Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.in
- analy####.####.com
- apptr####.com
- c####.####.net
- co####.####.com
- cpact####.com
- d####.####.in
- d1a1wrh####.####.net
- face####.com
- g####.####.net
- n####.####.com
- o####.####.com
- p####.####.com
- r####.####.com
- s####.####.com
- set####.####.com
- statist####.com
- twi####.com
- you####.com
Запросы HTTP GET:
- a####.####.com/link/buy/android/com.abnamro.nl.tikkie/e1?clinkID=####&pu...
- a####.####.in/abc/query/servers_list_opt/?country=####
- apptr####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&devic...
- c####.####.net/aff_c?offer_id=####&affiliate_id=####&gaid=####&device_id...
- co####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=...
- cpact####.com/api/v1.0/clk/track/proxy?ad_id=####&site_id=####&response_...
- d1a1wrh####.####.net/vpnmaster/speedtest_ad/speed_test_ad_bg_case_a.png
- face####.com/
- g####.####.net/prod/upload/adunion/images/27a/170_170_702a5eae6cc51f98.png
- n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os...
- p####.####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=####&o...
- s####.####.com/aff/ssp/click?channel=####&id=####&aoid=####&&uuid=####&c...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- statist####.com/match?p=####&adxguid=####
- twi####.com/
- you####.com/
Запросы HTTP POST:
- a####.####.com/app_logs
- analy####.####.com/
- d####.####.in/abc/vpn/diagnose_record/
- o####.####.com/check_config_update
- r####.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk=####&dpi...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/vpnmaster.dat.jar
- <Package Folder>/app_outdex/vpnmaster.dat.dex (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-993438615.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes2146885136.zip
- <Package Folder>/databases/du_ad_cache.db-journal
- <Package Folder>/databases/du_ad_ts.db-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_VY973X356RT9Q5NVHX8K_216
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.imprint
- <Package Folder>/files/.yflurrydatasenderblock.4c462786-baa4-4d12-bc6f-5dc0f17d63ab
- <Package Folder>/files/.yflurryreport.-29385377ded13a23
- <Package Folder>/files/5.5.1_server.json
- <Package Folder>/files/5.5.1_server_list_opt.json
- <Package Folder>/files/5.5.1_server_valid.ser
- <Package Folder>/files/AF_INSTALLATION
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/files/JhyyKUYax
- <Package Folder>/files/client.conf
- <Package Folder>/files/consumed.json
- <Package Folder>/files/consuming.json
- <Package Folder>/files/country.json
- <Package Folder>/files/mobclick_agent_cached_<Package>2017020516
- <Package Folder>/files/server_areas.json
- <Package Folder>/files/server_failed.json
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/user.dat
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
- <Package Folder>/shared_prefs/app.prefs.xml
- <Package Folder>/shared_prefs/app.prefs.xml.bak
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak (deleted)
- <Package Folder>/shared_prefs/charging_configs_sp.xml
- <Package Folder>/shared_prefs/charging_configs_sp.xml.bak
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/feedback_push.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/vpn_prefs.xml
- <Package Folder>/shared_prefs/vpn_prefs.xml.bak
- <SD-Card>/Android/####/-1839805859.tmp
- <SD-Card>/Android/####/-451339605.tmp
- <SD-Card>/Android/####/1236486304
- <SD-Card>/Android/####/2029996383.tmp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- ping -c 4 -w 3 alog.umeng.co
- ping -c 4 -w 3 alog.umeng.com
- ping -c 4 -w 3 oc.umeng.com
- sh
Использует права администратора.
