Android.Packed.33119

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Click.234
Android.RemoteCode.88.origin
Android.Xiny.202.origin
Android.Xiny.72.origin
Android.Xiny.73.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) smart####.google####.com:80
TCP(HTTP/1.1) vi####.ddf####.com:80
TCP(HTTP/1.1) r####.adsb####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) www.4g####.net:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) api.pings####.com:80
TCP(HTTP/1.1) thiscli####.com:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) t####.confirm####.online:80
TCP(HTTP/1.1) 4####.33.37.240:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) p####.everest####.net:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) d####.a####.com:443
TCP(TLS/1.0) c####.cloudf####.com:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) fcm####.go####.com:443
TCP(TLS/1.0) rtb.o####.net:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) p####.rubicon####.com:443
TCP(TLS/1.0) p4-fv3u####.me####.gst####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) fcm####.you####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) ssum####.casalem####.com.####.net:443
TCP(TLS/1.0) akamai-####.quants####.com.####.net:443
TCP(TLS/1.0) cm.g.doublec####.net:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) digital####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) c####.jq####.com:443
TCP(TLS/1.0) odr.moo####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) s####.search####.spotxch####.####.net:443
TCP(TLS/1.0) g.geo####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) s####.adgi####.com:443

Запросы DNS:

adser####.go####.com
adser####.go####.nl
api.bi####.com
api.ki####.com
api.pings####.com
c####.cloudf####.com
c####.jq####.com
cm.g.doublec####.net
cms.quants####.com
d.a####.com
digital####.com
f####.google####.com
f####.gst####.com
fcm####.go####.com
fcm####.you####.com
googl####.g.doublec####.net
ib.a####.com
ilv####.com
int.d####.s####.####.cn
lh3.googleu####.com
mt####.go####.com
odr.moo####.com
p####.everest####.net
p####.rubicon####.com
p4-fv3u####.me####.gst####.com
pag####.googles####.com
rtb.o####.net
s####.adgi####.com
s####.g.doublec####.net
s####.se####.spotxch####.com
sconten####.xx.f####.net
serv####.m####.com
smart####.google####.com
ssum####.casalem####.com
st####.xx.f####.net
t####.confirm####.online
thiscli####.com
tpc.googles####.com
vi####.ddf####.com
www.4g####.net
www.cu####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com
www.koapk####.com
www.okyes####.com
www.technol####.co.uk
www.technol####.net
www.trac####.site
www.zfr####.com

Запросы HTTP GET:

api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
pag####.googles####.com/pagead/gen_204?id=ia_nat&e=rej&napr=n&url=http:/...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171025/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171025/r20170110/show_ads_impl.js
r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
serv####.m####.com/119987?t=0.03296036785468459&ref=http://www.technolog...
serv####.m####.com/119987?t=0.30638706847094&ref=http://www.technologycr...
serv####.m####.com/119987?t=0.33966727182269096&ref=&lu=http://www.techn...
serv####.m####.com/119987?t=0.5635419220197946&ref=http://www.technology...
serv####.m####.com/119987?t=0.819832231849432&ref=http://www.technologyc...
serv####.m####.com/119987?t=0.8712215037085116&ref=&lu=http://www.techno...
serv####.m####.com/119987?t=0.9656730957794935&ref=&lu=http://www.techno...
smart####.google####.com/?utm_medium=####&utm_campaign=####&1=####&cid=#...
smart####.google####.com/?utm_term=####&clickverify=####&utm_content=####
smart####.google####.com/proc.php?39d9894####
t####.confirm####.online/?utm_medium=####&utm_campaign=####&c2=####&c3=#...
t####.confirm####.online/?utm_term=####&clickverify=####&utm_content=####
t####.confirm####.online/proc.php?3bb6dcd####
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
www.4g####.net/ad/adu?gffw=####&frrw=####&dlkvv=####&wdazz=####&fkk9ll=#...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...

Запросы HTTP POST:

api.bi####.com/un
vi####.ddf####.com/api/o
vi####.ddf####.com/api/va
www.4g####.net/ad/adc?gffw=####&frrw=####&dlkvv=####&wdazz=####&fkk9ll=#...
www.koapk####.com:8081/sm/sr/ku/ky
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_DEX_OPT/38605465.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/f_00003f
<Package Folder>/cache/####/f_000040
<Package Folder>/cache/####/f_000041
<Package Folder>/cache/####/f_000042
<Package Folder>/cache/####/f_000043
<Package Folder>/cache/####/f_000044
<Package Folder>/cache/####/f_000045
<Package Folder>/cache/####/f_000046
<Package Folder>/cache/####/f_000047
<Package Folder>/cache/####/f_000048
<Package Folder>/cache/####/f_000049
<Package Folder>/cache/####/f_00004a
<Package Folder>/cache/####/f_00004b
<Package Folder>/cache/####/f_00004c
<Package Folder>/cache/####/f_00004d
<Package Folder>/cache/####/f_00004e
<Package Folder>/cache/####/f_00004f
<Package Folder>/cache/####/f_000050
<Package Folder>/cache/####/f_000051
<Package Folder>/cache/####/f_000052
<Package Folder>/cache/####/f_000053
<Package Folder>/cache/####/f_000054
<Package Folder>/cache/####/f_000055
<Package Folder>/cache/####/f_000056
<Package Folder>/cache/####/f_000057
<Package Folder>/cache/####/f_000058
<Package Folder>/cache/####/f_000059
<Package Folder>/cache/####/f_00005a
<Package Folder>/cache/####/f_00005b
<Package Folder>/cache/####/f_00005c
<Package Folder>/cache/####/f_00005d
<Package Folder>/cache/####/f_00005e
<Package Folder>/cache/####/f_00005f
<Package Folder>/cache/####/f_000060
<Package Folder>/cache/####/f_000061
<Package Folder>/cache/####/f_000062
<Package Folder>/cache/####/f_000063
<Package Folder>/cache/####/f_000064
<Package Folder>/cache/####/f_000065
<Package Folder>/cache/####/f_000066
<Package Folder>/cache/####/f_000067
<Package Folder>/cache/####/f_000068
<Package Folder>/cache/####/f_000069
<Package Folder>/cache/####/f_00006a
<Package Folder>/cache/####/f_00006b
<Package Folder>/cache/####/f_00006c
<Package Folder>/cache/####/f_00006d
<Package Folder>/cache/####/f_00006e
<Package Folder>/cache/####/f_00006f
<Package Folder>/cache/####/f_000070
<Package Folder>/cache/####/f_000071
<Package Folder>/cache/####/f_000072
<Package Folder>/cache/####/f_000073
<Package Folder>/cache/####/f_000074
<Package Folder>/cache/####/f_000075
<Package Folder>/cache/####/f_000076
<Package Folder>/cache/####/f_000077
<Package Folder>/cache/####/f_000078
<Package Folder>/cache/####/f_000079
<Package Folder>/cache/####/f_00007a
<Package Folder>/cache/####/f_00007b
<Package Folder>/cache/####/f_00007c
<Package Folder>/cache/####/f_00007d
<Package Folder>/cache/####/f_00007e
<Package Folder>/cache/####/f_00007f
<Package Folder>/cache/####/f_000080
<Package Folder>/cache/####/f_000081
<Package Folder>/cache/####/f_000082
<Package Folder>/cache/####/f_000083
<Package Folder>/cache/####/f_000084
<Package Folder>/cache/####/f_000085
<Package Folder>/cache/####/f_000086
<Package Folder>/cache/####/f_000087
<Package Folder>/cache/####/f_000088
<Package Folder>/cache/####/f_000089
<Package Folder>/cache/####/f_00008a
<Package Folder>/cache/####/f_00008b
<Package Folder>/cache/####/f_00008c
<Package Folder>/cache/####/f_00008d
<Package Folder>/cache/####/f_00008e
<Package Folder>/cache/####/f_00008f
<Package Folder>/cache/####/f_000090
<Package Folder>/cache/####/f_000091
<Package Folder>/cache/####/f_000092
<Package Folder>/cache/####/f_000093
<Package Folder>/cache/####/f_000094
<Package Folder>/cache/####/f_000095
<Package Folder>/cache/####/f_000096
<Package Folder>/cache/####/f_000097
<Package Folder>/cache/####/f_000098
<Package Folder>/cache/####/f_000099
<Package Folder>/cache/####/f_00009a
<Package Folder>/cache/####/f_00009b
<Package Folder>/cache/####/f_00009c
<Package Folder>/cache/####/f_00009d
<Package Folder>/cache/####/f_00009e
<Package Folder>/cache/####/f_00009f
<Package Folder>/cache/####/f_0000a0
<Package Folder>/cache/####/f_0000a1
<Package Folder>/cache/####/f_0000a2
<Package Folder>/cache/####/f_0000a3
<Package Folder>/cache/####/f_0000a4
<Package Folder>/cache/####/f_0000a5
<Package Folder>/cache/####/f_0000a6
<Package Folder>/cache/####/f_0000a7
<Package Folder>/cache/####/f_0000a8
<Package Folder>/cache/####/f_0000a9
<Package Folder>/cache/####/f_0000aa
<Package Folder>/cache/####/f_0000ab
<Package Folder>/cache/####/f_0000ac
<Package Folder>/cache/####/f_0000ad
<Package Folder>/cache/####/f_0000ae
<Package Folder>/cache/####/f_0000af
<Package Folder>/cache/####/f_0000b0
<Package Folder>/cache/####/f_0000b1
<Package Folder>/cache/####/f_0000b2
<Package Folder>/cache/####/f_0000b3
<Package Folder>/cache/####/f_0000b4
<Package Folder>/cache/####/f_0000b5
<Package Folder>/cache/####/f_0000b6
<Package Folder>/cache/####/f_0000b7
<Package Folder>/cache/####/f_0000b8
<Package Folder>/cache/####/f_0000b9
<Package Folder>/cache/####/f_0000ba
<Package Folder>/cache/####/f_0000bb
<Package Folder>/cache/####/f_0000bc
<Package Folder>/cache/####/f_0000bd
<Package Folder>/cache/####/f_0000be
<Package Folder>/cache/####/f_0000bf
<Package Folder>/cache/####/f_0000c0
<Package Folder>/cache/####/f_0000c1
<Package Folder>/cache/####/f_0000c2
<Package Folder>/cache/####/f_0000c3
<Package Folder>/cache/####/f_0000c4
<Package Folder>/cache/####/f_0000c5
<Package Folder>/cache/####/f_0000c6
<Package Folder>/cache/####/f_0000c7
<Package Folder>/cache/####/f_0000c8
<Package Folder>/cache/####/f_0000c9
<Package Folder>/cache/####/f_0000ca
<Package Folder>/cache/####/f_0000cb
<Package Folder>/cache/####/f_0000cc
<Package Folder>/cache/####/f_0000cd
<Package Folder>/cache/####/f_0000ce
<Package Folder>/cache/####/f_0000cf
<Package Folder>/cache/####/f_0000d0
<Package Folder>/cache/####/f_0000d1
<Package Folder>/cache/####/f_0000d2
<Package Folder>/cache/####/f_0000d3
<Package Folder>/cache/####/f_0000d4
<Package Folder>/cache/####/f_0000d5
<Package Folder>/cache/####/f_0000d6
<Package Folder>/cache/####/f_0000d7
<Package Folder>/cache/####/f_0000d8
<Package Folder>/cache/####/f_0000d9
<Package Folder>/cache/####/f_0000da
<Package Folder>/cache/####/f_0000db
<Package Folder>/cache/####/f_0000dc
<Package Folder>/cache/####/index
<Package Folder>/cache/bb.jar
<Package Folder>/com.init.env/####/core_rb0e_hd
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1509331742992.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/netcfg_be0r_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1509331755617.zip
<Package Folder>/databases/####/http_www.technologycraze.co.uk_...ournal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/easv.data-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/38605465.apk
<Package Folder>/files/####/89769580.apk
<Package Folder>/files/####/dk906.data
<Package Folder>/files/####/ja201710271650.data
<Package Folder>/files/201709211650.apk
<Package Folder>/files/DEAB89CE10FEAA11
<Package Folder>/files/SW01.jar
<Package Folder>/files/c201709211650.apk
<Package Folder>/files/d.zip
<Package Folder>/files/dtemp.apk
<Package Folder>/files/ob1.dex
<Package Folder>/files/ob1.zip
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/MobikokCache_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/com.solo.adsdk.preference.optimize.xml
<Package Folder>/shared_prefs/com.solo.adsdk.preference.user.xml
<Package Folder>/shared_prefs/local_storage0.xml
<Package Folder>/shared_prefs/local_storage1.xml
<Package Folder>/shared_prefs/local_storage999.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/sp.xml
<Package Folder>/shared_prefs/t_ini.xml
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/test1509331724565

Другие:

Запускает следующие shell-скрипты:

.kugua
.kugua -c id
c201709211650.apk -p <Package> -c <Package>:yieldformula
cat /sys/class/net/wlan0/address
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 6777 <Package Folder>/files/c201709211650.apk
core_rb0e_hd
core_rb0e_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
sh

Загружает динамические библиотеки:

com.beginning

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней