Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- camon####.com
Запросы HTTP GET:
- camon####.com/api/v1/map/layers/?sign=####&v=####
- camon####.com/api/v1/insurance_companies?sign=####&v=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/crashlytics-userlog-ecd7088b-3793-4efb-8808-36ec33e6ca64.temp
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/initialization_marker
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9B009B-0001-083A-386D7C801793SessionUser.cls_temp
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsData_PFMTTK5TJ5FFZMW7R2TM_170
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9D02C9-0002-083A-386D7C801793SessionDevice.cls_temp
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/prefs.xml
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9D02C9-0002-083A-386D7C801793SessionOS.cls_temp
- <Package Folder>/databases/cache.db-journal
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics_to_send/sa_9d6e2176-ad31-4a98-8fc4-d9a851bd158a_1495005851723.tap
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-537509917.zip
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9B009B-0001-083A-386D7C801793SessionDevice.cls_temp
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap
- <Package Folder>/files/gaClientId
- <Package Folder>/app_Parse/CommandCache/CachedCommand_0000015c154aedfe_00000001_-320949002
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/app_Parse/CommandCache/CachedCommand_0000015c154aedee_00000000_122132637
- <Package Folder>/files/.flurryagent.-2a034f6
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap.tmp
- <Package Folder>/shared_prefs/com.crashlytics.android.internal.D.xml
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9B009B-0001-083A-386D7C801793SessionOS.cls_temp
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/com.crashlytics.settings.json
- <Package Folder>/app_Parse/CommandCache/CachedCommand_0000015c154aee1a_00000002_1785466781
- <Package Folder>/files/.FlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/app_Parse/applicationId
- <Package Folder>/app_Parse/installationId
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9D02C9-0002-083A-386D7C801793SessionApp.cls_temp
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics_to_send/sa_2033bdd1-8440-43c1-9a61-3fd06b8604af_1495005854205.tap
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9B009B-0001-083A-386D7C801793SessionApp.cls_temp
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9B009B-0001-083A-386D7C801793BeginSession.cls_temp
- <Package Folder>/app_Parse/LocalId/local_780803eb9caf1c20
- <Package Folder>/files/.flurrydatasenderblock.8711c4b7-a783-4f0d-9918-59486a33c0f7
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/app_Parse/pushState
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/app_Parse/currentInstallation
- <Package Folder>/app_app_apk/app.dat.jar
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591BFA9D02C9-0002-083A-386D7C801793BeginSession.cls_temp
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
