Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) t.gl####.y####.net:80
- TCP(HTTP/1.1) aiqiy####.com:80
- TCP(HTTP/1.1) bbs.vi####.com:80
- TCP(HTTP/1.1) t####.dmp.y####.net:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) mcc.god####.com:80
- TCP(HTTP/1.1) www.aiqiy####.com:80
- TCP(HTTP/1.1) ak.im####.com.####.net:80
- TCP(HTTP/1.1) ui.ki.u####.cn:80
- TCP(HTTP/1.1) global-####.w####.com.####.net:80
- TCP(HTTP/1.1) r.y####.net:80
- TCP(HTTP/1.1) s####.gw.y####.####.com:80
- TCP(HTTP/1.1) www.vipfenx####.com:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) d####.sin####.com:80
- TCP(HTTP/1.1) su####.g.doublec####.net:80
- TCP(SSL/3.0) img.god####.com:443
- TCP(TLS/1.0) l####.livepe####.net:443
- TCP(TLS/1.0) s.y####.com:443
- TCP(TLS/1.0) c####.qualt####.com.####.net:443
- TCP(TLS/1.0) ing-dis####.click####.net:443
- TCP(TLS/1.0) www.god####.com.####.net:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) img.god####.com:443
- TCP(TLS/1.0) bat-bin####.a-####.a-ms####.net:443
- TCP(TLS/1.0) global-####.w####.com.####.net:443
- TCP(TLS/1.0) 2-01-2f####.cdx.ced####.net:443
- TCP(TLS/1.0) mix.link####.com:443
- TCP(TLS/1.0) gl####.www.link####.com:443
- TCP(TLS/1.0) bbs.vi####.com:443
- TCP(TLS/1.0) ads.twi####.com:443
- TCP(TLS/1.0) st####.ads-twi####.com:443
- TCP(TLS/1.0) e####.yunj####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) a####.link:443
- TCP(TLS/1.0) cdn.br####.io:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) collect####.tvsqu####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) condu####.click####.net:443
- TCP(TLS/1.0) wild####.l####.com.####.net:443
- TCP(TLS/1.0) tra####.mar####.com.####.net:443
- TCP(TLS/1.0) cdn.click####.net.####.net:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) t####.co:443
Запросы DNS:
- a####.link
- adser####.go####.com
- adser####.go####.nl
- aiqiy####.com
- ak2.im####.com
- analy####.twi####.com
- bat.b####.com
- bbs.vi####.com
- cd####.click####.net
- cdn.br####.io
- collect####.tvsqu####.com
- con####.face####.net
- condu####.click####.net
- d####.sin####.com
- dc.ads.link####.com
- e####.yunj####.com
- i####.w####.com
- img.god####.com
- ing-dis####.click####.net
- l####.livepe####.net
- mcc.god####.com
- px.ads.link####.com
- r.y####.net
- s####.gw.y####.net
- s####.l####.com
- s.y####.com
- s11.c####.com
- st####.ads-twi####.com
- su####.g.doublec####.net
- t####.co
- t####.dmp.y####.net
- t####.ti####.com
- t.gl####.y####.net
- tra####.mar####.com
- ui.ki.u####.cn
- vip.vipfenx####.com
- www.521xu####.com
- www.aiqiy####.com
- www.go####.com
- www.god####.com
- www.google-####.com
- www.googlet####.com
- www.gst####.com
- www.link####.com
- www.vipfenx####.com
- znccpil####.siteint####.qualt####.com
Запросы HTTP GET:
- aiqiy####.com/?reqp=####&reqr=####
- aiqiy####.com/YOaOZ/?reqp=####&reqr=####
- aiqiy####.com/YmMRM/?reqp=####&reqr=####
- aiqiy####.com/img.aspx?q=L3MkW####
- ak.im####.com.####.net/images/99_prk_pg_background.jpg
- ak.im####.com.####.net/images/GDPPC_CAF_Search3.png
- ak.im####.com.####.net/images/bul_blacksquare.png
- ak.im####.com.####.net/images/new_logo_GDTrans.png
- ak.im####.com.####.net/images/or2.png
- ak.im####.com.####.net/images/v4Slice.png
- ak.im####.com.####.net/script/jquery-1.3.1.min.js
- bbs.vi####.com/forum-51-1.html
- d####.sin####.com/vipshare/update.php
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w4.ttf
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w8.ttf
- mcc.god####.com/park/oaMxqzk2nKMwYaOvrt==
- r.y####.net/spot/aos/v2/reqf?s=####
- s####.gw.y####.####.com/aos/v3/pns?s=####
- s####.gw.y####.####.com/v3/init?s=####
- su####.g.doublec####.net/async_survey?site=####
- su####.g.doublec####.net/gk/prompt?t=####&site=####&random=####&r####&t#...
- su####.g.doublec####.net/insights/consumersurveys/static/407936981429623...
- t.gl####.y####.net/v1/active?dv=####&ts=####&osv=####&pt=####&appid=####...
- ui.ki.u####.cn/g?a=####
- www.aiqiy####.com/
- www.aiqiy####.com/NncdZ/
- www.aiqiy####.com/WnZYo/NncdZ/
- www.go####.com/adsense/domains/caf.js
- www.go####.com/afs/ads/i/iframe.html
- www.go####.com/dp/ads?r=m&domain_name=aiqiyivip.com&client=dp-godaddy2_x...
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
- www.vipfenx####.com/
- www.vipfenx####.com/cdn-cgi/scripts/d07b1474/cloudflare-static/email-dec...
- www.vipfenx####.com/wp-content/themes/xiu/fonts/glyphicons-halflings-reg...
- www.vipfenx####.com/wp-content/themes/xiu/images/logo.png
- www.vipfenx####.com/wp-content/themes/xiu/images/sprite.png
- www.vipfenx####.com/wp-content/themes/xiu/js/bootstrap.js?ver=####
- www.vipfenx####.com/wp-content/themes/xiu/js/custom.js?ver=####
- www.vipfenx####.com/wp-content/themes/xiu/js/jquery.js?ver=####
- www.vipfenx####.com/wp-content/themes/xiu/style.css?ver=####
- www.vipfenx####.com/wp-includes/js/wp-embed.min.js?ver=####
- www.vipfenx####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
- www.vipfenx####.com/xuanfengvip/1884.html
Запросы HTTP POST:
- t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/index
- <Package Folder>/databases/71d5f5279015fd761fe0f4018691f7fe
- <Package Folder>/databases/71d5f5279015fd761fe0f4018691f7fe-journal
- <Package Folder>/databases/97bbd2586bff458bf7b8e7dd740dcece
- <Package Folder>/databases/97bbd2586bff458bf7b8e7dd740dcece-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/d50de8955fd17d3b09f05bb7b49a4967
- <Package Folder>/databases/d50de8955fd17d3b09f05bb7b49a4967-journal
- <Package Folder>/databases/eb15cd4fbe8822ef18c0c2df12b05f94
- <Package Folder>/databases/eb15cd4fbe8822ef18c0c2df12b05f94-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/files/org.xfer.dhpx.zcwhz.jar
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/f2620.xml
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
- <SD-Card>/Dali/####/783277492.tmp
- <SD-Card>/Dali/####/783277493.tmp
- <SD-Card>/Dali/####/783277494.tmp
- <SD-Card>/Dali/####/783277495.tmp
- <SD-Card>/Dali/####/783277496.tmp
Другие:
Использует следующие алгоритмы для шифрования данных:
- DES
- PBEWITHMD5andDES
Использует следующие алгоритмы для расшифровки данных:
- DES
- PBEWITHMD5andDES
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
