Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ci.tv.c####.cn:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) www.app####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) www.outthin####.com:80
Запросы DNS:
- ci.tv.c####.cn
- f####.google####.com
- f####.gst####.com
- www.app####.com
- www.google-####.com
- www.outthin####.com
Запросы HTTP GET:
- f####.google####.com/css?family=####
- f####.gst####.com/s/terminaldosis/v11/BXRyvFbejejHgENDQMs-nhycKtDQ9Z2cqx...
- www.app####.com/BadgeAd/Android/Ads/com.faceenhancer.android.png
- www.app####.com/BadgeAd/Android/Ads/com.instavideocollage.android.png
- www.app####.com/BadgeAd/Android/Ads/com.outdoing.absworkoutformen.jpg
- www.app####.com/BadgeAd/Android/Ads/com.picsmix.android.png
- www.app####.com/BadgeAd/Android/Ads/com.picturequotes.android.png
- www.app####.com/BadgeAd/Android/Ads/com.selfiecamerabeauty.android.png
- www.app####.com/BadgeAd/Android/startad.php?id=####
- www.google-####.com/analytics.js
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
- www.outthin####.com/newsletter
- www.outthin####.com/newsletter/
- www.outthin####.com/wp-content/plugins/contact-form-7/includes/css/style...
- www.outthin####.com/wp-content/plugins/contact-form-7/includes/js/jquery...
- www.outthin####.com/wp-content/plugins/contact-form-7/includes/js/script...
- www.outthin####.com/wp-content/themes/enfold-child/style.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/base.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/custom.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/grid.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/layout.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/print.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/css/shortcodes.css?ver=####
- www.outthin####.com/wp-content/themes/enfold/js/avia-compat.js?ver=####
- www.outthin####.com/wp-content/themes/enfold/js/avia.js?ver=####
- www.outthin####.com/wp-content/themes/enfold/js/aviapopup/jquery.magnifi...
- www.outthin####.com/wp-content/themes/enfold/js/aviapopup/magnific-popup...
- www.outthin####.com/wp-content/themes/enfold/js/mediaelement/skin-1/medi...
- www.outthin####.com/wp-content/themes/enfold/js/shortcodes.js?ver=####
- www.outthin####.com/wp-content/themes/enfold/style.css
- www.outthin####.com/wp-content/uploads/2015/12/favicon1.ico
- www.outthin####.com/wp-content/uploads/dynamic_avia/enfold_child.css?ver...
- www.outthin####.com/wp-includes/js/comment-reply.min.js?ver=####
- www.outthin####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- www.outthin####.com/wp-includes/js/jquery/jquery.js?ver=####
- www.outthin####.com/wp-includes/js/mediaelement/mediaelement-and-player....
- www.outthin####.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?v...
- www.outthin####.com/wp-includes/js/wp-embed.min.js?ver=####
- www.outthin####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
Запросы HTTP POST:
- ci.tv.c####.cn/wxozkkmckxdiordna/385e/pad
- ci.tv.c####.cn/wxozkkmckxdiordna/385e/qad
- ci.tv.c####.cn/wxozkkmckxdiordna/385e/sad
- ci.tv.c####.cn/wxozkkmckxdiordna/385e/tad
- ci.tv.c####.cn/wxozkkmckxdiordna/385e/wad
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/_msandroidxkcmkkzoxw_r.xml
- /data/data/####/com.lksdjfoi.ksdfjois.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
Другие:
Использует следующие алгоритмы для шифрования данных:
- DES
Использует следующие алгоритмы для расшифровки данных:
- DES
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
