Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Mobikok.1.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) api.myfree####.com:80
- TCP(HTTP/1.1) cp####.mobisma####.com:80
- TCP(HTTP/1.1) wa####.go2c####.org:80
- TCP(HTTP/1.1) t####.admob####.com:80
- TCP(HTTP/1.1) api.ap####.com:80
- TCP(HTTP/1.1) cl####.mob####.net:80
- TCP(HTTP/1.1) trac####.tap####.com:80
- TCP(HTTP/1.1) p####.admobc####.com:80
- TCP(HTTP/1.1) gl####.ymtrac####.com:80
- TCP(HTTP/1.1) us.api.adf####.cn:5000
- TCP(HTTP/1.1) www.ap####.com:80
- TCP(HTTP/1.1) got.pubna####.net:80
- TCP(HTTP/1.1) clinkad####.com:80
- TCP(HTTP/1.1) atracki####.appf####.com:80
- TCP(HTTP/1.1) ap####.mobi:80
- TCP(HTTP/1.1) advc####.weclou####.com:80
- TCP(HTTP/1.1) api.migh####.com:80
- TCP(HTTP/1.1) duc####.b####.com:80
- TCP(HTTP/1.1) t####.click####.com:80
- TCP(HTTP/1.1) aws.smarter####.net:80
- TCP(HTTP/1.1) trac####.shootme####.com:80
- TCP(HTTP/1.1) t.api.y####.net:80
- TCP(HTTP/1.1) t####.iches####.net:80
- TCP(HTTP/1.1) c####.jq####.com:80
- TCP(HTTP/1.1) c####.crunchi####.com:80
- TCP(HTTP/1.1) trac####.suma####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) camspla####.com:80
- TCP(HTTP/1.1) trkper####.com:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) c####.howdo####.net:80
- TCP(HTTP/1.1) apirepo####.revmo####.com:80
- TCP(HTTP/1.1) a.n####.ren:80
- TCP(HTTP/1.1) a####.bat####.net:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) ilv####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) www.myfree####.com:80
- TCP(HTTP/1.1) mtrac####.com:80
- TCP(HTTP/1.1) 5####.77.99.53:80
- TCP(HTTP/1.1) dsa.startap####.edg####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) c####.gowa####.com:80
- TCP(HTTP/1.1) s####.adin####.com:80
- TCP(HTTP/1.1) appco####.fusetra####.com:80
- TCP(HTTP/1.1) xch####.myfree####.com:80
- TCP(TLS/1.0) c.n####.com:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) cl####.dis####.io:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) c####.roya####.net:443
- TCP(TLS/1.0) s####.mf####.com:443
- TCP(TLS/1.0) img.mf####.com:443
- TCP(TLS/1.0) a####.app####.com:443
Запросы DNS:
- a####.app####.com
- a####.bat####.net
- a####.google####.com
- a.n####.ren
- advc####.weclou####.com
- ap####.mobi
- api.ap####.com
- api.bi####.com
- api.ki####.com
- api.migh####.com
- api.myfree####.com
- apirepo####.revmo####.com
- app.ad####.com
- atracki####.appf####.com
- aws.smarter####.net
- bulk-c####.startap####.com
- c####.crunchi####.com
- c####.gowa####.com
- c####.howdo####.net
- c####.jq####.com
- c####.roya####.net
- c.n####.com
- c.s####.co
- camspla####.com
- cl####.dis####.io
- cl####.mob####.net
- clinkad####.com
- cp####.mobisma####.com
- digital####.com
- duc####.b####.com
- fc.appco####.com
- gl####.ymtrac####.com
- got.pubna####.net
- ilv####.com
- img.mf####.com
- mtrac####.com
- oad.tap####.com
- offer####.online
- p####.admobc####.com
- s####.adin####.com
- s####.mf####.com
- t####.admob####.com
- t####.click####.com
- t####.iches####.net
- t.api.y####.net
- t.mob####.net
- trac####.shootme####.com
- trac####.suma####.com
- trac####.tap####.com
- trkper####.com
- us.api.adf####.cn
- wa####.go2c####.org
- www.ap####.com
- www.google-####.com
- www.myfree####.com
- xch####.myfree####.com
Запросы HTTP GET:
- a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
- a####.google####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- a.n####.ren/sm/v1/click?rule_id=####&sub_1=####&publisher_slot=####
- advc####.weclou####.com/advclick?advposid=####&mapid=####&aid=####&adid=...
- ap####.mobi/red/fc487c12-bfa1-11e5-a414-0cc47a44dbaa/?alg=####&clickid=#...
- api.ap####.com/link/buy/android/com.abnamro.nl.tikkie/e1?clinkID=####&pu...
- api.ap####.com/link/buy/android/com.joom/e1?clinkID=####&pubID=####&site...
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
- api.myfree####.com/dc?nc=####&site=####
- apirepo####.revmo####.com/apiClick?cidRev=####&ts=####&ifa=####&dm=####&...
- appco####.fusetra####.com/tl?a=####&o=####&s1=####&sc=####&s2=####&s3=##...
- atracki####.appf####.com/transaction/post_click?offer_id=####&aff_id=###...
- aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
- c####.crunchi####.com/index.php?o=####&p=####&s=####&s1=####&s2=####&cli...
- c####.gowa####.com/click?transaction_id=wadogo_WAdvChinaMobisummerAPI_31...
- c####.howdo####.net/aff_c?offer_id=####&affiliate_id=####&gaid=####&devi...
- c####.howdo####.net/smart_link?package_name=####&affiliate_id=####&aff_s...
- c####.jq####.com/jquery-1.11.1.min.js
- c####.jq####.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
- c.s####.co/api/v4/click?_castle####
- camspla####.com/
- camspla####.com/images/camgirl.jpg
- camspla####.com/images/cfnm-webcams.jpg
- camspla####.com/images/escort-sex.jpg
- camspla####.com/images/free-live-chat.jpg
- camspla####.com/images/ipad-webcam-sex.jpg
- camspla####.com/images/live-webcam-sex.jpg
- camspla####.com/images/massage.jpg
- camspla####.com/images/swinger-webcams.jpg
- camspla####.com/images/webcam-chat.jpg
- camspla####.com/images/webcam-sex.jpg
- camspla####.com/styles/forms.css
- camspla####.com/styles/layout.css
- camspla####.com/styles/navi.css
- camspla####.com/styles/tables.css
- cl####.mob####.net/target/t.mobrand.net/tracking/aff/AJ8Y35vDScGhJERSd58...
- cl####.mob####.net/tracking/aff/AJ8Y35vDScGhJERSd58mrw/3fLDksoWTYW71ASwC...
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&aid=####&gaid=###...
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&sid1=####&sid2=##...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=####&gai...
- cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFX1hWX...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&aff_sub=####&...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&google_aid=##...
- gl####.ymtrac####.com/trace?aff_sub=####&aff_sub2=####&sub_affiliate_id=...
- gl####.ymtrac####.com/trace?offer_id=####&aff_id=####&aff_sub=####&aff_s...
- got.pubna####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&af...
- ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpES1sd...
- mtrac####.com/mt/x274y244c4u2t20344v2s224p2/&subid1=KiQ2MzI4MjU5Ni0xODI3...
- offer####.online/r/4cabe480-00f4-11e8-91e2-114786a67813/0/
- offer####.online/r/4cabe480-00f4-11e8-91e2-114786a67813/1/
- offer####.online/r/5cfc56bc-00f4-11e8-a58e-1147acb6c9d2/0/
- offer####.online/r/5cfc56bc-00f4-11e8-a58e-1147acb6c9d2/1/
- p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
- t####.admob####.com/adTrack/track/click?oid=####&affid=####&aff_click_id...
- t####.click####.com/v1/ad/click?pubid=####&campid=####&geo=####&aid=####...
- t####.iches####.net/click?id=####&aff=####&ost=####&click=####&aff_sub=#...
- t####.iches####.net/click?id=####&aff=####&ost=####&click=####&gaid=####...
- t####.iches####.net/track?id=####&aff=####&ost=####&click=####&aff_sub=#...
- t####.iches####.net/track?id=####&aff=####&ost=####&click=####&gaid=####...
- t.api.y####.net/v1/click/f?ad=####&app_id=####&pid=####&api_type=####&s=...
- trac####.shootme####.com/click?id=####&aff=####&ost=####&click=####&aff_...
- trac####.suma####.com/aff_r?offer_id=335619&aff_id=6595&url=http://click...
- trac####.tap####.com/aff_c?tt_aff_impid=####&aff_id=####&offer_id=####&p...
- trac####.tap####.com/engine/a.aspx?id=####
- trkper####.com/click.php?key=####&exid=####&p=####&anpubid=####&f2=####&...
- trkper####.com/click.php?key=####&p=####&anpubid=####&f2=####&sub=####&f...
- us.api.adf####.cn:5000/static/click?adjust=####&p=####&pa=####&s=####&o=...
- wa####.go2c####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub...
- www.ap####.com/error.html
- www.google-####.com/__utm.gif?utmwv=1.4&utmn=1651055249&utmcs=UTF-8&utms...
- www.google-####.com/__utm.gif?utmwv=1.4&utmn=586897459&utmcs=UTF-8&utmsr...
- www.google-####.com/urchin.js
- www.myfree####.com/?cam=####
- www.myfree####.com/_html/player.html?broadcaster_id=####&cam=####&target...
- www.myfree####.com/_js/banner_art_config.js
- www.myfree####.com/_js/mfccore.js?vcc=####
- www.myfree####.com/_js/serverconfig.js?nc=####
- www.myfree####.com/_js/top.js?vcc=####
- www.myfree####.com/css/mfc_style.css?no_cache=####
- www.myfree####.com/css/style.css?no_cache=####
- www.myfree####.com/css/videojs.css?no_cache=####
- www.myfree####.com/css/videoplayer.css?no_cache=####
- www.myfree####.com/enter.php?cam=####
- www.myfree####.com/images/trend_light.svg
- www.myfree####.com/js/PluginDetect.js?vcc=####
- www.myfree####.com/js/common_shortcuts.js?vcc=####
- www.myfree####.com/js/flash_detect.js?vcc=####
- www.myfree####.com/js/news.js?vcc=####
- www.myfree####.com/js/zgw_proxy.js
- www.myfree####.com/myfreecams700.jpg
- www.myfree####.com/php/FcwExtResp.php?respkey=####&type=####&opts=####&s...
- xch####.myfree####.com/lib/AjaxGw.js
- xch####.myfree####.com/lib/FcCommon.js
- xch####.myfree####.com/lib/zgw_ajax.html?0.05289####
Запросы HTTP POST:
- api.bi####.com/un
- s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
- s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
- s####.adin####.com/track/ui?sdk_version=####&platform=####&app_version=#...
- www.myfree####.com/php/client_info.php
- xch####.myfree####.com/zgw/?mh=####&ms=####&mk=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/index
- <Package Folder>/cache/cc.jar
- <Package Folder>/databases/####/file__0.localstorage-journal
- <Package Folder>/databases/####/http_www.myfreecams.com_0.local...ournal
- <Package Folder>/databases/mc_cache.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/MobikokCache_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
- <Package Folder>/shared_prefs/SpZvShPrefs.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
Другие:
Запускает следующие shell-скрипты:
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Использует следующие алгоритмы для шифрования данных:
- AES
Использует следующие алгоритмы для расшифровки данных:
- AES
- DES
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
