Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) co####.du####.com:80
- TCP(HTTP/1.1) api.mo####.sdk.####.com:80
- TCP(HTTP/1.1) duapps-####.gsh####.com:80
- TCP(HTTP/1.1) sts.bat####.net:80
- TCP(HTTP/1.1) p####.sd.du####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) gl####.18wifi####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) s####.appsf####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) syndica####.s####.y####.net:443
- TCP(TLS/1.0) c####.b####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) t.appsf####.com:443
Запросы DNS:
- api.mo####.sdk.####.com
- c####.b####.com
- co####.du####.com
- ev####.appsf####.com
- f####.sd.du####.com
- g####.face####.com
- g####.t####.net
- gl####.18wifi####.com
- nrc.sd.du####.com
- over####.j####.com
- p####.sd.du####.com
- pag####.googles####.com
- rts.mo####.sdk.####.com
- s####.appsf####.com
- ssl.gst####.com
- sts.bat####.net
- syndica####.s####.y####.net
- t.appsf####.com
- u####.bat####.net
- www.go####.com
- www.gst####.com
Запросы HTTP GET:
- api.mo####.sdk.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&ven...
- api.mo####.sdk.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&ve...
- api.mo####.sdk.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####...
- api.mo####.sdk.####.com/get?model=####&signmd5=####&op=####&vendor=####&...
- co####.du####.com/cf//integral/config?model=####&signmd5=####&vendor=###...
- co####.du####.com/cf//materialGroup?model=####&signmd5=####&op=####&vend...
- co####.du####.com/cf//materials?model=####&signmd5=####&op=####&vendor=#...
- co####.du####.com/cf//project?model=####&signmd5=####&op=####&vendor=###...
- duapps-####.gsh####.com/prod/upload/adunion/images/0ae/700_488_53acb4897...
- duapps-####.gsh####.com/prod/upload/adunion/images/13f/80_80_d6ee65d94d7...
- duapps-####.gsh####.com/prod/upload/adunion/images/14e/80_80_bf6825f9746...
- duapps-####.gsh####.com/prod/upload/adunion/images/4b9/80_80_65c39e7ac33...
- duapps-####.gsh####.com/prod/upload/adunion/images/5df/80_80_60b7612708f...
- duapps-####.gsh####.com/prod/upload/adunion/images/7e2/80_80_2f085298e91...
- duapps-####.gsh####.com/prod/upload/adunion/images/8b6/80_80_ff3b83de0f5...
- duapps-####.gsh####.com/prod/upload/adunion/images/b10/80_80_620ff5e2e25...
- duapps-####.gsh####.com/prod/upload/adunion/images/b9a/80_80_b45e14e855c...
- duapps-####.gsh####.com/prod/upload/adunion/images/baa/80_80_f4dee87706f...
- duapps-####.gsh####.com/prod/upload/adunion/images/bc1/80_80_9aa382f88f5...
- duapps-####.gsh####.com/prod/upload/adunion/images/c1a/80_80_41131de747a...
- duapps-####.gsh####.com/prod/upload/adunion/images/c73/80_80_1a1fa74720e...
- duapps-####.gsh####.com/prod/upload/adunion/images/d56/80_80_728e6b13fa2...
- duapps-####.gsh####.com/prod/upload/adunion/images/e8a/80_80_76be876520a...
- duapps-####.gsh####.com/prod/upload/adunion/images/f26/80_80_2c4d98aa517...
- duapps-####.gsh####.com/prod/upload/adunion/images/fb8/80_80_5a5fe3dd502...
- p####.sd.du####.com/feedback/notify?model=####&signmd5=####&op=####&vend...
- sts.bat####.net/log?partner_id=####&p_name=####&aid=####&local=####&time...
Запросы HTTP POST:
- api.mo####.sdk.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sd...
- co####.du####.com/appLock/getConf?model=####&signmd5=####&op=####&vendor...
- co####.du####.com/cf//center/consume?tk=nb2N####&model=####&signmd5=####...
- co####.du####.com/cf//integral/get?tk=nb2N####&model=####&signmd5=####&v...
- p####.sd.du####.com/api/data?token=####&tk=nb2N####&sv=####
- p####.sd.du####.com/api/tokens?tk=nb2N####&sv=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/app_app_apk/dxbs.dat.jar
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code_cache/####/<Package>-1.apk.classes1430195690.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes420214807.zip
- <Package Folder>/databases/<Package>_cms.db-journal
- <Package Folder>/databases/appPackageName.db
- <Package Folder>/databases/appPackageName.db-journal
- <Package Folder>/databases/bat_statistics.db-journal
- <Package Folder>/databases/batterycurve.db-journal
- <Package Folder>/databases/d-journal
- <Package Folder>/databases/dufamily_cache.db-journal
- <Package Folder>/databases/duresultcard_image.db-journal
- <Package Folder>/databases/duscene_mobula.db-journal
- <Package Folder>/databases/dx_chargings.db-journal
- <Package Folder>/databases/emergency.sp-journal
- <Package Folder>/databases/i-journal
- <Package Folder>/databases/integral.db-journal
- <Package Folder>/databases/notify_items.sp-journal
- <Package Folder>/databases/scenery_app_info-journal
- <Package Folder>/databases/scenery_games_from_server.db-journal
- <Package Folder>/databases/scenery_games_name.db-journal
- <Package Folder>/databases/sk
- <Package Folder>/databases/sk-journal
- <Package Folder>/databases/toolbox.db-journal
- <Package Folder>/databases/toolbox_cache.db-journal
- <Package Folder>/databases/toolbox_ts.db-journal
- <Package Folder>/databases/z
- <Package Folder>/databases/z-journal
- <Package Folder>/files/####/<Package>-1.apk.classes-1219153854.zip
- <Package Folder>/files/####/<Package>-1.apk.classes-1663469496.zip
- <Package Folder>/files/AppEventsLogger.persistedsessioninfo
- <Package Folder>/files/IoRNIqAZw
- <Package Folder>/files/skin_mgr
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_grid.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_grid.xml.bak
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_global.xml
- <Package Folder>/shared_prefs/<Package>_sp_file_scenery_private.xml
- <Package Folder>/shared_prefs/AppWhiteList.xml
- <Package Folder>/shared_prefs/ChargingConfig.xml
- <Package Folder>/shared_prefs/DianxinDXB.xml
- <Package Folder>/shared_prefs/DuSwipeSharedPref.xml
- <Package Folder>/shared_prefs/RootRequestTimeRecord.xml
- <Package Folder>/shared_prefs/SettingsConfig.xml
- <Package Folder>/shared_prefs/TryTimeRecord.xml
- <Package Folder>/shared_prefs/_common_toolbox_coin_config.xml
- <Package Folder>/shared_prefs/_duf_prefs.xml
- <Package Folder>/shared_prefs/_duscene_module_prefs.xml
- <Package Folder>/shared_prefs/_search_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
- <Package Folder>/shared_prefs/ad_count_limit.xml
- <Package Folder>/shared_prefs/app_actions.xml
- <Package Folder>/shared_prefs/app_config.xml
- <Package Folder>/shared_prefs/app_lock_global_config.xml
- <Package Folder>/shared_prefs/app_urgentnotice.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/bt_sp.xml
- <Package Folder>/shared_prefs/charging_configs_sp.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/crab_app_life.xml
- <Package Folder>/shared_prefs/crab_crash_switch.xml
- <Package Folder>/shared_prefs/crab_user_info.xml
- <Package Folder>/shared_prefs/d.xml
- <Package Folder>/shared_prefs/front_scene.xml
- <Package Folder>/shared_prefs/global_config.xml
- <Package Folder>/shared_prefs/h.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/landing_page_data.xml
- <Package Folder>/shared_prefs/lazy_global_config.xml
- <Package Folder>/shared_prefs/ls_sp_date.xml
- <Package Folder>/shared_prefs/mode_settings.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/nettimes.xml
- <Package Folder>/shared_prefs/performace_monitor.xml
- <Package Folder>/shared_prefs/rt.xml
- <Package Folder>/shared_prefs/sdk_gmk_sp.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_settings.xml
- <Package Folder>/shared_prefs/smart_settings.xml
- <Package Folder>/shared_prefs/sp_file_card_private.xml
- <Package Folder>/shared_prefs/time_strategy.xml
- <Package Folder>/shared_prefs/utils.xml
- <Package Folder>/shared_prefs/video_pref_def.xml
- <Package Folder>/shared_prefs/widget_config.xml
- <SD-Card>/7da43077b485d258fb4316fa17695c13/####/3116083da4e2cae...59c1.0
- <SD-Card>/7da43077b485d258fb4316fa17695c13/####/journal
- <SD-Card>/7da43077b485d258fb4316fa17695c13/####/journal.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/dianxin/####/1460086758.tmp
- <SD-Card>/dianxin/####/journal (deleted)
- <SD-Card>/dianxin/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk2/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
Загружает динамические библиотеки:
- IoRNIqAZw
- acceleratecoreproxy
- yibawifisdk
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
