Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- d####.####.com
- startap####.com
- i####.####.com
- r####.####.com
Запросы HTTP GET:
- r####.####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVersion=#...
- d####.####.com/image/fetch/f_auto,q_80,w_256,h_256/http%3A%2F%2Flh3.googleusercontent.com%2FtYuF3mp-G0bg5joOnlOGjXeUq0r6omQSm5w6pYqq-NYXL22DRejYNdZki0...
- i####.####.com/InApp/resources/info_ex_l.png
- d####.####.com/styles/compressed/banner_rt_2d_rays_infra.20170124-0748.min.css
- startap####.com/tracking/infoEvent?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVer...
- r####.####.com/tracking/adClick?d=####&lu=####&index=####&clientSessionId=####&ts=####&afh=####
- d####.####.com/static/images/close-btn-infra.png
- d####.####.com/static/images/star_half_big.png
- d####.####.com/static/images/fullscreen_market_material_infra/arrow_down_white.png
- d####.####.com/image/fetch/f_auto,q_80,w_48,h_48/http%3A%2F%2Flh3.googleusercontent.com%2FI1xORgYMJHkPwlF-CRzgprHMuy3-O6qUBF0SS28D8x7oGlr0yLY2ouJywbLB...
- startap####.com/1.4/getadsmetadata?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVer...
- d####.####.com/styles/compressed/fullpage_float_window_infra.20170124-0748.min.css
- d####.####.com/static/images/star_full_big.png
- startap####.com/1.4/trackdownload?productId=####&os=####&sdkVersion=####&packageId=####&userAdvertisingId=####&model=####&manufacturer=####&deviceVers...
- d####.####.com/styles/compressed/fullscreen_market_material_infra_navy.20170124-0748.min.css
- i####.####.com/InApp/resources/info_ex_s.png
- r####.####.com/tracking/adImpression?d=####&clientSessionId=####&ts=####&afh=####
- i####.####.com/InApp/resources/info_s.png
- s####.####.com/TrafficCop.aspx?SetUid=####&SourceId=####&PublisherId=####&AppID=####&partner_var=####&index=####
- d####.####.com/static/images/banner_rt_2d_rays_base/download_icon_30.png
- d####.####.com/static/images/fullscreen_market_material_infra/star_full.png
- d####.####.com/static/images/fullscreen_market_material_infra/star_half.png
- d####.####.com/styles/compressed/animate.min.20170124-0748.min.css
- i####.####.com/InApp/resources/info_l.png
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/StartappMetadata
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/files/qwerty
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/files/metrica_client_data.db.lock
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/app_app_apk/batman.dat.jar
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/files/startapp_ads/keys/1777384550
- /data/data/####/files/startapp_ads/ads/1777384550
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/com.parse/applicationId
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1187856593.zip
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/cache/ads-5895684.jar
- /data/data/####/shared_prefs/com.startapp.android.publish.xml.bak
- /data/data/####/shared_prefs/716eadc46cbd1c8f4158d146fcf2122f.xml.bak
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-2018370489.zip
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/metrica_client_data.db
- /data/data/####/databases/ztrack.db-journal
- /data/data/####/shared_prefs/716eadc46cbd1c8f4158d146fcf2122f.xml
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2037573823.zip
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
- /data/data/####/app_Parse/installationId
- /data/data/####/shared_prefs/com.startapp.android.publish.xml
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/files/shared_prefs_sdk_ad_prefs
- /data/data/####/app_sslcache/api.parse.com.443
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/credentials.dat
Другие:
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
