Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.465.origin
- Android.DownLoader.478.origin
- Android.Xiny.220.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.info####.me:80
- TCP(HTTP/1.1) serv####.m####.com:80
- TCP(HTTP/1.1) d.billyaf####.com:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) r####.adsb####.com:80
- TCP(HTTP/1.1) www.technol####.co.uk:80
- TCP(HTTP/1.1) char####.com:80
- TCP(HTTP/1.1) a####.hitthe####.mobi:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) f####.cdn.1####.com:80
- TCP(HTTP/1.1) thiscli####.com:80
- TCP(HTTP/1.1) t####.cpa.offers####.com:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) go.redirec####.com:80
- TCP(HTTP/1.1) dpl.b####.com:80
- TCP(HTTP/1.1) api.mob####.b####.com:80
- TCP(HTTP/1.1) c.px####.com:80
- TCP(HTTP/1.1) l.a####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) real####.icec####.org:80
- TCP(HTTP/1.1) u####.b####.com:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) sl####.1####.com:8111
- TCP(HTTP/1.1) tek####.com:80
- TCP(HTTP/1.1) www.bestpho####.mobi:80
- TCP(HTTP/1.1) hy####.com:80
- TCP(HTTP/1.1) pl####.mob####.b####.com:80
- TCP(HTTP/1.1) adse####.hitthe####.mobi:80
- TCP(HTTP/1.1) cdn-hig####.unit####.uni####.com:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) pic.a####.com:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) cpgnrot####.com:80
- TCP(HTTP/1.1) ak.icec####.org:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) adse####.unit####.uni####.com:443
- TCP(TLS/1.0) cdn-hig####.unit####.uni####.com:443
- TCP(TLS/1.0) normale####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) smarto####.site:443
- TCP(TLS/1.0) auc####.unit####.uni####.com:443
- TCP(TLS/1.0) applovi####.edg####.net:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) ipv6-wi####.appl####.com.####.net:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) billmsc####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) down####.wild####.appl####.####.net:443
- TCP(TLS/1.0) adser####.go####.com:443
Запросы DNS:
- a####.hitthe####.mobi
- a.appl####.com
- adse####.hitthe####.mobi
- adse####.unit####.uni####.com
- adser####.go####.com
- adser####.go####.nl
- ak.icec####.org
- api.info####.me
- api.mob####.b####.com
- artul####.com
- as####.appl####.com
- auc####.unit####.uni####.com
- billmsc####.com
- c.px####.com
- cdn-hig####.unit####.uni####.com
- char####.com
- co####.unit####.uni####.com
- cpgnrot####.com
- d.appl####.com
- d.billyaf####.com
- digital####.com
- dpl.b####.com
- f####.cdn.1####.com
- f####.google####.com
- f####.gst####.com
- go.redirec####.com
- googl####.g.doublec####.net
- hy####.com
- img.appl####.com
- l.a####.com
- mo.freeind####.com
- na####.sno####.1####.com
- normale####.com
- pag####.googles####.com
- pic.a####.com
- pl####.mob####.b####.com
- r####.appl####.com
- real####.icec####.org
- rt.appl####.com
- s####.mob####.b####.com
- serv####.m####.com
- smarto####.site
- st####.xx.f####.net
- t####.cpa.offers####.com
- tek####.com
- thiscli####.com
- tpc.googles####.com
- u####.b####.com
- web####.unit####.uni####.com
- www.admobim####.com
- www.bestpho####.mobi
- www.face####.com
- www.google-####.com
- www.mmmmmm####.com
- www.technol####.co.uk
- www.trac####.site
Запросы HTTP GET:
- a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
- a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
- a####.hitthe####.mobi/proc.php?2b38d5c####
- api.info####.me/api/s2s/goto?id=####&channel=####&provider=####&appkey=#...
- api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
- cdn-hig####.unit####.uni####.com/impact/images/141091/89a4197f00749ad0/-...
- cdn-hig####.unit####.uni####.com/impact/images/141091/efcf12bcb68cee19/-...
- cdn-hig####.unit####.uni####.com/impact/videos/141091/85d4487ad77dadc7/m...
- cdn-hig####.unit####.uni####.com/store-icons/f801d6e4-879e-45f4-942d-cff...
- dpl.b####.com/M01/01/AE/CvJJDVnmxPCAXoFkABJ8Zroij3g5.4.zip
- hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20171025/r20170110/reactive_library.js
- pag####.googles####.com/pagead/js/r20171025/r20170110/show_ads_impl.js
- pic.a####.com/img/t4963v731.png
- r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
- serv####.m####.com/119987?t=0.781822957098484&ref=&lu=http://www.technol...
- u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
- www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
Запросы HTTP POST:
- api.info####.me/api/ads/connect
- api.info####.me/api/ads/fetch?_s=####
- api.info####.me/api/ads/vas?_s=####&
- l.a####.com/l.php
- l.a####.com/sal.php
- mo.freeind####.com/detail/getOfferListNew?enc=####
- pl####.mob####.b####.com/ad_dex.php
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- sl####.1####.com:8111/native/api/v1/init
- sl####.1####.com:8111/native/api/v1/update
- sl####.1####.com:8111/native/sdk/api/ad/client_action
- sl####.1####.com:8111/native/sdk/api/regclient
- www.mmmmmm####.com/osp/oaen_reg.action
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.mbj/####/classes.zip
- <Package Folder>/app_libs/.atmp9.jar
- <Package Folder>/app_libs/.atmp_8.log
- <Package Folder>/app_osdk/adflash_shell.jar
- <Package Folder>/app_osdk/t.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/index
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/arrkii.native.sdk.db-journal
- <Package Folder>/databases/im.database.ad-journal
- <Package Folder>/databases/my.db
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/UnityAdsCache-06f079160f5ec4e70df30984bd...75.jpg
- <Package Folder>/files/UnityAdsCache-29942d35f11ccc1d3418466a67...79.jpg
- <Package Folder>/files/UnityAdsCache-42c9d75c50a9753a4f8121fae4...51.mp4
- <Package Folder>/files/UnityAdsCache-c7dd67ce9395c88c16b3a43da8...d0.png
- <Package Folder>/files/UnityAdsStorage-private-data.json
- <Package Folder>/files/UnityAdsStorage-public-data.json
- <Package Folder>/files/UnityAdsTest.txt
- <Package Folder>/files/UnityAdsWebApp.html
- <Package Folder>/files/adflashcore.jar
- <Package Folder>/files/google.db
- <Package Folder>/files/t.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml.bak (deleted)
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/shared_prefs/adflash.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/arrkiiad.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak (deleted)
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQue...in.xml
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/hunter_config.xml
- <Package Folder>/shared_prefs/mjsetting.xml
- <Package Folder>/shared_prefs/other_config.xml
- <Package Folder>/shared_prefs/s_sdk_pro_pref.xml
- <Package Folder>/shared_prefs/service_config.xml
- <Package Folder>/shared_prefs/settingsLog.xml
- <Package Folder>/shared_prefs/sp_config.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/shared_prefs/v71.xml
- <SD-Card>/.androidsystem/####/49.x-5.0.4.apk
- <SD-Card>/.androidsystem/####/PlugShareData
- <SD-Card>/.androidsystem/####/files.db
- <SD-Card>/.androidsystem/####/plugxml.xml
- <SD-Card>/.androidsystem/####/syncfiles.db
- <SD-Card>/.androidsystem/Plugin.zip
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1380229154.js
- <SD-Card>/Android/####/68dc506adcbf5a2a75c2a7c4b4fe90711dbc6149...ne.mp4
- <SD-Card>/Android/####/inapp_dev.txt
- <SD-Card>/Android/####/jquery-1.9.1.min.js
- <SD-Card>/Android/####/jquery.knob.js
- <SD-Card>/Android/####/ob13c7a6_572de3cea7226d1c59c2411a4905d7a...e.jpeg
- <SD-Card>/Android/####/ob13c7a6_68a0df3e731bfae30903a7a498bdfd3...e.jpeg
- <SD-Card>/Android/####/sound_off.png
- <SD-Card>/Android/####/sound_on.png
- <SD-Card>/LogN/####/sp
- <SD-Card>/ad_native/2017-10-30.txt
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Загружает динамические библиотеки:
- gdx
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
