Android.DownLoader.5309

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.DownLoader.1051.origin

Сетевая активность:

Подключается к:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) sf16-st####.i18n-pg####.com.####.net:443
TCP(TLS/1.0) ad####.ray####.com:443
TCP(TLS/1.0) gdl.i9####.ru.####.com:443
TCP(TLS/1.0) laun####.appsf####.com:443
TCP(TLS/1.0) unit####.edges####.net:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) pangol####.isn####.com.####.net:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.194.221.95:443
TCP(TLS/1.0) us01####.ray####.com:443
TCP(TLS/1.0) web.next####.me:443
TCP(TLS/1.0) api.byteg####.ak####.net:443
TCP(TLS/1.0) sh####.zhuifen####.top:443
TCP(TLS/1.0) ads.between####.com:443
TCP(TLS/1.0) da.topon####.com:443
TCP(TLS/1.0) vg-aws-####.ray####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) t####.likeev####.ru:443
TCP(TLS/1.0) new.ads.vu####.com:443
TCP(TLS/1.0) api.tab####.com:443
TCP(TLS/1.0) crea####.ruta####.ru:443
TCP(TLS/1.0) d2zi34f####.cloudf####.net:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) gc####.appsf####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) in####.appsf####.com:443
TCP(TLS/1.0) lbs-us-####.ads.between####.com:443
TCP(TLS/1.0) ad####.topon####.com:443
TCP(TLS/1.0) c####.between####.com:443
TCP(TLS/1.0) www.tns-cou####.ru:443
TCP(TLS/1.0) vg-ne####.ray####.com:443
TCP(TLS/1.0) tls.vu####.edges####.net:443
TCP(TLS/1.0) api.appsfly####.com.####.net:443
TCP(TLS/1.0) tk.topon####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) api.topon####.com:443
TCP(TLS/1.0) configv####.unit####.uni####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) co####.ads.vu####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) 64.2####.164.94:443
TCP(TLS/1.0) raw.githubu####.com:443
TCP(TLS/1.2) 64.2####.164.94:443
TCP(TLS/1.2) firebas####.google####.com:443
TCP d####.topon####.com:9377
TCP gdl.news####.s####.####.com:443

Запросы DNS:

a####.appsf####.com
ad####.ray####.com
ad####.topon####.com
ads.between####.com
adx.ads.vu####.com
and####.a####.go####.com
and####.google####.com
api.tab####.com
api.topon####.com
api.you####.tech
api16-a####.pa####.io
c####.between####.com
cd####.vu####.com
cdn-set####.appsfly####.com
co####.ads.vu####.com
co####.unit####.uni####.com
conf####.unit####.uni####.com
convers####.appsf####.com
crea####.ruta####.ru
d####.topon####.com
d2zi34f####.cloudf####.net
da.topon####.com
f####.gst####.com
firebas####.google####.com
g####.face####.com
gc####.appsf####.com
gdl.i9####.ru
gdl.news####.site
im####.tab####.com
in####.appsf####.com
laun####.appsf####.com
lbs-us-####.ads.between####.com
new.ads.vu####.com
p####.google####.com
pangol####.isn####.com
pla####.google####.com
raw.githubu####.com
rr9---s####.g####.com
sf16-st####.i18n-pg####.com
sh####.zhuifen####.top
t####.q1####.ru
tk.topon####.com
tnc16-a####.isn####.com
us01####.ray####.com
vg-aws-####.ray####.com
vg-aws-####.ray####.com
vg-ne####.ray####.com
web.next####.me
www.googlet####.com
www.tns-cou####.ru

Запросы HTTP GET:

ad####.ray####.com:443/impression?opri=Nj####&rid=####&impid=####&cid=##...
api.appsfly####.com.####.net:443/android/v1/5c0b04b26d739ca97d3c9edfde0f...
d2zi34f####.cloudf####.net:443/i/22/12/20/10/04/u-yeXKLJeM4q.jpg
d2zi34f####.cloudf####.net:443/i/23/01/24/00/14/u-XdMgajlrxW.jpg
gc####.appsf####.com:443/install_data/v4.0/<Package>?devkey=####&device_...
gdl.i9####.ru.####.com:443/as/web-source/4hd/0J3np7.mp4
gdl.i9####.ru.####.com:443/as/web-source/4hd/1Xweym.mp4
new.ads.vu####.com:443/api/v5/new?ifa=####&app_id=####
raw.githubu####.com:443/StevenBlack/hosts/master/hosts
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-sg/renderer/1aff...
sf16-st####.i18n-pg####.com.####.net:443/obj/ad-pattern-sg/renderer/pack...
tls.vu####.edges####.net:443/get_domains/v4/?version_code=####&device_pl...
tls.vu####.edges####.net:443/template-rtb/programmaticBanner-v6.zip
tls.vu####.edges####.net:443/vm/1.4.1/6bd1fe6.zip
unit####.edges####.net:443/webview/4.0.0/ef10a55a545a4284efb40b0c6c58eed...
us01####.ray####.com:443/impression?k=####&z=MTI4M####&q=a_i09####&x=###...
us01####.ray####.com:443/onlyImpression?k=####&p=MjI5N####&csp=inJ####&c...
vg-aws-####.ray####.com:443/loss?token=####&win_price=####&auction_curre...
vg-ne####.ray####.com:443/win?token=####

Запросы HTTP POST:

ad####.topon####.com:443/bid
api.byteg####.ak####.net:443/api/ad/union/sdk/get_ads/?aid=####&device_p...
api.byteg####.ak####.net:443/api/ad/union/sdk/stats/batch/
api.topon####.com:443/v2/open/app
api.topon####.com:443/v2/open/placement
co####.ads.vu####.com:443/api/v5/ads
co####.ads.vu####.com:443/api/v5/config
configv####.unit####.uni####.com:443/webview/4.4.1/release/config.json
da.topon####.com:443/v1/open/da
in####.appsf####.com:443/api/v6.9/androidevent?app_id=####&buildnumber=#...
laun####.appsf####.com:443/api/v6.9/androidevent?app_id=####&buildnumber...
p####.google####.com:443/v1/projects/lite-browser-21dbd/installations
pangol####.isn####.com.####.net:443/api/ad/union/mediation/settings/
sh####.zhuifen####.top:443/v1/init?id=####
sh####.zhuifen####.top:443/v1/mr?id=####
tk.topon####.com:443/v1/open/tk

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.
/data/data/####/.
/data/data/####/. (deleted)
/data/data/####/. .flock (deleted)
/data/data/####/.
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/011134986548f3458aa3e7e2a7fceb8d
/data/data/####/114316peq
/data/data/####/114316peq.dex
/data/data/####/114316peq.dex.flock (deleted)
/data/data/####/114459peq
/data/data/####/114459peq.dex
/data/data/####/114459peq.dex.flock (deleted)
/data/data/####/1664557424545.dex
/data/data/####/1664557424545.dex.flock (deleted)
/data/data/####/1664557424545.jar
/data/data/####/1664557424545.tmp
/data/data/####/1687788308610
/data/data/####/1687788308618
/data/data/####/1687788308621
/data/data/####/1687788312083
/data/data/####/1687788316667
/data/data/####/1687788320740
/data/data/####/1687788322952
/data/data/####/1687788327032
/data/data/####/1687788327041
/data/data/####/1687788327048
/data/data/####/1687788327094
/data/data/####/1687788327234
/data/data/####/1687788327258
/data/data/####/1687788332810
/data/data/####/1687788332811
/data/data/####/1687788332820
/data/data/####/1687788333149
/data/data/####/1687788333293
/data/data/####/1687788333579
/data/data/####/1687788334148
/data/data/####/1687788334151
/data/data/####/1687788334512
/data/data/####/1687788334997
/data/data/####/1687788336047
/data/data/####/1687788345750
/data/data/####/1687788345830
/data/data/####/2859cd33aba3d737_0
/data/data/####/2d0d2d50e5235a82_0
/data/data/####/3158ae9a19333efa_0
/data/data/####/3158ae9a19333efa_1
/data/data/####/42dd628dcc561b6e_0
/data/data/####/435216ffffc236c1_0
/data/data/####/487b717cc169a70c_0
/data/data/####/51148df13b34d804_0
/data/data/####/5c90b63332089ce96249bba50cd01780
/data/data/####/685745853ff8140f_0
/data/data/####/6cf3457df655e088_0
/data/data/####/6cf3457df655e088_1
/data/data/####/73ae7d7def345b90_0
/data/data/####/73ae7d7def345b90_1
/data/data/####/761339f8da52c94ef5b0a2d7f7b99620
/data/data/####/76bc4dad5b03e436d7fa0e9aeb77e626
/data/data/####/7b5256407d503dac_0 (deleted)
/data/data/####/7c033d265b21a10c046fab04c369c104.xml
/data/data/####/7cbe031a0976a63b_0
/data/data/####/963ed2ea4a9d578d_0
/data/data/####/96acf5f3656b3174_0 (deleted)
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/Cookies-journal
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MToyNzQ0MjEwNTMzO...Zk.xml
/data/data/####/Ninja4.db
/data/data/####/Ninja4.db-journal
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToyNzQ0MjEw...k.json
/data/data/####/PersistedInstallation253429016tmp
/data/data/####/PersistedInstallation363581968tmp
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a5d54842dd005597_0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/anythink.db-journal
/data/data/####/anythink_agent_log
/data/data/####/anythink_hb_cache_file.xml
/data/data/####/anythink_myoffer-journal
/data/data/####/anythink_placement_load.xml
/data/data/####/anythink_placement_strategy_update_check.xml
/data/data/####/anythink_sdk.xml
/data/data/####/anythink_sdk.xml.bak
/data/data/####/anythink_temp_log
/data/data/####/anythink_wt_cache_info.xml
/data/data/####/anythinkadx_file.xml
/data/data/####/app_set_id_storage.xml
/data/data/####/app_set_id_storage.xml.bak
/data/data/####/appsflyer-data.xml
/data/data/####/cf3f6457afe57338_0 (deleted)
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.hb.lite.browser_preferences.xml
/data/data/####/com.hb.lite.browser_preferences.xml.bak
/data/data/####/com.vungle.sdk.xml
/data/data/####/com.vungle.sdk.xml.bak
/data/data/####/d9bf23147d04510c_0
/data/data/####/dfe849ea27bca694_0
/data/data/####/dfe849ea27bca694_1
/data/data/####/e44862ad6aae31f0_0
/data/data/####/eca58936fdd3e99a_0
/data/data/####/exc_log.xml
/data/data/####/f32280947cd0dd88_0
/data/data/####/f93178c1b2b9e2dc_0 (deleted)
/data/data/####/fa0fc4434cf3680f_0
/data/data/####/fa0fc4434cf3680f_1
/data/data/####/fb57c1d69528b911_0
/data/data/####/fb57c1d69528b911_1
/data/data/####/fe3e008a58a7e163_0 (deleted)
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/hosts.txt
/data/data/####/index
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/sp_global_app_id.xml
/data/data/####/sp_global_file.xml
/data/data/####/sp_global_icon_id.xml
/data/data/####/sp_global_privacy.xml
/data/data/####/sp_last_ad_show_cache_show_ad.xml
/data/data/####/sp_multi_info.xml
/data/data/####/sp_multi_ttadnet_config.xml
/data/data/####/ss_app_config.xml
/data/data/####/temp-index
/data/data/####/temp.txt
/data/data/####/temp_pkg_info.json
/data/data/####/the-real-index
/data/data/####/tt_ad_sdk_sp.xml
/data/data/####/tt_ads_conf
/data/data/####/tt_sdk_event_db_ad.xml
/data/data/####/tt_sdk_event_db_state.xml
/data/data/####/tt_sdk_event_db_trail.xml
/data/data/####/tt_sdk_event_get_ad.xml
/data/data/####/tt_sdk_event_get_ad.xml.bak
/data/data/####/tt_sdk_event_net_ad.xml
/data/data/####/tt_sdk_event_net_state.xml
/data/data/####/tt_sdk_event_net_trail.xml
/data/data/####/tt_sdk_settings.prop
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sp_app_env.xml
/data/data/####/ttnet_tnc_config1371.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/unityads-installinfo.xml
/data/data/####/vungle_db-journal
/data/data/####/vungle_settings
/data/data/####/vungle_settings (deleted)
/data/media/####/-275339539.tmp
/data/media/####/.nomedia
/data/media/####/0J3np7.mp4
/data/media/####/1JRpwU.png
/data/media/####/1Xweym.mp4
/data/media/####/2309T5.png
/data/media/####/236331564.tmp
/data/media/####/9KrtnXCbjwcL6l--ae9PASTmYpN0iVwfGV9x18NpHhY=
/data/media/####/9KrtnXCbjwcL6l--ae9PASTmYpN0iVwfGV9x18NpHhY=.vng_meta
/data/media/####/UnityAdsTest.txt
/data/media/####/UnityAdsWebApp.html
/data/media/####/UnityAdsWebViewConfiguration.json
/data/media/####/VUyhpKSpGk27ptUpYvgyLMIMbyqu5z4rWzddueFKAUE=
/data/media/####/VUyhpKSpGk27ptUpYvgyLMIMbyqu5z4rWzddueFKAUE=.vng_meta
/data/media/####/WrJHISRVfKHFLDimJ3-qtXxlNS9HOoziums8qSu3OWw=
/data/media/####/WrJHISRVfKHFLDimJ3-qtXxlNS9HOoziums8qSu3OWw=.vng_meta
/data/media/####/X2ceN9-h_TvSnuMJH2PV6ov2AglyHILWNC8_I4q0nrk=
/data/media/####/X2ceN9-h_TvSnuMJH2PV6ov2AglyHILWNC8_I4q0nrk=.vng_meta
/data/media/####/ZzdkGR6BjqXC-rdlorS6J2AiQIEma0vwB0ugHT6Sxm4=
/data/media/####/ZzdkGR6BjqXC-rdlorS6J2AiQIEma0vwB0ugHT6Sxm4=.vng_meta
/data/media/####/ca0f9b3bd17884c527e2ae22da17e96a.html
/data/media/####/cache_policy_journal
/data/media/####/cache_touch_timestamp
/data/media/####/cache_touch_timestamp (deleted)
/data/media/####/index.html
/data/media/####/ki3NNKCaTs0W4S0EeHFflDJ1N4OKmgzp99xbv550sMQ=
/data/media/####/ki3NNKCaTs0W4S0EeHFflDJ1N4OKmgzp99xbv550sMQ=.vng_meta
/data/media/####/log_1687788293743fa186335-5193-4142-a754-b4e032efd6a3
/data/media/####/mraid.js
/data/media/####/template
/data/misc/####/primary.prof

Другие:

Запускает следующие shell-скрипты:

getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id

Загружает динамические библиотеки:

libPglmetasec_ov

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding

Осуществляет доступ к приватному интерфейсу ITelephony.

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней