Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.570.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d.zxl####.com.####.com:80
- TCP(HTTP/1.1) pg.x####.com:80
- TCP(HTTP/1.1) ads.m####.com:80
- TCP(HTTP/1.1) i####.cn.com:80
- UDP(NTP) p####.ntp.org:123
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) api.vu####.com.####.net:443
- TCP(TLS/1.0) con####.ta####.com:443
- TCP(TLS/1.0) 1####.217.17.46:443
- TCP v.m####.com:7701
- TCP v.m####.com:7702
- TCP v.m####.com:7703
Запросы DNS:
- ads.m####.com
- api.vu####.com
- con####.ta####.com
- d####.fl####.com
- d.zxl####.com
- g####.face####.com
- i####.cn.com
- p####.ntp.org
- pg.x####.com
- v.m####.com
- www.tinyp####.net
Запросы HTTP GET:
- ads.m####.com/m/ad?id=####&nsv=####&dn=####&bundle=####&z=####&o=####&w=...
- ads.m####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=#...
- d.zxl####.com.####.com/d/42d2.jpg
- i####.cn.com/a/3cff577985556567209c8fa8131303f63
Запросы HTTP POST:
- pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
- pg.x####.com/api/statis/3cff577985556567209c8fa8131303f63/game-0FEAEA8F1...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/code_cache/####/<Package>-1.apk.classes904544492.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes96351177.zip
- <Package Folder>/databases/000.db-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/databases/vungle-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_J...P5_216
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.yflurrydatasenderblock.0228ea4e-a547-4d...51e500
- <Package Folder>/files/.yflurrydatasenderblock.05542dc6-b5ed-4f...ae50fd
- <Package Folder>/files/.yflurrydatasenderblock.0bf9dffc-30c1-4a...7c5b62
- <Package Folder>/files/.yflurrydatasenderblock.11c29353-312b-49...47fb7f
- <Package Folder>/files/.yflurrydatasenderblock.17c00000-0e3e-42...aa8249
- <Package Folder>/files/.yflurrydatasenderblock.2231a054-0ba3-4a...5cdedb
- <Package Folder>/files/.yflurrydatasenderblock.258e7615-a7e8-4b...399c4e
- <Package Folder>/files/.yflurrydatasenderblock.2cbc75ea-5510-49...b84fcf
- <Package Folder>/files/.yflurrydatasenderblock.33c16cc6-2062-43...ba0459
- <Package Folder>/files/.yflurrydatasenderblock.39e20b35-e11c-49...dacd3e
- <Package Folder>/files/.yflurrydatasenderblock.3af9557c-4355-43...c7d224
- <Package Folder>/files/.yflurrydatasenderblock.4d27ca5b-a92b-42...4a85a5
- <Package Folder>/files/.yflurrydatasenderblock.5169e0c9-b50b-45...8d6345
- <Package Folder>/files/.yflurrydatasenderblock.5606379b-9947-48...74de7e
- <Package Folder>/files/.yflurrydatasenderblock.6286c1d7-550b-48...0a25ad
- <Package Folder>/files/.yflurrydatasenderblock.659680dc-b0f8-44...b86ed2
- <Package Folder>/files/.yflurrydatasenderblock.6777c1db-8eed-43...97178d
- <Package Folder>/files/.yflurrydatasenderblock.6d0ae88f-fb0a-45...774761
- <Package Folder>/files/.yflurrydatasenderblock.7353f183-d1c5-49...efd785
- <Package Folder>/files/.yflurrydatasenderblock.75ef62da-1b5f-46...205043
- <Package Folder>/files/.yflurrydatasenderblock.777f27c5-a2a5-43...280ac0
- <Package Folder>/files/.yflurrydatasenderblock.7cfcec6f-a222-4e...0c1255
- <Package Folder>/files/.yflurrydatasenderblock.80d56df7-4356-4c...3369a1
- <Package Folder>/files/.yflurrydatasenderblock.8e55f972-0a3b-41...3eafbb
- <Package Folder>/files/.yflurrydatasenderblock.9c556251-0a4e-4b...8cb177
- <Package Folder>/files/.yflurrydatasenderblock.a48621de-51bb-45...83adc9
- <Package Folder>/files/.yflurrydatasenderblock.a8c0dbe7-9682-43...6dc9bb
- <Package Folder>/files/.yflurrydatasenderblock.b7406149-aa96-42...4dfe37
- <Package Folder>/files/.yflurrydatasenderblock.c14a48f4-5f08-44...48e2d3
- <Package Folder>/files/.yflurrydatasenderblock.cb0bca9a-c3da-40...0707bc
- <Package Folder>/files/.yflurrydatasenderblock.d387139d-dd7a-4c...8a22c5
- <Package Folder>/files/.yflurrydatasenderblock.d4ee6d1a-dc45-48...176e7e
- <Package Folder>/files/.yflurrydatasenderblock.dae3cf85-440d-4d...50a4b7
- <Package Folder>/files/.yflurrydatasenderblock.dafc57f9-ea92-47...c8734d
- <Package Folder>/files/.yflurrydatasenderblock.de40c7e3-6249-4e...765826
- <Package Folder>/files/.yflurrydatasenderblock.e2c46f3e-d8be-45...827289
- <Package Folder>/files/.yflurrydatasenderblock.f60db230-9e67-43...c6e921
- <Package Folder>/files/.yflurryreport.-24c560f7a5dd9cbd
- <Package Folder>/files/0.jar
- <Package Folder>/files/1.jar
- <Package Folder>/files/15.jar
- <Package Folder>/files/20.jar
- <Package Folder>/files/27.jar
- <Package Folder>/files/31.jar
- <Package Folder>/files/33.jar
- <Package Folder>/files/36.jar
- <Package Folder>/files/4.jar
- <Package Folder>/files/40.jar
- <Package Folder>/files/43.jar
- <Package Folder>/files/44.jar
- <Package Folder>/files/48.jar
- <Package Folder>/files/6.jar
- <Package Folder>/files/61.jar
- <Package Folder>/files/63.jar
- <Package Folder>/files/76.jar
- <Package Folder>/files/79.jar
- <Package Folder>/files/8.jar
- <Package Folder>/files/9.jar
- <Package Folder>/files/92.jar
- <Package Folder>/files/94.jar
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/3cff577985556567209c8fa8131303f63...le.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/shared_prefs/a33.xml
- <Package Folder>/shared_prefs/a33<IMEI>.xml
- <Package Folder>/shared_prefs/a34<IMEI>.xml
- <Package Folder>/shared_prefs/a35<IMEI>.xml
- <Package Folder>/shared_prefs/a36<IMEI>.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/tjcPrefrences.xml
- <SD-Card>/.tcookieid
- <SD-Card>/Android/####/.nomedia
Другие:
Загружает динамические библиотеки:
- baidumapapi
- cocos2dcpp
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
