Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- for-min####.com
- con####.####.net
- google-####.com
- cou####.####.ru
- w####.####.com
- count-s####.####.com
- l####.####.com
- a####.####.com
- pag####.####.com
Запросы HTTP GET:
- for-min####.com/uploads/posts/2017-05/1494441653_dex-shaders.jpg
- for-min####.com/engine/modules/antibot.php
- for-min####.com/maps-for-minecraft-pocket-edition/
- for-min####.com/uploads/posts/2017-05/1494264697_super-mega-dropper.jpg
- w####.####.com/button/buttons.js?publisher=####
- w####.####.com/button/async-buttons.js
- for-min####.com/engine/editor/css/default.css
- for-min####.com/templates/smartphone/images/logo.png
- for-min####.com/uploads/posts/2017-05/thumbs/1493642889_find-the-button....
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&u...
- for-min####.com/templates/smartphone/dleimages/noavatar.png
- for-min####.com/uploads/posts/2017-05/thumbs/1494085500_blpe-shaders.jpg
- for-min####.com/uploads/posts/2017-05/thumbs/1494264677_super-mega-dropp...
- l####.####.com/pview?event=####&version=####&lang=####&fpc=####&sessionI...
- w####.####.com/images/2017/whatsapp_32.png
- for-min####.com/uploads/posts/2016-04/thumbs/1459539344_improving-minecr...
- for-min####.com/uploads/posts/2017-05/thumbs/1494265995_kiellt-hack.jpg
- for-min####.com/uploads/posts/2015-06/thumbs/1434021633_buildcraftmod.jpg
- for-min####.com/templates/sightlytemp/images/facebook.png
- for-min####.com/uploads/posts/2017-01/thumbs/1484402877_dyltroit-city.jpg
- w####.####.com/images/2017/googleplus_16.png
- for-min####.com/uploads/posts/2015-06/thumbs/1434022924_maxresdefault.jpg
- for-min####.com/uploads/posts/2016-10/thumbs/1477760880_kbhwatkbkrq.jpg
- for-min####.com/uploads/posts/2017-05/thumbs/1494264697_super-mega-dropp...
- w####.####.com/share4x/images/bubble_arrow.png
- con####.####.net/connect/xd_arbiter/r/JtmcTFxyLye.js?version=####
- cou####.####.ru/hit?t43.10;####
- w####.####.com/button/css/buttons.e80452d5e7cc382dad89d10f50bde247.css
- for-min####.com/uploads/posts/2017-03/thumbs/1490886330_mcpe-1-1.jpg
- for-min####.com/engine/editor/scripts/webfont.js
- for-min####.com/maps-for-minecraft-pocket-edition/2451-super-mega-droppe...
- for-min####.com/templates/smartphone/images/dbgtw.png
- w####.####.com/images/2017/sharethis_counter.png
- for-min####.com/uploads/posts/2017-05/thumbs/1494441653_dex-shaders.jpg
- for-min####.com/uploads/posts/2017-05/thumbs/1494264650_super-mega-dropp...
- for-min####.com/uploads/posts/2015-06/thumbs/1434100212_aafde23b8f4cd321...
- for-min####.com/uploads/posts/2017-04/thumbs/1493471472_lonely-house.jpg
- for-min####.com/uploads/posts/2017-04/thumbs/1493464030_the-neighborhood...
- for-min####.com/uploads/posts/2017-03/thumbs/1490195246_firework-rocket-...
- for-min####.com/uploads/posts/2017-05/thumbs/1494264633_super-mega-dropp...
- w####.####.com/images/2017/twitter_counter.png
- for-min####.com/uploads/posts/2016-11/thumbs/1478785623_maxresdefault.jpg
- for-min####.com/uploads/posts/2015-06/1434098252_1412783242_millenaire.png
- count-s####.####.com/v2.0/get_counts?url=####&cb=####&wd=####
- for-min####.com/engine/classes/min/index.php?charset=####&g=####&1####
- for-min####.com/uploads/posts/2017-05/thumbs/1494523679_camel-addon.jpg
- for-min####.com/uploads/posts/2017-05/thumbs/1494264667_super-mega-dropp...
- pag####.####.com/pagead/gen_204?id=####&message=####
- w####.####.com/images/2017/sharethis_32.png
- for-min####.com/uploads/posts/2015-06/thumbs/1434097041_maxresdefault.jpg
- for-min####.com/uploads/posts/2017-03/thumbs/1490355624_minecraft-pe-1.1...
- for-min####.com/templates/smartphone/js/libs.js
- w####.####.com/images/2017/twitter_32.png
- for-min####.com/uploads/posts/2017-05/thumbs/1494264675_super-mega-dropp...
- for-min####.com/uploads/posts/2017-02/thumbs/1486885115_minecraft-pe-1.1...
- for-min####.com/engine/classes/min/index.php?charset=####&f=####&1####
- for-min####.com/uploads/posts/2015-06/thumbs/1434099494_image-again-smal...
- for-min####.com/uploads/posts/2017-03/thumbs/1490105753_dyeable-beds.jpg
- google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=...
- pag####.####.com/pagead/js/adsbygoogle.js
- con####.####.net/en_en/sdk.js
- w####.####.com/images/2017/facebook_32.png
- w####.####.com/images/2017/facebook_counter.png
- for-min####.com/mods-for-minecraft/
- for-min####.com/mods-for-minecraft/1550-improving-minecraft.html
- for-min####.com/uploads/posts/2017-05/thumbs/1494006360_tokyo-ghoul.jpg
- a####.####.com/ajax/libs/webfont/1/webfont.js
- for-min####.com/uploads/posts/2017-05/thumbs/1494264711_super-mega-dropp...
- count-s####.####.com/increment_clicks?url=####&refDomain=####&refQuery=#...
- for-min####.com/engine/classes/highslide/graphics/outlines/rounded-white...
- for-min####.com/uploads/posts/2017-05/thumbs/1494264635_super-mega-dropp...
- for-min####.com/uploads/posts/2017-05/thumbs/1494264663_super-mega-dropp...
- for-min####.com/templates/smartphone/css/engine.css
- for-min####.com/templates/sightlytemp/images/twitter.png
- for-min####.com/templates/smartphone/images/sprite.png
- for-min####.com/minecraft_pe_0180_0181_0182/
- for-min####.com/templates/smartphone/images/dbg.png
- for-min####.com/engine/classes/highslide/graphics/zoomout.cur
- pag####.####.com/pagead/js/r20170508/r20170110/show_ads_impl.js
- for-min####.com/uploads/posts/2016-02/1454342005_googleplus.png
- w####.####.com/images/2017/googleplus_32.png
- for-min####.com/
- for-min####.com/templates/smartphone/css/style.css
- google-####.com/analytics.js
- for-min####.com/uploads/posts/2017-05/thumbs/1493990976_missing-color.jpg
- for-min####.com/uploads/posts/2017-05/thumbs/1494264654_super-mega-dropp...
- for-min####.com/uploads/posts/2017-05/thumbs/1494264623_super-mega-dropp...
- cou####.####.ru/hit?q;t43.1####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/files/file
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/app_app_apk/laxer.dat.jar
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/credentials.dat
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 40 40 274680 /data/data/####/app_app_apk/laxer.dat.jar 1252819925 437195589 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
