Adware.Ninebox.89

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Ninebox.4.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c####.baidust####.com:80
TCP(HTTP/1.1) crs.b####.com:80
TCP(HTTP/1.1) m.l####.com:80
TCP(HTTP/1.1) cm.qt####.com:80
TCP(HTTP/1.1) ni.l####.com.####.net:80
TCP(HTTP/1.1) s####.jom####.com:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) zi####.b####.com:80
TCP(HTTP/1.1) mi.l####.com.####.net:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) map####.y####.com.cn:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) cpu.b####.com:80
TCP(HTTP/1.1) nsc####.b####.com:80
TCP(HTTP/1.1) wn.pos.b####.com:80
TCP(HTTP/1.1) llq.ush####.info:80
TCP(HTTP/1.1) s.c####.b####.com:80
TCP(HTTP/1.1) wap.n.sh####.com:80
TCP(HTTP/1.1) em.b####.com:80
TCP(HTTP/1.1) c####.jd.com:80
TCP(TLS/1.0) zhanz####.b####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) publish####.b####.com.####.com:443
TCP(TLS/1.0) cpu.b####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) cdn-boo####.b0.a####.com:443
TCP(TLS/1.0) zz.bdst####.com:443
TCP(TLS/1.0) wn.pos.b####.com:443
TCP(TLS/1.0) si####.jom####.com:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) h####.b####.com.####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) cac####.b####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) ni.l####.com.####.net:443

DNS requests:

api.s####.b####.com
b####.s####.b####.com
c####.baidust####.com
c####.baidust####.com
c####.jd.com
cac####.b####.com
cdn.boo####.com
cm.pos.b####.com
cm.qt####.com
cpu.b####.com
crs.b####.com
dup.baidust####.com
e####.b####.com
ec####.b####.com
em.b####.com
f10.b####.com
f11.b####.com
f12.b####.com
g####.bdst####.com
h####.b####.com
hm.b####.com
llq.ush####.info
m.b####.com
m.l####.com
map####.y####.com.cn
mi.l####.com
ni.l####.com
nsc####.b####.com
p####.zhanz####.b####.com
pos.b####.com
publish####.b####.com
r####.b####.com
s.c####.b####.com
t10.b####.com
t11.b####.com
t12.b####.com
wn.pos.b####.com
zhanz####.b####.com
zi####.b####.com
zz.bdst####.com

HTTP GET requests:

c####.baidust####.com/cpro/expire/time2.js
c####.baidust####.com/cpro/ui/cm.js
c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
c####.baidust####.com/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
c####.baidust####.com/cpro/ui/noexpire/ws/css/base_f258e90.css
c####.baidust####.com/cpro/ui/noexpire/ws/css/ui_b99a586.css
c####.baidust####.com/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
c####.baidust####.com/cpro/ui/noexpire/ws/widget/logo_94e2e1b.js
c####.baidust####.com/cpro/ui/pr.js
c####.baidust####.com/sync.htm?cproid=####
c####.jd.com/du?&baidu_user_id=####&cookie_version=####&timestamp=####&e...
cm.qt####.com/pixel?allyes_dspid=####&allye####&extra=####
cpu.b####.com/js/cb.js
crs.b####.com/t.js?siteId=####&planId=####&async=####&referer=####&title...
crs.b####.com/tj.gif?si=####&st=####&nv=####&et=####&ep=####&at=####&rnd...
dup.baidust####.com/holmes/t-dots.svg
em.b####.com/allyes?allyes_id=####&allyes_cver=####&extra=####
em.b####.com/pixel?dspid=####
em.b####.com/pixel?media_sign=####&media_site=####
hm.b####.com/h.js?36c0283####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.gif?si=####&st=####&nv=####&et=####&ep=####&rnd=####
llq.ush####.info/browser/css/browser.css?id=####
llq.ush####.info/browser/css/common.css?id=####
llq.ush####.info/browser/fb.asp?id=####&mid=####&e=####
llq.ush####.info/browser/img/ic_bd.png
llq.ush####.info/browser/img/ic_thunder.png
llq.ush####.info/browser/js/browser.js?id=####
llq.ush####.info/browser/js/circle-progress.min.js?id=####
m.l####.com/
m.l####.com/CSS/style.css
m.l####.com/e/extend/DoTimeRepage/
m.l####.com/e/public/ViewClick/?classid=####&id=####&addclick=####
m.l####.com/gaosanlizhi/
m.l####.com/gaosanlizhi/34773.html
m.l####.com/images/backtop.png
m.l####.com/images/home_ico.png
m.l####.com/images/menu_ico.png
m.l####.com/js/common.js
m.l####.com/js/jquery.js
m.l####.com/js/md.js
m.l####.com/lizhiwenzhang/
m.l####.com/renshengganwu/
m.l####.com/renshengganwu/47893.html
m.l####.com/shujixiazai/
m.l####.com/shujixiazai/36505.html
m.l####.com/weirenchushi/
m.l####.com/weirenchushi/47880.html
map####.y####.com.cn/s/mapping/?baidu_user_id=####&cookie_version=####&t...
mi.l####.com.####.net/dkgppb?ros=####&gsn=####&ns=####&vde=####&dzb=####...
mi.l####.com.####.net/llzfgkw/aar?c=####&ext=####
mi.l####.com.####.net/llzfgkw/vw?c=####&ext=####
mi.l####.com.####.net/m.html?baidu_error=####&timestamp=####
mi.l####.com.####.net/mijgywf?ros=####&gsn=####&ns=####&vde=####&zkb=###...
ni.l####.com.####.net/2e4d96dca598a574c917.js
ni.l####.com.####.net/bvzdlc.js
ni.l####.com.####.net/bwocytlctzdec.js
ni.l####.com.####.net/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
ni.l####.com.####.net/cpro/ui/noexpire/ws/css/base_f258e90.css
ni.l####.com.####.net/cpro/ui/noexpire/ws/css/ui_b99a586.css
ni.l####.com.####.net/cpro/ui/noexpire/ws/images/logo/close_9d33a11.png
ni.l####.com.####.net/cpro/ui/noexpire/ws/images/logo/logo-mob_94da672.png
ni.l####.com.####.net/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
ni.l####.com.####.net/cpro/ui/noexpire/ws/widget/logo_94e2e1b.js
ni.l####.com.####.net/faspgjbbb.js
ni.l####.com.####.net/hcurilddk.js
ni.l####.com.####.net/r9d95n7ne4.js
ni.l####.com.####.net/zwd71hzk5n.js
nsc####.b####.com/v.gif?pid=####&type=####&l=####&t=####&s=####&v=####&f...
nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
pos.b####.com/ecom?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/nclm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/nclm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&p...
pos.b####.com/nclm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&col=####&pis=####&dri...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&cpl=####&pss=####&dc=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dai=####&cdo=####&ccd...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dc=####&tlm=####&tpr=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&dtm=####&dri=####&cdo...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&exps=####&cja=####&tc...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&ltr=####&dri=####&dtm...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&psr=####&dai=####&ps=...
pos.b####.com/s?hei=####&wid=####&di=####&ltu=####&ti=####&ccd=####&cmi=...
pos.b####.com/sync_pos.htm?cproid=####
pos.b####.com/sync_pos.htm?cproid=####&t=####
pos.b####.com/tccm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/tcxm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/wcbm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
pos.b####.com/wcjm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
pos.b####.com/xcmm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&p...
pos.b####.com/xcmm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
s####.jom####.com/dst.gif?r=####&l=####
s####.jom####.com/push.js
s####.jom####.com/s.gif?r=####&l=####
s####.jom####.com/static/api/css/share_style0_16.css?v=####
s####.jom####.com/static/api/img/share/icons_0_16.png?v=####
s####.jom####.com/static/api/js/base/tangram.js?v=####
s####.jom####.com/static/api/js/component/partners.js?v=####
s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
s####.jom####.com/static/api/js/share/api_base.js
s####.jom####.com/static/api/js/share/share_api.js?v=####
s####.jom####.com/static/api/js/trans/logger.js?v=####
s####.jom####.com/static/api/js/view/share_view.js?v=####
s####.jom####.com/static/api/js/view/view_base.js
s####.jom####.com/v.gif
s.c####.b####.com/s.htm?cproid=####&t=####
si####.jom####.com/it/u=123207413,1390522706&fm=76
si####.jom####.com/it/u=145486076,4125360639&fm=76
si####.jom####.com/it/u=2083361222,3746588903&fm=72
si####.jom####.com/it/u=2578034984,2718778031&fm=76
si####.jom####.com/it/u=275400655,3258712238&fm=76
si####.jom####.com/it/u=2755584431,1129246769&fm=76
si####.jom####.com/it/u=2809798572,723040982&fm=72
si####.jom####.com/it/u=289674988,1830295868&fm=76
si####.jom####.com/it/u=2945672991,220875966&fm=72
si####.jom####.com/it/u=302945343,2161225857&fm=76
si####.jom####.com/it/u=3257843026,3064008603&fm=76
si####.jom####.com/it/u=3335963470,2980791554&fm=76
si####.jom####.com/it/u=3338203536,3614097140&fm=76
si####.jom####.com/it/u=3451521526,134313756&fm=72
si####.jom####.com/it/u=3542005213,3649252086&fm=76
si####.jom####.com/it/u=3631708702,3929097240&fm=76
si####.jom####.com/it/u=374952429,3510588813&fm=76
si####.jom####.com/it/u=3822554042,3928687533&fm=76
si####.jom####.com/it/u=3950980665,2709437368&fm=76
si####.jom####.com/it/u=3983405062,4089856182&fm=76
si####.jom####.com/it/u=416081020,2317124897&fm=76
si####.jom####.com/it/u=4173483332,157810343&fm=76
si####.jom####.com/it/u=514292623,4134511655&fm=76
si####.jom####.com/it/u=565542474,3427528455&fm=76
wap.n.sh####.com/mobads.php?060000a####&ck=####
wn.pos.b####.com/adx.php?c=####
wn.pos.b####.com/adx.php?c=####&ext=####
zi####.b####.com/api/reward/getpay?url=####&is_pc=####&callback=####

Modified file system:

Creates the following files:

/data/data/####/1525303237952.jar
/data/data/####/1525303237993.jar
/data/data/####/1525303238231.jar
/data/data/####/1525303238242.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dij.xml
/data/data/####/dim.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/http_m.lzrsh.com_0.localstorage-journal
/data/data/####/https_cpu.baidu.com_0.localstorage-journal
/data/data/####/index
/data/data/####/j-id.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/12.dat
/data/media/####/MID.DAT
/data/media/####/names.dat
/data/media/####/share.dat

Miscellaneous:

Uses the following algorithms to decrypt data:

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней