Adware.Was.8751

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Was.1.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) g####.62####.com:8001
TCP(HTTP/1.1) f1.ma####.xi####.####.com:80
TCP(HTTP/1.1) cdn-sto####.unit####.uni####.####.net:80
TCP(HTTP/1.1) api.zuuksg####.com:80
TCP(HTTP/1.1) z####.ad.xi####.com:80
TCP(HTTP/1.1) a.da####.com:9127
TCP(HTTP/1.1) cdn-cre####.unit####.uni####.####.net:80
TCP(TLS/1.0) co####.uca.c####.####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) 1####.217.169.42:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) adc3-la####.adco####.com:443
TCP(TLS/1.0) l####.chartb####.com:443
TCP(TLS/1.0) eve####.adco####.com:443
TCP(TLS/1.0) z####.ad.xi####.com:443
TCP(TLS/1.0) api-acc####.edges####.net:443
TCP(TLS/1.0) events####.adco####.com:443
TCP(TLS/1.0) adc3-as####.adco####.com:443
TCP(TLS/1.0) onesi####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) a2.chartb####.com:443
TCP(TLS/1.0) prd-le####.cdp.inte####.####.com:443
TCP(TLS/1.0) au####.unit####.uni####.com:443
TCP(TLS/1.0) sdkco####.ad.xi####.com:443
TCP(TLS/1.0) wd.adco####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) sc####.go####.com:443
TCP(TLS/1.0) a####.adco####.com:443
TCP(TLS/1.0) c4d####.adco####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) adc-ad-####.ad####.com:443
TCP(TLS/1.0) publish####.unit####.uni####.com:443
TCP(TLS/1.0) ipv4-wi####.appl####.com.####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP p####.google####.com:443

Запросы DNS:

a####.adco####.com
a.appl####.com
a.da####.com
a2.chartb####.com
a4.appl####.com
adc-ad-####.ad####.com
adc3-as####.adco####.com
adc3-la####.adco####.com
and####.cli####.go####.com
api.ad.xi####.com
api.vu####.com
api.zuuksg####.com
au####.unit####.uni####.com
auc####.unit####.uni####.com
c4d####.adco####.com
cdn-cre####.unit####.uni####.com
cdn-sto####.unit####.uni####.com
cdp.c####.uni####.com
co####.uca.c####.####.com
co####.unit####.uni####.com
connect####.gst####.com
d.appl####.com
eve####.adco####.com
events####.adco####.com
f1.ma####.xi####.com
f2.ma####.xi####.com
g####.62####.com
g####.face####.com
l####.chartb####.com
onesi####.com
p####.google####.com
pag####.googles####.com
pla####.googleu####.com
publish####.unit####.uni####.com
rt.appl####.com
sc####.go####.com
sdkco####.ad.xi####.com
t2.chartb####.com
wd.adco####.com
web####.unit####.uni####.com
www.google-####.com
z####.ad.xi####.com

Запросы HTTP GET:

a.da####.com:9127/ll/gs?baseversion=####&version=####&channel=####&appid...
a2.chartb####.com:443/apps/icons/56cf146d04b0165b7dc88418.114.png
a2.chartb####.com:443/base_templates/html/playable-core-v2-CBCloseButton...
a2.chartb####.com:443/base_templates/html/static-etna-e4bf514d28.html
a2.chartb####.com:443/base_templates/html/video-v3_01-ad549ad595.html
adc-ad-####.ad####.com:443/launch/__controllers__/3.1.0/1.0.7.33/ADCAdUn...
adc-ad-####.ad####.com:443/launch/__controllers__/3.1.0/1.0.7.33/ADCInst...
adc-ad-####.ad####.com:443/launch/__controllers__/3.1.0/1.0.7.33/ADCMRAI...
adc-ad-####.ad####.com:443/launch/__controllers__/3.1.0/1.0.7.33/android...
adc3-as####.adco####.com:443/pull/05021bc928410f4808d53f17bff79b94
adc3-as####.adco####.com:443/pull/09ac9df0d3175de20514cca70e4a3cbf
adc3-as####.adco####.com:443/pull/0f3db0d8f947d27b243c1faa8c88110f
adc3-as####.adco####.com:443/pull/48b6084f6b4bf72b249eeafb89bacbba
adc3-as####.adco####.com:443/pull/57068541632fb6e91c33f18f2b422e6c
adc3-as####.adco####.com:443/pull/663caa41472d21f636c4c4ea3509d0fd
adc3-as####.adco####.com:443/pull/72085ea0b46f9258ec25055ebb775a98
adc3-as####.adco####.com:443/pull/7acba3096e6d2fb5a73b1aaf98647368
adc3-as####.adco####.com:443/pull/7e4c7cfdc6e2ad17def64eee1df9c063
adc3-as####.adco####.com:443/pull/8541a1231ce16a3cd497a62392f80eec
adc3-as####.adco####.com:443/pull/94e393119255ece5818e2c31c56eff1a
adc3-as####.adco####.com:443/pull/9e863f7216fbbd29d3d97f04cf389a4e
adc3-as####.adco####.com:443/pull/a3fc10a0888b7b7ec1e98aa3ae939d34
adc3-as####.adco####.com:443/pull/a5f785a627f6d2a395f351dc01c413dc
adc3-as####.adco####.com:443/pull/a773392064e3d29fc6126d043db66f4a
adc3-as####.adco####.com:443/pull/d84a4bbb57d6e688e57b820272607b45
adc3-as####.adco####.com:443/pull/e2e9f0c54a835139d18c9ab009bd2604
adc3-as####.adco####.com:443/pull/eb1f75c0520af3b06da5101567ed188e
adc3-as####.adco####.com:443/pull/fa3b52d96e724daf591fa4fb38a75838
and####.cli####.go####.com:443/collect?v=####&ul=####&sr=####&an=####&ti...
api.face####.com:443/v2.9/753250764883192?fields=####&format=####&sdk=####
api.zuuksg####.com/api/?api_version=####&action=####&app_code=####&ad_fo...
c4d####.adco####.com:443/adc/3.2.2/210512/108af074-dd2e-41b2-bfde-e21de0...
cdn-cre####.unit####.uni####.####.net/assets/5d407b37411b82001d7d835a/40...
cdn-cre####.unit####.uni####.####.net/assets/5ea369f3142e4cd4251a19ff/VP...
cdn-sto####.unit####.uni####.####.net/store-icons/a285e811-38be-4e5f-8e2...
f1.ma####.xi####.####.com/download/AdCenter/04b69d2b65e6a445ba363a62ab5d...
ipv4-wi####.appl####.com.####.net:443/3.0/ad?accept=####&v4=####&api_did...
ipv4-wi####.appl####.com.####.net:443/nad?accept=####&v4=####&api_did=##...
onesi####.com:443/api/v1/apps/de51b1b2-1b0d-4f76-a519-949f3cc271aa/andro...
pag####.googles####.com:443/pagead/gen_204?id=####&action=####&js=####&o...
publish####.unit####.uni####.com:443/games/1543111/configuration?deviceM...
sc####.go####.com:443/macros/s/AKfycbwXOC6LyY0KVFN4_MivA15-zMjkIGbj4uL8C...
sdkco####.ad.xi####.com:443/api/checkupdate/lastusefulversion2?av=####&c...
unit####.edges####.net:443/webview/2.1.0/release/config.json?ts=####&sdk...
unit####.edges####.net:443/webview/2.1.0/release/index.html

Запросы HTTP POST:

a####.adco####.com:443/configure
a.da####.com:9127/ll//uu?t=####
adc3-la####.adco####.com:443/v4/launch
api-acc####.edges####.net:443/api/v4/config
api-acc####.edges####.net:443/api/v4/new?app_id=####&isu=####
api-acc####.edges####.net:443/api/v4/requestAd
api-acc####.edges####.net:443/api/v4/sessionStart
api.face####.com:443/v2.9/753250764883192/activities?access_token=####&f...
api.face####.com:443/v2.9/753250764883192/activities?format=####&sdk=####
au####.unit####.uni####.com:443/v1/category/experiment
co####.uca.c####.####.com:443/
eve####.adco####.com:443/t/5.0/ad_request?pl=kJm2####
eve####.adco####.com:443/t/5.0/ad_request?pl=zhpe####
eve####.adco####.com:443/t/5.0/cache_state?pl=1a1o####
eve####.adco####.com:443/t/5.0/cache_state?pl=GkTM####
eve####.adco####.com:443/t/5.0/filled?pl=1a1o####
eve####.adco####.com:443/t/5.0/filled?pl=GkTM####
eve####.adco####.com:443/t/5.0/update?pl=IJCw####
events####.adco####.com:443/t/5.0/session_start?pl=IJCw####
g####.62####.com:8001/adStatistics
g####.62####.com:8001/addNewApp
g####.62####.com:8001/gameState
ipv4-wi####.appl####.com.####.net:443/device?api_key=####
ipv4-wi####.appl####.com.####.net:443/pix?api_did=####&volume=####&count...
l####.chartb####.com:443/api/config
l####.chartb####.com:443/api/install
l####.chartb####.com:443/webview/v2/interstitial/get
l####.chartb####.com:443/webview/v2/prefetch
nginx-a####.unit####.uni####.com:443/v6/games/1543111/requests?androidId...
prd-le####.cdp.inte####.####.com:443/v1/events
wd.adco####.com:443/logs
z####.ad.xi####.com/union/fetchAds
z####.ad.xi####.com:443/client/upgrade/mimo/v1

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.cl
/data/data/####/.hptc.cache_alet.parking.xc
/data/data/####/.jg.ic
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_cf
/data/data/####/.jgck
/data/data/####/026ae9c9824b3e483fa6c71fa88f57ae27816141
/data/data/####/05021bc928410f4808d53f17bff79b94.js
/data/data/####/05d6b65d-be35-4cc8-bbee-13424536226f
/data/data/####/07e67144-a75c-4693-bcf1-246a777a18f9
/data/data/####/09ac9df0d3175de20514cca70e4a3cbf.js
/data/data/####/0f3db0d8f947d27b243c1faa8c88110f.html
/data/data/####/0f5c114d-285d-4b0e-9bcb-b0ebf51985a6
/data/data/####/1
/data/data/####/2
/data/data/####/20
/data/data/####/2e21c981-c7ce-483e-b07e-aa11432db2bd
/data/data/####/3
/data/data/####/32bf82aa-be34-4700-b151-0737babaa113
/data/data/####/35d28e56-03b4-4b52-ae5b-39921d202212
/data/data/####/36250f94-207d-4053-9fb9-b0057df01d31
/data/data/####/3ef59754-a2e9-4d0c-943d-048381f7d3de
/data/data/####/422de421e0f4e019426b9abfd780746bc40740eb
/data/data/####/48b6084f6b4bf72b249eeafb89bacbba.js
/data/data/####/50a23862-37b4-4427-87b7-40428c399e6b
/data/data/####/559d480d-3830-4db7-9a4e-9d5741bd5a4e
/data/data/####/57068541632fb6e91c33f18f2b422e6c.jpg
/data/data/####/663caa41472d21f636c4c4ea3509d0fd.js
/data/data/####/72085ea0b46f9258ec25055ebb775a98.js
/data/data/####/7acba3096e6d2fb5a73b1aaf98647368.js
/data/data/####/7bf3a1e7bbd31e612eda3310c2cdb8075c43c6b5
/data/data/####/7e4c7cfdc6e2ad17def64eee1df9c063.js
/data/data/####/7ff7edae-256f-4c44-a1e2-68d22d27b06a
/data/data/####/8541a1231ce16a3cd497a62392f80eec.js
/data/data/####/89ed450e-cc7a-417a-96f3-3d184721b81a
/data/data/####/94e393119255ece5818e2c31c56eff1a.mp4
/data/data/####/9e863f7216fbbd29d3d97f04cf389a4e.mp4
/data/data/####/9fbd20d6-418d-4ba7-b7eb-85b2b541eec3
/data/data/####/9fc5eaac3813d9502e2c301f2645e6da_nearby.dex
/data/data/####/9fc5eaac3813d9502e2c301f2645e6da_nearby.dex.flo...leted)
/data/data/####/9fc5eaac3813d9502e2c301f2645e6da_nearby.jar
/data/data/####/AppInfo
/data/data/####/AppVersion
/data/data/####/INSTALLATION
/data/data/####/OneSignal.db-journal
/data/data/####/OneSignal.xml
/data/data/####/VUNGLE_PUB_APP_INFO.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_m_rec.xml
/data/data/####/a3fc10a0888b7b7ec1e98aa3ae939d34.js
/data/data/####/a5f785a627f6d2a395f351dc01c413dc.png
/data/data/####/a67d5dc2a1b2b8b1fab5e8f920120ade_games.dex
/data/data/####/a67d5dc2a1b2b8b1fab5e8f920120ade_games.dex.flock (deleted)
/data/data/####/a67d5dc2a1b2b8b1fab5e8f920120ade_games.jar
/data/data/####/a690dad7-c84d-46e9-9daa-66b3c6b1f818
/data/data/####/a773392064e3d29fc6126d043db66f4a.js
/data/data/####/ac3d51c8-c607-46b8-8ac6-e9732072cd39
/data/data/####/analytics.apk.tmp
/data/data/####/analytics_updater.xml
/data/data/####/b1a9711b-cbbe-483e-9483-a3e9123ca6dc
/data/data/####/c46f5b79-0528-4b10-9b55-ca2f880122bb
/data/data/####/cbPrefs.xml
/data/data/####/cb_previous_session_info
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cheuu
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.oat
/data/data/####/com.applovin.sdk.1.xml
/data/data/####/com.applovin.sdk.impl.postbackQueue.domain.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.zuuks.valet.parking.xc.v2.playerprefs.xml
/data/data/####/com.zuuks.valet.parking.xc.v2.playerprefs.xml.bak
/data/data/####/com.zuuks.valet.parking.xc_preferences.xml
/data/data/####/d84a4bbb57d6e688e57b820272607b45.js
/data/data/####/d98ffdfa-8724-4c8e-a1c3-5bbdfcbfc897
/data/data/####/da972977-3ec5-4f1e-bdca-fbe6ea3edf92
/data/data/####/e2e9f0c54a835139d18c9ab009bd2604.js
/data/data/####/e6b3f01a-d57f-432b-9d12-43e03c9896ff
/data/data/####/eb1f75c0520af3b06da5101567ed188e.jpg
/data/data/####/ee4bb2b7-7a7c-40ba-a50c-1a8e12e02a2d
/data/data/####/f57f6c40-54f9-421a-86ba-8a922d4e1b38
/data/data/####/fa3b52d96e724daf591fa4fb38a75838.html
/data/data/####/index
/data/data/####/journal
/data/data/####/libjiagu.so
/data/data/####/media
/data/data/####/metrics_guid
/data/data/####/mimo_asset.apk
/data/data/####/mimo_asset.dex
/data/data/####/mimo_asset.dex.flock (deleted)
/data/data/####/network_requests
/data/data/####/plugin_updater.xml
/data/data/####/proc_auxv
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/the-real-index
/data/data/####/tmd
/data/data/####/tv
/data/data/####/umeng_general_config.xml
/data/data/####/uuloi
/data/data/####/vungle-journal
/data/data/####/vva
/data/data/####/vva.dex
/data/data/####/vva.dex.flock (deleted)
/data/data/####/vva.jar
/data/data/####/yg_cache_prefs.xml
/data/data/####/zeus_pms.xml
/data/media/####/.nomedia
/data/media/####/56cf146d04b0165b7dc88418.114.png
/data/media/####/6188fcd13913ae079fa1b6b0.json
/data/media/####/6188fcd1fd7a1c07a0997675.json
/data/media/####/62022a43634635389e2d64ec.json
/data/media/####/8118c3d5077104b8b973ff5ebd221fa8_tmp (deleted)
/data/media/####/UnityAdsCache-9cce4efe93002c6241640ab16c00d79a...40.png
/data/media/####/UnityAdsCache-bccd9844070eb8c54ddcca3684fefda6...96.png
/data/media/####/UnityAdsCache-f4f7e638961494bade9335ef18edb560...6.webm
/data/media/####/UnityAdsStorage-private-data.json
/data/media/####/UnityAdsStorage-public-data.json
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsWebApp.html
/data/media/####/config
/data/media/####/e
/data/media/####/g
/data/media/####/playable-core-v2-CBCloseButton--1136896784
/data/media/####/playable-core-v2-CBCloseButton--1136896784.tmp
/data/media/####/s
/data/media/####/static-etna-366428459.tmp
/data/media/####/values
/data/media/####/video-v3_01-2068878963
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

cat /sys/class/net/wlan0/address

Загружает динамические библиотеки:

libadcolony
libgpg
libjiagu
libjs
libmain

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней