Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.683.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) serv####.m####.com:80
- TCP(HTTP/1.1) s3.amazo####.com:80
- TCP(HTTP/1.1) f####.4mo####.xyz:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) wiq####.ti####.pw:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) s####.uni####.com:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) jsc.m####.com:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) and####.re####.com:80
- TCP(HTTP/1.1) worldga####.net:80
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) le.snow####.top:443
- TCP(TLS/1.0) cdn.app.pin####.####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) and####.re####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) 1####.217.20.110:443
Запросы DNS:
- adser####.go####.com
- adser####.go####.nl
- and####.re####.com
- cdn.app.pin####.top
- f####.4mo####.xyz
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- ios.re####.com
- jsc.m####.com
- le.snow####.top
- pag####.googles####.com
- s####.uni####.com
- s3.amazo####.com
- serv####.m####.com
- st####.xx.f####.net
- wiq####.ti####.pw
- worldga####.net
- www.face####.com
- www.go####.com
- www.google-####.com
- www.googlet####.com
Запросы HTTP GET:
- f####.4mo####.xyz/?utm_medium=####&utm_campaign=####&cid=####
- f####.4mo####.xyz/?utm_term=####&clickverify=####&utm_content=####
- f####.4mo####.xyz/proc.php?053524c####
- f####.google####.com/css?family=####&ver=####
- f####.gst####.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhsKKSTjw.ttf
- f####.gst####.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhsKKSTjw.ttf
- f####.gst####.com/s/opensans/v15/mem6YaGs126MiZpBA-UFUK0ZdchGAK6b.ttf
- f####.gst####.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0ef8pkAg.ttf
- f####.gst####.com/s/opensans/v15/memnYaGs126MiZpBA-UFUKWyV9hrIqaxjaPX.ttf
- f####.gst####.com/s/opensans/v15/memnYaGs126MiZpBA-UFUKXGUdhrIqaxjaPX.ttf
- f####.gst####.com/s/roboto/v18/KFOjCnqEu92Fr1Mu51S7ACc6CsHYl4BO.ttf
- f####.gst####.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xIIzcXKMny.ttf
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxPKTU1Kg.ttf
- jsc.m####.com/w/o/worldgadgetz.net.198717.js?t=####
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20180430/r20180504/reactive_library.js
- pag####.googles####.com/pagead/js/r20180430/r20180504/show_ads_impl.js
- s3.amazo####.com/revmob-creatives/uploads/creatives-revmob/custom_image_...
- serv####.m####.com/198717/1?w=484&h=280&cols=3&pv=5&cbuster=152550559593...
- wiq####.ti####.pw/qo38e9y1/click.php?c=####&key=####&c1=####&c2=####&c3=...
- worldga####.net/2213/expect-iphone-8-facial-recognition-feature/?6551950...
- worldga####.net/wp-content/themes/Newspaper/images/icons/newspaper.ttf?1...
- worldga####.net/wp-content/themes/Newspaper/includes/demos/tech/demo_sty...
- worldga####.net/wp-content/themes/Newspaper/js/tagdiv_theme.min.js?ver=#...
- worldga####.net/wp-content/themes/Newspaper/style.css?ver=####
- worldga####.net/wp-content/uploads/2017/01/shutterstock_226042189-100x70...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_226042189-218x15...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_254832583-218x15...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_254832583.jpg
- worldga####.net/wp-content/uploads/2017/01/shutterstock_277854590-218x15...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_465072101-218x15...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_486253066-100x70...
- worldga####.net/wp-content/uploads/2017/01/shutterstock_497764432-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_229132252-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_259333487-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_267582539-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_359803616-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_446371858-218x15...
- worldga####.net/wp-content/uploads/2017/02/shutterstock_49730833-218x150...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_111704807-100x70...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_111704807-218x15...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_123580762-218x15...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_224606434-218x15...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_224606434-324x23...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_481836484-100x70...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_500649118-218x15...
- worldga####.net/wp-content/uploads/2017/03/shutterstock_53586292-218x150...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_170445092-218x15...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_299161265-218x15...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_300613664-218x15...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_570238108-100x70...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_570238108-218x15...
- worldga####.net/wp-content/uploads/2017/04/shutterstock_624005843-100x70...
- worldga####.net/wp-content/uploads/2018/01/14.jpg
- worldga####.net/wp-content/uploads/2018/01/product-image-351510813_large...
- worldga####.net/wp-content/uploads/2018/02/black-world-G.png
- worldga####.net/wp-content/uploads/2018/02/iron-man-floating-figure-1-10...
- worldga####.net/wp-content/uploads/2018/02/iron-man-floating-figure-1-21...
- worldga####.net/wp-content/uploads/2018/02/shutterstock_1013478445-218x1...
- worldga####.net/wp-content/uploads/2018/02/shutterstock_380107090-218x15...
- worldga####.net/wp-content/uploads/2018/02/shutterstock_581397529-218x15...
- worldga####.net/wp-content/uploads/2018/02/shutterstock_667929118-2-300x...
- worldga####.net/wp-content/uploads/2018/02/wgadgets.png
- worldga####.net/wp-content/uploads/2018/03/shutterstock_1033114552-100x7...
- worldga####.net/wp-content/uploads/2018/03/shutterstock_1033114552-218x1...
- worldga####.net/wp-content/uploads/2018/03/shutterstock_1033114552-324x1...
- worldga####.net/wp-content/uploads/2018/03/shutterstock_194681609-100x70...
- worldga####.net/wp-content/uploads/2018/03/shutterstock_194681609-218x15...
- worldga####.net/wp-includes/js/comment-reply.min.js?ver=####
- worldga####.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- worldga####.net/wp-includes/js/jquery/jquery.js?ver=####
- worldga####.net/wp-includes/js/wp-embed.min.js?ver=####
- worldga####.net/wp-includes/js/wp-emoji-release.min.js?ver=####
- www.face####.com/plugins/like.php?href=####&layout=####&show_faces=####&...
- www.go####.com/complete/search?hl=####&client=####&q=####
Запросы HTTP POST:
- and####.re####.com/api/v4/mobile_apps/537cb9da60d870df42433372/click.jso...
- and####.re####.com/api/v4/mobile_apps/537cb9da60d870df42433372/impressio...
- and####.re####.com/api/v4/mobile_apps/537cb9da60d870df42433372/install.j...
- s####.uni####.com/HWStats.cgi
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/RevMob.xml
- /data/data/####/checker
- /data/data/####/com.shihun.savebob.xml
- /data/data/####/count.xml
- /data/data/####/kr.xml
- /data/data/####/lz.xml
- /data/data/####/store.kv.db-journal
- /data/data/####/store.prefs.xml
- /data/data/####/sv.xml
- /data/data/####/t_u.db-journal
- /data/data/####/tx.jar
- /data/data/####/uv.jar
- /data/media/####/.nomedia
- /data/media/####/V2.8.7.txt
Другие:
Загружает динамические библиотеки:
- main
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- PBEWithMD5AndDES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
- PBEWithMD5AndDES
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
