Android.DownLoader.2024

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.79.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.79.origin

Network activity:

Connecting to:

1####.####.110
ce####.####.org
1####.####.110:8006
a766c56####.####.net
api-ce####.####.org
u####.####.com
cou####.####.top
i####.####.com
t####.####.net
di####.aw
p####.####.com
f####.####.com
wa####.####.org
c####.####.org
m####.####.com
press####.com
b####.ly
ne####.####.com
h####.com
a####.####.com
t####.####.com
c####.####.net
cloudfr####.####.com
c####.####.com
a####.####.cn
0a951e0####.####.com
c####.####.co

HTTP GET requests:

c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
h####.com/article/58e6ae8366f6003903a94a92?view=####
c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
cloudfr####.####.com/x.png
c####.####.org/v2/system/version-1-111.json
ce####.####.org/v3/system/countrys.json
f####.####.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
h####.com/js/bundles/partner-article.js?squizard?bust=####
h####.com/css/fonts/roboto-v15-latin-500.ttf
c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
di####.aw/wp-content/uploads/2017/04/Segun-Michelle-de-Groot-directora-d...
a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
h####.com/js/jquery.js
p####.####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=####&o...
a766c56####.####.net/test.png
wa####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=##...
a####.####.cn/api_offline/click?appid=####&time=####&adid=####&gaid=####...
ne####.####.com/font-awesome/4.3.0/fonts/fontawesome-webfont.ttf?v=####
ce####.####.org/v3/system/initcountrytopic.json
t####.####.com/click?pid=####&offer_id=####&sub1=####&sub2=####
t####.####.com/tm42098.js
i####.####.com/s
c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
c####.####.org/v2/content/article1-46757188-9333e18b98c7c1a3a363f1b610a0...
api-ce####.####.org/v3/commentlist-46757188-9333e18b98c7c1a3a363f1b610a0...
c####.####.org/2017-04-11/6aa0d4e2b20f98ae7985f8d02edfdab1.jpg
b####.ly/presstiza
cou####.####.top/api/push/getsilentpushcfg2.json?push_ver=####&commonk####
u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
c####.####.org/v2/system/startimg-NL.json
t####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
di####.aw/wp-content/banners/728x90-presstiza.gif
press####.com/wp-includes/js/jquery/jquery.js
t####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
cou####.####.top/i?app_key=####&timestamp=####&sdk_version=####&begin_se...
c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1493023####
h####.com/css/partner-article.css?bust=####
1####.####.110/m/umeng:58fd9c1d1c5dd02612000133/600/Apqib1yr9sKMPjpO4Kiv...
c####.####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_p...
h####.com/content?url=####
cou####.####.top/api/push/getpushcfg2.json?push_ver=####&commonk####
cou####.####.top/api/push/getswitcher?commonk####
p####.####.com/sync/img?redir=####
t####.####.net/click/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####...
u####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
f####.####.com/css?family=####
api-ce####.####.org/v2/content/getItemDetails-46757188.json
c####.####.net/pixel?google_nid=####&googl####&id=####
ne####.####.com/font-awesome/4.3.0/css/font-awesome.min.css
c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
c####.####.org/v2/system/models-111.json
h####.com/css/fonts/roboto-v15-latin-regular.ttf
h####.com/js/bundles/cookies.js
u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
press####.com/wp-content/plugins/seedprod-coming-soon-pro/themes/default...
press####.com/
c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
c####.####.org/v2/system/languages.json
p####.####.com/sync/img?redir=####&mm####&mm####
di####.aw/wp-content/banners/728x90-diario.gif
c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
0a951e0####.####.com/58e6ae8366f6003903a94a92_500x356.jpg
1####.####.110:8006/m/umeng:58fd9c1d1c5dd02612000133/600/Apqib1yr9sKMPjp...
press####.com/wp-content/uploads/2016/07/12728923_1015154851855960_86236...
ce####.####.org/v2/content/recommend-9333e18b98c7c1a3a363f1b610a0a3ac-NL...
f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...

HTTP POST requests:

a####.####.com/api/ads/fetch?_s=####
a####.####.com/api/ads/connect
cou####.####.top/api/push/getpush?id=####&push_ver=####&time=####&common...
cou####.####.top/android_md_log/req?commonk####
ce####.####.org/auth/gather
m####.####.com/v2/register
cou####.####.top/api/push/getsilentpush.json?push_ver=####&time=####&com...
a####.####.com/app_logs
cou####.####.top/android/check_version?commonk####

Modified file system:

Creates the following files:

/sdcard/Android/data/####/files/logdata/delay_20170424083651023_9333e18b98c7c1a3a363f1b610a0a3ac_s.dat
/data/data/####/app_dex/reach-sdk.zip.tmp
/data/data/####/code_cache/secondary-dexes/####-1.apk.classes-802548167.zip
/data/data/####/app_tmpdex/reach-sdk.zip
/data/data/####/shared_prefs/AGOO_HOST.xml
/sdcard/AuthP/push_stat.dat
/data/data/####/databases/app.manager-journal
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/databases/MsgLogStore.db-journal
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/reach.database.ad-journal
/sdcard/Android/data/####/cache/uil-images/2yusinm2rkywdc11qxg0n4lup.0.tmp
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/AppEventsLogger.persistedevents
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
/sdcard/Android/data/####/cache/uil-images/7bm49evedwkg5wrg69xpl4qsi.0.tmp
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/shared_prefs/configLookPath.xml
/sdcard/Android/data/####/cache/reach.image.service/169CE4939B4DB3B20E9925F819A67C0F
/sdcard/Android/data/####/cache/reach.image.service/F90A84DB08EC3849E3A4492989409792
/data/data/####/databases/google_app_measurement_local.db-journal
/data/data/####/files/.yflurryreport.4af225f82a12efaa
/data/data/####/shared_prefs/CurArticleInfo.xml
/sdcard/.DataStorage/ContextData.xml
/data/data/####/files/.imprint
/data/data/####/files/lookDL/com.look.dlplugin.apk259684029.tmp
/sdcard/AuthPush/hstype.txt
/data/data/####/files/.yflurryfreqcap.4af225f82a12efaa
/data/data/####/shared_prefs/PhoneUtil.xml
/data/data/####/shared_prefs/coolook.minisite.xml
/data/data/####/shared_prefs/Alvin2.xml
/data/data/####/shared_prefs/COUNTLY_STORE.xml
/data/data/####/shared_prefs/com.google.android.gms.appid.xml
/data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
/data/data/####/cache/webviewCacheChromium/index
/sdcard/####/WelcomeImg/6aa0d4e2b20f98ae7985f8d02edfdab1.jpg
/data/data/####/files/lookDL/dlLookCore-802548167.tmp
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_2C9KHKY7SJ89D7PN952N_216
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/cache/webviewCacheChromium/data_2
/sdcard/AuthP/push_look.lck
/sdcard/AuthP/push_config.dat
/data/data/####/shared_prefs/Prophet.xml
/data/data/####/dex_cache/MultiDex.lock
/data/data/####/shared_prefs/umeng_message_state.xml
/data/data/####/shared_prefs/Game_recommend.xml.bak
/data/data/####/no_backup/com.google.android.gms.appid-no-backup
/sdcard/.UTSystemConfig/Global/Alvin2.xml
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/data/data/####/files/lookDL/dlLookPlugin.dat-1239379010.tmp
/data/data/####/files/.yflurryadlog.4af225f82a12efaa
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/files/umeng_it.cache
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/databases/push_look.db
/data/data/####/databases/google_app_measurement_local.db
/data/data/####/shared_prefs/v2_local_login.xml
/data/data/####/shared_prefs/openudid_prefs.xml
/data/data/####/shared_prefs/BSModelForPlaced.xml
/data/data/####/shared_prefs/MASTER_DATA.xml
/sdcard/Android/data/####/files/logdata/delay_20170424083645958_9333e18b98c7c1a3a363f1b610a0a3ac_s.dat
/sdcard/Android/data/####/cache/uil-images/37way6sghmg4qdb8n1u9aeax2.0.tmp
/data/data/####/databases/UmengLocalNotificationStore.db-journal
/data/data/####/shared_prefs/AGOO_CONNECT.xml
/data/data/####/shared_prefs/AppStore.xml.bak
/data/data/####/databases/Zuoyoo_db
/data/data/####/files/lookDL/base2944805459.tmp
/sdcard/Android/data/.nomedia
/data/data/####/shared_prefs/WebViewSettings.xml
/data/data/####/shared_prefs/AppStore.xml
/data/data/####/shared_prefs/Game_recommend.xml
/data/data/####/shared_prefs/Reach.xml
/data/data/####/shared_prefs/Reach.xml.bak
/data/data/####/databases/Zuoyoo_db-journal
/data/data/####/files/lookDL/dlLookCore944805459.tmp
/sdcard/AuthP/silence.dat
/data/data/####/shared_prefs/updateVer.xml
/data/data/####/shared_prefs/test.xml
/data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
/sdcard/Android/data/####/cache/uil-images/5lxhyicy8khrucm0n4s3z5fn9.0.tmp
/data/data/####/files/.yflurrydatasenderblock.ef01c0c3-a635-483b-a2b2-64b646fe5176
/data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
/sdcard/Android/data/####/cache/uil-images/71kwxwrfi7100dwjfthap1597.0.tmp
/data/data/####/files/DaemonServer
/data/data/####/shared_prefs/multidex.version.xml
/sdcard/Android/data/####/files/logdata/delay_20170424083645145_9333e18b98c7c1a3a363f1b610a0a3ac_b.dat
/sdcard/Android/data/####/files/logdata/delay_20170424083651372_9333e18b98c7c1a3a363f1b610a0a3ac_s.dat
/sdcard/Android/data/####/files/logdata/delay_20170424083643213_9333e18b98c7c1a3a363f1b610a0a3ac_s.dat
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/lookDL/com.look.dlplugin.apk
/data/data/####/shared_prefs/CountryRelevant.xml
/data/data/####/app_dex/reach-sdk.zip
/sdcard/AuthP/push_silentcfg.dat
/data/data/####/files/lookDL/dlLookPlugin.dat284899998.tmp
/data/data/####/shared_prefs/Module_Switch_DATA.xml
/data/data/####/files/lookDL/dlLookCore.dat46815814.tmp
/data/data/####/shared_prefs/pushdatas.xml
/data/data/####/code_cache/secondary-dexes/####-1.apk.classes944805459.zip
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/ContextData.xml
/sdcard/Android/data/####/cache/uil-images/6iesspr5711axr89uipkspnu1.0.tmp
/data/data/####/files/agoo.pid
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
/data/data/####/databases/push_look.db-journal
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/app_cache/ApplicationCache.db-journal
/sdcard/Android/data/####/cache/uil-images/journal.tmp
/data/data/####/dex_cache/base269058270.zip
/sdcard/Android/data/####/cache/uil-images/3w1nciday7eocv14qexy2zcqf.0.tmp
/data/data/####/shared_prefs/GATHER.xml
/sdcard/Android/data/####/cache/uil-images/7e2r4c4cilxkb58gnecubo2ml.0.tmp

Sets the 'executable' attribute to the following files:

/data/data/####/files/DaemonServer

Miscellaneous:

Executes next shell scripts:

Contains functionality to send SMS messages automatically.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней