Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) r####.adsb####.com:80
- TCP(HTTP/1.1) lp.youwant####.com:80
- TCP(HTTP/1.1) ald####.com:80
- TCP(HTTP/1.1) www.theadga####.com:80
- TCP(HTTP/1.1) go.oclase####.com:80
- TCP(HTTP/1.1) apto####.ru:80
- TCP(HTTP/1.1) t####.nextp####.xyz:80
- TCP(HTTP/1.1) gra####.ho####.com:12080
- TCP(HTTP/1.1) top.prem####.co:80
- TCP(HTTP/1.1) ssl-l####.com:80
- TCP(HTTP/1.1) us-scp####.ali####.com:80
- TCP(HTTP/1.1) tag.re####.net:80
- TCP(HTTP/1.1) st####.ho####.com:80
- TCP(HTTP/1.1) hy####.com:80
- TCP(HTTP/1.1) 4####.click:80
- TCP(HTTP/1.1) horny-g####.com:80
- TCP(HTTP/1.1) del####.com:80
- TCP(HTTP/1.1) avo####.tr####.com:80
- TCP(HTTP/1.1) pub.reachef####.com:80
- TCP(HTTP/1.1) deli####.traffic####.com:80
- TCP(TLS/1.0) st####.ho####.com:443
- TCP(TLS/1.0) djjcyqv####.cloudf####.net:443
- TCP(TLS/1.0) gw.al####.com:443
- TCP(TLS/1.0) m.ali####.com:443
- TCP(TLS/1.0) p####.mm####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) js-a####.newr####.com:443
- TCP(TLS/1.0) us-scp####.ali####.com:443
- TCP(TLS/1.0) sc####.ho####.com:443
- TCP(TLS/1.0) m####.ex####.com:443
- TCP(TLS/1.0) gj.mm####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) despite####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) questio####.com:443
- TCP(TLS/1.0) syndica####.exoc####.com:443
- TCP(TLS/1.0) v####.ho####.com:443
- TCP(TLS/1.0) insi####.ho####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
Запросы DNS:
- 4####.click
- ald####.com
- apto####.ru
- as####.al####.com
- c####.ali####.com
- c####.ali####.com
- d####.tra####.co
- del####.com
- deli####.traffic####.com
- despite####.com
- djjcyqv####.cloudf####.net
- f####.google####.com
- gj.mm####.com
- go.oclase####.com
- gra####.ho####.com
- gw.al####.com
- horny-g####.com
- hy####.com
- img.al####.com
- insi####.ho####.com
- js-a####.newr####.com
- lp.youwant####.com
- m####.ex####.com
- m####.exdy####.com
- m####.exoc####.com
- m.ali####.com
- mt####.go####.com
- offer####.online
- p####.mm####.com
- pub.reachef####.com
- questio####.com
- s####.al####.com
- s####.al####.com
- sc####.ho####.com
- secure####.com
- ssl-l####.com
- ssl.google-####.com
- st####.ho####.com
- t####.bruce####.com
- t####.nextp####.xyz
- tag.re####.net
- top.prem####.co
- u.al####.com
- v####.ho####.com
- www.go####.com
- www.theadga####.com
- www.trac####.site
- y####.instagi####.com
- y####.instagi####.com
Запросы HTTP GET:
- 4####.click/llexit/?country=####&networkid=####&publisher=####&service=#...
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- ald####.com/ck_jump?id=cz05####&__if=####&__type=####
- apto####.ru/1/m8kxsR?utm_source=####&utm_term=####
- avo####.tr####.com/click/5PK1yfzXxz?c1=####&c2=####&c3=####&c4=####&c5=#...
- avo####.tr####.com/main/d.php?s=1&link=http://top.premiumz.co/?utm_mediu...
- del####.com/?r=####&zoneid=####&pbk3=####&empty=####&uuid=####&ad_scheme...
- del####.com/afu.php?zoneid=####
- deli####.traffic####.com/retargeting.php?id=####
- go.oclase####.com/afu.php?zoneid=####
- horny-g####.com/?u=####&o=####
- horny-g####.com/cookie/js.cookie.js
- horny-g####.com/media/bb.js
- horny-g####.com/media/dating/toon3/css/style.css
- horny-g####.com/media/dating/toon3/fonts/QuattrocentoSans.ttf
- horny-g####.com/media/dating/toon3/fonts/QuattrocentoSansBold.ttf
- horny-g####.com/media/dating/toon3/images/age1_o.jpg
- horny-g####.com/media/dating/toon3/images/age2_o.jpg
- horny-g####.com/media/dating/toon3/images/age3_o.jpg
- horny-g####.com/media/dating/toon3/images/age4_o.jpg
- horny-g####.com/media/dating/toon3/images/age5_o.jpg
- horny-g####.com/media/dating/toon3/images/body1_o.jpg
- horny-g####.com/media/dating/toon3/images/body2_o.jpg
- horny-g####.com/media/dating/toon3/images/body3_o.jpg
- horny-g####.com/media/dating/toon3/images/body4_o.jpg
- horny-g####.com/media/dating/toon3/images/body5_o.jpg
- horny-g####.com/media/dating/toon3/images/girl.jpg
- horny-g####.com/media/dating/toon3/images/relations1_o.jpg
- horny-g####.com/media/dating/toon3/images/relations2_o.jpg
- horny-g####.com/media/dating/toon3/images/relations3_o.jpg
- horny-g####.com/media/dating/toon3/images/relations4_o.jpg
- horny-g####.com/media/dating/toon3/images/relations5_o.jpg
- horny-g####.com/media/dating/toon3/js/jquery-1.11.1.min.js
- horny-g####.com/media/dating/toon3/js/main.js
- horny-g####.com/media/exit-new/exit-popup.css
- horny-g####.com/media/exit-new/exit1.js
- horny-g####.com/util/utils.js
- hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
- lp.youwant####.com/bundles/3c373f3f/fonts/ProximaNovaBlack/ProximaNovaBl...
- lp.youwant####.com/bundles/3c373f3f/fonts/ProximaNovaBold/ProximaNovaBol...
- lp.youwant####.com/bundles/3c373f3f/fonts/ProximaNovaRegular/ProximaNova...
- lp.youwant####.com/bundles/3c373f3f/images/woolworths/basket.png
- lp.youwant####.com/bundles/3c373f3f/images/woolworths/invalid.png
- lp.youwant####.com/bundles/3c373f3f/images/woolworths/menu.png
- lp.youwant####.com/bundles/common.css?v=####
- lp.youwant####.com/bundles/common.js?v=####
- lp.youwant####.com/bundles/voucher.js?v=####
- lp.youwant####.com/bundles/voucher_brand_aldi.css?v=####
- lp.youwant####.com/bundles/voucher_color_white.css?v=####
- lp.youwant####.com/bundles/voucher_extra_empty.css?v=####
- lp.youwant####.com/bundles/voucher_layout_layout-products.css?v=####
- lp.youwant####.com/bundles/voucher_main_style.css?v=####
- lp.youwant####.com/exit-url/redirect?externalId=####&type=####
- lp.youwant####.com/nl/aldi?networkid=####&optinfo=####&publisher=####&pr...
- lp.youwant####.com/uploads/landings/359/main/1_31f41a057b2ffb665be956033...
- lp.youwant####.com/uploads/landings/359/main/3_fc220600f912a1026a96697a1...
- lp.youwant####.com/uploads/landings/359/main/4_fc220600f912a1026a96697a1...
- offer####.online/favicon.ico
- offer####.online/r/5a4841ac-f9af-11e7-9b0c-1145bf6b0f8d/0/
- offer####.online/r/5a4841ac-f9af-11e7-9b0c-1145bf6b0f8d/1/
- offer####.online/r/5bc602c6-f9af-11e7-ac5f-1144191bb38d/0/
- offer####.online/r/5bc602c6-f9af-11e7-ac5f-1144191bb38d/1/
- offer####.online/r/5be4a8c0-f9af-11e7-9a71-11414b48f4e9/0/
- offer####.online/r/5be4a8c0-f9af-11e7-9a71-11414b48f4e9/1/
- offer####.online/r/5c203246-f9af-11e7-9c52-11405fc00618/0/
- offer####.online/r/5c203246-f9af-11e7-9c52-11405fc00618/1/
- offer####.online/r/5d330848-f9af-11e7-a484-1143c331c85e/0/
- offer####.online/r/5d330848-f9af-11e7-a484-1143c331c85e/1/
- pub.reachef####.com/ra/1042/46/p/m/[campaign]/WW
- pub.reachef####.com/ra/369/1042/p2/m/6ACC9B57-528C-FB1C-2FA8-BE88-79FE89...
- r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
- r####.adsb####.com/c/679efeecdc3b4d07?&click_id=####&s1=####&s2=####&s3=...
- r####.adsb####.com/c/da57dc555e50572d?s1=####&s2=####&s3=####&j1=####&j2...
- ssl-l####.com/?a=####&c=####&s1=####&s2=####&s3=####
- ssl-l####.com/?a=####&c=####&s1=####&s2=####&s3=####&ckmguid=####
- st####.ho####.com/c/hotjar-689984.js?sv=####
- t####.nextp####.xyz/?utm_medium=####&utm_campaign=####&c2=####&c3=####
- t####.nextp####.xyz/?utm_term=####&clickverify=####&c=####&utm_content=#...
- t####.nextp####.xyz/?utm_term=####&clickverify=####&utm_content=####
- t####.nextp####.xyz/favicon.ico
- t####.nextp####.xyz/proc.php?0ebb8df####
- t####.nextp####.xyz/proc.php?64dc886####
- tag.re####.net/rem/pwy_1st
- top.prem####.co/?utm_medium=####&utm_campaign=####&1=####&3=####&4=####&...
- top.prem####.co/?utm_term=####&clickverify=####&utm_content=####
- top.prem####.co/proc.php?382f628####
- us-scp####.ali####.com/rd/kdopppr6?pid=####&tp1=####&cv=####&cn=####
- www.theadga####.com/jump/next.php?r=####&sub1=####
- www.theadga####.com/jump/next.php?stamat=####&cbrandom=####&cbtitle=####...
Запросы HTTP POST:
- gra####.ho####.com:12080/gelf
- lp.youwant####.com/lead/validate
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/aveqykeuel.dat.jar
- <Package Folder>/app_database/####/http_lp.youwant2win.com_0.lo...ournal
- <Package Folder>/app_database/ApplicationCache.db-journal
- <Package Folder>/app_database/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_database/CachedGeoposition.db
- <Package Folder>/app_database/CachedGeoposition.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-500711733.zip
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/llsBejqMg
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Загружает динамические библиотеки:
- llsBejqMg
Использует права администратора.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
