Android.DownLoader.5284

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.1051.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) vg-aws-####.ray####.com:80
TCP(HTTP/1.1) vg-ne####.ray####.com:80
TCP(TLS/1.0) bxx.pooboo####.com:443
TCP(TLS/1.0) c####.between####.com:443
TCP(TLS/1.0) re####.ads.vu####.com:443
TCP(TLS/1.0) t.rtb####.com:443
TCP(TLS/1.0) adx-vg####.topon####.com:443
TCP(TLS/1.0) configv####.unit####.uni####.com:443
TCP(TLS/1.0) p####.birdg####.com:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) t####.lacu####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) api.topon####.com:443
TCP(TLS/1.0) api.byteg####.ak####.net:443
TCP(TLS/1.0) tk.topon####.com:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) httpk####.unit####.uni####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) hy####.ray####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) ads.between####.com:443
TCP(TLS/1.0) web.next####.me:443
TCP(TLS/1.0) i####.opr.adx.####.com:443
TCP(TLS/1.0) www.tns-cou####.ru:443
TCP(TLS/1.0) new.ads.vu####.com:443
TCP(TLS/1.0) n####.bidders####.com:443
TCP(TLS/1.0) pangol####.isn####.com.####.net:443
TCP(TLS/1.0) tnc16-a####.isn####.com.####.net:443
TCP(TLS/1.0) nginx-a####.unit####.uni####.com:443
TCP(TLS/1.0) ssp-rtb####.s####.ru:443
TCP(TLS/1.0) t####.buzz####.com:443
TCP(TLS/1.0) r.m####.net:443
TCP(TLS/1.0) da.topon####.com:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) raw.githubu####.com:443
TCP(TLS/1.0) i####.a####.com:443
TCP(TLS/1.0) ad####.topon####.com:443
TCP(TLS/1.0) co####.ads.vu####.com:443
TCP(TLS/1.0) ad####.ray####.com:443
TCP(TLS/1.0) sf16-st####.i18n-pg####.com.####.net:443
TCP(TLS/1.0) adx-s####.ads.vu####.com:443
TCP(TLS/1.0) d2zi34f####.cloudf####.net:443
TCP(TLS/1.0) gwbudge####.iym####.me:443
TCP(TLS/1.0) mc.ya####.ru:443
TCP(TLS/1.0) aa.birdg####.com:443
TCP(TLS/1.0) us01####.ray####.com:443
TCP(TLS/1.2) 1####.194.222.94:443
TCP t####.lacu####.com:443
TCP d####.topon####.com:9377

Запросы DNS:

a####.com
aa.birdg####.com
ad####.ray####.com
ad####.topon####.com
ads.between####.com
adx-s####.ads.vu####.com
adx-vg####.topon####.com
and####.b####.qq.com
api.topon####.com
api16-a####.pa####.io
auction####.unit####.uni####.com
bxx.pooboo####.com
c####.between####.com
cd####.vu####.com
cdn####.s####.ru
co####.ads.vu####.com
co####.unit####.uni####.com
conf####.unit####.uni####.com
d####.topon####.com
d2zi34f####.cloudf####.net
da.topon####.com
ev####.ads.vu####.com
f####.gst####.com
g####.face####.com
googl####.g.doublec####.net
gwbudge####.iym####.me
httpk####.unit####.uni####.com
hy####.ray####.com
i####.a####.com
i####.opr.adx.####.com
m####.go####.com
mc.ya####.ru
n####.bidders####.com
new.ads.vu####.com
opr.adx.o####.com
p####.birdg####.com
pangol####.isn####.com
pla####.google####.com
r.m####.net
raw.githubu####.com
re####.ads.vu####.com
sf16-st####.i18n-pg####.com
ssp-rtb####.s####.ru
t####.buzz####.com
t####.lacu####.com
t.rtb####.com
tk.topon####.com
tnc16-a####.isn####.com
us01####.ray####.com
vg-aws-####.ray####.com
vg-ne####.ray####.com
web.next####.me
www.google####.com
www.googlet####.com
www.tns-cou####.ru

Запросы HTTP GET:

ad####.ray####.com:443/impression?opri=Nj####&rid=####&impid=####&cid=##...
ad####.ray####.com:443/impression?opri=NjQ1MmZlYmVjOTM3NmYwMGwYMBnnwUWlj...
adx-s####.ads.vu####.com:443/api/v5/tpat?cid=####&crid=####&event_id=###...
configv####.unit####.uni####.com:443/games/5239676/configuration?deviceM...
d2zi34f####.cloudf####.net:443/i/22/08/23/10/50/u-1lQQIvJav8.jpg
d2zi34f####.cloudf####.net:443/i/22/10/28/18/54/u-oLuNuIRVrf.jpg
d2zi34f####.cloudf####.net:443/i/22/12/20/10/04/u-yeXKLJeM4q.jpg
d2zi34f####.cloudf####.net:443/i/23/01/04/15/59/u-NPmlikLHFj.jpg
d2zi34f####.cloudf####.net:443/i/23/01/24/00/14/u-XdMgajlrxW.jpg
d2zi34f####.cloudf####.net:443/i/23/01/31/11/55/u-jpFzHpmhuH.jpg
d2zi34f####.cloudf####.net:443/i/23/05/03/21/49/u-BsLb8mcire.jpg
d2zi34f####.cloudf####.net:443/i/23/05/03/21/49/u-N3xRqngRqE.jpg
d2zi34f####.cloudf####.net:443/i/23/05/03/21/49/u-ag8WoQpytX.jpg
d2zi34f####.cloudf####.net:443/i/23/05/03/21/49/u-hCFnE4K4PZ.jpg
d2zi34f####.cloudf####.net:443/i/23/05/03/21/49/u-zavbWMydFH.jpg
hy####.ray####.com:443/m-banner/banner-1113/banner-1113.html?wfr=####&mo...
new.ads.vu####.com:443/api/v5/new?ifa=####&app_id=####
r.m####.net:443/img/32/6340A0.mp4
raw.githubu####.com:443/StevenBlack/hosts/master/hosts
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-sg/renderer/79a3...
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-sg/renderer/pack...
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-va/renderer/79a3...
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-va/renderer/pack...
tnc16-a####.isn####.com.####.net:443/get_domains/v4/?version_code=####&d...
tnc16-a####.isn####.com.####.net:443/template-rtb/programmaticBanner-v5....
tnc16-a####.isn####.com.####.net:443/template-rtb/programmaticFullscreen...
unit####.edges####.net:443/webview/4.0.0/99577f82a72c41e1c836a2b46fed139...
us01####.ray####.com:443/impression?k=####&z=####&q=a_i09####&x=####&r=e...
us01####.ray####.com:443/impression?k=####&z=MTI4M####&q=####&x=####&r=#...
us01####.ray####.com:443/impression?k=####&z=MTI4M####&q=a_i09####&x=###...
us01####.ray####.com:443/onlyImpression?k=####&p=MjI5N####&csp=inJ####&c...
vg-aws-####.ray####.com/loss?token=####&win_price=####&auction_currency=...
vg-aws-####.ray####.com/win?token=####
vg-ne####.ray####.com/loss?token=####&win_price=####&auction_currency=####
vg-ne####.ray####.com/win?token=####

Запросы HTTP POST:

aa.birdg####.com:443/v1/d_api
ad####.topon####.com:443/bid
adx-s####.ads.vu####.com:443/api/v5/ads
adx-vg####.topon####.com:443/request
and####.b####.qq.com:443/rqd/async?aid=####
api.byteg####.ak####.net:443/api/ad/union/sdk/get_ads/?aid=####&device_p...
api.byteg####.ak####.net:443/api/ad/union/sdk/stats/batch/
api.topon####.com:443/v2/open/app
api.topon####.com:443/v2/open/placement
bxx.pooboo####.com:443/v1/init?id=####
bxx.pooboo####.com:443/v1/mr?id=####
co####.ads.vu####.com:443/api/v5/config
configv####.unit####.uni####.com:443/webview/4.4.1/release/config.json
da.topon####.com:443/v1/open/da?1004631=####&1004632=####&1004634=####
httpk####.unit####.uni####.com:443/v1/events
nginx-a####.unit####.uni####.com:443/v6/games/5239676/requests?idfi=####...
p####.birdg####.com:443/v1/ptk
pangol####.isn####.com.####.net:443/api/ad/union/mediation/settings/
pangol####.isn####.com.####.net:443/api/ad/union/sdk/stats/batch/
re####.ads.vu####.com:443/api/v5/report_ad
tk.topon####.com:443/v1/open/tk

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/011134986548f3458aa3e7e2a7fceb8d
/data/data/####/0831283955937e52_0 (deleted)
/data/data/####/091dd7668b519bbe_0 (deleted)
/data/data/####/0c9f006eae76eb72_0 (deleted)
/data/data/####/0d190b68d76120db_0 (deleted)
/data/data/####/0dc2b191e7d004a7_0
/data/data/####/0dc2b191e7d004a7_0 (deleted)
/data/data/####/1004
/data/data/####/122263xkj
/data/data/####/122263xkj.dex
/data/data/####/122263xkj.dex.flock (deleted)
/data/data/####/122392xkj
/data/data/####/122392xkj.dex
/data/data/####/122392xkj.dex.flock (deleted)
/data/data/####/151a47c94fec1504_0 (deleted)
/data/data/####/1664557424545.dex
/data/data/####/1664557424545.dex.flock (deleted)
/data/data/####/1664557424545.jar
/data/data/####/1664557424545.tmp
/data/data/####/1ba4771e74c70691_0
/data/data/####/1ba4771e74c70691_1
/data/data/####/1e82dee9f70ad20cb7e408eb5b40563c
/data/data/####/278f8d170fe7a3e8_0
/data/data/####/278f8d170fe7a3e8_1
/data/data/####/2a84c080817a1782_0
/data/data/####/2b0edd848e974b1b_0 (deleted)
/data/data/####/3158ae9a19333efa_0
/data/data/####/3158ae9a19333efa_1
/data/data/####/316c066991ac609a_0
/data/data/####/364de63661a6afc3_0
/data/data/####/3af9ea847e4863cc_0
/data/data/####/41e3db99981f326c_0
/data/data/####/41e3db99981f326c_1
/data/data/####/45b70b72a965e712_0
/data/data/####/47159dde975fe133_0
/data/data/####/47159dde975fe133_1
/data/data/####/52b421c52eb67763_0
/data/data/####/556024268088ae2609eccb71b76fce20
/data/data/####/59526224cadeef27cfe2518ce46c4a43.xml
/data/data/####/59526224cadeef27cfe2518ce46c4a43.xml.bak
/data/data/####/5d0962d24eb8bbf3b06ced69fef0551f
/data/data/####/5e1bc91db28f92bb_0 (deleted)
/data/data/####/65004c6b9a6cc021_0
/data/data/####/6517811bf155ab8f_0 (deleted)
/data/data/####/6946a012ca07587d_0 (deleted)
/data/data/####/69a5fb49d8e0d1f6_0
/data/data/####/6cf3457df655e088_0
/data/data/####/6cf3457df655e088_1
/data/data/####/711e8536108aba24_0 (deleted)
/data/data/####/723ecca56a494400_0 (deleted)
/data/data/####/79ce0dcf877975c3_0 (deleted)
/data/data/####/8c4232a835e85ef8_0
/data/data/####/8cc409cb25176cfe_0 (deleted)
/data/data/####/ABLE_SP.xml
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/AppEventsLogger.persistedevents (deleted)
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/Cookies-journal
/data/data/####/FBAdPrefs.xml
/data/data/####/FirebaseHeartBeatYWJsZV9maXJlYmFzZV9hcHA+MTo3OT...Mw.xml
/data/data/####/Ninja4.db
/data/data/####/Ninja4.db-journal
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a6e417866798b2b8f098f119b22b71af
/data/data/####/aad3f89c197e662f_0
/data/data/####/aad3f89c197e662f_1
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/anythink.db-journal
/data/data/####/anythink_agent_log
/data/data/####/anythink_hb_cache_file.xml
/data/data/####/anythink_myoffer-journal
/data/data/####/anythink_placement_load.xml
/data/data/####/anythink_placement_strategy_update_check.xml
/data/data/####/anythink_sdk.xml
/data/data/####/anythink_sdk.xml.bak
/data/data/####/anythink_share_date.xml
/data/data/####/anythink_share_date.xml.bak
/data/data/####/anythink_temp_log
/data/data/####/anythink_wt_cache_info.xml
/data/data/####/anythinkadx_file.xml
/data/data/####/app_set_id_storage.xml
/data/data/####/app_set_id_storage.xml.bak
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/b0ecb45d8c908c9c0ee5c14fc108b30d
/data/data/####/b4e7ababd9bcfbf6_0
/data/data/####/b4facae1ff19a323_0
/data/data/####/bad4007d6a731813_0 (deleted)
/data/data/####/bugly_db_-journal
/data/data/####/bugly_last_us_up_tm
/data/data/####/c3608c6ea2f64685_0
/data/data/####/c4ca87d3d17e3b8f_0
/data/data/####/cbfed5359178f476f4a070b0008f31b6
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.hb.lite.browser_preferences.xml
/data/data/####/com.hb.lite.browser_preferences.xml.bak
/data/data/####/com.hb.lite.browser_preferences.xml.bak (deleted)
/data/data/####/com.vungle.sdk.xml
/data/data/####/com.vungle.sdk.xml.bak
/data/data/####/crashrecord.xml
/data/data/####/dfe6b2497a7513ba_0
/data/data/####/dfe849ea27bca694_0
/data/data/####/dfe849ea27bca694_1
/data/data/####/efc466153a8eb6bc_0 (deleted)
/data/data/####/exc_log.xml
/data/data/####/f038e94cb33282ab_0
/data/data/####/f161b694774ae8c1_0 (deleted)
/data/data/####/f93178c1b2b9e2dc_0 (deleted)
/data/data/####/fa0fc4434cf3680f_0
/data/data/####/fa0fc4434cf3680f_1
/data/data/####/fe3e008a58a7e163_0 (deleted)
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/hosts.txt
/data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/index
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/native_record_lock
/data/data/####/proc_auxv
/data/data/####/sp_global_app_id.xml
/data/data/####/sp_global_file.xml
/data/data/####/sp_global_icon_id.xml
/data/data/####/sp_global_privacy.xml
/data/data/####/sp_global_privacy.xml.bak
/data/data/####/sp_last_ad_show_cache_show_ad.xml
/data/data/####/sp_multi_info.xml
/data/data/####/sp_multi_ttadnet_config.xml
/data/data/####/ss_app_config.xml
/data/data/####/temp-index
/data/data/####/temp.txt
/data/data/####/temp_pkg_info.json
/data/data/####/the-real-index
/data/data/####/tramini.db-journal
/data/data/####/tramini.xml
/data/data/####/tramini.xml.bak
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_ads_conf
/data/data/####/tt_sdk_event_db_ad.xml
/data/data/####/tt_sdk_event_db_state.xml
/data/data/####/tt_sdk_event_db_trail.xml
/data/data/####/tt_sdk_event_get_ad.xml
/data/data/####/tt_sdk_event_get_ad.xml.bak
/data/data/####/tt_sdk_event_net_ad.xml
/data/data/####/tt_sdk_event_net_state.xml
/data/data/####/tt_sdk_event_net_trail.xml
/data/data/####/tt_sdk_settings.prop
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sp_app_env.xml
/data/data/####/ttnet_tnc_config1371.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/unityads-installinfo.xml
/data/data/####/vungle_db-journal
/data/data/####/vungle_settings
/data/data/####/vungle_settings (deleted)
/data/media/####/-1164979124
/data/media/####/-1164979124.tmp
/data/media/####/-1275002673
/data/media/####/-1275002673.tmp
/data/media/####/-1578379407.tmp
/data/media/####/-1683663379.tmp
/data/media/####/-1946220625.tmp
/data/media/####/-24954548
/data/media/####/-24954548.tmp
/data/media/####/-275339539.tmp
/data/media/####/.nomedia
/data/media/####/1541888759.tmp
/data/media/####/236331564.tmp
/data/media/####/460355119.tmp
/data/media/####/4ba20ff58df139a683a3cb85a636c1cd.html
/data/media/####/6340A0.mp4
/data/media/####/666475579.tmp
/data/media/####/IwaLMw71eX-8i5UIzTJjJ8O1-XZV7iifJjYxJdvwuV4=
/data/media/####/IwaLMw71eX-8i5UIzTJjJ8O1-XZV7iifJjYxJdvwuV4=.vng_meta
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsTest.txt (deleted)
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/media/####/cache_policy_journal
/data/media/####/cache_touch_timestamp
/data/media/####/index.html
/data/media/####/log_1683160766671c1fd98ae-a672-4390-a43a-8caa63112a12
/data/media/####/mraid.js
/data/media/####/omsdk-session.js
/data/media/####/omsdk.js
/data/media/####/ouL0l2hjVDLZoUxzAsi_huhFpLkKuCEkOJbHFt7JSfI=
/data/media/####/ouL0l2hjVDLZoUxzAsi_huhFpLkKuCEkOJbHFt7JSfI=.vng_meta
/data/media/####/template
/data/media/####/xgrBpy6tCVTJ6Emb_PjeSyEdEUWoXHLNYDaya7QuP14=
/data/media/####/xgrBpy6tCVTJ6Emb_PjeSyEdEUWoXHLNYDaya7QuP14=.vng_meta
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id

Загружает динамические библиотеки:

libBugly_Native
libPglmetasec_ov

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7PADDING
AES-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней