Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- t####.####.com
- plat####.####.com
- statcou####.com
- google-####.com
- 1####.####.com
- c####.####.com
- e####.####.com
- mc####.com
- w####.####.com
- count-s####.####.com
- l####.####.com
- b####.####.com
- pag####.####.com
Запросы HTTP GET:
- pag####.####.com/pagead/js/r20170130/r20170110/show_ads_impl.js
- mc####.com/wp-content/uploads/2017/01/mine-tanks-4-520x245.jpg
- b####.####.com/b2?c1=####&c2=####&rn=####&c7=####&c3=####&c8=####&c9=####&cv=####&cs=####
- mc####.com/wp-content/plugins/front-end-registration-login-forms/js/feralf-scripts.js?ver=####
- pag####.####.com/pixel?google_nid=####&google_ula=####&google_ula=####
- mc####.com/wp-content/plugins/wp-skins/modules/inc/fa/css/font-awesome.min.css?ver=####
- mc####.com/wp-content/uploads/2016/12/killer-bunny-520x245.jpg
- s####.####.com/adxmapping.php?google_ula=####&google_ula=####
- mc####.com/wp-content/themes/hueman/js/scripts.js?ver=####
- mc####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
- w####.####.com/button/async-buttons.js
- mc####.com/wp-content/uploads/2017/02/war-tank-520x245.jpg
- mc####.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=####
- mc####.com/wp-content/plugins/cj-membership-modules/cjfm-custom.css?ver=####
- google-####.com/analytics.js
- mc####.com/wp-content/themes/hueman/style.css?ver=####
- mc####.com/wp-content/uploads/2017/02/mine-trucks-2.jpg
- mc####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- w####.####.com/share5x/js/st.eb86ded37d3ddd5adf94f4c2b64fa60f.js
- mc####.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=####
- mc####.com/wp-content/themes/hueman/js/jquery.flexslider.min.js?ver=####
- mc####.com/wp-content/uploads/2017/02/torcherino-1-520x245.jpg
- c####.####.com/t.php?sc_project=####&java=####&security=####&u1=####&sc_random=####&jg=####&rr=####&resolution=####&h=####&camefrom=####&u=####&t=####...
- w####.####.com/images/2017/googleplus_16.png
- mc####.com/wp-content/themes/hueman/fonts/titillium-lightitalic-webfont.svg
- mc####.com/wp-includes/js/jquery/jquery.js?ver=####
- mc####.com/wp-content/themes/hueman/fonts/titillium-light-webfont.ttf
- w####.####.com/share4x/images/bubble_arrow.png
- mc####.com/wp-content/uploads/2017/02/mine-trucks-3.jpg
- w####.####.com/button/css/buttons.e80452d5e7cc382dad89d10f50bde247.css
- mc####.com/wp-includes/js/wp-embed.min.js?ver=####
- t####.####.com/d/a.gif?cid=####&puu=####&r=####
- l####.####.com/pview?event=####&version=####&lang=####&fpc=####&sessionID=####&hostname=####&location=####&product=####&stid=####&publisher=####&st_op...
- w####.####.com/images/2017/sharethis_counter.png
- mc####.com/category/mods/
- mc####.com/wp-content/uploads/2017/02/uks-city-520x245.jpg
- mc####.com/wp-content/uploads/2017/01/no-griefers-1-520x245.jpg
- mc####.com/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=####
- mc####.com/wp-content/themes/hueman/fonts/titillium-lightitalic-webfont.ttf
- mc####.com/wp-content/uploads/2014/08/tech1-520x245.png
- statcou####.com/counter/counter.js
- t####.####.com/1/d/t.dhj?rnd=####&cid=####&dmn=####
- mc####.com/wp-includes/js/comment-reply.min.js?ver=####
- mc####.com/wp-content/uploads/2017/02/dayz-mcpe-520x245.jpg
- c####.####.com/ajax/libs/cookieconsent2/1.0.9/dark-bottom.css
- mc####.com/wp-content/plugins/cj-membership-modules/assets/css/cjfm.css?ver=####
- mc####.com/wp-content/themes/hueman/img/sidebar/s-right-s1.png
- w####.####.com/images/2017/twitter_counter.png
- google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=####&de=####&dt=####&sd=####&sr=####&vp=####&je=####&_u=####&jid=####&cid=####...
- mc####.com/wp-content/themes/hueman-child/style.css?ver=####
- mc####.com/wp-content/plugins/cj-membership-modules/assets/js/cjfm.js?ver=####
- mc####.com/wp-content/plugins/wp-skins/modules/inc/assets/css/boot-cont.css?ver=####
- s####.####.com/getSegment.php?purl=####&jsref=####&product=####&rnd=####
- w####.####.com/share5x/js/stcommon.abaae5e95825c1fb680e1c6259855261.js
- e####.####.com/share5x/index.5ce994dfd943a0cbb890329fbc6ae1de.html
- mc####.com/wp-content/plugins/cj-membership-modules/assets/cjfm-icons/style.css?ver=####
- b####.####.com/b?c1=####&c2=####&rn=####&c7=####&c3=####&c8=####&c9=####&cv=####&cs=####
- mc####.com/wp-content/themes/hueman/responsive.css?ver=####
- mc####.com/wp-content/themes/hueman/fonts/titillium-regularitalic-webfont.svg
- mc####.com/wp-content/themes/hueman/fonts/titillium-regular-webfont.svg
- count-s####.####.com/increment_clicks?url=####&refDomain=####&refQuery=####
- mc####.com/wp-content/uploads/2017/02/mine-trucks-1.jpg
- mc####.com/wp-content/themes/hueman/fonts/titillium-semibold-webfont.svg
- mc####.com/mine-trucks-addon/
- mc####.com/wp-content/plugins/wp-skins/modules/inc/fa/fonts/fontawesome-webfont.ttf?v=####
- mc####.com/wp-content/uploads/2015/12/defscape-2-520x245.jpg
- mc####.com/wp-content/uploads/2014/04/dllogo1.png
- pag####.####.com/pagead/js/adsbygoogle.js
- mc####.com/wp-content/plugins/wp-skins/modules/css/front.css?ver=####
- w####.####.com/images/2017/facebook_counter.png
- mc####.com/wp-content/plugins/wp-skins/modules/js/front.js?ver=####
- mc####.com/wp-content/themes/hueman/fonts/titillium-semibold-webfont.ttf
- mc####.com/wp-content/uploads/2017/01/herobrines-everywhere-520x245.jpg
- mc####.com/wp-content/uploads/2017/01/wither-turrets-1-520x245.jpg
- mc####.com/wp-content/uploads/2017/01/disneypark-7-520x245.jpg
- mc####.com/wp-content/themes/hueman/fonts/titillium-regularitalic-webfont.ttf
- mc####.com/wp-content/themes/hueman/img/opacity-10.png
- mc####.com/wp-content/themes/hueman/fonts/fontawesome-webfont.ttf?v=####
- c####.####.com/ajax/libs/cookieconsent2/1.0.9/cookieconsent.min.js?ver=####
- plat####.####.com/widgets.js
- mc####.com/wp-content/themes/hueman/fonts/titillium-light-webfont.svg
- mc####.com/wp-content/themes/hueman/fonts/font-awesome.min.css?ver=####
- mc####.com/wp-content/uploads/2016/11/max-framerate-addon-1-520x245.jpg
- mc####.com/wp-content/themes/hueman/fonts/titillium-regular-webfont.ttf
- mc####.com/wp-content/uploads/2017/02/sumo-520x245.jpg
- mc####.com/wp-content/plugins/mc-cookie-consent/js/mc-cookie-consent.js?ver=####
- mc####.com/wp-content/plugins/cj-membership-modules/cjfm-custom.js?ver=####
- mc####.com/
- mc####.com/wp-content/uploads/2017/02/mine-trucks-520x245.jpg
- mc####.com/wp-content/uploads/2017/01/naruto-craft-1-520x245.jpg
- count-s####.####.com/v2.0/get_counts?url=####&cb=####&wd=####
- plat####.####.com/css/timeline.3a5bba37d8a97ff1a6185653efe28c38.light.ltr.css
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=####&de=####&dt=####&sd=####&sr=####&vp=####&je=####&_u=####&jid=####&cid=##...
- mc####.com/wp-includes/css/dashicons.min.css?ver=####
- mc####.com/wp-content/uploads/2017/02/magic-wizard-balls-520x245.jpg
- mc####.com/wp-content/uploads/2017/02/mine-trucks.jpg
- w####.####.com/button/buttons.js
- 1####.####.com/avatar/432533f42e82e579b27607038bf62b28?s=####&d=####&r=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/webviewCacheChromium/f_00002f
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/app_app_apk/mof.dat.jar
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000034
- /data/data/####/cache/webviewCacheChromium/f_000035
- /data/data/####/cache/webviewCacheChromium/f_000036
- /data/data/####/cache/webviewCacheChromium/f_000037
- /data/data/####/cache/webviewCacheChromium/f_000030
- /data/data/####/cache/webviewCacheChromium/f_000031
- /data/data/####/cache/webviewCacheChromium/f_000032
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/cache/webviewCacheChromium/f_000038
- /data/data/####/cache/webviewCacheChromium/f_000039
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/cache/webviewCacheChromium/f_00003d
- /data/data/####/cache/webviewCacheChromium/f_00003e
- /data/data/####/cache/webviewCacheChromium/f_00003f
- /data/data/####/cache/webviewCacheChromium/f_00003a
- /data/data/####/cache/webviewCacheChromium/f_00003b
- /data/data/####/cache/webviewCacheChromium/f_00003c
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/files/asdfg
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/files/credentials.dat
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/cache/webviewCacheChromium/f_000033
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/cache/webviewCacheChromium/f_000048
- /data/data/####/cache/webviewCacheChromium/f_000045
- /data/data/####/cache/webviewCacheChromium/f_000044
- /data/data/####/cache/webviewCacheChromium/f_000047
- /data/data/####/cache/webviewCacheChromium/f_000046
- /data/data/####/cache/webviewCacheChromium/f_000041
- /data/data/####/cache/webviewCacheChromium/f_000040
- /data/data/####/cache/webviewCacheChromium/f_000043
- /data/data/####/cache/webviewCacheChromium/f_000042
- /data/data/####/databases/webview.db-journal
Другие:
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
