Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.76.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.76.origin
Сетевая активность:
Подключается к:
- a####.####.com
- b####.com
- chu####.biz
- ilove####.com
- rib####.com
- rib####.com:8181
- secrets####.com
- t####.####.com
Запросы HTTP GET:
- a####.####.com/c/679efeecdc3b4d07?ijykJHsadL5=####&click_id=####&s1=####...
- b####.com/
- chu####.biz/t5/111/1497931393x2728265315.jpg
- ilove####.com/nl/sexdrive/?affl=####
- secrets####.com/?u=####&o=####
- t####.####.com/ck.php?line_item_id=####&site=####&xxx=####
Запросы HTTP POST:
- a####.####.com/project/adjarupdate/adupdate.php/ServicesEngine/DataServi...
- rib####.com/api/v1/ad_message
- rib####.com:8181/api/v1/register
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/databases/download_file.db-journal
- <Package Folder>/databases/kdl.db-journal
- <Package Folder>/databases/kmob.db-journal
- <Package Folder>/databases/log.db
- <Package Folder>/databases/log.db-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/databases/process_frame.db-journal
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/you1.db
- <Package Folder>/databases/you1.db-journal
- <Package Folder>/files/####/KmobAdSdk.jar
- <Package Folder>/files/####/aa.jar
- <Package Folder>/files/####/cc.jar
- <Package Folder>/files/####/uuid1.data
- <Package Folder>/files/####/uuid2.data
- <Package Folder>/files/.uuid3.data
- <Package Folder>/files/SdPlatform.dex
- <Package Folder>/files/SdPlatform.jar
- <Package Folder>/files/SdPlatform.odex
- <Package Folder>/files/apkseparate.DoubleBackUpDB.db
- <Package Folder>/files/apkseparate.DoubleBackUpDB.db-journal
- <Package Folder>/files/apkseparate.DoubleBackUpDB.db.one_day
- <Package Folder>/files/decSdPlatform.jar
- <Package Folder>/files/dn_config.db
- <Package Folder>/files/dn_config.db-journal
- <Package Folder>/files/grouppad.DoubleBackUpDB.db
- <Package Folder>/files/grouppad.DoubleBackUpDB.db-journal
- <Package Folder>/files/grouppad.DoubleBackUpDB.db.one_day
- <Package Folder>/files/update_day.ini
- <Package Folder>/shared_prefs/KmobAdpf.xml
- <Package Folder>/shared_prefs/Preference.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/adcube.xml
- <Package Folder>/shared_prefs/count.xml
- <Package Folder>/shared_prefs/kokId.xml
- <Package Folder>/shared_prefs/sp_url.xml
- <Package Folder>/shared_prefs/userAgentSp.xml
- <Package Folder>/shared_prefs/youPreferences.xml
- <Package Folder>/shared_prefs/youPreferences.xml.bak
- <Package Folder>/shared_prefs/youPreferences.xml.bak (deleted)
- <SD-Card>/.Android/####/SdPlatform.jar
- <SD-Card>/.Android/####/dn_config.db
- <SD-Card>/.Android/####/dn_config.db-journal
- <SD-Card>/.Android/####/update_day.ini
- <SD-Card>/.Android/uuid1.data
- <SD-Card>/.systemconfig/uuid2.data
- <SD-Card>/.uuid3.data
- <SD-Card>/Android/####/-1572559898.tmp
- <SD-Card>/Android/####/-1814020968
- <SD-Card>/Android/####/-1814020968.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1244302078.tmp
- <SD-Card>/Android/####/1612885655.tmp
- <SD-Card>/Android/####/1682200855.tmp
- <SD-Card>/Android/####/2086083932
- <SD-Card>/Android/####/2086083932.tmp
- <SD-Card>/Android/####/486789753.tmp
- <SD-Card>/SspGuide/IsGuideInstall
- <SD-Card>/SspGuide/IsShowAd
- <SD-Card>/sc/####/<Package>10.0.0apkseparate.DoubleBackUpDB.db
- <SD-Card>/sc/####/<Package>10.0.0apkseparate.DoubleBackUpDB.db-journal
- <SD-Card>/sc/####/<Package>10.0.0apkseparate.DoubleBackUpDB.db.one_day
- <SD-Card>/sc/####/<Package>10.0.0grouppad.DoubleBackUpDB.db
- <SD-Card>/sc/####/<Package>10.0.0grouppad.DoubleBackUpDB.db-journal
- <SD-Card>/sc/####/<Package>10.0.0grouppad.DoubleBackUpDB.db.one_day
Другие:
Запускает следующие shell-скрипты:
- /system/bin/app_process /system/bin com.dn.feature.common.DamnedGod 2115 com.android.hoyh 123456 nullaa
- <dexopt>
- cat /sys/class/net/wlan0/address
- com.android.cryptmsn
