Adware.Adpush.11178

Technical information

Malicious functions:

Prompts to install third-party apps.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) banner####.l####.ir:80
TCP(HTTP/1.1) w####.l####.ir:80
TCP(HTTP/1.1) gen####.shahr####.ir:80
TCP(HTTP/1.1) 1.l####.ir:80
TCP(TLS/1.0) t####.ir:443
TCP(TLS/1.0) 1####.217.17.46:443
TCP(TLS/1.0) analy####.me####.ir:443
TCP(TLS/1.0) api.me####.ir:443
TCP(TLS/1.0) cdn.tap####.ir:443

DNS requests:

1.l####.ir
analy####.me####.ir
api.me####.ir
banner####.l####.ir
bannerc####.l####.ir
c####.l####.ir
cdn.tap####.ir
e####.l####.ir
gen####.shahr####.ir
t####.ir
tra####.me####.ir
v####.l####.ir
w####.l####.ir
www.visi####.com

HTTP GET requests:

1.l####.ir/g/tapsell/apks/com.aminsft.baazar2.1.9.1.apk
1.l####.ir/g/tapsell/graphics/bazar-banner.gif
1.l####.ir/g/tapsell/graphics/bazar-icon.jpg
1.l####.ir/g/tapsell/graphics/bazar-icon2.jpg
1.l####.ir/g/tapsell/graphics/bazar-icon3.jpg
1.l####.ir/g/tapsell/graphics/kipad-icon.jpg
1.l####.ir/g/tapsell/graphics/kipad-icon2.jpg
1.l####.ir/g/tapsell/graphics/kipad-icon3.jpg
1.l####.ir/g/tapsell/graphics/kipad-icon4.jpg
1.l####.ir/g/tapsell/graphics/kipad-icon5.jpg
1.l####.ir/g/tapsell/graphics/kipad-splash.jpg
1.l####.ir/g/tapsell/graphics/miher-icon.jpg
1.l####.ir/g/tapsell/graphics/miher-icon2.jpg
1.l####.ir/g/tapsell/graphics/nazdika-icon.jpg
1.l####.ir/g/tapsell/graphics/nazdika-icon2.jpg
1.l####.ir/g/tapsell/graphics/okala-icon2.jpg
1.l####.ir/g/tapsell/graphics/pinket-icon.jpg
banner####.l####.ir/ad.svc/clk/0/6275/banner/<Operator Name>/310004/unkn...
banner####.l####.ir/ad.svc/viwb/0/5856/banner/6692/<Operator Name>/31000...
banner####.l####.ir/ad.svc/viwb/0/6275/banner/19587/<Operator Name>/3100...
gen####.shahr####.ir/global.txt
w####.l####.ir/ad.svc/clk/0/6195/Endsplash/<Operator Name>/310004/unknow...
w####.l####.ir/ad.svc/gal/0/<Operator Name>/310004/<Operator Name>/unkno...
w####.l####.ir/ad.svc/gb2/0/<Operator Name>/310004/<Operator Name>/unkno...
w####.l####.ir/ad.svc/gs/0/<Operator Name>/310004/<Operator Name>/unknow...
w####.l####.ir/ad.svc/log/0/2x5285733/Click_View_Exchange_Report/high/10...
w####.l####.ir/ad.svc/ru/0/-1/unknown/<System Property>/<System Property...
w####.l####.ir/ad.svc/ru/0/2x5285733/unknown/<System Property>/<System P...
w####.l####.ir/ad.svc/viw/0/6195/Endsplash/<Operator Name>/310004/unknow...
w####.l####.ir/ads/27a523ec-9fd7-4d76-a618-1652e38939a9.png
w####.l####.ir/ads/28bface3-51f6-426a-a572-8392a65eb036.jpg
w####.l####.ir/ads/519e60a0-eef0-490d-aa45-e3e2e4a72c21.png
w####.l####.ir/ads/6f68d372-298b-4867-9982-bd7cd6d42cc4.png
w####.l####.ir/ads/765871db-63b1-4198-92f7-0aaa210022ca.jpg
w####.l####.ir/ads/c3b2fce5-5b58-47da-b394-6cb802eb9a68.png
w####.l####.ir/ads/e4254d43-b0cd-4fc3-bfb3-c226fdc1a9e4.jpg
w####.l####.ir/ads/ed108b5c-c93b-4858-acca-7201d20831a2.jpg
w####.l####.ir/htmlads/arrow.png
w####.l####.ir/htmlads/device.js?v=####
w####.l####.ir/htmlads/downloadIcon.png
w####.l####.ir/htmlads/downloadbtn.jpg
w####.l####.ir/htmlads/generatedfiles/5856.html?v=####
w####.l####.ir/htmlads/generatedfiles/6195.html?v=####
w####.l####.ir/htmlads/generatedfiles/6275.html?v=####
w####.l####.ir/htmlads/splashclose.png

File system changes:

Creates the following files:

/data/data/####/00cad7e34c57647f1651d2e3783a7e76.0.tmp
/data/data/####/00cad7e34c57647f1651d2e3783a7e76.1.tmp
/data/data/####/05b92f2494f0bc94d03031296cf47a50.0.tmp
/data/data/####/05b92f2494f0bc94d03031296cf47a50.1.tmp
/data/data/####/066203ba5d7739ad9c70ddd45c3d73f0.0.tmp
/data/data/####/066203ba5d7739ad9c70ddd45c3d73f0.1.tmp
/data/data/####/2ccb57e7d5b837207e4f3659153735ff.0.tmp
/data/data/####/2ccb57e7d5b837207e4f3659153735ff.1.tmp
/data/data/####/2cfb21b620fe93fbd949e04328d203a3.0.tmp
/data/data/####/2cfb21b620fe93fbd949e04328d203a3.1.tmp
/data/data/####/2d41009bc4a71bf352f2bcb291dfc535.0.tmp
/data/data/####/2d41009bc4a71bf352f2bcb291dfc535.1.tmp
/data/data/####/3e30920820aa2597d1fd69ba323287e6.0.tmp
/data/data/####/3e30920820aa2597d1fd69ba323287e6.1.tmp
/data/data/####/69c42c1358f78ed52ec59698b390e08b.0.tmp
/data/data/####/69c42c1358f78ed52ec59698b390e08b.1.tmp
/data/data/####/6a8c4632fdc3da9f63c421611f896577.0.tmp
/data/data/####/6a8c4632fdc3da9f63c421611f896577.1.tmp
/data/data/####/71e1b4ec965c33ec5a08e5bc4b1031ea.0.tmp
/data/data/####/71e1b4ec965c33ec5a08e5bc4b1031ea.1.tmp
/data/data/####/75d82dac971b57dbf114e083ed092177.0.tmp
/data/data/####/75d82dac971b57dbf114e083ed092177.1.tmp
/data/data/####/7725fe3edef88ce1def7a19075b63c3f.0.tmp
/data/data/####/7725fe3edef88ce1def7a19075b63c3f.1.tmp
/data/data/####/87f3d570f5a839b22e5abf4bfbf9ad5e.0.tmp
/data/data/####/87f3d570f5a839b22e5abf4bfbf9ad5e.1.tmp
/data/data/####/8cd465b5a53caa4b9ee7f2f634bda7b8.0.tmp
/data/data/####/8cd465b5a53caa4b9ee7f2f634bda7b8.1.tmp
/data/data/####/93f9ddcaf30668570d6516262e4caf9d.0.tmp
/data/data/####/93f9ddcaf30668570d6516262e4caf9d.1.tmp
/data/data/####/MultiDex.lock
/data/data/####/__pushe_base_lib_db-journal
/data/data/####/a482cd3167fbbf321a9ece3429a1e794.0.tmp
/data/data/####/a482cd3167fbbf321a9ece3429a1e794.1.tmp
/data/data/####/a5cc175d537b40890df429af1d31f2c7.0.tmp
/data/data/####/a5cc175d537b40890df429af1d31f2c7.1.tmp
/data/data/####/acfc72d83dd7ce3b7f4afa6f4763adc4.0.tmp
/data/data/####/acfc72d83dd7ce3b7f4afa6f4763adc4.1.tmp
/data/data/####/af88d33ed652cf9f245716649830bfc6.0.tmp
/data/data/####/af88d33ed652cf9f245716649830bfc6.1.tmp
/data/data/####/c89a9db664f56c5f7b0e85f2dc52af2a.0.tmp
/data/data/####/c89a9db664f56c5f7b0e85f2dc52af2a.1.tmp
/data/data/####/c9f5b8228dd8ea113452b6c79840f05f.0.tmp
/data/data/####/c9f5b8228dd8ea113452b6c79840f05f.1.tmp
/data/data/####/cb60ea78ca745aa2a65670e3d77e4f03.0.tmp
/data/data/####/cb60ea78ca745aa2a65670e3d77e4f03.1.tmp
/data/data/####/cfaefd92b79f4912e084b123a4cf8ffd.0.tmp
/data/data/####/cfaefd92b79f4912e084b123a4cf8ffd.1.tmp
/data/data/####/co.ronash.pushe.keystore.xml
/data/data/####/com.etick.mobilemancard.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.sarinateam.gheblenamytalaye_preferences.xml
/data/data/####/com.sarinateam.gheblenamytalaye_preferences.xml.bak
/data/data/####/d73e74ddbf07af4ca439e5c1e020051a.0.tmp
/data/data/####/d73e74ddbf07af4ca439e5c1e020051a.1.tmp
/data/data/####/d8e62b5edbe4dc33d4c3ec91694cf487.0.tmp
/data/data/####/d8e62b5edbe4dc33d4c3ec91694cf487.1.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dec61b857a991a286880b1c62cd64012.0.tmp
/data/data/####/dec61b857a991a286880b1c62cd64012.1.tmp
/data/data/####/evernote_jobs.db
/data/data/####/evernote_jobs.db-journal
/data/data/####/f6c5bc8e2b447eb8c62c186a0e6d0deb.0.tmp
/data/data/####/f6c5bc8e2b447eb8c62c186a0e6d0deb.1.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/fa983447a158af51df750ce458919650.0.tmp
/data/data/####/fa983447a158af51df750ce458919650.1.tmp
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/index
/data/data/####/ir.metrix.sdk
/data/data/####/ir.metrix.sdk-journal
/data/data/####/journal.tmp
/data/data/####/multidex.version.xml
/data/data/####/tmp-com.etick.mobilemancard-1.apk.classes1838804549.zip
/data/data/####/unsent_requests
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/com.aminsft.baazar2downloadIcon.png
/data/media/####/com.etick.mobilemancard.apk
/data/media/####/com.etick.mobilemancarddownloadIcon.png

Miscellaneous:

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5PADDING

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial