Unblocked site with a lot of downloadable android adware

Viruses and worms
1

Chinese Android game download site hp://shuju.naitang.com/ (you cannot go to it directly as it return forbidden, use this instead hp://a.naitang.com/), currently unblocked by avast

with a few possible android game adware sample undetected by avast (The link will directly download the app)
h**p://shuju.naitang.com/az/youxi/appipa/201311/14030747xeKGmq0IogdqGi6Sd7qe.apk
adware, https://www.virustotal.com/en/file/8ef0655a38ebe2ae78945a21a6d7fb9ce0e1a9bd8d48d1ef10ff7455c7c6cff6/analysis/1400587502/

h**p://shuju.naitang.com/az/youxi/appipa/201312/02/02040138Wy2fHg8Puo1GF8EwDtcr.apk
adware, https://www.virustotal.com/en/file/695258f021bd109a0a4b80ee4b91dd768ad3b5edc0e5a15928d996ec34a53e23/analysis/1400649000/

h**p://shuju.naitang.com/az/youxi/appipa/201311/30/30034230EGY0GpyXVg2Jp3KIC0os.apk
adware, https://www.virustotal.com/en/file/7394d76044d65b21e911d268d792d98157b0c8d09cea2206588e71370edd935b/analysis/1400586782/

h**p://shuju.naitang.com/az/youxi/appipa/201311/b6e81450236bbd29b5b8c22040a99f67.apk
adware, https://www.virustotal.com/en/file/4ef83bd2ac6e80f1a57bec57310be84b1a3d38104dd7eb9c9fd8870b5d783d4c/analysis/1400649560/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/koudaiyaoguaiqiheimeiying_3.apk
adware, https://www.virustotal.com/en/file/c5102b5b1cabf7df4d9f0eea44b6a5f4807927a70c009cf346ce7ddb32a9928d/analysis/1400652831/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/com.mobile.maoxiandao4_6.apk
adware, https://www.virustotal.com/en/file/76525b3eedfebd1bd999921ea6213364becab5c7df047c89fc9f84b1a203ecfa/analysis/1400653346/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/com.androidemu.harvemarioxb_24620500_0.apk
trojan/adware, https://www.virustotal.com/en/file/a46253bdeadbe3111f97308c9ac8aba78fb87ef39255c0cb54cb9635a6dd2273/analysis/1400653590/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/com.daweisnes.wrdwy_2.apk
spyware/adware, https://www.virustotal.com/en/file/9331a8fc310c98fbe65c416c389e2b421c33f72b2f95149d6f39997d5ce8106c/analysis/1398113337/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/612814_7f0d7cf6-c9fd-4d99-bbf2-726a1aeb1cfd.apk
adware, https://www.virustotal.com/en/file/6065b17e18219208bd3cf209827a90371d7fe09b0e3b18062e9c7c85f2a9b11d/analysis/1400472720/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/koudaiyaoguaihuanyingzhiyi_10.apk
adware, https://www.virustotal.com/en/file/a0c2274c755de12728bc9a4f503eb1c07e43aec32765817876451aa0df10de00/analysis/1400657652/

h**p://shuju.naitang.com/az/youxi/appipa/20131025/lsh.kdygyhzy_1.apk
adware, https://www.virustotal.com/en/file/224410a7abb49170cc7ab528f47df5e9d85b1f4c54a46b2ea17cf2a010c99854/analysis/1397034873/

2

You can upload files and report issues to avast here : http://www.avast.com/contact-form.php (select subject according to Your case)

You can use mail
send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected

or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21

3

I mean the website itself isn’t blocked by avast when there is adware downloadable on it

For the adware sample, I don’t have it and afraid downloading will affect the computer, so I give the link that will directly download the files.

4

Put info / URL in a notepad.txt and send to avast Using above options

5

The adware is being alerted by IDS alert here for instance: http://urlquery.net/report.php?id=1400473353040
Those that detect: https://www.virustotal.com/nl/domain/shuju.naitang.com/information/ are DrWeb’s and AntiVir.

polonus

6

@rickyyeung:
Thanks for the submissions. The files will be detected in the next definitions update.