Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cdn-fa####.k####.net:80
- TCP(HTTP/1.1) beacon-####.lb.k####.net:80
- TCP(HTTP/1.1) pq-di####.re####.net:80
- TCP(HTTP/1.1) www.dailymo####.com:80
- TCP(HTTP/1.1) stat####.face####.com:80
- TCP(HTTP/1.1) sta####.d####.net:80
- TCP(HTTP/1.1) sb.scoreca####.com.####.net:80
- TCP(HTTP/1.1) m####.space:80
- TCP(HTTP/1.1) s1####.d####.net:80
- TCP(HTTP/1.1) r####.cr####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) con####.face####.net:80
- TCP(TLS/1.0) gra####.api.dailymo####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) stat####.face####.com:443
- TCP(TLS/1.0) userm####.k####.net:443
- TCP(TLS/1.0) s1####.d####.net:443
- TCP(TLS/1.0) aa.a####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) cm.g.doublec####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) p####.go####.com:443
Запросы DNS:
- a####.google####.com
- aa.a####.com
- api.d####.net
- b.scoreca####.com
- be####.k####.net
- cdn.k####.net
- cm.g.doublec####.net
- con####.face####.net
- googl####.g.doublec####.net
- gra####.api.dailymo####.com
- js.re####.net
- m####.space
- p####.go####.com
- pq-di####.re####.net
- r####.cr####.com
- s1####.d####.net
- s2####.d####.net
- sb.scoreca####.com
- sta####.d####.net
- stat####.face####.com
- syn####.everest####.net
- userm####.k####.net
- www.dailymo####.com
- www.face####.com
- www.go####.com
- www.google-####.com
- www.googlet####.com
Запросы HTTP GET:
- b.scoreca####.com.####.net/b2?c1=####&c2=####&c3=####&c4=####&c5=####&c6...
- b.scoreca####.com.####.net/b?c1=####&c2=####&c3=####&c4=####&c5=####&c6=...
- b.scoreca####.com.####.net/b?c1=####&c2=####&ns__t=####&ns_c=####&cv=###...
- b.scoreca####.com.####.net/beacon.js
- beacon-####.lb.k####.net/optout_check?callback=####
- cdn-fa####.k####.net/controltag?confid=####
- cdn-fa####.k####.net/ctjs/controltag.js.1c86c30cac854ccdacab6e3099f5b9ee
- cdn-fa####.k####.net/userdata/get?pub=####&technographics=####&callback=...
- con####.face####.net/en_US/sdk.js
- pq-di####.re####.net/gateway/gw.js?csid=####&auto=####&bpid=####
- pq-di####.re####.net/pql?placementIdList=####&cb=####
- r####.cr####.com/delivery/rta/rta.js?netId=####&cookieName=####&rnd=####...
- s1####.d####.net/images/neon/pinterest-icon.png.v5f78badd1e6125fd
- s1####.d####.net/js/gen/lib/dm/ga.js.v2a02ea2165b82b382
- s1####.d####.net/neon/prod/374.9dc31694d2cb29585217.js
- s1####.d####.net/neon/prod/380.9dc31694d2cb29585217.js
- sb.scoreca####.com.####.net/beacon.js
- sta####.d####.net/all.js
- sta####.d####.net/css/fonts/retina/RetinaBook.woff.vda3d013f2ec1680a
- sta####.d####.net/css/gen/pack/common.ltr.css.veecb05664cfbcceb2
- sta####.d####.net/css/gen/views/legal/legal.ltr.css.ve03d49b4cf908a212
- sta####.d####.net/css/gen/views/macros/vertical_menu.ltr.css.vbaae202047...
- sta####.d####.net/images/neon/facebook-icon.png.ved1a18d7c99d373f
- sta####.d####.net/images/neon/google-icon.png.v8ecbfb4f58a0469d
- sta####.d####.net/images/neon/instagram-icon.png.vc2b62d92f6317bc7
- sta####.d####.net/images/neon/logo-grey.png.v86742cb3ba5017ff
- sta####.d####.net/images/neon/logo.png.vcc82ff3541837d9a
- sta####.d####.net/images/neon/twitter-icon.png.v6b7aa6a089ad8d2f
- sta####.d####.net/js/gen/widget/pack/base.js.v4169a7ee659c3d102
- sta####.d####.net/js/gen/widget/pack/mandatory.js.v1e1d78520156c5722
- sta####.d####.net/neon/prod/0.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/355.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/358.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/360.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/361.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/365.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/370.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/371.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/372.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/373.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/376.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/378.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/392.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/397.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/399.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/410.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/419.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/424.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/435.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/437.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/439.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/456.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/fonts/RetinaBold.cd747ac57dbad1301e9c9dd84cc...
- sta####.d####.net/neon/prod/fonts/RetinaBook.c4cccca9cea52aa384c20c23213...
- sta####.d####.net/neon/prod/fonts/RetinaMedium.23e7b277dc8317a3553ca1b2b...
- sta####.d####.net/neon/prod/img/hexagon1.e292b13de98319d7a75c6b73547f62e...
- sta####.d####.net/neon/prod/img/hexagon2.d26e698d7e5783e7b3b490dc7510e04...
- sta####.d####.net/neon/prod/img/logo.754e4ebaecad6bcdebb0d83ac8d66144.svg
- sta####.d####.net/neon/prod/mobile.6f63d93181306f80ee3d02dcb50f5538.css
- sta####.d####.net/neon/prod/mobile.9dc31694d2cb29585217.js
- sta####.d####.net/neon/prod/vendor.66bc4f798c3154d68878183c4709d1a8.css
- sta####.d####.net/neon/prod/vendor.9dc31694d2cb29585217.js
- sta####.d####.net/playerv5/dmp.cd324f918e5a0ac12a45.js
- sta####.d####.net/playerv5/dmpmanifest.f53da2cb504c87227c89.js
- sta####.d####.net/playerv5/dmpvendor.7695aa95aa6a2348be11.js
- stat####.face####.com/connect/xd_arbiter/r/Ms1VZf1Vg1J.js?version=####
- www.dailymo####.com/
- www.dailymo####.com/legal/cookiemanagement
- www.dailymo####.com/us
Запросы HTTP POST:
- m####.space/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/QAIWvqmpf
- /data/data/####/ads1136805741.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/inc.dat.jar
- /data/data/####/index
- /data/data/####/multidex.version.xml
- /data/data/####/sddailymotion.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/xvideodownloaders.inc-1.apk.classes-1962323543.zip
- /data/data/####/xvideodownloaders.inc_preferences.xml
- /data/data/####/xvideodownloaders.inc_preferences.xml.bak (deleted)
Другие:
Загружает динамические библиотеки:
- QAIWvqmpf
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
