Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- im####.####.com
- startap####.com
- i####.####.com
- googl####.####.net
- 1####.####.245
- pag####.####.com
Запросы HTTP GET:
- im####.####.com/image/fetch/f_auto,q_80,w_150,h_150/http%3A%2F%2Flh3.goo...
- googl####.####.net/mads/static/sdk/native/sdk-core-v40.html
- im####.####.com/styles/compressed/animate.min.20170517-0838.min.css
- im####.####.com/static/images/fullpage_cok_gyro_infra/phone.png
- googl####.####.net/mads/static/mad/sdk/native/production/sdk-core-v40-im...
- i####.####.com/InApp/resources/info_ex_l.png
- im####.####.com/static/images/parachute-bird.gif
- im####.####.com/static/images/parachute.png
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.appcache
- im####.####.com/static/images/fullpage_cok_gyro_infra/x.png
- startap####.com/1.3/gethtmlad?publisherId=####&productId=####&os=####&sd...
- im####.####.com/static/images/fullpage_cok_gyro_infra/men.png
- im####.####.com/static/images/fullpage_cok_gyro_infra/red_landscape.png
- im####.####.com/styles/compressed/fullpage_cok_gyro_infra.20170517-0838....
- im####.####.com/static/images/fullpage_cok_gyro_infra/sky2_landscape.jpg
- googl####.####.net/mads/static/mad/sdk/native/canary/sdk-core-v40-impl.js
- i####.####.com/InApp/resources/info_ex_s.png
- im####.####.com/static/images/fullpage_cok_gyro_infra/figthers.png
- im####.####.com/static/images/fullpage_cok_gyro_infra/bubble.png
- startap####.com/1.3/trackdownload?publisherId=####&productId=####&os=###...
- im####.####.com/static/images/fullpage_cok_gyro_infra/logo.png
- pag####.####.com/activeview?avi=####&id=####&mtos=####&tos=####&p=####&r...
- 1####.####.245/tracking/adImpression?d=####
- im####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.googl...
- im####.####.com/static/images/fullpage_cok_gyro_infra/_women.png
- im####.####.com/styles/compressed/fullpage-ios-big.20170517-0838.min.css
- startap####.com/1.3/getadsmetadata?publisherId=####&productId=####&os=##...
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.js
- im####.####.com/image/fetch/f_auto,q_80,w_256,h_256/http%3A%2F%2Flh3.goo...
- i####.####.com/InApp/resources/info_l.png
- i####.####.com/InApp/resources/info_s.png
- im####.####.com/static/images/close-btn-infra.png
- googl####.####.net/mads/static/mad/sdk/native/sdk-core-v40.html
- im####.####.com/image/fetch/f_auto,q_80,w_124,h_124/http%3A%2F%2Flh3.goo...
- startap####.com/1.3/getads?publisherId=####&productId=####&os=####&sdkVe...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/free.dat.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/prefrence_viruscleaner.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1941216895.zip
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/http_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/ads-1643188114.jar
- <Package Folder>/app_outdex/free.dat.dex
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
