Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- startap####.com
- i####.####.com
- r####.####.com
- d####.####.com
- d3v1lb8####.####.net
- w####.####.net
- a####.####.com
- m####.####.mobi
Запросы HTTP GET:
- d3v1lb8####.####.net/output_static/ui/browser-forward-x1.png
- startap####.com/1.4/getadsmetadata?productId=####&os=####&sdkVersion=###...
- d3v1lb8####.####.net/output_static/ui/tiny-glow.png
- i####.####.com/sound_on.png
- i####.####.com/sound_off.png
- d3v1lb8####.####.net/output_static/ui/end-card-replay-normal-x2.png
- d3v1lb8####.####.net/output_static/ui/rocket-icon-embossed.png
- d3v1lb8####.####.net/output_static/ui/v4vc-alert-bg-x2.png
- d3v1lb8####.####.net/output_static/ui/browser-stop-x1.png
- d3v1lb8####.####.net/output_static/ui/browser-back-x1.png
- i####.####.com/InApp/resources/info_ex_l.png
- i####.####.com/1380229154.js
- d####.####.com/styles/compressed/fullpage-ios-big.20170517-0838.min.css
- i####.####.com/1446230889_1024x768.gif
- i####.####.com/f2a9dbf83784a3d2396166f721970a5e7693b2aa_768x1024_opt_v1....
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-confirm-normal-x2.png
- d####.####.com/static/images/close-btn-infra.png
- d3v1lb8####.####.net/output_static/ui/bg-applelinen-tile.png
- i####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...
- d3v1lb8####.####.net/output_static/ui/browser-bar-background.png
- d3v1lb8####.####.net/output_static/ui/browser-close-x1.png
- w####.####.net/80250F/s3videos/output/videos/hd_77858.m4v
- d####.####.com/image/fetch/f_auto,q_80,w_256,h_256/http%3A%2F%2Flh3.goog...
- i####.####.com/1463369263_1024x768_opt_v1.jpeg
- i####.####.com/InApp/resources/info_l.png
- i####.####.com/jquery-1.9.1.min.js
- w####.####.net/80250F/s3videos/output/videos/hd_66959.m4v
- i####.####.com/e058011c5948783736eb58522d30137013940c93_570x320_opt_v1.mp4
- i####.####.com/ffd934cd954523c8ad429508f50d8b0fce65a39b_570x320_opt_v1.mp4
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-confirm-down-x2.png
- i####.####.com/1464732476_1200x627_opt_v1.jpeg
- d3v1lb8####.####.net/output_static/ui/browser-reload-x1.png
- d3v1lb8####.####.net/output_static/ui/v4vc-alert-logo-x2.png
- d3v1lb8####.####.net/output_static/ui/browser-logo-tablet-x1.png
- i####.####.com/jquery.knob.js
- i####.####.com/InApp/resources/info_ex_s.png
- d3v1lb8####.####.net/output_static/ui/v4vc-bg-full.png
- i####.####.com/3ff5a41fc7d6717184d7c8042484446514b53dba_1024x768_opt_v1....
- r####.####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&user...
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
- i####.####.com/InApp/resources/info_s.png
- i####.####.com/b6cf2fcd9733bb73431376663a57e01ef22e7dbe_640x360_opt_v1.mp4
- i####.####.com/1463369262_768x1024_opt_v1.jpeg
- d3v1lb8####.####.net/output_static/ui/end-card-close-normal-x2.png
- d3v1lb8####.####.net/mraid/production/adc_mraid-tablet-android.js
- d3v1lb8####.####.net/output_static/ui/end-card-close-down-x2.png
- startap####.com/1.4/trackdownload?productId=####&os=####&sdkVersion=####...
- i####.####.com/nad?v1=####&model=####&dx=####&dy=####&accept=####&slot_c...
- i####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-cancel-down-x2.png
- m####.####.mobi/simpleM2M/requestEnhancedHtmlAd?aid=####&v=####&bid=####...
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-cancel-normal-x2.png
- d####.####.com/styles/compressed/animate.min.20170517-0838.min.css
- i####.####.com/1464732380_300x300_opt_v1.jpeg
- d3v1lb8####.####.net/output_static/ui/end-card-replay-down-x2.png
- i####.####.com/1446230887_768x1024.gif
Запросы HTTP POST:
- i####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
- i####.####.com/device?api_key=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/1a862772d910fa7b5d959443c76451bb.1
- <Package Folder>/files/adc/data/iap_cache.txt
- <Package Folder>/cache/image_manager_disk_cache/bc0ea3d37c7d2049c3f049b2770b531aef82de54732cf4dfa4752335a91d9171.0.tmp
- <Package Folder>/cache/image_manager_disk_cache/063f9eb88f9a2425a5d23706eee7246801a1ad44535a6d46bdf531b249f368e0.0.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_a11de795-9715-42e7-affb-894913809854_1495005863549.tap
- <Package Folder>/cache/3242ac6db2da586563bbc05f7ee1e47c.1.tmp
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.m.xml
- <Package Folder>/app_working/flurry.dex
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/cache/image_manager_disk_cache/84bec14a6e6753ced80f01a7ab3eafbc616c6448db969b9319eee63f59683b17.0.tmp
- <Package Folder>/files/Tapjoy/Cache/f2389f076324d476fca6986e4c026c94005b1cebbbad2eec4b1e695b9ddea1c1
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/files/Tapjoy/Cache/760771fbd572a4fea4fb5958c473c4cdbe5d459bdbc53b244bc2e32e9b822804
- <Package Folder>/files/adc/media/19.png
- <Package Folder>/shared_prefs/fiverocks.xml.bak
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA600B7-0001-08A7-4BFDDCD63037BeginSession.cls_temp
- <Package Folder>/cache/image_manager_disk_cache/01be15199d70a729dae0cba09252f6402f38ecafd973b929ce19eccbe908c6a9.0.tmp
- <Package Folder>/files/adc/media/20.png
- <Package Folder>/files/adc/data/tracking_info.txt
- <Package Folder>/files/INSTALLATION
- <Package Folder>/cache/image_manager_disk_cache/027c3aaa301f68f033cf403171f52806f455fb5c67ea9427e8cb4b9daaa61d24.0.tmp
- <Package Folder>/app_fiverocks/install
- <Package Folder>/files/adc/media/23.m4v
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_8537df96-a869-4e4c-a87f-ed1e9f7d904d_1495005848519.tap
- <Package Folder>/cache/93257e051dc58c1fbcb4a00bc43a79e7.1
- <Package Folder>/cache/93257e051dc58c1fbcb4a00bc43a79e7.0
- <Package Folder>/files/Tapjoy/Cache/6c974ead6b403a4ccc27ff1980e8b1f385e335f617df38276ae7fd36a13b45bd
- <Package Folder>/app_working/revmob.dex
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA600B7-0001-08A7-4BFDDCD63037SessionDevice.cls_temp
- <Package Folder>/files/adc/media/5.png
- <Package Folder>/cache/9c1628d045887ecd818291a705951861.0.tmp
- <Package Folder>/files/adc/media/8.png
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/cache/10f273e1bd5eb3916cf87a6e0842bbf9.0.tmp
- <Package Folder>/files/adc/media/18.js
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak
- <Package Folder>/cache/image_manager_disk_cache/d7f925331dfd146c36a17b2de23b888762df215caf4c3b34c582cdc06da727ff.0.tmp
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/Tapjoy/Cache/d4680d455a95c9ff6822ab0dc2f91dada368ce4c14ac1da5df9508dc2c85908f
- <Package Folder>/files/Tapjoy/Cache/ce474ca9929115d27d111456840875861155d65ed2597440016c9d821b1a88dc
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/cache/image_manager_disk_cache/0c869a823db916a2a89eedadbfae354c4db6bb68407604e932619ad7bf0836a3.0.tmp
- <Package Folder>/files/adc/media/6.png
- <Package Folder>/files/adc/media/7.png
- <Package Folder>/files/adc/media/24.m4v
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/crash_marker
- <Package Folder>/cache/image_manager_disk_cache/62451d8efc5534aa307e262db4350d75ce19f7562f510d08af528be04e41ca60.0.tmp
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/adc/data/zone_state.txt
- <Package Folder>/cache/image_manager_disk_cache/739c73d0eedd0ea816a175f125977ea88860192df5c6c8b8253a8f2e989e38d3.0.tmp
- <Package Folder>/cache/image_manager_disk_cache/2ad2e51f1fcb3d4ebfca203ed78b33eaf15467a229034ea2e94edcf1097552a6.0.tmp
- <Package Folder>/files/Tapjoy/Cache/a77be758a287e3f5aa1f3c99bb73af00b2334c6496e79c2fedef89d0d1686d95
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_347a2496-7a31-4cd3-b57e-a803d2515fa3_1495005862586.tap
- <Package Folder>/cache/image_manager_disk_cache/f32fcec0d2167df29a2ace8dc025959f22face0aa3b669617bc2b0ef5326e271.0.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037SessionDevice.cls_temp
- <Package Folder>/cache/3754307b4d7f47f2dd68eed0a672b24b.1
- <Package Folder>/cache/journal.tmp
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/cache/1460683162801.tmp
- <Package Folder>/cache/image_manager_disk_cache/3efa5aebfec3976f1269e60f6bd274ff856949e14d87330a272cafd2be5b53dd.0.tmp
- <Package Folder>/cache/3754307b4d7f47f2dd68eed0a672b24b.1.tmp
- <Package Folder>/files/adc/media/11.png
- <Package Folder>/cache/image_manager_disk_cache/68d6319b5775fc8dd4f6f30818482956c41ef93786cf92ce5d24f51814805535.0.tmp
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-751597250.zip
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/files/Tapjoy/Cache/d4df85a13557f81dec31fa4f3e36410449fd46a0feeae980494f063eec9e1836
- <Package Folder>/cache/image_manager_disk_cache/760d8411a422011788948a268607c8d67cd7d3887cc4bf6a8e9afa501bc8475f.0.tmp
- <Package Folder>/cache/example.png
- <Package Folder>/app_ajw/registry
- <Package Folder>/cache/most_downloads.json
- <Package Folder>/files/shared_prefs_sdk_ad_prefs
- <Package Folder>/app_working/vungle.dex
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/files/Tapjoy/Cache/fcb4c0267f2b358bd223e03ea8b1f34d1571bf9d12bf0d0217b82a9ea11f9b69
- <Package Folder>/app_app_apk/skinsforminecraftpe.dat.jar
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/fatal-sessions/591BFA970020-0001-0838-4BFDDCD63037.cls_temp
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/app_working/avocarrot.dex
- <Package Folder>/cache/9c1628d045887ecd818291a705951861.1.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA50211-0002-0838-4BFDDCD63037BeginSession.cls_temp
- <Package Folder>/files/adc/media/9.png
- <Package Folder>/files/adc/data/manifest.txt
- <Package Folder>/cache/image_manager_disk_cache/300db7f3fbc6e873e9ec915acc9c3b348b018cbb6ff78f0730b985e43fe6b3e1.0.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA600B7-0001-08A7-4BFDDCD63037SessionApp.cls_temp
- <Package Folder>/files/adc/media/14.png
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA50211-0002-0838-4BFDDCD63037SessionApp.cls_temp
- <Package Folder>/shared_prefs/appodeal.xml
- <Package Folder>/cache/3754307b4d7f47f2dd68eed0a672b24b.0.tmp
- <Package Folder>/cache/image_manager_disk_cache/d50245af111a1c1579ba8f7704333d5c396f2792830b0f29fb36ec33f63d7e27.0.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037BeginSession.cls_temp
- <Package Folder>/shared_prefs/tapjoyCacheData.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_da470495-4866-4953-9f1f-f9663f21c6d8_1495005847129.tap
- <Package Folder>/cache/image_manager_disk_cache/7ac3461068423e1c4ee2782305d9cfd6d88a5dc526af703ba2089722a093afcc.0.tmp
- <Package Folder>/cache/1a862772d910fa7b5d959443c76451bb.1.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037SessionOS.cls_temp
- <Package Folder>/cache/featured_skins.json
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA600B7-0001-08A7-4BFDDCD63037SessionOS.cls_temp
- <Package Folder>/files/adc/media/3.png
- <Package Folder>/files/adc/media/15.png
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037SessionApp.cls_temp
- <Package Folder>/files/adc/media/21.png
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/oneaudience.xml
- <Package Folder>/cache/image_manager_disk_cache/5b2db2efea12b34db37d6b7fd0b15a2f30e5e3e2df244100450a61ac27afbc93.0.tmp
- <Package Folder>/files/adc/media/1.png
- <Package Folder>/shared_prefs/tjcPrefrences.xml
- <Package Folder>/files/adc/media/13.png
- <Package Folder>/cache/image_manager_disk_cache/c902716d7d365269f29887f212a4302646e27b5c514c5faa20750eb7f0d4dfc4.0.tmp
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037SessionCrash.cls_temp
- <Package Folder>/files/Tapjoy/Cache/f9027d6142eee7f05b9477d1be4013394dc6dfb8ed10b2bf1876deb2e1aa16bd
- <Package Folder>/cache/efcfc8abde90631f57a6c248c57e0653.1
- <Package Folder>/cache/efcfc8abde90631f57a6c248c57e0653.0
- <Package Folder>/files/adc/data/media_info.txt
- <Package Folder>/app_working/yandex.dex
- <Package Folder>/shared_prefs/localPreferences.xml
- <Package Folder>/cache/most_recent.json
- <Package Folder>/cache/10f273e1bd5eb3916cf87a6e0842bbf9.0
- <Package Folder>/cache/10f273e1bd5eb3916cf87a6e0842bbf9.1
- <Package Folder>/files/adc/media/10.png
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
- <Package Folder>/files/Tapjoy/Cache/b2dbf695282cf51e2a9df8b14b68d70b6bad94eed347aa291a697128a08c5640
- <Package Folder>/files/Tapjoy/Cache/399324a6cd38aaf37b1ee969d82c98c8f490db0508da2603cc18bca1ad037419
- <Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
- <Package Folder>/shared_prefs/oneaudience.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android.crashlytics-core;com.crashlytics.android.core.CrashlyticsCore.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/files/Tapjoy/Cache/c5e1706cd4387fea718e9ae3d0e9cbc687af83e83dd64534f40abc0fdf27e8f4
- <Package Folder>/files/Tapjoy/Cache/c536f32f5f9f27437a094bebc7dccd76307ede5f715040e14fa75448ee9eb1cc
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/1460683162801.jar
- <Package Folder>/cache/3242ac6db2da586563bbc05f7ee1e47c.0.tmp
- <Package Folder>/files/Tapjoy/Cache/363fd2a890cfb629dc7aa8febfe5d4371581d327dde4ab5a080a24f27fbbfb83
- <Package Folder>/app_working/tapjoy.dex
- <Package Folder>/files/adc/media/2.png
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA50211-0002-0838-4BFDDCD63037SessionOS.cls_temp
- <Package Folder>/files/adc/media/16.png
- <Package Folder>/files/adc/media/17.png
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/adc/media/4.png
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA50211-0002-0838-4BFDDCD63037SessionUser.cls_temp
- <Package Folder>/cache/image_manager_disk_cache/journal.tmp
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/Appodeal.xml
- <Package Folder>/shared_prefs/freq.xml
- <Package Folder>/files/adc/media/12.png
- <Package Folder>/cache/image_manager_disk_cache/e3e6fac0dea0c241fbb5abe3f5f8414a2d8bdeaa8defd48bd17e630c1710c2c9.0.tmp
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/files/adc/media/22.png
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1000225812.zip
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/app_working/adcolony.dex
- <Package Folder>/files/StartappMetadata
- <Package Folder>/cache/image_manager_disk_cache/b03ea771b3b915ae5576eedb4fb907455dce9af5cc3557dcd929f9930584317e.0.tmp
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/tapjoyCacheData.xml
- <Package Folder>/cache/1a862772d910fa7b5d959443c76451bb.0.tmp
- <Package Folder>/files/Tapjoy/Cache/720f1c13bb5f274a42c765e1531f80cbfe3b9f2f173e0884a7251342ba52aca8
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFA970020-0001-0838-4BFDDCD63037SessionUser.cls_temp
- <Package Folder>/files/Tapjoy/Cache/ae6bc38af361a64d34222516d61ce883a148f02af1cbe74b3828dcd36dcdf205
- <Package Folder>/files/Tapjoy/Cache/25e8b8ab02eccf9915da4e770222c806ac0e4d51640ce9a32191412ccfc6e83b
- <Package Folder>/cache/image_manager_disk_cache/0dd390b59fe5d64f94100b1446eef02c7ed005701f1f82521576f51ce5bd6fab.0.tmp
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/image_manager_disk_cache/6c2a5b23db6d014aa44f0afd8e20c6893b2dea653232e95fc1cddf865be2c1de.0.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFAA50211-0002-0838-4BFDDCD63037SessionDevice.cls_temp
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
