Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) r####.adsna####.com:80
- TCP(HTTP/1.1) www.a####.com:80
- TCP(HTTP/1.1) mbs.ldgagaw####.com:80
- TCP(HTTP/1.1) g.geo####.com:80
- TCP(HTTP/1.1) q####.g####.gdn:80
- TCP(HTTP/1.1) cm.g.doublec####.net:80
- TCP(HTTP/1.1) st####.adsna####.com:80
- TCP(HTTP/1.1) s7.add####.com:80
- TCP(HTTP/1.1) uip.sem####.net:80
- TCP(HTTP/1.1) uip####.traffic####.net:80
- TCP(HTTP/1.1) xianxia####.di####.com:80
- TCP(HTTP/1.1) st####.cl####.com:80
- TCP(HTTP/1.1) t####.blu####.com.####.net:80
- TCP(HTTP/1.1) m.addthis####.com:80
- TCP(HTTP/1.1) m.xianxia####.net:80
- TCP(HTTP/1.1) www.traktra####.com:80
- TCP(HTTP/1.1) m####.disqu####.com:80
- TCP(HTTP/1.1) bis.cl####.com:80
- TCP(HTTP/1.1) api.adsna####.com:80
- TCP(HTTP/1.1) a####.adsbt####.com:80
- TCP(HTTP/1.1) inven####.cl####.com:80
- TCP(HTTP/1.1) vhost####.t####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) verak####.com:80
- TCP(HTTP/1.1) disqu####.com:80
- TCP(HTTP/1.1) r####.f####.com.####.net:80
- TCP(HTTP/1.1) ald####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) bevo-eu####.adsna####.com:80
- TCP(HTTP/1.1) www.xianxia####.net:80
- TCP(HTTP/1.1) se####.cl####.com:80
- TCP(HTTP/1.1) as.eu.ang####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) di####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) xianxia####.di####.com:443
- TCP(TLS/1.0) cdn.123sha####.com:443
- TCP(TLS/1.0) p.adsympt####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) refe####.di####.com:443
- TCP(TLS/1.0) game####.com:443
- TCP(TLS/1.0) st####.cl####.com:443
Запросы DNS:
- a####.adsbt####.com
- a####.u####.com
- ald####.com
- api.adsna####.com
- as.eu.ang####.com
- bevo-eu####.adsna####.com
- bis.cl####.com
- cdn.123sha####.com
- cm.g.doublec####.net
- di####.com
- digital####.com
- disqu####.com
- f####.google####.com
- game####.com
- googl####.g.doublec####.net
- ib.a####.com
- inven####.cl####.com
- m####.disqu####.com
- m.add####.com
- m.addthis####.com
- m.xianxia####.net
- mbs.ldgagaw####.com
- offer####.online
- p.adsympt####.com
- pag####.googles####.com
- q####.g####.gdn
- r####.adsna####.com
- r####.f####.com
- refe####.di####.com
- s7.add####.com
- se####.cl####.com
- st####.adsna####.com
- st####.cl####.com
- su.add####.com
- t####.blu####.com
- tape####.t####.com
- uip####.sem####.net
- uip.sem####.net
- verak####.com
- www.a####.com
- www.google-####.com
- www.traktra####.com
- www.xianxia####.net
- xianxia####.di####.com
Запросы HTTP GET:
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- ald####.com/ck_jump?id=cz0x####&__if=####&__type=####&__ref=####
- cm.g.doublec####.net/pixel?google_nid=####&googl####&_####&sInitiator=####
- cm.g.doublec####.net/pixel?google_nid=####&google_cm=####&_sdv=####&sIni...
- m####.disqu####.com/ad-frames/vendor/prebid/dist/prebid.0.26-pre.a8e4b7f...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20170920/r20170110/show_ads_impl.js
- r####.f####.com.####.net/vpaid/ANGUserSyncer-9.js
- st####.adsna####.com/static/js/render.v2.js
- t####.blu####.com.####.net/site/21176?ret=####&limit=####&id=####
- t####.blu####.com.####.net/site/21177?dt=####&r=####&sig=####&bkca=KJ####
- uip####.traffic####.net/dbm/1/info?sType=####&sExtCookieId=####&sInitiat...
- www.a####.com/redirect/index?type=####&to=aHR0####&data=aH####&action=####
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
- www.traktra####.com/?a_aid=####&page=####&PrOwPUr=####&pubid=####&clicki...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ads-1692524826.jar
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/engines
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/preferences.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/46bd456abbbf79e43a366cf0575835e0.0.tmp
- <SD-Card>/Android/####/80e98a6479b282bfee2fd26e6cf35ee5.0.tmp
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.bkp (deleted)
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/FrameworkList.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/files/engines
- ps engines
- sh
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
