Android.Spy.2753

Technical information

Malicious functions:

Sends SMS:

106901332942: rg|295|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T3842om2Odt9gL7hI16TsqpqJaCCF.0kDB9PE6gc3joA24ZDi4JNMCIYW5WciDDBC9Rk!

Executes code of the following detected threats:

Android.Spy.373.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) csk.mc####.com:9003
TCP(HTTP/1.1) 1####.55.161.68:29092
TCP(HTTP/1.1) www.gamez####.com:80
TCP(SSL/3.0) st####.ho####.com.####.io:443
TCP(SSL/3.0) td-####.mix.link####.com:443
TCP(SSL/3.0) st####.zdas####.com:443
TCP(SSL/3.0) s.swiftyp####.com:443
TCP(SSL/3.0) g.geo####.com:443
TCP(TLS/1.0) td-####.mix.link####.com:443
TCP(TLS/1.0) u####.o####.net:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) p####.rubicon####.com:443
TCP(TLS/1.0) wild####.ad####.com.####.net:443
TCP(TLS/1.0) foxitso####.actonso####.com:443
TCP(TLS/1.0) www.foxitso####.com:443
TCP(TLS/1.0) con####.face####.net:443
TCP(TLS/1.0) pug2200####.pubm####.com:443
TCP(TLS/1.0) t####.co:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) f####.gamez####.com:443
TCP(TLS/1.0) entchat####.com####.com:443
TCP(TLS/1.0) c####.cloudf####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) sc####.craz####.com:443
TCP(TLS/1.0) ads.twi####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) st####.ads-twi####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) x.bidsw####.net:443
TCP(TLS/1.0) id####.r####.com:443
TCP(TLS/1.0) www.gamez####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) eb2.3####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) s.swiftyp####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) js.dr####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) ads.y####.com:443
TCP(TLS/1.0) s####.outb####.com:443
TCP(TLS/1.0) d.ad####.com:443
TCP(TLS/1.0) wild####.l####.com.####.net:443
TCP(TLS/1.0) st####.ho####.com.####.io:443
TCP(TLS/1.0) www.googlet####.com:443
TCP(TLS/1.0) p####.adverti####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) g.geo####.com:443
TCP(TLS/1.0) st####.zdas####.com:443
TCP(TLS/1.0) dsum####.casalem####.com.####.net:443

DNS requests:

ads.y####.com
adser####.go####.com
adser####.go####.nl
analy####.twi####.com
c####.cloudf####.com
cm.g.doublec####.net
con####.face####.net
csk.mc####.com
d.ad####.com
dsum####.casalem####.com
eb2.3####.com
entchat####.com####.com
f####.gamez####.com
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
ib.a####.com
id####.r####.com
js.dr####.com
maomaoc####.funu####.com
marke####.foxitso####.com
mt####.go####.com
p####.adverti####.com
p####.rubicon####.com
pag####.googles####.com
px.ads.link####.com
s####.g.doublec####.net
s####.l####.com
s####.outb####.com
s.ad####.com
s.swiftyp####.com
sc####.craz####.com
sim####.pubm####.com
st####.ads-twi####.com
st####.ho####.com
st####.xx.f####.net
st####.zdas####.com
t####.co
tpc.googles####.com
trc.tab####.com
u####.o####.net
www.face####.com
www.foxitso####.com
www.gamez####.com
www.go####.com
www.go####.nl
www.google-####.com
www.googlea####.com
www.googlet####.com
www.googlet####.com
www.gst####.com
x.bidsw####.net

HTTP GET requests:

ti####.c####.l####.####.com/
ti####.c####.l####.####.com//atlas.png
ti####.c####.l####.####.com//atlas.xml
ti####.c####.l####.####.com//audio/sound_button_click.m4a
ti####.c####.l####.####.com//audio/sound_button_over.m4a
ti####.c####.l####.####.com//audio/sound_cat_eat.m4a
ti####.c####.l####.####.com//audio/sound_cat_move.m4a
ti####.c####.l####.####.com//audio/sound_cat_sleep.m4a
ti####.c####.l####.####.com//audio/sound_change_screen.m4a
ti####.c####.l####.####.com//audio/sound_fall.m4a
ti####.c####.l####.####.com//audio/sound_restart.m4a
ti####.c####.l####.####.com//audio/sound_star_1.m4a
ti####.c####.l####.####.com//audio/sound_star_2.m4a
ti####.c####.l####.####.com//audio/sound_star_3.m4a
ti####.c####.l####.####.com//audio/sound_undo.m4a
ti####.c####.l####.####.com//audio/sound_win.m4a
ti####.c####.l####.####.com//background_main.png
ti####.c####.l####.####.com//help_use_chrome.png
ti####.c####.l####.####.com//levels.json
ti####.c####.l####.####.com//logo.png
ti####.c####.l####.####.com//preloader/background.png
ti####.c####.l####.####.com//preloader/preloader_bar.png
ti####.c####.l####.####.com//preloader/preloader_bar_over.png
ti####.c####.l####.####.com/api.min.js?v=####
ti####.c####.l####.####.com/api/bgplay.png
ti####.c####.l####.####.com/api/css/embed.css
ti####.c####.l####.####.com/api/images/logos/gamezhero.com.png
ti####.c####.l####.####.com/api/js/ads/ads.js
ti####.c####.l####.####.com/default/js/jquery/cookie/jquery.cookie.min.j...
ti####.c####.l####.####.com/default/js/jquery/jquery-1.11.3.min.js?v=####
ti####.c####.l####.####.com/default/js/profile.min.js?v=####
ti####.c####.l####.####.com/js/app.js?_=####
ti####.c####.l####.####.com/js/boot.js?_=####
ti####.c####.l####.####.com/js/cat.js?_=####
ti####.c####.l####.####.com/js/core.js?_=####
ti####.c####.l####.####.com/js/field_objects.js?_=####
ti####.c####.l####.####.com/js/load.js?_=####
ti####.c####.l####.####.com/js/phaser.min.js?_=####
ti####.c####.l####.####.com/js/screens_windows_buttons.js?_=####
ti####.c####.l####.####.com/js/util.js?_=####
ti####.c####.l####.####.com/preloader/bg_rect.png
www.gamez####.com/?utm_source=####&utm_medium=####&utm_campaign=####

HTTP POST requests:

csk.mc####.com:9003/csk/c_s/g_f.json
csk.mc####.com:9003/csk/st_c/cn_i_sec.json
csk.mc####.com:9003/csk/st_c/cn_sk_login.json
csk.mc####.com:9003/csk/st_c/cn_sk_specialVersion.json
csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
csk.mc####.com:9003/csk/st_c/getst_tegy.json

File system changes:

Creates the following files:

/data/data/####/ApplicationCache.db-journal
/data/data/####/app_test.apk
/data/data/####/brushs.xml
/data/data/####/bt_bkg.xml
/data/data/####/bt_grey.xml
/data/data/####/cds.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/diag_bg.xml
/data/data/####/diag_cls_ig.png
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/fmoonStore.db
/data/data/####/fmoonStore.db-journal
/data/data/####/fpsdktempfile
/data/data/####/fs_dia_fir_ly.xml
/data/data/####/fs_dia_fir_ly_old.xml
/data/data/####/fs_dia_ret_ly.xml
/data/data/####/fs_dia_snd_ly.xml
/data/data/####/index
/data/data/####/order_sp.xml
/data/data/####/pro_activi_sho.png
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Loads the following dynamic libraries:

mustang

Uses the following algorithms to encrypt data:

AES
AES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней