Техническая информация
Вредоносные функции:
Предлагает установить сторонние приложения.
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ip.p####.co:80
- TCP(HTTP/1.1) w####.l####.ir:80
- TCP(HTTP/1.1) t####.magneta####.com:80
- TCP(HTTP/1.1) gen####.shahr####.ir:80
- TCP(HTTP/1.1) api.mydigi####.com:80
- TCP(HTTP/1.1) 1.l####.ir:80
- TCP(HTTP/1.1) kimiade####.net:80
- TCP(HTTP/1.1) srv.magneta####.com:80
- TCP(HTTP/1.1) www.visi####.com:80
- TCP(HTTP/1.1) e####.l####.ir:80
- TCP(TLS/1.0) e.crashly####.com:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) ws.b####.com:443
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) 1####.app.link:443
- TCP(TLS/1.0) cafeba####.ir:443
Запросы DNS:
- 1####.app.link
- 1.l####.ir
- api.mydigi####.com
- app.ad####.com
- banne####.l####.ir
- c####.l####.ir
- ca.p####.ir
- cafeba####.ir
- crea####.magneta####.com
- e####.l####.ir
- e.crashly####.com
- gen####.shahr####.ir
- ip.p####.co
- kimiade####.net
- req.l####.ir
- sett####.crashly####.com
- srv.magneta####.com
- t####.magneta####.com
- v####.l####.ir
- w####.l####.ir
- ws.b####.com
- www.visi####.com
Запросы HTTP GET:
- 1.l####.ir/g/dl.html?bg=####&apk=####
- 1.l####.ir/g/dorsa/Fandoghestan.apk
- 1.l####.ir/g/hamechidan.apk
- api.mydigi####.com/v1/version/200/check
- e####.l####.ir/ad.svc/clk3/0/4613/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/clk3/0/4824/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/clk3/0/4946/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/clk3/0/4977/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/clk3/0/602/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/clk3/0/604/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/clk3/0/608/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/evt3/0/1x14117096/co.narin.digibazi/Applist/instal...
- e####.l####.ir/ad.svc/evt3/0/1x14117096/null/Applist/AppList_is_now_on_d...
- e####.l####.ir/ad.svc/log3/0/1x14117096/Applist/high/1009_2Crun_intent/<...
- e####.l####.ir/ad.svc/log3/0/1x14117096/Click_View_Exchange_Report/high/...
- e####.l####.ir/ad.svc/viw3/0/4088/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4516/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4613/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4787/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4824/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4845/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4946/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4977/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/4981/OnlineApplist/<Operator Name>/310004/u...
- e####.l####.ir/ad.svc/viw3/0/600/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/viw3/0/602/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/viw3/0/604/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/viw3/0/606/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/viw3/0/608/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ad.svc/viw3/0/610/OnlineApplist/<Operator Name>/310004/un...
- e####.l####.ir/ads/080cbc5b-9547-4400-bf20-32c9ed3d38ab.png
- e####.l####.ir/ads/262ed2aa-63d2-4d70-9479-ee8d07608cb0.png
- e####.l####.ir/ads/830d35e5-6234-4e18-83d1-eb34257f8802.png
- e####.l####.ir/ads/c3b2fce5-5b58-47da-b394-6cb802eb9a68.png
- e####.l####.ir/htmlads/downloadIcon.png
- gen####.shahr####.ir/global3.txt
- ip.p####.co/geoip
- kimiade####.net/splash2.html
- srv.magneta####.com/2019/2/464797e02a8345aba250ccdf1ba1bb7b/NativeAdPort...
- srv.magneta####.com/2019\1\3380f4da4ecc4db9a479371704706a0c\NativeAdIcon...
- srv.magneta####.com/2019\1\464797e02a8345aba250ccdf1ba1bb7b\NativeAdIcon...
- srv.magneta####.com/2019\1\4a11739243994a159fd5e91c5042df3f\NativeAdIcon...
- srv.magneta####.com/2019\1\8361ea5890bc4e239fd74d9b26585827\NativeAdIcon...
- srv.magneta####.com/2019\2\9d50580a133c4c629cd34d884fdd41ae\NativeAdIcon...
- srv.magneta####.com/helper/click/61de94f7a2ba4b3c8575d8492512fa66/41fcd0...
- t####.magneta####.com/vizit/11989/co.narin.digibazi.apk
- t####.magneta####.com/vizit/12185/com.huawei.iran.avano.apk
- t####.magneta####.com/vizit/12313/com.snapphitt.trivia.apk
- w####.l####.ir/ad.svc/gal3/0/<Operator Name>/310004/<Operator Name>/unkn...
- w####.l####.ir/ad.svc/gb3/0/<Operator Name>/310004/<Operator Name>/unkno...
- w####.l####.ir/ad.svc/gs3/0/<Operator Name>/310004/<Operator Name>/unkno...
- w####.l####.ir/ad.svc/ru3/0/-1/unknown/<System Property>/<System Propert...
- www.visi####.com/ads/1263d0b4-1b55-4ef0-86dd-a6a233a83dfd.jpg
- www.visi####.com/ads/21ce5d0f-b5d5-46f1-8ee8-d24de2f3135f.jpg
- www.visi####.com/ads/5b92a42d-7011-4097-9624-f3fcd596cbe9.jpg
- www.visi####.com/ads/851e689f-c134-438e-b0e2-a17a6f8ec0ca.jpg
- www.visi####.com/ads/b7f89647-19a0-46e8-a60e-664e4ee444be.jpg
- www.visi####.com/ads/d5191866-8554-45e0-aea5-52c65af47bcf.jpg
- www.visi####.com/htmlads/arrow.png
- www.visi####.com/htmlads/device.js?v=####
- www.visi####.com/htmlads/generatedfiles/504.html?v=####
- www.visi####.com/htmlads/splashclose.png
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/03a855b0107dc207b917b84f476a1948.0.tmp
- /data/data/####/03a855b0107dc207b917b84f476a1948.1.tmp
- /data/data/####/066203ba5d7739ad9c70ddd45c3d73f0.0.tmp
- /data/data/####/066203ba5d7739ad9c70ddd45c3d73f0.1.tmp
- /data/data/####/0cedb0c825dd41e6f48da0755cc367e2.0.tmp
- /data/data/####/0cedb0c825dd41e6f48da0755cc367e2.1.tmp
- /data/data/####/2c17de2fbb2e6905a1f0baf094bd082b.0.tmp
- /data/data/####/2c17de2fbb2e6905a1f0baf094bd082b.1.tmp
- /data/data/####/46fa2757f114f0e9576df77721f0d84d.0.tmp
- /data/data/####/46fa2757f114f0e9576df77721f0d84d.1.tmp
- /data/data/####/5191064813d53177933c720e3f4766ad.0.tmp
- /data/data/####/5191064813d53177933c720e3f4766ad.1.tmp
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7BeginSession.cls_temp
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7BeginSession.json
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionApp.cls_temp
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionApp.json
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionDevice.cls_temp
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionDevice.json
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionOS.cls_temp
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionOS.json
- /data/data/####/5C6627D30383-0001-0AD3-ECF3FE85AFC7SessionUser.cls_temp
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7BeginSession.cls_temp
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7BeginSession.json
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionApp.cls_temp
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionApp.json
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionDevice.cls_temp
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionDevice.json
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionOS.cls_temp
- /data/data/####/5C6627D400E7-0001-0AF9-ECF3FE85AFC7SessionOS.json
- /data/data/####/5b1bb0fda709614bb37b8c5dfc8ef8ca.0.tmp
- /data/data/####/5b1bb0fda709614bb37b8c5dfc8ef8ca.1.tmp
- /data/data/####/73d76191fe27e35b11ca0b2a770d3d61.0.tmp
- /data/data/####/73d76191fe27e35b11ca0b2a770d3d61.1.tmp
- /data/data/####/7f8bbda8c2db2753350e9ae043f2090f.0.tmp
- /data/data/####/7f8bbda8c2db2753350e9ae043f2090f.1.tmp
- /data/data/####/87695201516080224b1125a6d7c01561.0.tmp
- /data/data/####/87695201516080224b1125a6d7c01561.1.tmp
- /data/data/####/949554d1c31b6c1610140c406e514e51.0.tmp
- /data/data/####/949554d1c31b6c1610140c406e514e51.1.tmp
- /data/data/####/AdjustAttribution
- /data/data/####/AdjustIoActivityState
- /data/data/####/AdjustIoPackageQueue
- /data/data/####/DIGIBAZI_DB
- /data/data/####/DIGIBAZI_DB-journal
- /data/data/####/LocalCampaignsSQLTracker.db-journal
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/adjust_preferences.xml
- /data/data/####/af8bc7bf6eb84226317eaaf54fea007a.0.tmp
- /data/data/####/af8bc7bf6eb84226317eaaf54fea007a.1.tmp
- /data/data/####/ba_tr.db-journal
- /data/data/####/bastion_kv.xml
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/co.ronash.pushe.keystore.xml.bak
- /data/data/####/com.batch.optout.xml
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.developer.ghabc_preferences.xml
- /data/data/####/com.developer.ghabc_preferences.xml.bak
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml (deleted)
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak (deleted)
- /data/data/####/d8bdb9d3d8685b6777db7da2dccfcf96.0.tmp
- /data/data/####/d8bdb9d3d8685b6777db7da2dccfcf96.1.tmp
- /data/data/####/d8e62b5edbe4dc33d4c3ec91694cf487.0.tmp
- /data/data/####/d8e62b5edbe4dc33d4c3ec91694cf487.1.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/evernote_jobs.db
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/f661523c1ef3615d2d479da178ef6bc9.0.tmp
- /data/data/####/f661523c1ef3615d2d479da178ef6bc9.1.tmp
- /data/data/####/f6c5bc8e2b447eb8c62c186a0e6d0deb.0.tmp
- /data/data/####/f6c5bc8e2b447eb8c62c186a0e6d0deb.1.tmp
- /data/data/####/fff61b30570c67afaba05b2fd2b951a5.0.tmp
- /data/data/####/fff61b30570c67afaba05b2fd2b951a5.1.tmp
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
- /data/data/####/journal.tmp
- /data/data/####/sa_81dd4d87-a43e-4056-84b6-85146b5c10ab_1550198739512.tap
- /data/data/####/sa_93e5ea49-beed-41d3-b722-0e00ea7def7d_1550198743282.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/unsent_requests
- /data/media/####/26f605bb-552f-453c-b410-7a7fe88cafff.html
- /data/media/####/NativeAdPortraitImage-large.jpg
- /data/media/####/co.narin.digibazi-1.apk
- /data/media/####/co.narin.digibazi-1downloadIcon.png
- /data/media/####/com.huawei.iran.avano-1downloadIcon.png
- /data/media/####/com.pooyeshgaran.hamechidan-1.apk
- /data/media/####/com.pooyeshgaran.hamechidan-1downloadIcon.png
- /data/media/####/com.snapphitt.trivia-1.apk
- /data/media/####/com.snapphitt.trivia-1downloadIcon.png
- /data/media/####/device.js
- /data/media/####/ir.persamob.fandoghestan-1downloadIcon.png
- /data/media/####/splash2.html#
- /data/media/####/splashclose.png
Другие:
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5PADDING
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из SMS.
