Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Click.171.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) api.ap####.com:80
- TCP(HTTP/1.1) p####.admobc####.com:80
- TCP(HTTP/1.1) sdk.api.kaf####.com:80
- TCP(HTTP/1.1) lh6.g####.com:80
- TCP(HTTP/1.1) trac####.volo-mo####.com:80
- TCP(HTTP/1.1) kua####.com:80
- TCP(HTTP/1.1) ad.c####.kaf####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) lh3.googleu####.com:80
- TCP(HTTP/1.1) t####.mobfire####.com:80
- TCP(HTTP/1.1) duc####.b####.com:80
- TCP(HTTP/1.1) aws.smarter####.net:80
- TCP(HTTP/1.1) api.netmast####.com:80
- TCP(HTTP/1.1) c####.howdo####.net:80
- TCP(HTTP/1.1) t####.cpa.iqop####.com:80
- TCP(HTTP/1.1) gl####.ymtrac####.com:80
- TCP(HTTP/1.1) trk.gl####.com:80
- TCP(HTTP/1.1) down####.prizes####.online:80
- TCP(HTTP/1.1) cdn.bat####.net:80
- TCP(HTTP/1.1) stra####.l####.net:80
- TCP(HTTP/1.1) a####.bat####.net:80
- TCP(HTTP/1.1) a####.batm####.net:80
- TCP(HTTP/1.1) dsp.batm####.net:80
- TCP(HTTP/1.1) 5####.77.99.53:80
- TCP(HTTP/1.1) ad.api.kaf####.com:80
- TCP(TLS/1.0) g####.gl:443
- TCP(TLS/1.0) app####.hs.l####.net:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) apptr####.com:443
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) md.apptr####.com:443
- TCP(TLS/1.0) f####.staticf####.com:443
- TCP(TLS/1.0) app.appsf####.com:443
- TCP(TLS/1.0) lh5.g####.com:443
- TCP(TLS/1.0) u####.bat####.net:443
- TCP(TLS/1.0) lh6.g####.com:443
- TCP(TLS/1.0) a####.app####.com:443
Запросы DNS:
- a####.app####.com
- a####.bat####.net
- a####.batm####.net
- a####.batm####.net
- a####.u####.com
- ad.api.kaf####.com
- ad.c####.kaf####.com
- and####.cli####.go####.com
- api.ap####.com
- api.netmast####.com
- app####.hs.l####.net
- app.appsf####.com
- apptr####.com
- aws.smarter####.net
- c####.howdo####.net
- c.s####.co
- cdn.bat####.net
- down####.prizes####.online
- dsp.batm####.net
- duc####.b####.com
- f####.staticf####.com
- g####.gl
- gl####.ymtrac####.com
- kua####.com
- lh3.googleu####.com
- lh5.g####.com
- lh6.g####.com
- md.apptr####.com
- p####.admobc####.com
- sdk.api.kaf####.com
- stra####.l####.net
- t####.cpa.iqop####.com
- t####.mobfire####.com
- trac####.volo-mo####.com
- trk.gl####.com
- u####.bat####.net
Запросы HTTP GET:
- api.netmast####.com/v3/gamecenter/
- down####.prizes####.online/?utm_medium=####&utm_campaign=####&1=####&2=#...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&aff_sub=####&...
- lh3.googleu####.com/2cJwK3ze2CD1YWNUL4HvbxlBuKucZeAFiR08LC1y9XOaHA79Kv5n...
- lh6.g####.com/K9czCJMDj3G4AUonnuDi6yYgbQ37vgIcRygRzzF36r79nfitFFBIrYdMxi...
- p####.admobc####.com/v1/ad/click?subsite_id=####&id=####&offer_id=####&t...
- t####.cpa.iqop####.com/click?pid=####&offer_id=####&sub1=####&sub2=####
- t####.mobfire####.com/mobfire/data/click?cid=####&affid=####&sub_param1=...
Запросы HTTP POST:
- stra####.l####.net/cc/v1/api?serviceid=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/046189c04dcf725f292ed00349b14d169fd....0.tmp
- <Package Folder>/cache/####/0621a89e72a6a0a1d34cd8999145a204166....0.tmp
- <Package Folder>/cache/####/101495016490178226
- <Package Folder>/cache/####/23b97701b4ffc58d4f3412e203cf3e960ff....0.tmp
- <Package Folder>/cache/####/2a525b1f0f1d9fb93e5085995837c75b0c3....0.tmp
- <Package Folder>/cache/####/5b91676db94a4c88cd894c333df73be7db5....0.tmp
- <Package Folder>/cache/####/7203983ab7ed60e0514e58ce54e3d7b2649....0.tmp
- <Package Folder>/cache/####/81d538e833f258b4cc79550089320bd042f....0.tmp
- <Package Folder>/cache/####/83cf4668fe9b762ddc83beacf035398117f....0.tmp
- <Package Folder>/cache/####/9059941e6ce7bab0f0e65a200c311bc70bd....0.tmp
- <Package Folder>/cache/####/94453d54ab567106c5a78bca179f116beab....0.tmp
- <Package Folder>/cache/####/952d381be9d78e8b4bb132d44383d071345....0.tmp
- <Package Folder>/cache/####/b3c3588eff5c35278ba82dd8c24f5e74eaa....0.tmp
- <Package Folder>/cache/####/cce1fd7306bcd3effa03fc57069d92f89eb....0.tmp
- <Package Folder>/cache/####/d297873a0ec8dd3e7dd1b482269ee3a29cf....0.tmp
- <Package Folder>/cache/####/d8d54ea7d009497fef79ec9230a39a2899e....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/eca12e3d77e659c4827aa279041584fb3c0....0.tmp
- <Package Folder>/cache/####/f8077ed97169217c6fe7113097e5ed3d7bf....0.tmp
- <Package Folder>/cache/####/f9d01facc79ffa5dbbd2ea3dab50c78e15a....0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/kaffnet_ads-journal
- <Package Folder>/databases/ps.db-journal
- <Package Folder>/databases/sample.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/kaffnet_device
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/wy.jar
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics....leted)
- <Package Folder>/shared_prefs/com.google.android.gms.analytics....ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measuremen...ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/common_config_settings.xml
- <Package Folder>/shared_prefs/common_config_settings.xml.bak
- <Package Folder>/shared_prefs/kaffnet_sp_sdk.xml
- <Package Folder>/shared_prefs/kaffnet_sp_sdk.xml.bak
- <Package Folder>/shared_prefs/kaffnet_sp_sdk.xml.bak (deleted)
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/native_config_settings.xml
- <Package Folder>/shared_prefs/pref_validate_placement_id.xml
- <Package Folder>/shared_prefs/rate_us.xml
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/shared_prefs/settings.xml.bak
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clic...rs.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_offers.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_settings.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_settings.xml.bak
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_strateg...me.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_strategy_info.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
Другие:
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
