Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) wac.1####.alph####.net:80
- TCP(HTTP/1.1) cdn-hig####.unit####.uni####.com:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) a.ap####.com:443
- TCP(TLS/1.0) adse####.unit####.uni####.com:443
- TCP(TLS/1.0) auction####.ads.prd.####.com:443
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) cdn.vu####.com.####.net:443
- TCP(TLS/1.0) api.vu####.com.####.net:443
- TCP(TLS/1.0) ipv6-wi####.appl####.com.####.net:443
- TCP(TLS/1.0) im####.google####.com:443
- TCP(TLS/1.0) ma####.dl.sourcef####.net:443
- TCP(TLS/1.0) cdn-hig####.unit####.uni####.com:443
- TCP(TLS/1.0) raw.githubu####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
Запросы DNS:
- a####.u####.com
- a.ap####.com
- a.appl####.com
- adse####.unit####.uni####.com
- api.vu####.com
- app.ad####.com
- auc####.unit####.uni####.com
- cd####.vu####.com
- cdn-hig####.unit####.uni####.com
- co####.unit####.uni####.com
- d.appl####.com
- f####.google####.com
- f####.gst####.com
- g####.co
- g####.face####.com
- googl####.g.doublec####.net
- im####.google####.com
- lh3.googleu####.com
- ma####.dl.sourcef####.net
- raw.githubu####.com
- rt.appl####.com
- tpc.googles####.com
- web####.unit####.uni####.com
- www.google-####.com
Запросы HTTP GET:
- cdn-hig####.unit####.uni####.com/impact/videos/117070/897db1d055ef76c6/2...
- wac.1####.alph####.net//res/p/p6.zip
- wac.1####.alph####.net/res/1/BasketballSports_bjoh5iz7_en_l_1024x500_1.jpg
- wac.1####.alph####.net/res/1/BasketballSports_bjoh5iz7_ic_1.png
- wac.1####.alph####.net/res/1/Infinity_bjoh5iz7_ic_11.png
- wac.1####.alph####.net/res/1/Inifity_bjoh5iz7_en_l_1024x500_1.jpg
- wac.1####.alph####.net/res/1/PinballGo_bjoh5iz7_ic_1.png
- wac.1####.alph####.net/res/1/TowerClashTD_bjoh5iz7_ic_1.jpg
- wac.1####.alph####.net/res/1/TowerClash_bjoh5iz7_en_l_1024x500_1.jpg
- wac.1####.alph####.net/res/1/ZombieCommando_bjoh5iz7_en_l_1024x500_1.jpg
- wac.1####.alph####.net/res/1/ZombieDefense_bjoh5iz7_en_l_1024x500_1.jpg
- wac.1####.alph####.net/res/1/ZombieDefense_bjoh5iz7_ic_1.png.png
- wac.1####.alph####.net/res/1/zombiecommando_bjoh5iz7_ic_1.png.png
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/free.dat.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1470286953684.jar
- <Package Folder>/cache/1470286953684.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/vungle-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/<Package>-1.apk.classes-352376662.zip
- <Package Folder>/files/####/<Package>-1.apk.classes1980838239.zip
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/AdjustAttribution
- <Package Folder>/files/AdjustIoActivityState
- <Package Folder>/files/AdjustIoPackageQueue
- <Package Folder>/files/UnityAdsCache-f4f4bc7d5f1c2be3f552d2e007...cd.mp4
- <Package Folder>/files/UnityAdsStorage-private-data.json
- <Package Folder>/files/UnityAdsStorage-public-data.json
- <Package Folder>/files/UnityAdsTest.txt
- <Package Folder>/files/UnityAdsWebApp.html
- <Package Folder>/files/exid.dat
- <Package Folder>/files/oPsKtELou
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_sdk_opt.xml
- <Package Folder>/shared_prefs/Cocos2dxPrefsFile.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQue...in.xml
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences...GS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/lib_shared_preferences.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/savegame.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.$sys7776876788933/####/button_close.png
- <SD-Card>/.$sys7776876788933/####/morewall.htm
- <SD-Card>/.$sys7776876788933/####/offerwall.htm
- <SD-Card>/.$sys7776876788933/####/taskdetail.htm
- <SD-Card>/.$sys7776876788933/####/template.zip
- <SD-Card>/.$sys7776876788933/08cf9d0fec0b875b367ab4da14f54fe8_temp
- <SD-Card>/.$sys7776876788933/0ace02183347d0f9b443e8c0aa459988_temp
- <SD-Card>/.$sys7776876788933/0eaf2535d708a4c889a1ccc3bf48b5d2_temp
- <SD-Card>/.$sys7776876788933/12e03723eebcc18e2de00bebb5f0b901_temp
- <SD-Card>/.$sys7776876788933/455bfd4c43fc185cf53cd4fd5ae15d13_temp
- <SD-Card>/.$sys7776876788933/7586eb9fd4a270cfa273c0974184b662_temp
- <SD-Card>/.$sys7776876788933/a9a2d27d2c162b297426285702b184a7_temp
- <SD-Card>/.$sys7776876788933/bba8a7d547f69a2867f03d577512a8cd_temp
- <SD-Card>/.$sys7776876788933/cf3d0473a28baa86103f3cb8b3f1f1a2_temp
- <SD-Card>/.$sys7776876788933/ec966ea5c4c5be7b6a64c1cdd0576690_temp
- <SD-Card>/.$sys7776876788933/f49dc8ef0c8555b52885cec0eda77098_temp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/app_icon.jpg
- <SD-Card>/Android/####/app_store.gif
- <SD-Card>/Android/####/download_arrow.png
- <SD-Card>/Android/####/exit_button_light.png
- <SD-Card>/Android/####/exit_button_pressed.png
- <SD-Card>/Android/####/index.html
- <SD-Card>/Android/####/landscape.jpg
- <SD-Card>/Android/####/localVideo.mp4
- <SD-Card>/Android/####/logo.png
- <SD-Card>/Android/####/portrait.jpg
- <SD-Card>/Android/####/postRoll.zip
- <SD-Card>/Android/####/postroll-script.js
- <SD-Card>/Android/####/postroll-style.css
- <SD-Card>/Android/####/privacy_button_extension_light_mode.png
- <SD-Card>/Android/####/privacy_button_light_mode.png
- <SD-Card>/Android/####/star_empty.png
- <SD-Card>/Android/####/star_full.png
- <SD-Card>/Android/####/star_half.png
- <SD-Card>/Android/####/vungle_logo_light.png
Другие:
Загружает динамические библиотеки:
- EpicDefendersTD
- oPsKtELou
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
