Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.607.origin
- Android.Loki.10.origin
- Android.Loki.15.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.607.origin
Сетевая активность:
Подключается к:
- 5####.####.53
- a####.####.com
- a####.####.mobi
- a####.####.org
- a####.####.tech
- a####.com
- ad####.####.net
- adh####.####.org
- ald####.com
- c####.####.com
- c####.####.net
- cl####.####.net
- cpgnrot####.com
- dqhmu04####.####.net
- duc####.####.com
- f####.####.com
- face####.com
- g####.####.net
- gl####.####.com
- j####.####.com:8888
- koolm####.info
- kua####.com
- m####.####.com
- pag####.####.com
- pre####.####.net
- r####.####.tech
- real####.####.org
- s####.####.com
- sdk-112####.####.com
- serv####.####.com
- spxt####.com
- t####.####.com
- technol####.####.uk
- trac####.####.com
Запросы HTTP GET:
- 5####.####.53/acs.php?sid=####&adid=####&udid=####&gaid=####&pb=####
- a####.####.com/acs.php?sid=####&adid=####&os=####&osv=####&udid=####&gai...
- a####.####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- a####.####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&click...
- a####.####.com/click?_type=####&action=####&sdk_redir=####&campid=####&s...
- a####.####.com/link/buy/android/com.bitmango.rolltheballunrollme/e1?clin...
- a####.####.mobi/ai/ai_script.js
- a####.####.mobi/track?pid=####&eid=####&jsb=####&ckb=####&dm=####&dlh=##...
- a####.####.org/op?platform=####&os_version=####&package_name=####&app_ve...
- a####.####.org/op_report?platform=####&os_version=####&package_name=####...
- a####.####.org/rule?platform=####&os_version=####&package_name=####&app_...
- a####.####.tech/common/notification/v1?ai=####&lo=####&mi=####&vc=####&l...
- a####.com/c/170184/r51nq141-r076-66r9-or7o-55704503n7s1/q70111r7-ns58-9n...
- ad####.####.net/index.php?m=####&p=####&app_id=####&offer_id=####&aff_su...
- adh####.####.org/aff_c?offer_id=####&aff_id=####&url_id=####&aff_sub3=##...
- adh####.####.org/aff_r?offer_id=629&aff_id=1164&url=https://control.koch...
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- c####.####.com/?utm_medium=####&utm_campaign=####&cid=####&1=####
- c####.####.com/?utm_term=####&clickverify=####&utm_content=####
- c####.####.com/call/v2/ad/click?aff_id=####&ads_id=####&ak_id=####&from_...
- c####.####.com/call/v2/ad/click?asd=####&afi=####&ai=####&ll=####&ce=###...
- c####.####.com/call/v2/ad/click_callback?asd=####&afi=####&ai=####&ll=##...
- c####.####.com/image/auto/20170103/5df621ebfd7b4d32981e39cbaf95187c/8da2...
- c####.####.com/image/tryauto/20170425/99c4973a67444c378921061f0c8ebec3/a...
- c####.####.com/jquery-1.11.1.min.js
- c####.####.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
- c####.####.com/proc.php?1ded2cd####
- c####.####.com/stat/v2/imp?afi=####&ai=####&ll=####&ce=####&odk=####&da=...
- c####.####.com/stat/v2/request?afi=####&ai=####&ll=####&ce=####&odk=####...
- c####.####.com/tracking/adClick?d=####&clickId=####&prod=####&pub=####&s...
- c####.####.com/tracking/adClick?d=IAAAA####&clickId=####&prod=####&advId...
- c####.####.com/tracking/adClick?d=IAAAA####&prod=####&segId=####&advId=#...
- c####.####.com/tracking/index/599b59a414add?aff_sub=####&sub_id=####&goo...
- cl####.####.net/target/t.mobrand.net/tracking/aff/yszn9HXPQrOuTQYiAwyhHQ...
- cpgnrot####.com/campaign/2292|518?tag=####&website=####&placement=####
- cpgnrot####.com/campaign/8741|656?tag=####&token1=####&_uu=####
- dqhmu04####.####.net/Ad280ff.jar
- duc####.####.com/click/affClick?aff_id=####&offer_id=####&aff_sub=####&a...
- f####.####.com/css?family=####&ver=####
- f####.####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4.ttf
- f####.####.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-BxWgZ...
- face####.com/plugins/likebox.php?href=####&w####&height=####&colorscheme...
- g####.####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&affid...
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&a...
- j####.####.com:8888/rule?p=eyJ0c####
- koolm####.info/r/389600a0-86f3-11e7-ae6f-11419a6afde7/0/
- koolm####.info/r/389600a0-86f3-11e7-ae6f-11419a6afde7/1/
- koolm####.info/r/3981e902-86f3-11e7-816a-1145076f367d/0/
- koolm####.info/r/3981e902-86f3-11e7-816a-1145076f367d/1/
- kua####.com/mt/w264x2b4b4u2y20344y2w234s2/&subid1=2595e9bf5a9886ada45e76...
- kua####.com/mt/w264x2b4b4u2y20344y2w234s2/&subid1=297bdfe8d2ed5880cfc7c4...
- kua####.com/mt/w264x2b4b4u2y20344y2w234s2/&subid1=c564a99003a00d77363fcb...
- kua####.com/mt/w264z234e4p2u20344y2w234s2/&subid1=6d2b9e6f3d135d6cc920f9...
- m####.####.com/dir/click?c=####&offerid=####&affid=####&cid=####&data1=#...
- m####.####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&data...
- pag####.####.com/pagead/js/adsbygoogle.js
- pag####.####.com/pagead/js/r20170817/r20170110/reactive_library.js
- pag####.####.com/pagead/js/r20170817/r20170110/show_ads_impl.js
- pre####.####.net/
- r####.####.tech/notifications/2017/08/17/1502939627965-yff7dxut-lADO99jL...
- real####.####.org/realtime?platform=####&os_version=####&package_name=##...
- s####.####.com/srv/click/?pid=####&p1=####&p2=####
- serv####.####.com/119987?t=0.23208829876966774&ref=&lu=http://www.techno...
- spxt####.com/d/122920589f65453c5fa?sub=####&pkg=####
- spxt####.com/d/5185560ac77d48a6f?source=####&sub3=####&sub=####
- spxt####.com/gw?url=http://cpgnrotation.com/campaign/2292%7C518?tag=####...
- spxt####.com/gw?url=https://billmscurlrev.com/c/0e3d3438-e3bf-11e6-b975-...
- t####.####.com/click?_type=####&action=####&sdk_redir=####&campid=####&s...
- t####.####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=#...
- technol####.####.uk/mobile/iphone/digging-deeper-iphone-8s-battery/?subi...
- technol####.####.uk/wp-content/plugins/wp-share-buttons/Front_end/js/cus...
- technol####.####.uk/wp-content/plugins/wp-share-buttons/style/front.end....
- technol####.####.uk/wp-content/themes/sparkle-childtheme/style.css?ver=#...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/css/animate.css...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/css/flexslider....
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/css/font-awesom...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/fonts/fontaweso...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/framework/css/b...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/framework/js/bo...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/js/jquery.flexs...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/js/jquery.sharr...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/js/yt.custom.mi...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/js/yt.script.mi...
- technol####.####.uk/wp-content/themes/yeahthemes-sparkle/style.css
- technol####.####.uk/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- technol####.####.uk/wp-includes/js/jquery/jquery.js?ver=####
- technol####.####.uk/wp-includes/js/wp-embed.min.js?ver=####
- technol####.####.uk/wp-includes/js/wp-emoji-release.min.js?ver=####
- trac####.####.com/aff_c?aff_sub=####&source=####&google_aid=####&ios_ifa...
Запросы HTTP POST:
- c####.####.com/api/v2/app?sid=####
- c####.####.com/cc/v1/api?sid=####
- c####.####.com/stat?sid=####
- c####.####.net/config/update
- c####.####.net/dc/sync_adr
- sdk-112####.####.com/sdk/sdkClient/request
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_files/ini.bin
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1470286953684.dex
- <Package Folder>/cache/1470286953684.jar
- <Package Folder>/cache/1470286953684.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/Datebase-journal
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/arrkii.native.sdk.db-journal
- <Package Folder>/databases/dataeye_database_3D752345268CF1E76E09F5CFB113311F.db
- <Package Folder>/databases/dataeye_database_3D752345268CF1E76E09F5CFB113311F.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/DataEye_Android.jar
- <Package Folder>/files/EGHLsNQoLMSzcubDstub.jar
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/fivWGWBmcLYoYQdtsa.jar
- <Package Folder>/files/icon_HD.jar
- <Package Folder>/files/ini.jar
- <Package Folder>/files/syErvTFYOoeGkNcSdaemon.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/SPConfigUtil.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml.bak
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
- <Package Folder>/shared_prefs/all_info_data.xml
- <Package Folder>/shared_prefs/all_info_data.xml.bak
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml.bak
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/dc.3D752345268CF1E76E09F5CFB113311F.preferences.xml
- <Package Folder>/shared_prefs/dc.3D752345268CF1E76E09F5CFB113311F.preferences.xml.bak
- <Package Folder>/shared_prefs/sharepreference_common_record.xml
- <Package Folder>/shared_prefs/sharepreference_common_record.xml.bak
- <Package Folder>/shared_prefs/sharepreference_url_param.xml
- <Package Folder>/shared_prefs/sharepreference_url_param.xml.bak
- <SD-Card>/.SystemService/####/2D7F07BB6125DEB407E92A22DC4AC550
- <SD-Card>/.SystemService/####/uid
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.salvia/tick
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1019594696.0.tmp
- <SD-Card>/Android/####/112762496.0.tmp
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
Загружает динамические библиотеки:
- bound
- librzKXgueSDvKSXJOpbootstrap
- syErvTFYOoeGkNcSdaemon
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к интерфейсу камеры.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
