Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v####.ge####.mobi:80
- TCP(HTTP/1.1) cl####.ge####.com:80
- TCP(HTTP/1.1) eventlo####.ge####.com:80
- TCP(HTTP/1.1) ip####.io:80
- TCP(HTTP/1.1) csi.gst####.com:80
- TCP(HTTP/1.1) www.agilein####.com:80
- TCP(HTTP/1.1) www.googlet####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) st####.ho####.com:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) m####.google####.com:80
- TCP(TLS/1.0) www.googlea####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) c####.cloudf####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) gl####.www.link####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) i####.ads.link####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) ne####.bootstr####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) www.bizogra####.com:443
- TCP(TLS/1.0) eu-we####.dc.ads.####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) mix.link####.com:443
- TCP(TLS/1.0) m####.go####.com:443
- TCP(TLS/1.0) sc####.ho####.com:443
- TCP(TLS/1.0) cm.g.doublec####.net:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) www.ge####.com:443
- TCP(TLS/1.0) st####.ge####.com:443
- TCP(TLS/1.0) sjs.bizogra####.com:443
- TCP(TLS/1.0) wild####.l####.com.####.net:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) v####.ho####.com:443
- TCP(TLS/1.0) g.geo####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) dc.ads.link####.com:443
Запросы DNS:
- a####.google####.com
- adser####.go####.com
- adser####.go####.nl
- c####.cloudf####.com
- cl####.ge####.com
- cm.g.doublec####.net
- con####.face####.net
- csi.gst####.com
- dc.ads.link####.com
- eu-we####.dc.ads.####.com
- eventlo####.ge####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- i####.ads.link####.com
- ip####.io
- m####.go####.com
- m####.google####.com
- ne####.bootstr####.com
- pag####.googles####.com
- px.ads.link####.com
- s####.g.doublec####.net
- s####.l####.com
- sc####.ho####.com
- se####.a####.com
- sjs.bizogra####.com
- st####.ge####.com
- st####.ho####.com
- tpc.googles####.com
- v####.ge####.mobi
- v####.ho####.com
- www.agilein####.com
- www.bizogra####.com
- www.face####.com
- www.ge####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlea####.com
- www.googlet####.com
- www.gst####.com
- www.link####.com
Запросы HTTP GET:
- csi.gst####.com/csi?v=####&s=####&v3v=####&action=####&e=####&rt=####
- v####.ge####.mobi/views/mobile/img/logo.png
- www.agilein####.com//wp-content/themes/aton-child/images/icon.svg
- www.agilein####.com/?gjclnt=####
- www.agilein####.com/it-services-christmas-offer/?gclid=####&gjclnt=####
- www.agilein####.com/wp-content/cache/min/1/467ae07dcbf32a81621dc661b4a13...
- www.agilein####.com/wp-content/cache/min/1/849015905d303cf52334ba68677fd...
- www.agilein####.com/wp-content/cache/min/1/9729cad226c7fbabc66ef6b8fba34...
- www.agilein####.com/wp-content/cache/min/1/c14c0b37d92cfba1ad73aaab26b71...
- www.agilein####.com/wp-content/cache/min/1/e4843cc15f51daa4eb8ec2649a45f...
- www.agilein####.com/wp-content/plugins/contact-form-7/images/ajax-loader...
- www.agilein####.com/wp-content/plugins/international-telephone-input-for...
- www.agilein####.com/wp-content/plugins/jquery-validation-for-contact-for...
- www.agilein####.com/wp-content/plugins/js_composer/assets/css/js_compose...
- www.agilein####.com/wp-content/plugins/referrer-input-for-contact-form-7...
- www.agilein####.com/wp-content/plugins/wp-rocket/inc/front/js/lazyload.1...
- www.agilein####.com/wp-content/themes/aton-child/custom.js
- www.agilein####.com/wp-content/themes/aton-child/custom_responsive_style...
- www.agilein####.com/wp-content/themes/aton-child/fonts/Broadway.ttf
- www.agilein####.com/wp-content/themes/aton-child/images/android-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/apple-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/closebtnorange.svg
- www.agilein####.com/wp-content/themes/aton-child/images/ecommerce-tab.png
- www.agilein####.com/wp-content/themes/aton-child/images/file-upload-bg.png
- www.agilein####.com/wp-content/themes/aton-child/images/footer-image.jpg
- www.agilein####.com/wp-content/themes/aton-child/images/html5-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/icon.svg
- www.agilein####.com/wp-content/themes/aton-child/images/magento-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/mob-app-tab.png
- www.agilein####.com/wp-content/themes/aton-child/images/new-testi-bg.png
- www.agilein####.com/wp-content/themes/aton-child/images/offer-bullet-ico...
- www.agilein####.com/wp-content/themes/aton-child/images/offer.png
- www.agilein####.com/wp-content/themes/aton-child/images/php-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/python-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/quote.png
- www.agilein####.com/wp-content/themes/aton-child/images/select-arrow.svg
- www.agilein####.com/wp-content/themes/aton-child/images/share.svg
- www.agilein####.com/wp-content/themes/aton-child/images/tab-icons.png
- www.agilein####.com/wp-content/themes/aton-child/images/trending-tab.png
- www.agilein####.com/wp-content/themes/aton-child/images/ux-ui-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/ux-ul-tab.png
- www.agilein####.com/wp-content/themes/aton-child/images/web-dev-tab-icon...
- www.agilein####.com/wp-content/themes/aton-child/images/windows-bubble.png
- www.agilein####.com/wp-content/themes/aton-child/images/wp-bubble.png
- www.agilein####.com/wp-content/themes/aton/assets/css/dripicons/dripicon...
- www.agilein####.com/wp-content/themes/aton/assets/css/elegant-icons/font...
- www.agilein####.com/wp-content/themes/aton/assets/css/elegant-icons/styl...
- www.agilein####.com/wp-content/themes/aton/assets/css/font-awesome/css/f...
- www.agilein####.com/wp-content/themes/aton/assets/css/font-awesome/fonts...
- www.agilein####.com/wp-content/themes/aton/assets/css/ion-icons/css/ioni...
- www.agilein####.com/wp-content/themes/aton/assets/css/ion-icons/fonts/io...
- www.agilein####.com/wp-content/themes/aton/assets/css/linea-icons/style....
- www.agilein####.com/wp-content/themes/aton/assets/css/modules-responsive...
- www.agilein####.com/wp-content/themes/aton/assets/css/modules.min.css
- www.agilein####.com/wp-content/themes/aton/assets/css/plugins.min.css
- www.agilein####.com/wp-content/themes/aton/assets/css/simple-line-icons/...
- www.agilein####.com/wp-content/themes/aton/assets/css/style_dynamic.css
- www.agilein####.com/wp-content/themes/aton/assets/css/style_dynamic_resp...
- www.agilein####.com/wp-content/themes/aton/assets/js/modules.min.js
- www.agilein####.com/wp-content/themes/aton/assets/js/smoothPageScroll.js
- www.agilein####.com/wp-content/themes/aton/assets/js/third-party.min.js
- www.agilein####.com/wp-content/uploads/2017/01/footer-image.jpg
- www.agilein####.com/wp-content/uploads/2017/01/landing-parallax.jpg?id=#...
- www.agilein####.com/wp-content/uploads/2017/06/agile-logo.png
- www.agilein####.com/wp-content/uploads/2017/07/agile-logo1.png
- www.agilein####.com/wp-content/uploads/2017/10/mobile-development-tab.png
- www.agilein####.com/wp-content/uploads/2017/10/new-home-video-bg-img.png...
- www.agilein####.com/wp-content/uploads/2017/11/offer-banner-image.png
- www.agilein####.com/wp-content/uploads/revslider/main-home-slider/main-h...
- www.agilein####.com/wp-includes/js/jquery/jquery-migrate.min.js
- www.agilein####.com/wp-includes/js/jquery/jquery.js
- www.agilein####.com/wp-includes/js/jquery/ui/core.min.js
- www.agilein####.com/wp-includes/js/jquery/ui/tabs.min.js
- www.agilein####.com/wp-includes/js/jquery/ui/widget.min.js
- www.agilein####.com/wp-includes/js/mediaelement/mediaelement-and-player....
- www.agilein####.com/wp-includes/js/mediaelement/wp-mediaelement.min.js
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=1&_v=j65&a=1868102138&t=pageview&_s=1&dl=h...
- www.google-####.com/collect?v=1&_v=j65&a=42693105&t=adtiming&_s=2&dl=htt...
- www.google-####.com/collect?v=1&_v=j65&a=42693105&t=pageview&_s=1&dl=htt...
- www.google-####.com/collect?v=1&_v=j65&a=453770032&t=pageview&_s=1&dl=ht...
- www.google-####.com/r/collect?v=1&_v=j65&a=1000998414&t=pageview&_s=1&dl...
- www.googlet####.com/a?id=####&cv=####&v=####&n=####&g=####&p=####&l=####...
- www.gst####.com/s/catamaran/v4/5ys9TqpQc9Q6gHqbSox6p43LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/6VjB_uSfn3DZ93IQv58CmI3LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/83WSX3F86qsvj1Z4EI0tQo3LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/Aaag4ccR7Oh_4eai-jbrYI3LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/AsJXcel0VOprDS7k9OVAcwzzZlagSe_blz3aczwf9...
- www.gst####.com/s/catamaran/v4/PpgVtUHUdnBZYNpnzGbSc43LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/a9PlHHnuBWiGGk0TwuFKTo3LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/hFc-HKSsGk6M-psujei1MI3LH2FgLjViKkqswU-xt...
- www.gst####.com/s/catamaran/v4/t_-OVtQ5f4U5rdYNmrStgyZ2oysoEQEeKwjgmXLRn...
- www.gst####.com/s/ptserif/v9/Foydq9xJp--nfYIx2TBz9bjKjXH-9gfYoX3727zLV00...
- www.gst####.com/s/ptserif/v9/QABk9IxT-LFTJ_dQzv7xpAzzZlagSe_blz3aczwf9QY...
- www.gst####.com/s/ptserif/v9/b31S45a_TNgaBApZhTgE6MDdSZkkecOE1hvV7ZHvhyU...
- www.gst####.com/s/ptserif/v9/lyvcXAp_ih3ehVX3UeaIanYhjbSpvc47ee6xR_80Hnw...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/clientokacrehyr.dat.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/index
- <Package Folder>/databases/GetJarDB-journal
- <Package Folder>/databases/GetJarDBEvents-journal
- <Package Folder>/databases/GetJarDBRunning-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/<Package>-1.apk.classes637313062.zip
- <Package Folder>/files/####/<Package>-1.apk.classes893653567.zip
- <Package Folder>/files/QGwHKCARj
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/GetJarClientPrefs.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/timestamp.xml
Другие:
Загружает динамические библиотеки:
- QGwHKCARj
Использует права администратора.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
