Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Appsad.5.origin
- Adware.Mobikok.1.origin
- Android.Mobifun.32
- Android.RemoteCode.88.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cp####.mobisma####.com:80
- TCP(HTTP/1.1) p####.admobc####.com:80
- TCP(HTTP/1.1) a####.hitthe####.mobi:80
- TCP(HTTP/1.1) www.ap####.com:80
- TCP(HTTP/1.1) api.migh####.com:80
- TCP(HTTP/1.1) clinkad####.com:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) t####.snapbac####.com:80
- TCP(HTTP/1.1) adse####.hitthe####.mobi:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) aws.smarter####.net:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) offence####.accountant:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) u####.b####.com:80
- TCP(HTTP/1.1) www.rcyc####.com:80
- TCP(HTTP/1.1) api.mob####.b####.com:80
- TCP(HTTP/1.1) pl####.mob####.b####.com:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) clk.ocea####.com:80
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) s####.adin####.com:80
- TCP(TLS/1.0) cl####.dis####.io:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) coin####.com:443
- TCP(TLS/1.0) app.appsf####.com:443
Запросы DNS:
- a####.hitthe####.mobi
- adse####.hitthe####.mobi
- api.bi####.com
- api.ki####.com
- api.migh####.com
- api.mob####.b####.com
- app.appsf####.com
- aws.smarter####.net
- cl####.dis####.io
- clinkad####.com
- clk.ocea####.com
- coin####.com
- cp####.mobisma####.com
- digital####.com
- hy####.com
- ilv####.com
- mo.freeind####.com
- offence####.accountant
- offer####.online
- p####.admobc####.com
- pl####.mob####.b####.com
- questio####.com
- s####.adin####.com
- s####.mob####.b####.com
- t####.snapbac####.com
- u####.b####.com
- www.ap####.com
- www.cu####.com
- www.mmmmmm####.com
- www.rcyc####.com
- www.zfr####.com
Запросы HTTP GET:
- a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
- a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
- a####.hitthe####.mobi/proc.php?3282d41####
- adse####.hitthe####.mobi/tracker/click.php?link=####&click_id=####&pub_i...
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
- api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
- aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=5a5####&...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=s5a####&...
- clk.ocea####.com/tracking/index/5a5d507528661?gaid=####&idfa=####&andid=...
- clk.ocea####.com/tracking/index/5a5d507541926?gaid=####&idfa=####&andid=...
- clk.ocea####.com/tracking/index/5a5d50755bb85?gaid=####&idfa=####&andid=...
- clk.ocea####.com/tracking/index/s5a671d7a9df93?gaid=####&idfa=####&andid...
- cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- offence####.accountant/10.jpg
- offence####.accountant/11.jpg
- offence####.accountant/7.jpg
- offence####.accountant/8.jpg
- offence####.accountant/9.jpg
- offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
- offence####.accountant/flag.png
- offence####.accountant/index.html
- offence####.accountant/ip7.png
- offence####.accountant/iphone6.jpg
- offence####.accountant/iphone7.jpg
- offence####.accountant/item1.png
- offence####.accountant/item2.png
- offence####.accountant/item3.png
- offence####.accountant/like.png
- offence####.accountant/search.png
- offer####.online/r/78eab18e-00fe-11e8-96bb-11481fa5dc5a/0/
- offer####.online/r/78eab18e-00fe-11e8-96bb-11481fa5dc5a/1/
- offer####.online/r/9a3516ea-00fe-11e8-b41b-1147acb69a86/0/
- offer####.online/r/9a3516ea-00fe-11e8-b41b-1147acb69a86/1/
- p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
- t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
- tretras####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKh...
- tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
- u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
- www.ap####.com/error.html
- www.cu####.com/20180103150757.gen521_BdJar_NgpDex_D827_0103.zip
- www.rcyc####.com/
Запросы HTTP POST:
- api.bi####.com/un
- mo.freeind####.com/detail/getOfferListNew?enc=####
- pl####.mob####.b####.com/ad_dex.php
- s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
- s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
- www.mmmmmm####.com/osp/oaen_reg.action
- www.zfr####.com/up.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.mbj/####/classes.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/cache/cc.jar
- <Package Folder>/databases/####/file__0.localstorage-journal
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/mc_cache.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/d.zip
- <Package Folder>/files/dtemp.apk
- <Package Folder>/files/google.db
- <Package Folder>/files/ob3.zip
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/MobikokCache_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/SpZvShPrefs.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/cn_rs.xml
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/other_config.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <Package Folder>/shared_prefs/upgrade_config.xml
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/LogG/####/sp
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
Другие:
Запускает следующие shell-скрипты:
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Использует следующие алгоритмы для шифрования данных:
- AES
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- DES
- DES-CBC-PKCS5Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
