Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/databases/totalsolution.db-journal
- /data/data/####/databases/usage_counter.db-journal
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/res_files/banner_loading_zh_TW.png
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/files/file
- /data/data/####/res_files/bg_main_ui_action_bar_zh_TW.9.png
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/Library/publickey
- /data/data/####/databases/wtp.db-journal
- /data/data/####/res_files/icon_oem_asus.png
- /data/data/####/Library/librtpatch.so
- /data/data/####/app_CTmodule/pubkey
- /data/data/####/res_files/ic_notification.png
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/files/metrica_client_data.db.lock
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/Library/libtmactupdate.so
- /data/data/####/Library/aucfg.ini
- /data/data/####/res_files/icon_oem_trueyou.png
- /data/data/####/shared_prefs/share_preference.xml.bak
- /data/data/####/shared_prefs/SCAN_AU_SHARED.xml
- /data/data/####/shared_prefs/cobranding_preference.xml
- /data/data/####/databases/jobStore.db-journal
- /data/data/####/res_files/bg_main_ui_action_bar_mu.9.png
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/databases/MessageCall.db
- /data/data/####/databases/google_app_measurement_local.db
- /data/data/####/shared_prefs/ReferralParamsFile.xml
- /data/data/####/shared_prefs/NETWORK_PREF_MUP.xml
- /data/data/####/no_backup/com.google.android.gms.appid-no-backup
- /data/data/####/databases/anti-spam.db-journal
- /data/data/####/res_files/banner_about.png
- /data/data/####/res_files/banner_loading.png
- /data/data/####/databases/anti-spam.db
- /data/data/####/shared_prefs/callsms_preference.xml.bak
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/google_app_measurement_local.db-journal
- /data/data/####/shared_prefs/NETWORK_PREF.xml
- /data/data/####/shared_prefs/LICENSE_SHARED.xml
- /data/data/####/shared_prefs/NETWORK_PREF.xml.bak
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/res_files/ico_tm_logo.png
- /data/data/####/Library/AuPatch
- /data/data/####/res_files/ico_action_bar_tball.png
- /data/data/####/app_CTmodule/index.json
- /data/data/####/Library/pattern.properties
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/code_cache/secondary-dexes/tmp-####-1.apk.classes922701764.zip
- /data/data/####/app_app_apk/gmobi.dat.jar
- /data/data/####/shared_prefs/total_solution.xml
- /data/data/####/shared_prefs/callsms_preference.xml
- /data/data/####/res_files/img_product_name_zh_TW.png
- /data/data/####/databases/marsquerycache.dat-journal
- /data/data/####/shared_prefs/SCAN_AU_SHARED.xml.bak
- /data/data/####/res_files/bg_main_ui_action_bar_mu_zh_TW.9.png
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/files/gaClientId
- /data/data/####/databases/MessageCall.db-journal
- /data/data/####/code_cache/secondary-dexes/tmp-####-1.apk.classes-1703628200.zip
- /data/data/####/res_files/bg_main_ui_action_bar.9.png
- /data/data/####/databases/metrica_client_data.db
- /data/data/####/shared_prefs/secondary_email_preference.xml
- /data/data/####/shared_prefs/whoscallSDK.xml
- /data/data/####/res_files/bg_popup_header_zh_TW.png
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/Library/pattern/msothaos.625
- /data/data/####/res_files/img_product_name.png
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/res_files/image_tm_logo_loading.png
- /data/data/####/shared_prefs/NETWORK_PREF_MUP.xml.bak
- /data/data/####/databases/scannedapp.dat-journal
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/res_files/img_trend_micro_logo.png
- /data/data/####/res_files/bg_popup_header.png
- /data/data/####/shared_prefs/share_preference.xml
- /data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/shared_prefs/com.google.android.gms.appid.xml
- /data/data/####/shared_prefs/whoscallSDK.xml.bak
- /data/data/####/files/credentials.dat
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
Другие:
Запускает следующие shell-скрипты:
- ps
Может автоматически отправлять СМС-сообщения.
