Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/app-data/####/AUTHORS
- /sdcard/app-data/####/Data/AdRollvr1440.pcx
- /sdcard/app-data/####/config/battleStartpos.json
- /sdcard/app-data/####/config/bankconfig.json
- /sdcard/app-data/####/Data/CreWin2.pcx
- /sdcard/app-data/####/.nomedia
- /sdcard/app-data/####/config/town_pictures.json
- /data/data/####/files/asdfg
- /sdcard/app-data/####/config/ERMU_to_picture.json
- /sdcard/app-data/####/Data/AdvMap1366x768.pcx
- /sdcard/app-data/####/config/sp_sounds.json
- /sdcard/app-data/####/config/hall.txt
- /data/data/####/shared_prefs/multidex.version.xml
- /sdcard/app-data/####/config/settings.txt
- /sdcard/app-data/####/config/spell_info.txt
- /sdcard/app-data/####/Data/CreWin1.pcx
- /sdcard/app-data/####/Data/ZResBar1680.pcx
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/app-data/####/libsdl-DownloadFinished-2.flag
- /sdcard/app-data/####/config/native_terrains.txt
- /sdcard/app-data/####/Data/OvCast5.pcx
- /sdcard/app-data/####/sprites/IAM004L.DEF
- /sdcard/app-data/####/config/TERCOSTS.TXT
- /sdcard/app-data/####/libsdl-DownloadFinished-1.flag
- /sdcard/app-data/####/config/threatlevel.txt
- /sdcard/app-data/####/Data/DIBOXPI.pcx
- /sdcard/app-data/####/Data/AdvMap1280x1024.pcx
- /sdcard/app-data/####/config/battleStartpos.txt
- /sdcard/app-data/####/config/dwellings.json
- /sdcard/app-data/####/Data/AdRollvr1920.pcx
- /sdcard/app-data/####/config/towns_defs.json
- /sdcard/app-data/####/config/NEUTRAL.PAL
- /sdcard/app-data/####/Data/ZResBar1440.pcx
- /sdcard/app-data/####/Data/AdvMap1680x1050.pcx
- /sdcard/app-data/####/config/campaign_regions.json
- /sdcard/app-data/####/Data/AdRollvr1280.pcx
- /sdcard/app-data/####/Data/CreWin3.pcx
- /sdcard/app-data/####/config/cregens.txt
- /sdcard/app-data/####/MP3/snd1.wav
- /sdcard/app-data/####/libsdl-DownloadFinished-0.flag
- /sdcard/app-data/####/sprites/IAM005L.DEF
- /sdcard/app-data/####/Data/s/testy.erm
- /sdcard/app-data/####/Data/AdRollvr1680.pcx
- /sdcard/app-data/####/sprites/IAM008L.DEF
- /sdcard/app-data/####/Data/AdRollvr1366.pcx
- /sdcard/app-data/####/Data/OvCast6.pcx
- /sdcard/app-data/####/Data/CreWin4.pcx
- /sdcard/app-data/####/Data/AdvMap1024x600.pcx
- /data/data/####/files/Scripting/libvcmiERM.so
- /sdcard/app-data/####/sprites/IAM010L.DEF
- /sdcard/app-data/####/config/buildings5.txt
- /sdcard/app-data/####/config/portraits.json
- /sdcard/app-data/####/config/buildings5.json
- /sdcard/app-data/####/config/bankconfig.txt
- /sdcard/app-data/####/config/cr_sounds.json
- /sdcard/app-data/####/Data/OvCast7.pcx
- /sdcard/app-data/####/Data/AdvMap1440x900.pcx
- /sdcard/app-data/####/config/fonts.txt
- /data/data/####/files/AI/libGeniusAI.so
- /sdcard/app-data/####/config/campaign_regions.txt
- /sdcard/app-data/####/ChangeLog
- /sdcard/app-data/####/config/sysopts.bin
- /sdcard/app-data/####/config/startres.json
- /sdcard/app-data/####/config/ressources.json
- /sdcard/app-data/####/sprites/PortraitsSmall.json
- /sdcard/app-data/####/config/spell_info.json
- /sdcard/app-data/####/sprites/IAM009L.DEF
- /sdcard/app-data/####/Data/AdRollvr1024.pcx
- /sdcard/app-data/####/Fonts/georgia.ttf
- /sdcard/app-data/####/Data/AdvMap1280x960.pcx
- /sdcard/app-data/####/Data/ZResBar1024.pcx
- /sdcard/app-data/####/config/minimap.json
- /sdcard/app-data/####/config/bonusnames.json
- /data/data/####/files/libsdl-settings.cfg
- /sdcard/app-data/####/config/obstacles.txt
- /data/data/####/files/stdout-test
- /sdcard/app-data/####/sprites/IAM002L.DEF
- /sdcard/app-data/####/config/puzzle_map.txt
- /sdcard/app-data/####/config/terrains.json
- /sdcard/app-data/####/sprites/IAM006L.DEF
- /sdcard/app-data/####/config/creature_backgrounds.json
- /sdcard/app-data/####/Fonts/tnrb.ttf
- /sdcard/app-data/####/config/puzzle_map.json
- /sdcard/app-data/####/config/wall_pos.json
- /sdcard/app-data/####/config/buildings.json
- /sdcard/app-data/####/sprites/PortraitsLarge.json
- /sdcard/app-data/####/sprites/IAM003L.DEF
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/app-data/####/Data/ZResBar1366.pcx
- /sdcard/app-data/####/Data/AdvMap1600x1200.pcx
- /sdcard/app-data/####/Data/OvCast8.pcx
- /sdcard/app-data/####/sprites/IAM007L.DEF
- /sdcard/app-data/####/Data/s/std.verm
- /sdcard/app-data/####/config/resources.txt
- /data/data/####/files/AI/libStupidAI.so
- /data/data/####/files/vcmiserver
- /sdcard/app-data/####/license.txt
- /sdcard/app-data/####/Data/AdRollvr1600.pcx
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-1103732283.zip
- /sdcard/app-data/####/Data/AdvMap1024x768.pcx
- /sdcard/app-data/####/config/heroes.json
- /sdcard/app-data/####/Data/CHRROP.pcx
- /sdcard/app-data/####/config/hall.json
- /sdcard/app-data/####/config/battles_graphics.json
- /sdcard/app-data/####/config/resolutions.json
- /sdcard/app-data/####/Data/ZResBar1280.pcx
- /sdcard/app-data/####/Data/ZResBar1920.pcx
- /sdcard/app-data/####/Data/ZResBar1600.pcx
- /sdcard/app-data/####/config/mageBg.txt
- /sdcard/app-data/####/config/obstacles.json
- /sdcard/app-data/####/Data/AdvMap1920x1080.pcx
- /sdcard/app-data/####/config/creatures.json
- /data/data/####/app_app_apk/vcmi.dat.jar
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/AI/libStupidAI.so
- /data/data/####/files/vcmiserver
- /data/data/####/files/Scripting/libvcmiERM.so
- /data/data/####/files/AI/libGeniusAI.so
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 41 40 503548 /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2.zip 2168832 586063991 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
- sh /data/data/####/files/stdout-test
- /system/bin/dexopt --dex 27 40 40 264556 /data/data/####/app_app_apk/vcmi.dat.jar 1244893332 1670085215 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
- /data/data/####/files/stdout-test
Может автоматически отправлять СМС-сообщения.
