Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Mobikok.1.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) api.pings####.com:80
- TCP(HTTP/1.1) r1.s####.co:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) cl####.mid####.com:80
- TCP(HTTP/1.1) sc.smard####.com:80
- TCP(HTTP/1.1) claim-p####.com:80
- TCP(HTTP/1.1) a####.solo-la####.com:80
- TCP(HTTP/1.1) solo-m####.dfs.solo-la####.com:80
- TCP(HTTP/1.1) play####.forward####.loan:80
- TCP(HTTP/1.1) tdsj####.com:80
- TCP(TLS/1.0) s####.appsf####.com:443
- TCP(TLS/1.0) t.appsf####.com:443
Запросы DNS:
- a####.solo-la####.com
- and####.b####.qq.com
- ap.smard####.com
- api.bi####.com
- api.ki####.com
- api.pings####.com
- api.solo-la####.com
- cl####.mid####.com
- claim-p####.com
- ev####.appsf####.com
- ilv####.com
- play####.forward####.loan
- r1.s####.co
- s####.appsf####.com
- sc.smard####.com
- solo-m####.dfs.solo-la####.com
- t.appsf####.com
- tdsj####.com
- www.solo-la####.com
Запросы HTTP GET:
- a####.solo-la####.com/v0/lockheadlines/configuration?version_code=####&d...
- a####.solo-la####.com/v0/upgrade/group?package_name=####
- a####.solo-la####.com/v1/diylocker/mainscreen/pattern?page=####&size=###...
- a####.solo-la####.com/v1/diylocker/vip/wallpaper/images?page=####&size=#...
- a####.solo-la####.com/v1/diylocker/wallpaper/images?page=####&size=####&...
- a####.solo-la####.com/v2/weather/backgounds
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- api.pings####.com/mediation/config?publisher_id=####&slot_id=####&app_id...
- api.pings####.com/v3/api/nativeads?publisherid=####&slotid=####&lang=###...
- cl####.mid####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&dir...
- claim-p####.com/?u=####&o=####&t=####&cid=####
- play####.forward####.loan/default.aspx?u=####&o=####&t=####&cid=####&f=#...
- play####.forward####.loan/media/mainstream/backbutton_mainstream.js
- play####.forward####.loan/media/mainstream/exit_ms.js
- play####.forward####.loan/media/mainstream/jquery.js
- play####.forward####.loan/media/mainstream/js.cookie6_pure.js
- play####.forward####.loan/media/mainstream/js1.js
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/bootstrap.mi...
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/font-awesome...
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img1.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img10.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img11.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img2.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img3.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img4.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img5.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img6.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img7.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img8.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/img9.jpg
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/jquery-ui.mi...
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/lidl.png
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/logo_f01.png
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.css
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/main.js
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/modernizr-2....
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/returnDate.n...
- play####.forward####.loan/media/mainstream/nl/wap/mobsurvey/safari.png
- play####.forward####.loan/util/utils-ms.js
- r1.s####.co/v1/wad/r?size_w=####&size_h=####&destiny=####&tzone=####&gai...
- sc.smard####.com/v1/scheme/app?model=####&mcc=####&os_v=####&direction=#...
- sc.smard####.com/v1/scheme/placement?model=####&mcc=####&os_v=####&direc...
- solo-m####.dfs.solo-la####.com/group1/M00/00/4F/LThZZFer2meAIhEoAABJJPg_...
- solo-m####.dfs.solo-la####.com/group1/M00/00/4F/LThZZFey63mAa89DAABN0Mak...
- solo-m####.dfs.solo-la####.com/group1/M00/00/50/LThZZFe_vF-AY8AdAAA19y88...
- solo-m####.dfs.solo-la####.com/group1/M00/00/50/LThZZFf40u6ATkgxAABSbgI3...
- solo-m####.dfs.solo-la####.com/group1/M00/00/50/LThZZFfNEzOAf3XrAABtfjua...
- solo-m####.dfs.solo-la####.com/media/images/diylocker/wallpapers/2ed9b75...
- solo-m####.dfs.solo-la####.com/media/images/diylocker/wallpapers/6e21e48...
- solo-m####.dfs.solo-la####.com/media/images/diylocker/wallpapers/911492d...
- solo-m####.dfs.solo-la####.com/media/images/diylocker/wallpapers/c7e7761...
- solo-m####.dfs.solo-la####.com/media/images/diylocker/wallpapers/e7ea794...
- tdsj####.com/ExtService.svc/getextparams
- tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
Запросы HTTP POST:
- a####.solo-la####.com/v0/upgrade/updatelist
- and####.b####.qq.com/rqd/async?aid=####
- api.bi####.com/un
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_crashrecord/1004
- <Package Folder>/background.png
- <Package Folder>/cache/####/-1600351218-1175205981
- <Package Folder>/cache/####/-16432214981350404725
- <Package Folder>/cache/####/-19799226651892126933
- <Package Folder>/cache/####/-2129832544-1175205981
- <Package Folder>/cache/####/-30550571204921824
- <Package Folder>/cache/####/049ad2a4100eb2988442dc44f27a5c90f0a....0.tmp
- <Package Folder>/cache/####/279a73afdc9fb87889ee9ae5f790a3f750a....0.tmp
- <Package Folder>/cache/####/4f5ddfece3d12d97dadc0117a5d30d83340....0.tmp
- <Package Folder>/cache/####/7a5893d10a7c37ddce1b4bf1a4f8e07cd8b....0.tmp
- <Package Folder>/cache/####/9640773551455943969
- <Package Folder>/cache/####/967b3d05fb5fd4fde1df25f87fdff1929ab....0.tmp
- <Package Folder>/cache/####/ace8a0ede3aa736423cd8ee70a15d2a932f....0.tmp
- <Package Folder>/cache/####/c27136ef56476e73a2a5e9645de39594996....0.tmp
- <Package Folder>/cache/####/d4602468b66413f9ce7639db58a56524474....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f675e5a7cd72f3b59bc81e978689640d5b5....0.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/bb.jar
- <Package Folder>/databases/bugly_db_-journal
- <Package Folder>/databases/cover.db-journal
- <Package Folder>/databases/lockerscreen.db
- <Package Folder>/databases/lockerscreen.db-journal
- <Package Folder>/databases/main_screen_style.db-journal
- <Package Folder>/databases/mobpower.db-journal
- <Package Folder>/databases/music.db-journal
- <Package Folder>/databases/notification.db-journal
- <Package Folder>/databases/preferencesProvider.db-journal
- <Package Folder>/databases/timer.db
- <Package Folder>/databases/timer.db-journal
- <Package Folder>/databases/weather.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/mp_agent_log
- <Package Folder>/files/local_crash_lock
- <Package Folder>/files/security_info
- <Package Folder>/ptinnormal.png
- <Package Folder>/ptinpressed.png
- <Package Folder>/ptnormal.png
- <Package Folder>/ptpressed.png
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ACTIVATE_SERVICE.xml
- <Package Folder>/shared_prefs/BasedSharedPref.xml
- <Package Folder>/shared_prefs/BatterySharedPref.xml
- <Package Folder>/shared_prefs/EnvSharedPref.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_3.xml
- <Package Folder>/shared_prefs/SpZvPrefs.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/com.mobpower.xml
- <Package Folder>/shared_prefs/com.mobpower.xml (deleted)
- <Package Folder>/shared_prefs/com.mobpower.xml.bak
- <Package Folder>/shared_prefs/com.mobpower.xml.bak (deleted)
- <Package Folder>/shared_prefs/crashrecord.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/wallpaper.xml
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- getprop
Загружает динамические библиотеки:
- Bugly
Использует следующие алгоритмы для шифрования данных:
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-GCM-NoPadding
- DES
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
