Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.net
- c####.####.com
- i####.####.com
- n####.####.com
- set####.####.com
- u####.####.com
Запросы HTTP GET:
- a####.####.com/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=...
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- c####.####.com/files/92c2a1cb8f28bce81d5bf81fe971a686
- i####.####.com/s
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- u####.####.com/ad/sspstat?placementid=####&tu=####&s=####&token=####&adn...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_bin/daemon
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/cache/####/-515249652-975763097
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1478228129219.jar
- <Package Folder>/cache/1478228129219.tmp
- <Package Folder>/cache/1501850185202_4xrTYlc1cqPAEX1jroaN-Jvr9RdZsDL2iMs_rZQk4LrDvPeaC3dx-XkZvrXqMASd4X1tUeihN5g=w423-h752-n-e7-rw-v2
- <Package Folder>/cache/1501850187941_10IsZW7hGkb0y1BaENNoIrQGvRV_OoKS5CglrQ5diclGyHF2VPw9F4hE9Sjpmpe1aHMbwKPlenQ=w128-h128-rw-v2
- <Package Folder>/cache/1501850188572_GBhc5vSq2fJRmGBaCqshz04dfOB9bXWCdWOj3PPuBuP7J3rzxJc6PgyxEMQ9zk_WZ-e8etEOTeEw6TLaDlvytX4uyUL6ZjIC6ArI-FnzTZg07khggK8_4FU=w600-h313-n-e7-rw-v2
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-1220816097.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-545972736.zip
- <Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal (deleted)
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/ararat-journal
- <Package Folder>/databases/filter-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/1501850168689
- <Package Folder>/files/####/1501850174979
- <Package Folder>/files/####/1501850175120
- <Package Folder>/files/####/1501850175277
- <Package Folder>/files/####/1501850175291
- <Package Folder>/files/####/1501850175305
- <Package Folder>/files/####/1501850175980
- <Package Folder>/files/####/1501850179978
- <Package Folder>/files/####/1501850180077
- <Package Folder>/files/####/1501850180578
- <Package Folder>/files/####/1501850180582
- <Package Folder>/files/####/1501850180589
- <Package Folder>/files/####/1501850180608
- <Package Folder>/files/####/1501850180620
- <Package Folder>/files/####/1501850180703
- <Package Folder>/files/####/1501850180872
- <Package Folder>/files/####/1501850180901
- <Package Folder>/files/####/1501850180910
- <Package Folder>/files/####/1501850182145
- <Package Folder>/files/####/1501850182146
- <Package Folder>/files/####/1501850182148
- <Package Folder>/files/####/1501850182152
- <Package Folder>/files/####/1501850182156
- <Package Folder>/files/####/1501850182160
- <Package Folder>/files/####/1501850182300
- <Package Folder>/files/####/1501850183176
- <Package Folder>/files/####/1501850183180
- <Package Folder>/files/####/1501850183213
- <Package Folder>/files/####/1501850183679
- <Package Folder>/files/####/1501850184060
- <Package Folder>/files/####/1501850184076
- <Package Folder>/files/####/1501850184104
- <Package Folder>/files/####/1501850185056
- <Package Folder>/files/####/1501850185058
- <Package Folder>/files/####/1501850185088
- <Package Folder>/files/####/1501850185093
- <Package Folder>/files/####/1501850185114
- <Package Folder>/files/####/1501850185130
- <Package Folder>/files/####/1501850185146
- <Package Folder>/files/####/1501850185158
- <Package Folder>/files/####/1501850185164
- <Package Folder>/files/####/1501850187956
- <Package Folder>/files/####/1501850187958
- <Package Folder>/files/####/1501850187984
- <Package Folder>/files/####/1501850187990
- <Package Folder>/files/####/1501850187999
- <Package Folder>/files/####/1501850188564
- <Package Folder>/files/####/1501850188569
- <Package Folder>/files/####/1501850188572
- <Package Folder>/files/####/1501850188574
- <Package Folder>/files/####/1501850188576
- <Package Folder>/files/####/1501850188991
- <Package Folder>/files/####/1501850188993
- <Package Folder>/files/####/1501850189056
- <Package Folder>/files/####/1501850189083
- <Package Folder>/files/####/1501850189089
- <Package Folder>/files/####/1501850189121
- <Package Folder>/files/####/1501850189132
- <Package Folder>/files/####/1501850193442
- <Package Folder>/files/####/1501850193485
- <Package Folder>/files/####/1501850196293
- <Package Folder>/files/####/1501850196311
- <Package Folder>/files/####/1501850201978
- <Package Folder>/files/####/1501850204086
- <Package Folder>/files/####/1501850204623
- <Package Folder>/files/####/1501850204731
- <Package Folder>/files/####/1501850222324
- <Package Folder>/files/####/1501850226385
- <Package Folder>/files/####/1501850226654
- <Package Folder>/files/####/1501850226710
- <Package Folder>/files/persisted_config
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/TOKEN.xml
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/admob.xml.bak
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/ararat.xml
- <Package Folder>/shared_prefs/com.cootek.tark.active_statistic.xml
- <Package Folder>/shared_prefs/com.cootek.tark.identifier.preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/cross_settings.xml
- <Package Folder>/shared_prefs/ct_default.xml
- <Package Folder>/shared_prefs/history_new.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/present_global_params.xml
- <Package Folder>/shared_prefs/present_global_params.xml.bak
- <Package Folder>/shared_prefs/push_history_manager.xml
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/shared_prefs/settings.xml.bak
- <Package Folder>/shared_prefs/share_date.xml
- <Package Folder>/shared_prefs/share_date.xml.bak
- <Package Folder>/shared_prefs/token_recommendchannel.xml
- <Package Folder>/shared_prefs/token_recommendchannel.xml.bak
- <Package Folder>/shared_prefs/usage_setting.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 700 <Package Folder>/app_bin/daemon
- mars_d -p <Package> -s <Package>.bbase.BBaseDaemonService -p1r 40 -p1w 41 -p2r 42 -p2w 43
Загружает динамические библиотеки:
- daemon_api20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
