Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) cdn-hig####.unit####.uni####.com:80
- TCP(TLS/1.0) en####.f####.com:443
- TCP(TLS/1.0) e.crashly####.com:443
- TCP(TLS/1.0) ser####.f####.com:443
- TCP(TLS/1.0) adse####.unit####.uni####.com:443
- TCP(TLS/1.0) cdn-hig####.unit####.uni####.com:443
- TCP(TLS/1.0) auc####.unit####.uni####.com:443
- TCP(TLS/1.0) rep####.crashly####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) apptra####.spilg####.com:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) l####.chartb####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
Запросы DNS:
- adse####.unit####.uni####.com
- and####.cli####.go####.com
- app.ad####.com
- apptra####.spilg####.com
- auc####.unit####.uni####.com
- cdn-hig####.unit####.uni####.com
- co####.unit####.uni####.com
- e.crashly####.com
- en####.f####.com
- l####.chartb####.com
- rep####.crashly####.com
- ser####.f####.com
- sett####.crashly####.com
- ssl.google-####.com
- web####.unit####.uni####.com
Запросы HTTP GET:
- cdn-hig####.unit####.uni####.com/impact/images/23013/b91c71d286e1b182/co...
- cdn-hig####.unit####.uni####.com/impact/images/23013/d818bf856ea732c9/co...
- cdn-hig####.unit####.uni####.com/impact/videos/23013/5bdae03a7c2af3ce/hi...
- cdn-hig####.unit####.uni####.com/impact/videos/23013/a0ecc6e41f670c36/sh...
- cdn-hig####.unit####.uni####.com/store-icons/8935f81b-3860-4466-87c2-b82...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/OperateNow2.dat.jar
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-15...33.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes260847064.zip
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/5984694E0054-0001-0833-8A5D12077738...s_temp
- <Package Folder>/files/####/5984694E0054-0001-0833-8A5D12077738.cls_temp
- <Package Folder>/files/####/59846953000B-0002-0833-8A5D12077738...s_temp
- <Package Folder>/files/####/598469590055-0001-08AD-8A5D12077738...s_temp
- <Package Folder>/files/####/598469590055-0001-08AD-8A5D12077738.cls_temp
- <Package Folder>/files/####/598469620365-0002-08AD-8A5D12077738...s_temp
- <Package Folder>/files/####/598469630358-0001-090D-8A5D12077738...s_temp
- <Package Folder>/files/####/598469630358-0001-090D-8A5D12077738.cls_temp
- <Package Folder>/files/####/598469750094-0002-090D-8A5D12077738...s_temp
- <Package Folder>/files/####/598469780295-0001-0972-8A5D12077738...on.cls
- <Package Folder>/files/####/598469780295-0001-0972-8A5D12077738...s_temp
- <Package Folder>/files/####/598469780295-0001-0972-8A5D12077738.cls_temp
- <Package Folder>/files/####/5984697F01C4-0002-0972-8A5D12077738...s_temp
- <Package Folder>/files/####/598469850117-0001-09DA-8A5D12077738...s_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/crash_marker
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_165969c1-41ae-413b-9df5-24df975a...12.tap
- <Package Folder>/files/####/sa_165b8d7b-8438-4a87-bfa3-3420c246...64.tap
- <Package Folder>/files/####/sa_191bb06f-a422-40b7-99d1-7951a023...67.tap
- <Package Folder>/files/####/sa_372f7c52-7bde-4236-be24-fa9908ec...04.tap
- <Package Folder>/files/####/sa_a2cd6e40-8a87-4126-8fc5-8fffc411...43.tap
- <Package Folder>/files/####/sa_d030c27f-590b-46e6-9b41-df9d09c7...73.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/AdjustAttribution
- <Package Folder>/files/AdjustIoActivityState
- <Package Folder>/files/AdjustIoPackageQueue
- <Package Folder>/files/UnityAdsCache-30107eb3594ae59acda8ed3665...7f.png
- <Package Folder>/files/UnityAdsCache-82439149df5ad1d260e27490fc...e3.mp4
- <Package Folder>/files/UnityAdsCache-83adc068236ec96994ce9b27bd...b2.mp4
- <Package Folder>/files/UnityAdsCache-8f2272b124980b4946a8331e38...38.jpg
- <Package Folder>/files/UnityAdsCache-ecf85350dbafd4d1dd421b5831...36.jpg
- <Package Folder>/files/UnityAdsStorage-private-data.json
- <Package Folder>/files/UnityAdsStorage-public-data.json
- <Package Folder>/files/UnityAdsTest.txt
- <Package Folder>/files/UnityAdsWebApp.html
- <Package Folder>/files/eYYIhxWFX
- <Package Folder>/files/gaClientId
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/FyberPreferences.xml
- <Package Folder>/shared_prefs/MediationConfigurationNetworkOperation.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answe...gs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics....ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measuremen...leted)
- <Package Folder>/shared_prefs/com.google.android.gms.measuremen...ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.f...ng.xml
- <Package Folder>/shared_prefs/migration.xml
- <Package Folder>/shared_prefs/migration.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/SpilGames/SpilGamesID.txt
Другие:
Загружает динамические библиотеки:
- eYYIhxWFX
- main
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
