Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- d1a1wrh####.####.net
- set####.####.com
- analy####.####.com
- face####.com
- o####.####.com
- a####.####.in
- co####.####.com
- a####.####.com
- you####.com
- twi####.com
- n####.####.com
Запросы HTTP GET:
- co####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- d1a1wrh####.####.net/ic_snap.png
- twi####.com/
- d1a1wrh####.####.net/vpnmaster/speedtest_ad/speed_test_ad_icon_case_a.png
- n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os...
- face####.com/
- a####.####.in/abc/query/servers_list_opt/?country=####
- you####.com/
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- d1a1wrh####.####.net/vpnmaster/speedtest_ad/speed_test_ad_bg_case_a.png
Запросы HTTP POST:
- analy####.####.com/
- a####.####.in/abc/service/ping/
- a####.####.in/abc/activate/
- a####.####.in/abc/query/data/ramains/
- o####.####.com/check_config_update
- a####.####.com/app_logs
- co####.####.com/appLock/getConf?model=####&op=####&vendor=####&locale=##...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/files/.imprint
- <Package Folder>/files/server_failed.json
- <Package Folder>/files/user.dat
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.yflurryreport.-29385377ded13a23
- <Package Folder>/files/5.5.1_server_list_opt.json
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/country.json
- <Package Folder>/files/mobclick_agent_cached_<Package>2017020516
- <Package Folder>/files/onlinejson/server_list_opt.json
- <Package Folder>/files/file
- <Package Folder>/files/server_areas.json
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/app_app_apk/vpnmaster.dat.jar
- <Package Folder>/shared_prefs/vpn_prefs.xml
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes372067269.zip
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_VY973X356RT9Q5NVHX8K_216
- <Package Folder>/shared_prefs/charging_configs_sp.xml
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/shared_prefs/app.prefs.xml
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1785281248.zip
- <Package Folder>/files/online_config.json
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/vpn_prefs.xml.bak
- <Package Folder>/databases/du_ad_ts.db-journal
- <Package Folder>/files/.yflurrydatasenderblock.528e88bc-64c2-4f2a-966b-05a11dfe9e31
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/app.prefs.xml.bak
- <Package Folder>/shared_prefs/feedback_push.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/AF_INSTALLATION
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/files/5.5.1_server_valid.ser
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/charging_configs_sp.xml.bak
- <Package Folder>/files/client.conf
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
