Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) rts.mo####.sdk.####.com:80
- TCP(HTTP/1.1) komliin####.go2c####.org:80
- TCP(HTTP/1.1) trk.gl####.com:80
- TCP(HTTP/1.1) photoed####.s.xox####.com:80
- TCP(HTTP/1.1) i####.o.xox####.com:80
- TCP(HTTP/1.1) seventy####.go2c####.org:80
- TCP(HTTP/1.1) photoed####.r.xox####.com:80
- TCP(HTTP/1.1) duapps-####.gsh####.com:80
- TCP(HTTP/1.1) api.mo####.sdk.####.com:80
- TCP(HTTP/1.1) api.stic####.du####.com:80
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) clk.tap####.com:443
- TCP(TLS/1.0) 17####.measure####.com:443
- TCP(TLS/1.0) t.appsf####.com:443
- TCP(TLS/1.0) c####.b####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) s3-ap-s####.amazo####.com:443
Запросы DNS:
- 17####.measure####.com
- api.mo####.sdk.####.com
- api.stic####.du####.com
- c####.b####.com
- clk.tap####.com
- co####.du####.com
- g####.face####.com
- g####.t####.net
- i####.o.xox####.com
- komliin####.go2c####.org
- pag####.googles####.com
- photoed####.r.xox####.com
- photoed####.s.xox####.com
- rts.mo####.sdk.####.com
- s3-ap-s####.amazo####.com
- seventy####.go2c####.org
- t.appsf####.com
- trk.gl####.com
Запросы HTTP GET:
- api.stic####.du####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####...
- api.stic####.du####.com/adunion/slot/getDlAd?h=####&w=####&model=####&ve...
- api.stic####.du####.com/material-checknew?timestamp=####&app_id=####&pla...
Запросы HTTP POST:
- photoed####.s.xox####.com/api/data?token=####&tk=nsTC####&sv=####
- photoed####.s.xox####.com/api/tokens?tk=nsTC####&sv=####
- photoed####.s.xox####.com/orts/ua?h=####&w=####&model=####&vendor=####&s...
- rts.mo####.sdk.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk...
- rts.mo####.sdk.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sd...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/photoeditor.dat.jar
- <Package Folder>/cache/####/-14497033221706852016
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-18...24.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes60109158.zip
- <Package Folder>/databases/d-journal
- <Package Folder>/databases/duscene_mobula.db-journal
- <Package Folder>/databases/fsdk.db-journal
- <Package Folder>/databases/i-journal
- <Package Folder>/databases/notify_items.sp-journal
- <Package Folder>/databases/sk
- <Package Folder>/databases/sk-journal
- <Package Folder>/databases/toolbox.db-journal
- <Package Folder>/databases/toolbox_cache.db-journal
- <Package Folder>/databases/toolbox_ts.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/z
- <Package Folder>/databases/z-journal
- <Package Folder>/files/####/1493179081.zip
- <Package Folder>/files/####/index.png
- <Package Folder>/files/####/muscle-1
- <Package Folder>/files/####/muscle-10
- <Package Folder>/files/####/muscle-2
- <Package Folder>/files/####/muscle-3
- <Package Folder>/files/####/muscle-4
- <Package Folder>/files/####/muscle-5
- <Package Folder>/files/####/muscle-6
- <Package Folder>/files/####/muscle-7
- <Package Folder>/files/####/muscle-8
- <Package Folder>/files/####/muscle-9
- <Package Folder>/files/uSjlSyHFa
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_scene_global.xml
- <Package Folder>/shared_prefs/<Package>_scene_global.xml.bak
- <Package Folder>/shared_prefs/<Package>_shell_dlsdk_reflux_global.xml
- <Package Folder>/shared_prefs/<Package>_shell_scenerydispatcher...ml.bak
- <Package Folder>/shared_prefs/<Package>_shell_scenerydispatcher...te.xml
- <Package Folder>/shared_prefs/<Package>_shell_scenerydispatcher_global.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_grid.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_grid.xml.bak
- <Package Folder>/shared_prefs/<Package>ad_unlock.xml
- <Package Folder>/shared_prefs/DianxinDXB.xml
- <Package Folder>/shared_prefs/DuSwipeSharedPref.xml
- <Package Folder>/shared_prefs/DuSwipeSharedPref.xml.bak
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/IPLPrefStorage.xml
- <Package Folder>/shared_prefs/IPLPrefStorage.xml.bak
- <Package Folder>/shared_prefs/PePref.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/_duscene_module_prefs.xml
- <Package Folder>/shared_prefs/_search_prefs.xml
- <Package Folder>/shared_prefs/_search_prefs.xml.bak
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak (deleted)
- <Package Folder>/shared_prefs/ad_trans_sp.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/batsdk_app_life.xml
- <Package Folder>/shared_prefs/batsdk_crash_switch.xml
- <Package Folder>/shared_prefs/batsdk_user_info.xml
- <Package Folder>/shared_prefs/charging_configs_sp.xml
- <Package Folder>/shared_prefs/charging_configs_sp.xml.bak
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences...GS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/d.xml
- <Package Folder>/shared_prefs/facebook_deeplink.xml
- <Package Folder>/shared_prefs/global_config.xml
- <Package Folder>/shared_prefs/global_config.xml.bak
- <Package Folder>/shared_prefs/h.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/icon_change_config.xml
- <Package Folder>/shared_prefs/inner_pop_dispatcher.xml
- <Package Folder>/shared_prefs/ls_sp_date.xml
- <Package Folder>/shared_prefs/ls_sp_date.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/one_key_makeup.xml
- <Package Folder>/shared_prefs/outer_ad_data_pipe.xml
- <Package Folder>/shared_prefs/outer_ad_data_pipe.xml.bak
- <Package Folder>/shared_prefs/outer_ads_limit_config.xml
- <Package Folder>/shared_prefs/stateStorage.xml
- <Package Folder>/shared_prefs/time_strategy.xml
- <Package Folder>/shared_prefs/time_strategy.xml.bak
- <Package Folder>/shared_prefs/utils.xml
- <SD-Card>/.userReturn
- <SD-Card>/dianxin/####/-1467411402.tmp
- <SD-Card>/dianxin/####/-2012902702.tmp
- <SD-Card>/dianxin/####/-2073702348.tmp
- <SD-Card>/dianxin/####/-39943912
- <SD-Card>/dianxin/####/-40867433.tmp
- <SD-Card>/dianxin/####/-41790954
- <SD-Card>/dianxin/####/-42714475.tmp
- <SD-Card>/dianxin/####/-43637996.tmp
- <SD-Card>/dianxin/####/-44561517.tmp
- <SD-Card>/dianxin/####/-45485038.tmp
- <SD-Card>/dianxin/####/-46408559.tmp
- <SD-Card>/dianxin/####/-47332080
- <SD-Card>/dianxin/####/-945655832.tmp
- <SD-Card>/dianxin/####/76eafb86c8f911b6abe13227ac242d3c.0
- <SD-Card>/dianxin/####/journal
- <SD-Card>/dianxin/####/journal (deleted)
- <SD-Card>/dianxin/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk2/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
- logcat -v time
- top -n 1
Загружает динамические библиотеки:
- acceleratecoreproxy
- idl_face_license
- libacceleratecoreproxy
- uSjlSyHFa
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- RSA
- RSA-NONE-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
