Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.RemoteCode.88.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m####.ads####.com:80
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) c####.lab####.com:80
- TCP(HTTP/1.1) thiscli####.com:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) i####.ki####.com:80
- TCP(HTTP/1.1) ilv####.com:80
- TCP(HTTP/1.1) wpc.4####.edgecas####.net:80
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) v1h.amazing####.com:80
- TCP(HTTP/1.1) a####.securel####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) djjcyqv####.cloudf####.net:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) f####.google####.com:443
Запросы DNS:
- 4####.h####.a####.####.net
- a####.securel####.com
- api.bi####.com
- api.ki####.com
- c####.lab####.com
- cdn.securel####.com
- digital####.com
- djjcyqv####.cloudf####.net
- f####.google####.com
- f####.gst####.com
- i####.ki####.com
- ilv####.com
- m####.ads####.com
- t####.bruce####.com
- thiscli####.com
- v1h.amazing####.com
- www.cu####.com
- www.zfr####.com
Запросы HTTP GET:
- a####.securel####.com/t/lj3d155538jgAwkhp1y2c6bqnnb249bA/?subpub=####&s2...
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpES1sd...
- m####.ads####.com/c/69c5e7f9210e673c?tid=####&trafficsource_id=####&toke...
- t####.bruce####.com/ck.php?line_item_id=####&cid=####&site=####&traffics...
- t####.bruce####.com/ck_jump?id=cz0y####&__if=####&__type=####&__ref=####
- v1h.amazing####.com/api/front/coregs/c33a76e943e7b8ee1d0f0aac9d240a22/get
- v1h.amazing####.com/offer/h25d4ljrg2yt1ljrh27tq/?subpub=####&s2=####&aff...
- wpc.4####.edgecas####.net/assets/fonts/myriad-pro/MyriadPro-Bold.ttf
- wpc.4####.edgecas####.net/assets/fonts/myriad-pro/MyriadPro-Light.ttf
- wpc.4####.edgecas####.net/assets/fonts/myriad-pro/MyriadPro-Regular.ttf
- wpc.4####.edgecas####.net/assets/fonts/myriad-pro/MyriadPro-Semibold.ttf
- wpc.4####.edgecas####.net/data/cache-cmp5/86d0a55d6224d49ef687f1eef8c393...
- wpc.4####.edgecas####.net/data/cache-cmp5/ff5c2c5c9dca71dd75b0ab10c2a307...
- wpc.4####.edgecas####.net/media/79217b6df466871557c10bb8b0d2b1fa5414.png
- wpc.4####.edgecas####.net/media/cd0dd7a8f61375e8cac73bc9e73736fa5415.jpg
- www.cu####.com/20170907171543.ExpDex_5.2.1_201709071714.zip
Запросы HTTP POST:
- api.bi####.com/un
- i####.ki####.com/express
- i####.ki####.com/jar
- i####.ki####.com/u
- v1h.amazing####.com/api/session/start?subpub=####&s2=####&affid=####
- v1h.amazing####.com/api/track
- www.zfr####.com/up.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/databases/download_record.db
- <Package Folder>/databases/download_record.db-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/plug_2.jar
- <Package Folder>/files/####/plug_3.jar
- <Package Folder>/files/mobikokJarDecMd5File
- <Package Folder>/files/mobikokJarEntityFile
- <Package Folder>/files/ob1.zip
- <Package Folder>/filesbb.jar
- <Package Folder>/shared_prefs/.xml
- <Package Folder>/shared_prefs/MashupGroupSaleFile.xml
- <Package Folder>/shared_prefs/MobikokConfig.xml
- <Package Folder>/shared_prefs/MobikokConfig.xml.bak
- <Package Folder>/shared_prefs/SspZvPrefers.xml
- <Package Folder>/shared_prefs/cn_rs.xml
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <SD-Card>/DownloadCache/mobikokCacheFileInfos
Другие:
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
