Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.net
- c####.####.com
- i####.####.com
- set####.####.com
- u####.####.com
Запросы HTTP GET:
- a####.####.com/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=...
- a####.####.com/m/ad?id=####&nsv=####&dn=####&bundle=####&z=####&o=####&w...
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- c####.####.com/files/92c2a1cb8f28bce81d5bf81fe971a686
- i####.####.com/s
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- u####.####.com/ad/keyboard?nt=####&adn=####&prt=####&at=####&h=####&w=##...
- u####.####.com/ad/sspstat?nt=####&adn=####&osv=####&prt=####&pkg=####&ss...
- u####.####.com/ad/sspstat?nt=####&osv=####&prt=####&pkg=####&sspid=####&...
- u####.####.com/integrated/ots?mcc=####&country_code=####&locale=####
Запросы HTTP POST:
- a####.####.com/api/ads/connect
- u####.####.com/advertise/platform/get
- u####.####.com/auth/activate
- u####.####.com/notification_center/beb7d959-d61c-460a-9f99-c677fccb19e8/...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_bin/daemon
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1478228129219.jar
- <Package Folder>/cache/1478228129219.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-328885771.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes1004878025.zip
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/ararat-journal
- <Package Folder>/databases/filter-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/1501850202057
- <Package Folder>/files/####/1501850202136
- <Package Folder>/files/####/1501850202145
- <Package Folder>/files/####/1501850202281
- <Package Folder>/files/####/1501850204410
- <Package Folder>/files/####/1501850205467
- <Package Folder>/files/####/1501850205865
- <Package Folder>/files/####/1501850206560
- <Package Folder>/files/####/1501850206877
- <Package Folder>/files/####/1501850207471
- <Package Folder>/files/####/1501850207573
- <Package Folder>/files/####/1501850208925
- <Package Folder>/files/####/1501850208933
- <Package Folder>/files/####/1501850209211
- <Package Folder>/files/####/1501850209213
- <Package Folder>/files/####/1501850209409
- <Package Folder>/files/####/1501850209602
- <Package Folder>/files/####/1501850209638
- <Package Folder>/files/####/1501850209671
- <Package Folder>/files/####/1501850210109
- <Package Folder>/files/####/1501850210119
- <Package Folder>/files/####/1501850210129
- <Package Folder>/files/####/1501850211424
- <Package Folder>/files/####/1501850211611
- <Package Folder>/files/####/1501850211805
- <Package Folder>/files/####/1501850213608
- <Package Folder>/files/####/1501850213611
- <Package Folder>/files/####/1501850213780
- <Package Folder>/files/####/1501850213943
- <Package Folder>/files/####/1501850213955
- <Package Folder>/files/####/1501850214848
- <Package Folder>/files/####/1501850214870
- <Package Folder>/files/####/1501850215194
- <Package Folder>/files/####/1501850215223
- <Package Folder>/files/####/1501850216444
- <Package Folder>/files/####/1501850216445
- <Package Folder>/files/####/1501850216477
- <Package Folder>/files/####/1501850216494
- <Package Folder>/files/####/1501850216798
- <Package Folder>/files/####/1501850216830
- <Package Folder>/files/####/1501850216850
- <Package Folder>/files/####/1501850220745
- <Package Folder>/files/####/1501850220751
- <Package Folder>/files/####/1501850220758
- <Package Folder>/files/####/1501850220761
- <Package Folder>/files/####/1501850220936
- <Package Folder>/files/####/1501850221103
- <Package Folder>/files/####/1501850221121
- <Package Folder>/files/####/1501850221626
- <Package Folder>/files/####/1501850221973
- <Package Folder>/files/####/1501850221975
- <Package Folder>/files/####/1501850222011
- <Package Folder>/files/####/1501850222035
- <Package Folder>/files/####/1501850222400
- <Package Folder>/files/####/1501850222437
- <Package Folder>/files/####/1501850226256
- <Package Folder>/files/####/1501850233956
- <Package Folder>/files/####/1501850233962
- <Package Folder>/files/####/1501850235876
- <Package Folder>/files/####/1501850238435
- <Package Folder>/files/####/1501850238455
- <Package Folder>/files/####/1501850242979
- <Package Folder>/files/####/1501850245054
- <Package Folder>/files/####/1501850251668
- <Package Folder>/files/####/1501850251677
- <Package Folder>/files/####/1501850251682
- <Package Folder>/files/####/1501850254187
- <Package Folder>/files/####/1501850254216
- <Package Folder>/files/####/1501850257828
- <Package Folder>/files/####/1501850260488
- <Package Folder>/files/####/1501850260860
- <Package Folder>/files/####/1501850260914
- <Package Folder>/files/####/1501850260987
- <Package Folder>/files/####/1501850261030
- <Package Folder>/files/persisted_config
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/TOKEN.xml
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/ararat.xml
- <Package Folder>/shared_prefs/com.cootek.tark.active_statistic.xml
- <Package Folder>/shared_prefs/com.cootek.tark.identifier.preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/cross_settings.xml
- <Package Folder>/shared_prefs/ct_default.xml
- <Package Folder>/shared_prefs/history_new.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/present_global_params.xml
- <Package Folder>/shared_prefs/present_global_params.xml.bak
- <Package Folder>/shared_prefs/push_history_manager.xml
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/shared_prefs/settings.xml (deleted)
- <Package Folder>/shared_prefs/settings.xml.bak
- <Package Folder>/shared_prefs/share_date.xml
- <Package Folder>/shared_prefs/share_date.xml.bak
- <Package Folder>/shared_prefs/tark_ads.xml
- <Package Folder>/shared_prefs/tark_ads.xml.bak
- <Package Folder>/shared_prefs/token_recommendchannel.xml
- <Package Folder>/shared_prefs/token_recommendchannel.xml.bak
- <Package Folder>/shared_prefs/usage_setting.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 700 <Package Folder>/app_bin/daemon
- mars_d -p <Package> -s <Package>.bbase.BBaseDaemonService -p1r 40 -p1w 41 -p2r 42 -p2w 43
Загружает динамические библиотеки:
- daemon_api20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
