Техническая информация
Вредоносные функции:
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ab81341####.pro####.y####.####.net:80
- TCP(HTTP/1.1) ac20291####.pro####.c####.####.net:80
- TCP(HTTP/1.1) acc####.khabar####.com:80
- TCP(HTTP/1.1) cdn.khabar####.com:80
- TCP(HTTP/1.1) www.khabar####.com:80
- TCP(HTTP/1.1) cloudfr####.amazo####.com:80
- TCP(HTTP/1.1) wea####.khabar####.com:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) acc####.khabar####.com:443
- TCP(TLS/1.0) d31qbv1####.cloudf####.net:443
- TCP(TLS/1.0) onesi####.com:443
- TCP(TLS/1.0) wea####.khabar####.com:443
Запросы DNS:
- ab81341####.pro####.y####.####.net
- ac20291####.pro####.c####.####.net
- acc####.khabar####.com
- cdn.khabar####.com
- cloudfr####.amazo####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- onesi####.com
- wea####.khabar####.com
- www.google-####.com
- www.khabar####.com
Запросы HTTP GET:
- cdn.khabar####.com/2254918
- cdn.khabar####.com/2254918/خودکشی-نافرجام-قاتل-آتنا
- cdn.khabar####.com/Api/V1/settings/all
- cdn.khabar####.com/api/v2/sp/pagevisit
- cdn.khabar####.com/images/media/16446.jpg
- cdn.khabar####.com/images/media/16447.jpg
- cdn.khabar####.com/images/media/16448.jpg
- cdn.khabar####.com/images/media/16449.jpg
- cdn.khabar####.com/images/media/16450.jpg
- cdn.khabar####.com/images/media/16451.jpg
- cdn.khabar####.com/wwwroot/content/fonts/iranSans/ttf/IRANSansWeb_FaNum....
- cdn.khabar####.com/wwwroot/content/img/logo/icon-text.png
- cdn.khabar####.com/wwwroot/lib/jquery-sweetalert/jquery-sweetalert.min.css
- cdn.khabar####.com/wwwroot/output/app.min.js?v=####
- cdn.khabar####.com/wwwroot/output/lib.min.js?v=####
- cdn.khabar####.com/wwwroot/output/style.min.css?v=####
- cdn.khabar####.com/wwwroot/template/shared/layout.html?v=####
- cloudfr####.amazo####.com/x.png
Запросы HTTP POST:
- cdn.khabar####.com/api/V1/logger/event
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/2VXQu1f_bNJaR7EdvJSjYVBBpDQ.651410364.tmp
- <Package Folder>/cache/####/FgaTHY0aIERQ3E2w2f-WscAogig.1971053858.tmp
- <Package Folder>/cache/####/GwW56FNUWiu2z9DCaCBv72tsHMQ.-2143072707.tmp
- <Package Folder>/cache/####/QzG54cj7w2IxATXuRptid_dIzHE.283156296.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/fZ1XiSA1aZuu0rXItoB02E8prHE.-1003125511.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/wyBj-4XPcgo2Ccig4tEJDmseLVs.-48104318.tmp
- <Package Folder>/databases/OneSignal.db-journal
- <Package Folder>/databases/sugar_example.db
- <Package Folder>/databases/sugar_example.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/OneSignal.xml
- <Package Folder>/shared_prefs/material_showcaseview_prefs.xml
- <Package Folder>/shared_prefs/myprefs.xml
- <Package Folder>/shared_prefs/myprefs.xml.bak
Другие:
Загружает динамические библиотеки:
- imagepipeline
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
