Adware.Was.12821

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Was.1.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 64.2####.164.94:80
TCP(HTTP/1.1) a.da####.com:9127
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) prd-le####.cdp.inte####.####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) s3.amazo####.com:443
TCP(TLS/1.0) co####.uca.c####.####.com:443
TCP(TLS/1.0) t.appsf####.com:443
TCP(TLS/1.0) myto####.fireba####.com:443
TCP(TLS/1.0) api.appsf####.com:443
TCP(TLS/1.0) 64.2####.164.94:443
TCP(TLS/1.2) www.google####.com:443
TCP(TLS/1.2) 64.2####.164.94:443
TCP(TLS/1.2) 74.1####.131.113:443
TCP(TLS/1.2) 1####.177.14.103:443

DNS requests:

a.da####.com
api.appsf####.com
cdp.c####.uni####.com
co####.uca.c####.####.com
g####.62####.com
m####.go####.com
myto####.fireba####.com
mytownd####.fireba####.com
rr9---s####.g####.com
s3.amazo####.com
t.appsf####.com
www.go####.com
www.google####.com

HTTP GET requests:

a.da####.com:9127/ll/app_com.wdxzhz.bp.json?a169667####
a.da####.com:9127/ll/gs?baseversion=####&version=####&appversion=####&ch...
a.da####.com:9127/ll/tips.json
api.appsf####.com:443/install_data/v3/com.wdxzhz.bp?devkey=####&device_i...
myto####.fireba####.com:443//cross_promo/my_city/.json?auth%3d####
myto####.fireba####.com:443//cross_promo/my_little_princess/.json?auth%3...
myto####.fireba####.com:443//cross_promo/my_town/.json?auth%3d####
myto####.fireba####.com:443//cross_promo/my_town_3D/.json?auth%3d####
myto####.fireba####.com:443//cross_promo/wonderland/.json?auth%3d####
myto####.fireba####.com:443//cross_promo_visibility/my_city/mansion/andr...
myto####.fireba####.com:443//games/my_city/.json?auth%3d####
myto####.fireba####.com:443//games/my_little_princess/.json?auth%3d####
myto####.fireba####.com:443//games/my_town/.json?auth%3d####
myto####.fireba####.com:443//games/my_town_3D/.json?auth%3d####
myto####.fireba####.com:443//games/wonderland/.json?auth%3d####
myto####.fireba####.com:443//last_update/.json?auth%3d####
myto####.fireba####.com:443//my_city/episode_one/games/.json?auth%3d####
myto####.fireba####.com:443//my_city/episode_one/updated/.json?auth%3d####
myto####.fireba####.com:443//my_city/episode_one/version/.json?auth%3d####
myto####.fireba####.com:443//users/6110eeb0a374cb24eebf073ac073fb55/.jso...

HTTP POST requests:

a.da####.com:9127/ll//uu?t=####
co####.uca.c####.####.com:443/
myto####.fireba####.com:443//users/6110eeb0a374cb24eebf073ac073fb55/.jso...
prd-le####.cdp.inte####.####.com:443/v1/events
t.appsf####.com:443/api/v4/androidevent?buildnumber=####&app_id=####

File system changes:

Creates the following files:

/data/data/####/.dex2oatlock
/data/data/####/.hptc.cache_com.wdxzhz.bp
/data/data/####/.hptc_kache_com.wdxzhz.bp
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/.updateIV.dat_2
/data/data/####/.updateIV.dat_3
/data/data/####/.updateIV.dat_4
/data/data/####/.updateIV.dat_5
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/0000000lllll_2.dex
/data/data/####/0000000lllll_3.dex
/data/data/####/0000000lllll_4.dex
/data/data/####/0000000lllll_5.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/000O00ll111l_2.dex
/data/data/####/000O00ll111l_3.dex
/data/data/####/000O00ll111l_4.dex
/data/data/####/000O00ll111l_5.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/00O000ll111l_2.dex
/data/data/####/00O000ll111l_2.dex (deleted)
/data/data/####/00O000ll111l_2.dex.flock
/data/data/####/00O000ll111l_2.dex.flock (deleted)
/data/data/####/00O000ll111l_3.dex
/data/data/####/00O000ll111l_3.dex (deleted)
/data/data/####/00O000ll111l_3.dex.flock
/data/data/####/00O000ll111l_3.dex.flock (deleted)
/data/data/####/00O000ll111l_4.dex
/data/data/####/00O000ll111l_4.dex (deleted)
/data/data/####/00O000ll111l_4.dex.flock
/data/data/####/00O000ll111l_4.dex.flock (deleted)
/data/data/####/00O000ll111l_5.dex
/data/data/####/00O000ll111l_5.dex (deleted)
/data/data/####/00O000ll111l_5.dex.flock
/data/data/####/00O000ll111l_5.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/FIREBASE_CLOUD_MESSAGING_LOCAL_STORAGE
/data/data/####/FIREBASE_CLOUD_MESSAGING_LOCKFILE (deleted)
/data/data/####/app_resources_lib.dex
/data/data/####/app_resources_lib.dex.flock (deleted)
/data/data/####/app_resources_lib.jar
/data/data/####/appsflyer-data.xml
/data/data/####/appsflyer-data.xml.bak
/data/data/####/cheuu
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.messaging.xml
/data/data/####/com.wdxzhz.bp.v2.playerprefs.xml
/data/data/####/com.wdxzhz.bp.v2.playerprefs.xml.bak
/data/data/####/google_api_resources_lib.dex
/data/data/####/google_api_resources_lib.dex.flock (deleted)
/data/data/####/google_api_resources_lib.jar
/data/data/####/libshellx-super.2019.so
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/proc_auxv
/data/data/####/secret.xml
/data/data/####/tmd
/data/data/####/tosversion
/data/data/####/tv
/data/data/####/uuloi
/data/data/####/vva
/data/data/####/vva.dex
/data/data/####/vva.dex.flock (deleted)
/data/data/####/vva.jar
/data/media/####/-1340345719.room
/data/media/####/.nomedia
/data/media/####/15ba15f8-62a4-4782-a9d3-0f86835c51fb.tmp
/data/media/####/194fc4a4-e5e9-4d53-86db-4f540ddf0e7a.tmp
/data/media/####/1a81eab7-65e0-4103-9a66-56bc8310d011.tmp
/data/media/####/246455d3-840a-4aa2-a8a9-ab4e3754b9d0.tmp
/data/media/####/260482f3-b584-4708-85df-037fc04c524b.tmp
/data/media/####/27a3cd9f-cbd7-43a9-b92e-88921b9dfec1.tmp
/data/media/####/3034a9a9-714b-4304-b3e3-131f54d9dde1.tmp
/data/media/####/317945ca-d0d6-42d6-aeb6-f8122e8b5b4c.tmp
/data/media/####/3896fed6-b025-4400-96ee-93636b9bbf41.tmp
/data/media/####/3b7aa729-04ae-4635-8d64-a049be9ff21a.tmp
/data/media/####/4a429d1e-62d8-49a9-add0-533088fa3c59.tmp
/data/media/####/4dab9bb7-fb87-4f22-a6ee-b4546e5254aa.tmp
/data/media/####/5f7266dc-5800-4075-887f-3d43fdf6bfb7.tmp
/data/media/####/67f7d41b9489c57d68ef973033c7b468_tmp
/data/media/####/67f7d41b9489c57d68ef973033c7b468_tmp (deleted)
/data/media/####/6ed5f148-c1c0-455d-865b-f01166410b26.tmp
/data/media/####/89eeaf1d-e39e-4b31-80ed-a671ea3cee98.tmp
/data/media/####/8df6901a-acf8-4622-a8d0-fbf2479637f0.tmp
/data/media/####/95828844-1ceb-4b74-9b2e-9096f2812550.tmp
/data/media/####/9c5ade60-001b-4bc5-a2eb-ce0a589310e6.tmp
/data/media/####/9e06d3fb-c4dd-46e2-b99f-b0f29ef84007.tmp
/data/media/####/CommonSave.json
/data/media/####/Compat.browser
/data/media/####/DefaultWsdlHelpGenerator.aspx
/data/media/####/DiskAssets.asset
/data/media/####/DiskAssets.lock
/data/media/####/Firebase.Platform.dll-resources.dat
/data/media/####/GameData.json
/data/media/####/a9f0688a-4cd5-4e0b-a1ac-bef8c1a855d4.tmp
/data/media/####/ad10ee22-2ad1-4771-80d3-403b18151855.tmp
/data/media/####/babytown.coloring.learn.kids.cpid
/data/media/####/browscap.ini
/data/media/####/bus_vehicle.tex2d
/data/media/####/c
/data/media/####/commonData.json
/data/media/####/config
/data/media/####/config.xml
/data/media/####/d
/data/media/####/d370e854-835e-4611-99af-50fc046b5ee1.tmp
/data/media/####/e
/data/media/####/e5319474-b4e5-4f1d-96cf-50ee9d3d8274.tmp
/data/media/####/ed884865-bab1-45df-afd2-c9c3a8ea1fb1.tmp
/data/media/####/ed88a85bb870f1e26b952504e77dc32e_tmp (deleted)
/data/media/####/f28bc53b-c71b-405c-89f8-84d238c07f17.tmp
/data/media/####/fe1bccae-522b-4a2e-bccf-3acef8a4e72b.tmp
/data/media/####/g
/data/media/####/gamesData.json
/data/media/####/garage_vehicle_0.task
/data/media/####/garage_vehicle_0.tex2d
/data/media/####/garage_vehicle_1.task
/data/media/####/global-metadata.dat
/data/media/####/last-btime
/data/media/####/last_update.json
/data/media/####/machine.config
/data/media/####/mscorlib.dll-resources.dat
/data/media/####/mycity.afterschool.cpid
/data/media/####/mycity.airport.cpid
/data/media/####/mycity.babysitter.cpid
/data/media/####/mycity.bank.cpid
/data/media/####/mycity.campingvacation.cpid
/data/media/####/mycity.dentist.cpid
/data/media/####/mycity.friends.cpid
/data/media/####/mycity.friendshouse.cpid
/data/media/####/mycity.grandparents.cpid
/data/media/####/mycity.highschool.cpid
/data/media/####/mycity.home.cpid
/data/media/####/mycity.hospital.cpid
/data/media/####/mycity.hotel.cpid
/data/media/####/mycity.jailbreak.cpid
/data/media/####/mycity.london.cpid
/data/media/####/mycity.mansion.cpid
/data/media/####/mycity.mayorsoffice.cpid
/data/media/####/mycity.newbornbaby.cpid
/data/media/####/mycity.newyork.cpid
/data/media/####/mycity.office.cpid
/data/media/####/mycity.orphan.cpid
/data/media/####/mycity.petstore.cpid
/data/media/####/mycity.pjparty.cpid
/data/media/####/mycity.police.cpid
/data/media/####/mycity.popstar.cpid
/data/media/####/mycity.seaport.cpid
/data/media/####/mycity.shopping.cpid
/data/media/####/mycity.skiresort.cpid
/data/media/####/mycity.stable.cpid
/data/media/####/mycity.students.cpid
/data/media/####/mycity.university.cpid
/data/media/####/mycity.wedding.cpid
/data/media/####/mycity.ymca.cpid
/data/media/####/mylittleprincess.castle.cpid
/data/media/####/mylittleprincess.castle.free.cpid
/data/media/####/mylittleprincess.fairy.cpid
/data/media/####/mylittleprincess.stores.cpid
/data/media/####/mylittleprincess.stores.free.cpid
/data/media/####/mylittleprincess.wizard.cpid
/data/media/####/mylittleprincess.wizard.free.cpid
/data/media/####/mytown.airport.cpid
/data/media/####/mytown.amusementpark.cpid
/data/media/####/mytown.bakery.cpid
/data/media/####/mytown.beach.cpid
/data/media/####/mytown.beautycontest.cpid
/data/media/####/mytown.cinema.cpid
/data/media/####/mytown.danceschool.cpid
/data/media/####/mytown.daycare.cpid
/data/media/####/mytown.farm.cpid
/data/media/####/mytown.fashion.cpid
/data/media/####/mytown.firestation.cpid
/data/media/####/mytown.friendshouse.cpid
/data/media/####/mytown.games3d.cpid
/data/media/####/mytown.garage.cpid
/data/media/####/mytown.grandparents.cpid
/data/media/####/mytown.hauntedhouse.cpid
/data/media/####/mytown.home.cpid
/data/media/####/mytown.hospital.cpid
/data/media/####/mytown.hotel.cpid
/data/media/####/mytown.mall.cpid
/data/media/####/mytown.museum.cpid
/data/media/####/mytown.pets.cpid
/data/media/####/mytown.police.cpid
/data/media/####/mytown.preschool.cpid
/data/media/####/mytown.school.cpid
/data/media/####/mytown.spa.cpid
/data/media/####/mytown.stores.cpid
/data/media/####/mytown.street.cpid
/data/media/####/mytown.wedding.cpid
/data/media/####/mytown.world.cpid
/data/media/####/s
/data/media/####/settings.map
/data/media/####/values
/data/media/####/web.config
/data/media/####/wonderland.beauty.cpid
/data/media/####/wonderland.mermaid.cpid
/data/media/####/wonderland.peterpan.cpid
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

cat /sys/class/net/wlan0/address
getprop ro.product.cpu.abi
ls /data/local

Loads the following dynamic libraries:

libFirebaseCppApp-6.1.1
libmain
libshellx-super.2019

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial