Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Appsad.5.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) androi####.b####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) 75a2####.cdn.uc####.####.cn:80
- TCP(HTTP/1.1) net.ray####.com:80
- TCP(HTTP/1.1) www.gam####.com:80
- TCP(HTTP/1.1) www.lit####.com:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) u####.b####.com:80
- TCP(HTTP/1.1) 1####.255.26.42:80
- TCP(HTTP/1.1) fk-k8s-####.ray####.com:80
- TCP(HTTP/1.1) d####.ray####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) www.o####.com:80
- TCP(TLS/1.0) www.o####.com:443
- TCP(TLS/1.0) www.googlea####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) ms-ads-####.pre####.io:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) wsback-####.pre####.io:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) ma####.bootstr####.com:443
- TCP(TLS/1.0) dwqtlnw####.cloudf####.net:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) 1####.217.168.206:443
- TCP(TLS/1.0) st####.addt####.com:443
- TCP(TLS/1.0) st####.doublec####.net:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) i.y####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) www.you####.com:443
- TCP(TLS/1.0) desdcc5####.cloudf####.net:443
- TCP(TLS/1.0) endpo####.collec####.eu.####.com:443
Запросы DNS:
- androi####.b####.com
- api.mob####.b####.com
- cdn####.ray####.com
- d####.ray####.com
- desdcc5####.cloudf####.net
- dwqtlnw####.cloudf####.net
- endpo####.collec####.eu.####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- i.y####.com
- ma####.bootstr####.com
- ms-ads-####.pre####.io
- net.ray####.com
- resou####.pre####.io
- s####.g.doublec####.net
- s####.mob####.b####.com
- s.y####.com
- set####.ray####.com
- st####.addt####.com
- st####.doublec####.net
- u####.b####.com
- wsback-####.pre####.io
- wsback-####.pre####.io
- wsback-####.pre####.io
- wsback-####.pre####.io
- www.gam####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlea####.com
- www.googlet####.com
- www.lit####.com
- www.o####.com
- www.you####.com
Запросы HTTP GET:
- 75a2####.cdn.uc####.####.cn/cdn-adn/dmp/17/12/22/15/27/5a3cb3f9c8dcb.png
- 75a2####.cdn.uc####.####.cn/cdn-adn/v2/offersync/18/12/01/11/27/5c01ffb1...
- androi####.b####.com/index.php/OfferList/getOfferListNew?start=####&limi...
- d####.ray####.com/impression?k=####&p=fHx8f####&q=a_i09####&x=####&r=eyJ...
- d####.ray####.com/onlyImpression?k=####&p=OTc4M####&csp=####&rs=####
- f####.google####.com/css?family=####
- f####.google####.com/css?family=####&ver=####
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc9AMP6lQ.ttf
- f####.gst####.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxPKTU1Kg.ttf
- f####.gst####.com/s/robotocondensed/v16/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7...
- fk-k8s-####.ray####.com/setting?app_id=####&sign=####&platform=####&os_v...
- fk-k8s-####.ray####.com/setting?unit_ids=####&app_id=####&sign=####&plat...
- net.ray####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&onl...
- net.ray####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sig...
- u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...
- www.gam####.com/cola0008/<Package>/control.json
- www.google-####.com/analytics.js
- www.google-####.com/plugins/ua/linkid.js
- www.lit####.com/v2.41.2-1f0a8f3/formats/browser-sdk3/index.js
- www.lit####.com/v2.41.2-1f0a8f3/formats/browser-sdk3/mraid.js
- www.lit####.com/v2.41.2-1f0a8f3/formats/eula/index.js
- www.lit####.com/v2.41.2-1f0a8f3/formats/mraid-wrapper/index.html
- www.o####.com/privacy
- www.o####.com/privacy/
- www.o####.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=####
- www.o####.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=####
- www.o####.com/wp-content/plugins/bb-plugin/css/jquery.magnificpopup.css?...
- www.o####.com/wp-content/plugins/bb-plugin/js/jquery.imagesloaded.js?ver...
- www.o####.com/wp-content/plugins/bb-plugin/js/jquery.magnificpopup.min.j...
- www.o####.com/wp-content/plugins/google-analytics-for-wordpress/assets/j...
- www.o####.com/wp-content/plugins/ninja-forms/assets/css/display-structur...
- www.o####.com/wp-content/plugins/ninja-forms/assets/js/min/front-end-dep...
- www.o####.com/wp-content/plugins/ninja-forms/assets/js/min/front-end.js?...
- www.o####.com/wp-content/plugins/popup-maker/assets/css/site.min.css?ver...
- www.o####.com/wp-content/plugins/popup-maker/assets/js/site.min.js?d####...
- www.o####.com/wp-content/plugins/uk-cookie-consent/assets/css/style.css?...
- www.o####.com/wp-content/plugins/uk-cookie-consent/assets/js/uk-cookie-c...
- www.o####.com/wp-content/themes/bb-theme/css/bootstrap.min.css?ver=####
- www.o####.com/wp-content/themes/bb-theme/css/mono-social-icons.css?ver=#...
- www.o####.com/wp-content/themes/bb-theme/js/bootstrap.min.js?ver=####
- www.o####.com/wp-content/themes/bb-theme/js/jquery.throttle.min.js?ver=#...
- www.o####.com/wp-content/themes/bb-theme/js/theme.min.js?ver=####
- www.o####.com/wp-content/themes/ogury/assets/favicon.png
- www.o####.com/wp-content/themes/ogury/images/Unerline.png
- www.o####.com/wp-content/themes/ogury/js/main.js?ver=####
- www.o####.com/wp-content/themes/ogury/popup-close.png
- www.o####.com/wp-content/themes/ogury/style.css?ver=####
- www.o####.com/wp-includes/css/dashicons.min.css?ver=####
- www.o####.com/wp-includes/js/backbone.min.js?ver=####
- www.o####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- www.o####.com/wp-includes/js/jquery/jquery.js?ver=####
- www.o####.com/wp-includes/js/jquery/ui/core.min.js?ver=####
- www.o####.com/wp-includes/js/jquery/ui/position.min.js?ver=####
- www.o####.com/wp-includes/js/underscore.min.js?ver=####
- www.o####.com/wp-includes/js/wp-embed.min.js?ver=####
- www.o####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/1599820861-438225816
- /data/data/####/AdsBusiness-data.xml
- /data/data/####/L-mbv-1544740889248-1592499206.log
- /data/data/####/L-mbv-1544740904091-1622421855.log
- /data/data/####/aps.xml
- /data/data/####/apscomm.xml
- /data/data/####/classes.zip
- /data/data/####/com.cgame.b2048r_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/index
- /data/data/####/mobvista.msdk.db-journal
- /data/data/####/mobvista.xml
- /data/data/####/presage.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-968937429.temp
- /data/media/####/.cuid
- /data/media/####/354694414.temp
- /data/media/####/journal.tmp
Другие:
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Получает информацию о привязанных к устройству аккаунтах (Google, Facebook и т. д.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
