAdFlag.xml
/data/data/####/UTMCBase.xml
/data/data/####/UTMCConf-1946446896.xml
/data/data/####/UTMCLog-1946446896.xml
/data/data/####/agoo.pid
/data/data/####/com.huahua.yueyu_preferences.xml
/data/data/####/fb_audio_switch.xml
/data/data/####/feedback_push.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_com.huahua.yueyu8
/data/data/####/mobclick_agent_online_setting_com.huahua.yueyu.xml
/data/data/####/s_update.xml
/data/data/####/settingss.xml
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_feedback_user_info.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/wdj_ads_sdk.xml
/data/media/####/.nomedia
/data/media/####/.udid
/data/media/####/0de1117f43ba0dc54d203e518ffa55ec
/data/media/####/11bff27be6c574cfb5bc785f38f92dfc
/data/media/####/586c1dfae4befc16c5fece5cff38a170
/data/media/####/647b7d170f3f9f12c98ce981999e8804
/data/media/####/938e790af8936191d01351bc9eec7fd0
/data/media/####/977e97767fd09498be4b7bcb61b45b9f
/data/media/####/9bb5312d84deb53d2e9454e5b4477476
/data/media/####/Alvin2.xml
/data/media/####/AppPackage.dat
/data/media/####/CacheTime.dat
/data/media/####/ContextData.xml
/data/media/####/UnPackage.dat
/data/media/####/aafdb84f8c73adfcf3bcd2af38e01f6a
/data/media/####/actived.txt
/data/media/####/android
/data/media/####/c9d0bb1259c6710dea561b5618d9a6eb
/data/media/####/ec34ad2a9cc514480b1278f0fee283bf
/data/media/####/f52de1a2b2412d433970839fb658ea6f
/data/media/####/f9ffc2ecc282aee38eff14cc89a1ac4b
/data/media/####/journal.tmp
/data/media/####/point.txt

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:5594b03967e58e402e00161d","utdid":"XO0kaTVFiKEDAGdzx1GZZmvI","sdkVersion":"20150423"} -I 100.69.168.33 -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 777 /data/local/tmp
sh

Загружает динамические библиотеки: