Adware.Was.10205

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Was.1.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) cdn-cre####.acq####.unity3d####.####.net:80
TCP(HTTP/1.1) cdn-sto####.unit####.uni####.####.net:80
TCP(HTTP/1.1) api.ad.xi####.com:80
TCP(HTTP/1.1) sdkco####.ad.xi####.com:80
TCP(HTTP/1.1) daa.shu####.cn:80
TCP(HTTP/1.1) api.shu####.cn:80
TCP(HTTP/1.1) dai.shu####.cn:8080
TCP(HTTP/1.1) a.da####.com:9127
TCP(HTTP/1.1) a####.u####.com.####.com:80
TCP(HTTP/1.1) g####.62####.com:8001
UDP(NTP) p####.ntp.org:123
TCP(TLS/1.0) publish####.unit####.uni####.com:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) networ####.ss####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) wild####.moa####.com.####.net:443
TCP(TLS/1.0) 1####.251.36.3:443
TCP(TLS/1.0) ws.tapjo####.com:443
TCP(TLS/1.0) con####.ta####.com:443
TCP(TLS/1.0) rpc.ta####.com:443
TCP(TLS/1.0) au####.unit####.uni####.com:443
TCP(TLS/1.0) 1####.217.168.234:443
TCP(TLS/1.0) d.ap####.com:443
TCP(TLS/1.0) i####.superso####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) placem####.ta####.com:443
TCP(TLS/1.0) outcome####.superso####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) c####.jq####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) f.ma####.c.####.com:443
TCP(TLS/1.0) 1####.250.179.142:443
TCP(TLS/1.0) 1####.217.168.238:443
TCP(TLS/1.0) ui####.oss-cn-####.aliy####.com:443
TCP(TLS/1.2) 1####.217.168.234:443
TCP(TLS/1.2) 1####.250.179.142:443
TCP(TLS/1.2) 1####.217.168.238:443
TCP tp-se####.appspot####.com:443
TCP www.go####.com:443
TCP encry####.go####.com:443
TCP tp-prod####.app####.com:443

Запросы DNS:

106.39.251.####.arpa
138.179.250.####.arpa
142.179.250.####.arpa
165.120.108.####.arpa
234.168.217.####.arpa
254.9.0.####.arpa
3.36.251.####.arpa
58.18.157.####.arpa
a####.u####.com
a.ap####.com
a.da####.com
and####.google####.com
api.ad.xi####.com
api.shu####.cn
app-mea####.com
au####.unit####.uni####.com
auc####.unit####.uni####.com
c####.jq####.com
cdn-cre####.acq####.unity3d####.com
cdn-sto####.unit####.uni####.com
cloudco####.google####.com
co####.unit####.uni####.com
con####.ta####.com
con####.ta####.com
d.ap####.com
daa.shu####.cn
dai.shu####.cn
encry####.go####.com
f5.ma####.xi####.com
g####.62####.com
g####.face####.com
i####.superso####.com
networ####.ss####.com
outcome####.superso####.com
p####.google####.com
p####.ntp.org
placem####.ta####.com
publish####.unit####.uni####.com
rpc.ta####.com
rt.ap####.com
safebro####.google####.com
sdkco####.ad.xi####.com
sett####.crashly####.com
sett####.crashly####.com.####.8
tp-prod####.app####.com
tp-se####.appspot####.com
trac####.m####.com
ui####.oss-cn-####.aliy####.com
ws.tapjo####.com
www.go####.com
z.moa####.com

Запросы HTTP GET:

a.da####.com:9127/ll/gs?baseversion=####&version=####&channel=####&appid...
api.face####.com:443/v2.11/fappid?fields=####&format=####&sdk=####
cdn-cre####.acq####.unity3d####.####.net/assets/621dfd5eecd44e93bba9ea99...
cdn-cre####.acq####.unity3d####.####.net/assets/6246fd424001e542ddabaad6...
cdn-sto####.unit####.uni####.####.net/store-icons/d87ff263-a422-4a36-95f...
con####.ta####.com:443/assets/ad_unit/loader-634117884ad6e001da18755836b...
con####.ta####.com:443/assets/ad_unit/vast_unit-12ba5a1497409a13ce1f5300...
con####.ta####.com:443/assets/adunit-full-8bf9b1623a6546b99ff13e9ab81973...
con####.ta####.com:443/assets/compound_unit/behavior-da9209e3e2f61bdda61...
con####.ta####.com:443/assets/custom_html_unit/behavior-823aeb56d292384a...
con####.ta####.com:443/assets/shared/interstitial-595d11bbdc67fb3c41a076...
con####.ta####.com:443/assets/vast_unit/behavior-35198f4663d22cd5c771faa...
con####.ta####.com:443/compound/assets/365-4409f30454/compound.min.css
con####.ta####.com:443/compound/assets/365-4409f30454/modular_ad.min.js
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/history_page_buil...
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/manifest_build.js
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/offerwall_build.css
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/offerwall_build.js
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/polyfill_build.js
con####.ta####.com:443/offerwall_assets/632-c099b8ecff/vendor_build.js
d.ap####.com:443/3.0/ad?accept=####&v4=####&api_did=####&country_code=##...
d.ap####.com:443/nad?accept=####&v4=####&api_did=####&country_code=####&...
f.ma####.c.####.com:443/download/AdCenter/0e830c372382e473d94ba4667b014d...
i####.superso####.com:443/sdk/v6.7.5?request=####
networ####.ss####.com:443/mobileSDKController/mobileController.html
publish####.unit####.uni####.com:443/games/1719235/configuration?deviceM...
sdkco####.ad.xi####.com/api/checkupdate/lastusefulversion?currentApiVers...
sdkco####.ad.xi####.com/api/detail/461918ecb899c6ed7371981095d56e3a?ts=#...
sdkco####.ad.xi####.com/api/detail/54db829f09424caad69f7fb9350fa48d?ts=#...
sdkco####.ad.xi####.com/api/detail/5a0d76b426bd66bf94b94e19a8719e41?ts=#...
ui####.oss-cn-####.aliy####.com:443/unity_xm_1028.action
unit####.edges####.net:443/webview/2.1.1/4cec9885f8912c624d45f47478e7869...
unit####.edges####.net:443/webview/2.1.1/release/config.json?ts=####&sdk...
wild####.moa####.com.####.net:443/IRO/android/2bc3418/status.json?ts=###...
ws.tapjo####.com:443/set_publisher_user_id?device_type=####&display_h=##...

Запросы HTTP POST:

a####.u####.com.####.com/app_logs
a.da####.com:9127/ll//uu?t=####
api.ad.xi####.com/union/fetchAds
api.face####.com:443/v2.11/fappid/activities?access_token=####&format=##...
api.face####.com:443/v2.11/fappid/activities?format=####&sdk=####
api.shu####.cn/report?v=####&c=####&e=####
au####.unit####.uni####.com:443/v1/category/experiment
con####.ta####.com:443/api/connect/v3.json
d.ap####.com:443/device?api_key=####
d.ap####.com:443/pix?api_did=####&volume=####&country_code=####&sim=####...
daa.shu####.cn/report?v=####&c=####&e=####
dai.shu####.cn:8080/report?v=####&c=####&e=####
g####.62####.com:8001/adStatistics
g####.62####.com:8001/addNewApp
nginx-a####.unit####.uni####.com:443/v6/games/1719235/requests?advertisi...
outcome####.superso####.com:443/mediation?adUnit=####&sessionId=####&app...
placem####.ta####.com:443/v1/apps/e5fa8f5b-9e70-47dd-93d4-ccd2684f009e/c...
placem####.ta####.com:443/v1/apps/e5fa8f5b-9e70-47dd-93d4-ccd2684f009e/m...
rpc.ta####.com:443/api/v1/cevs
sdkco####.ad.xi####.com/track/v1

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.hptc_kache_olfevolution.xc
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/00b0f3a566ff967fce5a560a1773cae2f9a50ed2b50a435...1eb9aa
/data/data/####/0aa1201a52240b0d6b2ef61e78a125001c4f9c980cbf29b...c8405e
/data/data/####/19b5e04a22a167bd_0
/data/data/####/19b5e04a22a167bd_1
/data/data/####/1e414e81074cf81a_0
/data/data/####/3010e1b45e257a276560433113d0abfa47383bc49ded304...7fc7f2
/data/data/####/305e92b552f0b149f572e401c5e9b4fb1d1c5bbf57888f3...42e92b
/data/data/####/325443351d4161d5_0
/data/data/####/325443351d4161d5_1
/data/data/####/3baded48d30054b87c9d49bfb618e19f0a164770d874478...1470db
/data/data/####/4854f100aaee66f406ea72785ea2acb4cde5be4d94637c4...054bb0
/data/data/####/596025bf5194657b_0
/data/data/####/596025bf5194657b_1
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780BeginSession.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780BeginSession.json
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionApp.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionApp.json
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionDevice.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionDevice.json
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionEvent...07.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionEvent...08.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionEvent...09.cls
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionEvent...s_temp
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionOS.cls_temp
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780SessionOS.json
/data/data/####/625349710034-0001-0D30-C0E5DFD1D780keys.meta
/data/data/####/6b5630e5db9cdfecc8b968bb92af81857d87d7e4670fea7...9450f5
/data/data/####/762d7a70c472bd89cf3cf9cb042affa1a49df48b9117826...99510c
/data/data/####/7aa15ccbdd3b0416_0
/data/data/####/7aa15ccbdd3b0416_1
/data/data/####/7c620c3f45f15cc8_0
/data/data/####/9d42fd6d01ed424797feb3fe082c4403c1d6145e3e42cff...99a925
/data/data/####/AdServer_asset.apk
/data/data/####/AdServer_asset.dex
/data/data/####/AdServer_asset.dex.flock (deleted)
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/Cookies-journal
/data/data/####/FirebasePerfSharedPrefs.xml
/data/data/####/Mediation_Shared_Preferences.xml
/data/data/####/ReporterService.xml
/data/data/####/TPDLC-Info.json
/data/data/####/TPTableToDiskMetadata.db
/data/data/####/TPTableToDiskMetadata.db-journal
/data/data/####/TPTableToDiskMetadata.db-journal (deleted)
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/_miad_sdk_module_versions.xml
/data/data/####/analytics.apk.tmp
/data/data/####/analytics.db-journal
/data/data/####/analytics_asset.apk
/data/data/####/analytics_asset.dex
/data/data/####/analytics_asset.dex.flock (deleted)
/data/data/####/apkloader.xml
/data/data/####/apkloader.xml.bak
/data/data/####/br.com.tapps.wolfevolution.xc_dna.xml
/data/data/####/br.com.tapps.wolfevolution.xc_preferences.xml
/data/data/####/br.com.tapps.wolfevolution.xc_preferences.xml.bak
/data/data/####/br.com.tapps.wolfevolution.xc_prefs.xml
/data/data/####/c3db525304722ddfe37c39ee77880a624fd64e95c97e2e5...603176
/data/data/####/c4c47fdf2cf6b9d4a3c522777dec0a0703945ccc0f68e7f...f10278
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cheuu
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/com.applovin.sdk.1.xml
/data/data/####/com.applovin.sdk.preferences.Ra31GHTlRgcB-un7sT...__.xml
/data/data/####/com.applovin.sdk.preferences.Ra31GHTlRgcB-un7sT...ml.bak
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/ddae487885c0833633e76326daa10199df9ffb2787943bf...037512
/data/data/####/e61027d2162f76d4edb3b4303c0d7ed55ddfda25b249a7d...72bacf
/data/data/####/e7308e56284d69846043cb39564e7579a8d87f17c12cdb7...252cf4
/data/data/####/ead6d79e11f2359a67e3a3554984b9018f7eb33d8ca2df0...9dcd0c
/data/data/####/events2-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f3d51800f3d63a76_0
/data/data/####/fiverocks.xml
/data/data/####/gdtadv2.jar
/data/data/####/gdtadv2.jar.sig
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/heartbeat.xml
/data/data/####/hjtmp
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/install
/data/data/####/kva
/data/data/####/libanalytics.so
/data/data/####/libas.so
/data/data/####/libdu.so
/data/data/####/libjiagu.so
/data/data/####/metrics_guid
/data/data/####/persisted_config
/data/data/####/policy.cache
/data/data/####/proc_auxv
/data/data/####/requests.db-journal
/data/data/####/sa_809e420e-b1a0-49e4-8c71-e2210e3d0e35_1649625462637.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/shuzilm.db
/data/data/####/supersonic_sdk.db
/data/data/####/supersonic_sdk.db-journal
/data/data/####/supersonic_shared_preferen.xml
/data/data/####/tables.db
/data/data/####/tables.db-journal
/data/data/####/tables.db-journal (deleted)
/data/data/####/tapjoyCacheData.xml
/data/data/####/tapjoyCacheData.xml.bak
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/tjcPrefrences.xml
/data/data/####/tmd
/data/data/####/tv
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/updater.xml
/data/data/####/vva
/data/data/####/vva.dex
/data/data/####/vva.dex.flock (deleted)
/data/data/####/vva.jar
/data/media/####/.nomedia
/data/media/####/UnityAdsCache-4afc02b3a64c72b1801081d1601f32d5...1e.jpg
/data/media/####/UnityAdsCache-ae826a32f4d9cfa954b23941a6eae2be...6a.jpg
/data/media/####/UnityAdsCache-cd404e825c074e8a18cdb14f55449101...2.webm
/data/media/####/UnityAdsStorage-private-data.json
/data/media/####/UnityAdsStorage-public-data.json
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsTest.txt (deleted)
/data/media/####/UnityAdsWebApp.html
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/aart
/data/media/####/actt
/data/media/####/lut
/data/media/####/mobileController.html
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

cat /sys/class/net/wlan0/address
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
getprop net.hostname
ls /dev/socket
netstat
ps
service call iphonesubinfo 1
sh -c cat /proc/cpuinfo
sh -c cat /proc/net/arp
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid

Загружает динамические библиотеки:

libc++_shared
libdu
libjiagu
libjnlua5.1
libmpg123
libopenal

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Запрашивает разрешение на отображение системных уведомлений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней