Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- startap####.com
- i####.####.com
- r####.####.com
- d####.####.com
- f####.####.com
- d####.####.org
- co####.com
- appo####.####.com
Запросы HTTP GET:
- r####.####.com/tracking/adClick?d=####&lu=####&index=####&adTag=####&clientSessionId=####&profileId=####&displayDuration=####&ts=####&afh=####
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2FtYuF3mp-G0bg5joOnlOGjXeUq0r6omQSm5w6pYqq-NYXL22DRejYNdZki02v...
- r####.####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVersion=#...
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh6.ggpht.com%2FK9czCJMDj3G4AUonnuDi6yYgbQ37vgIcRygRzzF36r79nfitFFBIrYdMxia-LvXJxKE
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2FcZ2u7ZBqKr6q-a4sVWjwV11uKJWGzlLovU94hdAG88D_wZ_fuBpjbqW8RZTz...
- i####.####.com/InApp/resources/info_ex_l.png
- r####.####.com/1.4/getads?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVersion=####...
- startap####.com/tracking/infoEvent?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVer...
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2FI1xORgYMJHkPwlF-CRzgprHMuy3-O6qUBF0SS28D8x7oGlr0yLY2ouJywbLB...
- startap####.com/1.4/trackdownload?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVers...
- r####.####.com/tracking/adImpression?d=####&position=####&adTag=####&clientSessionId=####&profileId=####&ts=####&afh=####
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2FWJYy_3SAx2S1E1kcq52aodttE3S6IC3UhNzPJOVAWO2nGPAfuxml8mEYhWKY...
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2FNXzd9MBKGL6__sBs2uTOLsYrH2hO0-jxvJacKdjnW8t8WzFRyhHK6BNu9WLe...
- appo####.####.com/ep/url
- d####.####.com/image/fetch/f_auto,q_80,w_124,h_124/http%3A%2F%2Flh3.googleusercontent.com%2FtYuF3mp-G0bg5joOnlOGjXeUq0r6omQSm5w6pYqq-NYXL22DRejYNdZki0...
- d####.####.com/styles/compressed/fullpage_ios_call_infra.20170124-0748.min.css
- d####.####.org/android-distance.json
- d####.####.com/static/images/close-btn-infra.png
- startap####.com/1.4/getadsmetadata?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVer...
- co####.com/shop/sirhowardlee
- d####.####.com/static/images/fullpage_ios_call/ok@2x.png
- f####.####.com/fyber/credentials/android/com.mobincube.the_online_gift_shop.sc_HZSW51?sdk_version=####&android_version=####&device_type=####&platform=...
- d####.####.com/static/images/fullpage_ios_call/cross@2x.png
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh5.ggpht.com%2FWZWxKkLnUk043l1eFyIZWIxk4xeSVQROA2qsOQ4gO-4cyscxeG6W0G3iEpI4Leastg
- d####.####.com/styles/compressed/fullpage_3d_spinning_cube_infra.20170124-0748.min.css
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2F3KJC9pal4atugkpFZn18I_EmAeFZnQqchtz5F_DETKOZfgp3GO7wYSJAVoUr...
- i####.####.com/InApp/resources/info_s.png
- d####.####.com/image/fetch/f_auto,q_80,w_230,h_230/http%3A%2F%2Flh3.googleusercontent.com%2FtYuF3mp-G0bg5joOnlOGjXeUq0r6omQSm5w6pYqq-NYXL22DRejYNdZki0...
- i####.####.com/InApp/resources/info_ex_s.png
- i####.####.com/InApp/resources/info_l.png
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googleusercontent.com%2Fvy78qNVGZSGJc71jOW7T6UcdAhB0NMyjnbtbP5W1f8n7wOdn4Am5KESVgVIv...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/StartappMetadata
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2035361866.zip
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/files/metrica_client_data.db.lock
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/files/credentials.dat
- /data/data/####/files/asdfg
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/app_app_apk/sc_HZSW51.dat.jar
- /data/data/####/shared_prefs/shared_preferences.xml.bak
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/shared_prefs/com.startapp.android.publish.xml.bak
- /data/data/####/shared_prefs/shared_preferences.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/metrica_client_data.db
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
- /data/data/####/cache/app.dat
- /data/data/####/shared_prefs/com.startapp.android.publish.xml
- /data/data/####/shared_prefs/ap_app_details.xml
- /data/data/####/files/shared_prefs_sdk_ad_prefs
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/model-distance-calculations.json
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
Другие:
Может автоматически отправлять СМС-сообщения.
