Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.248.origin
- Android.Triada.373.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) me####.effecti####.net:80
- TCP(HTTP/1.1) ib.3####.com:80
- TCP(HTTP/1.1) sa.b####.co.uk:80
- TCP(HTTP/1.1) t####.crwdc####.net:80
- TCP(HTTP/1.1) 1####.26.217.12:8080
- TCP(HTTP/1.1) im####.google####.com:80
- TCP(HTTP/1.1) s.effecti####.net:80
- TCP(HTTP/1.1) td2.crwdc####.net:80
- TCP(HTTP/1.1) tpc.googles####.com:80
- TCP(HTTP/1.1) ssc.l####.3925c5b####.####.uk:80
- TCP(HTTP/1.1) www.googlet####.com:80
- TCP(HTTP/1.1) w####.bbc.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) zvi####.v.qin####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) st####.bbc.co.####.net:80
- TCP(HTTP/1.1) tlx.3####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) w####.bbc.co.uk:80
- TCP(SSL/3.0) bbc.gsco####.net:443
- TCP(TLS/1.0) bbc.gsco####.net:443
- TCP(TLS/1.0) securep####.g.doublec####.net:443
- TCP(TLS/1.0) s####.bbc.co.uk:443
- TCP(TLS/1.0) p####.adsafep####.com:443
- TCP(TLS/1.0) nav.f####.b####.####.net:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) sa.b####.co.uk:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) pay.v####.com.cn:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) t####.ce####.com:443
- TCP(TLS/1.0) l####.optimi####.com:443
- TCP(TLS/1.0) st####.adsafep####.com:443
- TCP(TLS/1.0) ads.ce####.com:443
- TCP(TLS/1.0) cache####.ce####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) cdn.optimi####.com:443
- TCP(TLS/1.0) ad.doublec####.net:443
- TCP(TLS/1.0) p####.moa####.com:443
- TCP(TLS/1.0) google####.g.doublec####.net:443
- TCP(TLS/1.0) w####.bbc.co.uk:443
- TCP(TLS/1.0) w####.bbc.com:443
- TCP(TLS/1.0) dt.adsafep####.com:443
- TCP(TLS/1.0) wild####.cdn.optimi####.####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) st####.bbc.co.####.net:443
- TCP(TLS/1.0) wild####.moa####.com.####.net:443
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) f####.bbc.co.uk:443
Запросы DNS:
- a####.u####.com
- a462104####.cdn.optimi####.com
- ad.crwdc####.net
- ad.doublec####.net
- ads.ce####.com
- adser####.go####.com
- adser####.go####.nl
- and####.cli####.go####.com
- b.scoreca####.com
- bbc.gsco####.net
- cache####.ce####.com
- cdn.optimi####.com
- dt.adsafep####.com
- e####.bbc.com
- emp.b####.co.uk
- f####.bbc.co.uk
- f.up.v####.####.cn
- googl####.g.doublec####.net
- google####.g.doublec####.net
- home####.f####.b####.####.uk
- i####.b####.co.uk
- ib.3####.com
- im####.google####.com
- l####.optimi####.com
- m####.f####.b####.####.uk
- me####.effecti####.net
- mybbc-a####.f####.b####.####.uk
- nav.f####.b####.####.uk
- p####.adsafep####.com
- p####.moa####.com
- pag####.googles####.com
- pay.v####.com.cn
- px.moa####.com
- s####.api.bbc.com
- s####.bbc.co.uk
- s.effecti####.net
- s0.2####.net
- sa.b####.co.uk
- securep####.g.doublec####.net
- ssl.gst####.com
- st####.adsafep####.com
- st####.b####.co.uk
- st####.bbc.co.uk
- t####.ce####.com
- t####.crwdc####.net
- tlx.3####.com
- tpc.googles####.com
- w####.bbc.co.uk
- w####.bbc.com
- www.go####.com
- www.go####.nl
- www.googlet####.com
- www.gst####.com
- z.moa####.com
Запросы HTTP GET:
- b.scoreca####.com.####.net/p2?ns_alias=####&c1=####&c2=####&b_imp_src=##...
- b.scoreca####.com.####.net/p?ns_alias=####&c1=####&c2=####&b_imp_src=###...
- ib.3####.com/rev/e25dd327e33dfaf4a1e28ef53680ab074747c68b/dist/bundle.js
- ib.3####.com/ttj?inv_code=####
- im####.google####.com/js/core/bridge3.211.3_en.html
- im####.google####.com/js/sdkloader/ima3.js
- me####.effecti####.net/em.js
- pag####.googles####.com/activeview?avi=####&cid=####&id=####&ti=####&r=#...
- pag####.googles####.com/pagead/js/r20180606/r20110914/activeview/lidar.js
- pag####.googles####.com/pagead/osd.js
- s.effecti####.net/d/6/p?pu=####&ru=####&tz=####&fc=####&ii=####&ua=####&...
- s.effecti####.net/html/frame_2.3.7.html
- sa.b####.co.uk/bbc/bbc/s?name=####&app_name=####&app_type=####&ml_name=#...
- ssc.l####.3925c5b####.####.uk/?c1=####&c2=####&b_imp_src=####&b_vs_un=##...
- ssc.l####.3925c5b####.####.uk/?ns_alias=####&c1=####&c2=####&b_imp_src=#...
- st####.bbc.co.####.net/bbcdotcom/1.82.559/script/av/emp/adverts.js
- st####.bbc.co.####.net/bbcdotcom/1.82.559/script/av/emp/analytics.js
- st####.bbc.co.####.net/bbcdotcom/1.82.559/script/dist/bbcdotcom.js
- st####.bbc.co.####.net/bbcdotcom/1.82.559/script/vendor/edr/edr.min.js
- st####.bbc.co.####.net/bbcdotcom/1.82.559/style/dist/bbcdotcom-async.css
- st####.bbc.co.####.net/echo-client-js/echo-11.0.2.min.js
- st####.bbc.co.####.net/emp/SMPj/2.19.11/iframe.html
- st####.bbc.co.####.net/emp/assets/2.0.21/cta_play.png
- st####.bbc.co.####.net/emp/bump-3/bump-3.js
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/img/bbc-blocks...
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/img/orb-sprite...
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/script/orb.min...
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/script/orb/api...
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/script/orb/fon...
- st####.bbc.co.####.net/frameworks/barlesque/3.22.55/orb/4/style/orb.min....
- st####.bbc.co.####.net/frameworks/jquery/0.4.1/sharedmodules/jquery-1.7....
- st####.bbc.co.####.net/frameworks/jquery/0.4.1/sharedmodules/jquery-1.9....
- st####.bbc.co.####.net/frameworks/requirejs/lib.js
- st####.bbc.co.####.net/id/0.37.24/modules/idcta/dist/idcta-1.min.js
- st####.bbc.co.####.net/id/0.37.24/modules/idcta/statusbar.js
- st####.bbc.co.####.net/id/0.37.24/style/id-cta-v5.css
- st####.bbc.co.####.net/id/0.37.24/style/id-cta.css
- st####.bbc.co.####.net/id/0.37.24/svg/icon-sprite.svg
- st####.bbc.co.####.net/nav-analytics/0.1.0-95/js/istats-1.js
- st####.bbc.co.####.net/notification-ui/3.8.4/css/main.min.css
- st####.bbc.co.####.net/notification-ui/3.8.4/js/NotificationsMain.js
- st####.bbc.co.####.net/plugins/dfpAdsHTML/3.24.1/css/dfpAds.css
- st####.bbc.co.####.net/plugins/dfpAdsHTML/3.24.1/js/dfpAds.js
- st####.bbc.co.####.net/searchbox/1.0.0-137/css/main.css
- st####.bbc.co.####.net/searchbox/1.0.0-137/img/gel-icon-search-dark.svg
- st####.bbc.co.####.net/weather/0.5.284/images/icons/individual_56_icons/...
- st####.bbc.co.####.net/wwhp/1.123.289/fonts/wwhp-icons.ttf
- st####.bbc.co.####.net/wwhp/1.123.289/modules/compiled.js
- st####.bbc.co.####.net/wwhp/1.123.289/modules/vendor/bower/modernizr/mod...
- st####.bbc.co.####.net/wwhp/1.123.289/responsive/css/wwhp.min.css
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/180E6/production/_99943589_p05...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/32BB/production/_101978921_kim...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/35FF/production/_101932831_hi0...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/4D21/production/_101954791_unt...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/5CF4/production/_101969732_get...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/7BCD/production/_101939613_1ec...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/A0D3/production/_101917114_5cb...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/EC10/production/_101923406_hi0...
- st####.bbc.co.####.net/wwhp/144/cpsprodpb/FB35/production/_101890346_01_...
- st####.bbc.co.####.net/wwhp/144/ibroadcast/images/live/p0/68/s0/p068s03j...
- st####.bbc.co.####.net/wwhp/800/cpsprodpb/6F8C/production/_101965582_p06...
- st####.bbc.co.####.net/wwhp/999/cpsprodpb/32BB/production/_101978921_kim...
- t####.crwdc####.net/c/10816/cc.js?ns=####
- td2.crwdc####.net/5/c=10815/pe=y/var=ccauds
- tlx.3####.com/web/auction?inv_code=####&referrer=####&imp_id=####&rev=##...
- tpc.googles####.com/safeframe/1-0-28/html/container.html
- w####.bbc.co.uk/
- w####.bbc.co.uk/idcta/config?call####&locale=####&ptrt=####
- w####.bbc.co.uk/idcta/translations?call####&locale=####
- w####.bbc.co.uk/mraid.js
- w####.bbc.com/
- w####.bbc.com/mraid.js
- w####.bbc.com/wwscripts/flag
- www.googlet####.com/tag/js/gpt.js
Запросы HTTP POST:
- a####.u####.com/app_logs
- zvi####.v.qin####.com/usrsys/reportUsrsys?version=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1143945219847306209
- /data/data/####/.imprint
- /data/data/####/ALzbay0GlPK24XWf.zip
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/Om6fj3P9KrvRNLvWo1V5zQ==.new
- /data/data/####/bWTiG-gC_KBgDjl0
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.maan.Qcqzhanjj.vivo_preferences.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/gdvbw_f.zip
- /data/data/####/mRJRRMhuyDBJWirwQvVRtQ==
- /data/data/####/pQrU3FtSmK5hmwtljxHj8Q==.new
- /data/data/####/prefs_vivounionsdk.xml
- /data/data/####/rdata_comfunzavnoyj.new
- /data/data/####/trackevents.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/unionuserinfo.db-journal
- /data/data/####/vIscwg2L2goOsSuUm5ouZQ==
- /data/data/####/vivounionapk_v2.2.41_a1e788e_201708101947.vua
- /data/data/####/webview.db-journal
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/sdkaccountinfo.db
- /data/media/####/sdkaccountinfo.db-journal
- /data/media/####/sysid.dat
- /data/media/####/vivounionapk_v2.2.41_a1e788e_201708101947.vua
Другие:
Загружает динамические библиотеки:
- hellocpp
- vivo_account_sdk
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
