Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) r####.adsna####.com:80
- TCP(HTTP/1.1) m.addthis####.com:80
- TCP(HTTP/1.1) mbs.ldgagaw####.com:80
- TCP(HTTP/1.1) st####.adsna####.com:80
- TCP(HTTP/1.1) s7.add####.com:80
- TCP(HTTP/1.1) xianxia####.di####.com:80
- TCP(HTTP/1.1) m.xianxia####.net:80
- TCP(HTTP/1.1) m####.disqu####.com:80
- TCP(HTTP/1.1) api.adsna####.com:80
- TCP(HTTP/1.1) c####.jq####.com:80
- TCP(HTTP/1.1) verak####.com:80
- TCP(HTTP/1.1) disqu####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) s####.srv.stacka####.com:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ap####.mobi:80
- TCP(HTTP/1.1) www.xianxia####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) refe####.di####.com:443
- TCP(TLS/1.0) c.disqu####.com:443
- TCP(TLS/1.0) a.disqu####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) di####.com:443
- TCP(TLS/1.0) btt####.com:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) xianxia####.di####.com:443
- TCP(TLS/1.0) www.story####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) r####.adsna####.com:443
- TCP(TLS/1.0) s####.outb####.com:443
Запросы DNS:
- a####.google####.com
- a####.u####.com
- a.disqu####.com
- ap####.mobi
- api.adsna####.com
- btt####.com
- c####.jq####.com
- c.disqu####.com
- di####.com
- digital####.com
- disqu####.com
- googl####.g.doublec####.net
- m####.disqu####.com
- m.add####.com
- m.addthis####.com
- m.xianxia####.net
- mbs.ldgagaw####.com
- offer####.online
- pag####.googles####.com
- r####.adsna####.com
- refe####.di####.com
- s####.outb####.com
- s####.srv.stacka####.com
- s7.add####.com
- st####.adsna####.com
- verak####.com
- www.google-####.com
- www.story####.net
- www.xianxia####.net
- xianxia####.di####.com
Запросы HTTP GET:
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20170918/r20170110/show_ads_impl.js
- st####.adsna####.com/static/js/render.v2.js
- www.google-####.com/analytics.js
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/ads-1988482097.jar
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/-1819277931
- <Package Folder>/files/####/580037954
- <Package Folder>/files/####/63560145
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/engines
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/46bd456abbbf79e43a366cf0575835e0.0.tmp
- <SD-Card>/Android/####/50a4e5b1576b6168e8ed02eed7ddce26.0.tmp
- <SD-Card>/Android/####/5e1b8d3cb9e662fe15da5f77d08d49d8.0.tmp
- <SD-Card>/Android/####/63b6a5eeba8cc1ebb112a6254af30deb.0.tmp
- <SD-Card>/Android/####/80e98a6479b282bfee2fd26e6cf35ee5.0.tmp
- <SD-Card>/Android/####/b0f82f210db1da667a0c1cecdb313f35.0.tmp
- <SD-Card>/Android/####/f518e51136838b80d4fd16931e37673e.0.tmp
- <SD-Card>/Android/####/journal (deleted)
- <SD-Card>/Android/####/journal.bkp (deleted)
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/journal.tmp (deleted)
- <SD-Card>/Download/FrameworkList.xml
- <SD-Card>/Download/WinFXList.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/files/engines
- ps engines
- sh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
