Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/DownloadsDB-journal
- /data/anr/traces.txt
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes907102152.zip
- <Package Folder>/files/usr/lib/1444416414/libOpenAL.so
- <Package Folder>/files/usr/lib/1444416414/libBridgeKit.so
- <Package Folder>/files/usr/lib/1444416414/libCoreGraphics.so
- <Package Folder>/files/usr/lib/1444416414/libfreetype.so
- <Package Folder>/files/adc/data/zone_state.txt
- <Package Folder>/files/adc/media/8.png
- <Package Folder>/databases/mixpanel-journal
- <Package Folder>/files/usr/lib/1444416414/libFoundation.so
- <Package Folder>/files/.Defaults.plist
- <Package Folder>/files/usr/lib/1444416414/libAudioUnit.so
- <Package Folder>/files/Library/Defaults.plist
- <Package Folder>/files/adc/media/2.png
- <Package Folder>/files/adc/media/3.png
- <Package Folder>/files/adc/media/15.png
- <Package Folder>/files/adc/media/16.png
- <Package Folder>/files/adc/media/17.png
- <Package Folder>/files/adc/media/21.png
- <Package Folder>/files/usr/lib/1444416414/libdispatch.so
- <Package Folder>/files/usr/lib/1444416414/libpthread_workqueue.so
- <Package Folder>/files/usr/lib/1444416414/libcrypto_1_01k.so
- <Package Folder>/files/file
- <Package Folder>/files/adc/media/22.png
- <Package Folder>/files/adc/media/5.png
- <Package Folder>/files/adc/media/19.png
- <Package Folder>/files/Notifications
- <Package Folder>/files/usr/lib/1444416414/libAudioFile.so
- <Package Folder>/files/adc/media/24.m4v
- <Package Folder>/files/adc/media/1.png
- <Package Folder>/files/.flurryagent.267b3fec
- <Package Folder>/files/adc/media/13.png
- <Package Folder>/cache/com.android.opengl.shaders_cache
- <Package Folder>/app_app_apk/kingdomrushorigins.dat.jar
- <Package Folder>/files/adc/media/20.png
- <Package Folder>/databases/mixpanel
- <Package Folder>/files/adc/data/tracking_info.txt
- <Package Folder>/files/usr/lib/1444416414/libCoreAudio.so
- <Package Folder>/cache/__chartboost/CBSessionDirectory/cb_previous_session_info
- <Package Folder>/files/usr/lib/1444416414/libv.so
- <Package Folder>/files/INSTALLATION
- <Package Folder>/shared_prefs/com.android.vending.licensing.APKExpansionPolicy.xml
- <Package Folder>/files/adc/data/media_info.txt
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/files/adc/media/23.m4v
- <Package Folder>/files/Documents/.sktransactions
- <Package Folder>/files/adc/media/11.png
- <Package Folder>/files/adc/media/10.png
- <Package Folder>/files/usr/lib/1444416414/libssl_1_01k.so
- <Package Folder>/files/adc/media/12.png
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/savegame.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/adc/media/18.js
- <Package Folder>/files/usr/lib/1444416414/libSystem.so
- <Package Folder>/files/adc/media/4.png
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/files/usr/lib/1444416414/libverde.so
- <Package Folder>/files/usr/lib/1444416414/libAudioToolbox.so
- <Package Folder>/files/adc/media/9.png
- <Package Folder>/files/adc/data/manifest.txt
- <Package Folder>/files/usr/lib/1444416414/libffi.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/usr/lib/1444416414/libCoreText.so
- <Package Folder>/files/usr/lib/1444416414/libcxx.so
- <Package Folder>/files/usr/lib/1444416414/libobjc.so
- <Package Folder>/files/adc/media/14.png
- <Package Folder>/files/adc/media/6.png
- <Package Folder>/files/adc/media/7.png
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
