Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.465.origin
- Android.Loki.10.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) j.bay####.com:8888
- TCP(HTTP/1.1) fkse####.adfan####.com:8080
- TCP(HTTP/1.1) got.pubna####.net:80
- TCP(HTTP/1.1) t####.ray####.com:80
- TCP(HTTP/1.1) boo####.offerst####.net:80
- TCP(HTTP/1.1) trac####.suma####.com:80
- TCP(HTTP/1.1) aws.smarter####.net:80
- TCP(HTTP/1.1) clinkad####.com:80
- TCP(HTTP/1.1) c####.app####.com:80
- TCP(HTTP/1.1) ads.flyer####.com:80
- TCP(HTTP/1.1) a####.app####.com:80
- TCP(HTTP/1.1) l.a####.com:80
- TCP(HTTP/1.1) a####.flyer####.com:80
- TCP(HTTP/1.1) t####.hxc####.com:80
- TCP(HTTP/1.1) 177f####.cdn.uc####.####.cn:80
- TCP(HTTP/1.1) trac####.shootme####.com:80
- TCP(HTTP/1.1) a####.pubna####.net:80
- TCP(HTTP/1.1) pic.a####.com:80
- TCP(HTTP/1.1) c####.gowa####.com:80
- TCP(HTTP/1.1) api.reac####.com:80
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) api.applike####.info:443
Запросы DNS:
- a####.app####.com
- a####.flyer####.com
- a####.pubna####.net
- ad####.flyer####.com
- ads.flyer####.com
- api.applike####.info
- api.reac####.com
- aws.smarter####.net
- boo####.offerst####.net
- c####.app####.com
- c####.gowa####.com
- c.s####.co
- clinkad####.com
- fkdown####.u####.uc####.####.cn
- fkse####.adfan####.com
- got.pubna####.net
- j.bay####.com
- l.a####.com
- lh3.googleu####.com
- pic.a####.com
- t####.hxc####.com
- t####.ray####.com
- trac####.shootme####.com
- trac####.suma####.com
Запросы HTTP GET:
- a####.app####.com/aff_c?offer_id=####&aff_id=####&aff_sub4=####&aff_clic...
- a####.app####.com/aff_r?offer_id=54264&aff_id=23079&url=https://api.appl...
- ads.flyer####.com/search.php?sid=####&aid=####&udid=####&gaid=####&os=##...
- api.reac####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&cli...
- c####.app####.com/application/click?channelid=####&offerid=####&info=###...
- c####.gowa####.com/click?transaction_id=wadogo_WAdvMinimobAPI_223802_102...
- pic.a####.com/img/fc40801.png
Запросы HTTP POST:
- fkse####.adfan####.com:8080/api/updateCheck.do
- l.a####.com/l.php
- l.a####.com/sal.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_libs/.o.jar
- <Package Folder>/app_libs/.tmp9.jar
- <Package Folder>/app_libs/.tmp_8.log
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/FreeTouch_db-journal
- <Package Folder>/databases/android_random_db1098107278
- <Package Folder>/databases/android_random_db1098107278-journal
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/random_sdkdb_data-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.freetouch.apk
- <Package Folder>/files/.freetouch.raw
- <Package Folder>/files/freetouch.res
- <Package Folder>/game.dex
- <Package Folder>/shared_prefs/NATIVE123456_FILE.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/alias.xml
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/fanking.sdk.xml
- <Package Folder>/shared_prefs/fanking.strategy.sdk.xml
- <Package Folder>/shared_prefs/fksdk_pid_config.xml
- <Package Folder>/shared_prefs/freetouch_update.xml
- <Package Folder>/shared_prefs/market_preferences.xml
- <Package Folder>/shared_prefs/mobnativeads_preferences.xml
- <Package Folder>/shared_prefs/sdk_scl_pid_config.xml
- <Package Folder>/shared_prefs/settingsLog.xml
- <Package Folder>/shared_prefs/track_preferences.xml
- <Package Folder>/shared_prefs/v71.xml
- <Package Folder>/uberhelper/####/ad10050.apk
- <Package Folder>/uberhelper/####/ad10050.tmp
- <Package Folder>/uberhelper/####/fsdk80000.apk
- <SD-Card>/.fankv7/.fankcoas
- <SD-Card>/.googlev7/.libx2coas
- <SD-Card>/.salvia/####/-1523921961.temp
- <SD-Card>/.salvia/####/-172007293.temp
- <SD-Card>/.salvia/####/951224641.temp
- <SD-Card>/.salvia/<Package>
Другие:
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
