Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- im####.####.com
- i####.####.com
- as####.####.com
- creat####.####.com
- and####.####.com
- r####.####.com
- user####.####.com
- traffic####.####.com
- a####.####.com
Запросы HTTP GET:
- as####.####.com/6e5a3fdf685a91e06b24816043a0a0f732ebaa36_570x320_opt_v1....
- as####.####.com/309d4d3973c5e7f58a89935fcba39b5743538ba6_640x360_opt_v1....
- as####.####.com/playable/playable_fallback.png
- r####.####.com/nad?v1=####&model=####&adr=####&dx=####&v4=####&dy=####&v...
- as####.####.com/playable/playable_close.png
- r####.####.com/redirect?clcode=####&did=####&eventid=####&placement=####...
- as####.####.com/1471990138_768x1024.jpeg
- a####.####.com/com.cmplay.tiles2?pid=####&clickid=####&advertising_id=##...
- as####.####.com/sound_off.png
- as####.####.com/1380229154.js
- r####.####.com/imp?clcode=####&placement=####
- as####.####.com/jquery-1.9.1.min.js
- as####.####.com/playable/c2_pathfind_02.min.js
- as####.####.com/jquery.knob.js
- as####.####.com/playable/PianoTiles_V2_l_05.js
- creat####.####.com/uploads/creatives-revmob/custom_image/728x90/en/light...
- r####.####.com/2.0/ad?v1=####&model=####&adr=####&etf=####&dx=####&v4=##...
- as####.####.com/0e0bf3ed2d59f64139d2033fd8d0061542562f01_768x1024.jpeg
- as####.####.com/playable/PianoTiles_V2_p_05.js
- as####.####.com/playable/playable_loader.gif
- as####.####.com/sound_on.png
- r####.####.com/2.0/ad?v1=####&model=####&adr=####&dx=####&v4=####&dy=###...
- im####.####.com/creatives/fullscreen-closebutton2.png
- as####.####.com/jquery-2.1.1.min.js
- as####.####.com/1474415557_570x320_opt_v1.mp4
- r####.####.com/vid?clcode=####&event=####&placement=####&pv=####&vid_ts=...
Запросы HTTP POST:
- r####.####.com/device?api_key=####
- and####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/install.json
- r####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
- traffic####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/adRecei...
- i####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/impression.js...
- and####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/placements/...
- user####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/userInform...
- and####.####.com/api/v4/mobile_apps/4ed91bd9a6260c000300003a/sessions.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_c261d29a-b1ce-4d6f-b91a-509a6dc5d640_1495006107831.tap
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_fcb561e7-10ac-4253-a4ac-62d040268335_1495006109219.tap
- <Package Folder>/shared_prefs/com.applovin.interstitial.sharedpreferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/cache/1460683162801.jar
- <Package Folder>/shared_prefs/com.applovin.interstitial.sharedpreferences.xml.bak
- <Package Folder>/cache/37325bece59e34bb1b30b1f2686192d5d6ed6d3a
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
- <Package Folder>/cache/ff1a77369bc90041b315838783731ce44a19fe01
- <Package Folder>/shared_prefs/AppData.xml
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1686764457.zip
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9B0204-0001-083A-0618A8A7EA82SessionOS.cls
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
- <Package Folder>/cache/1460683162801.tmp
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9B0204-0001-083A-0618A8A7EA82SessionDevice.cls
- <Package Folder>/shared_prefs/AntSmasherShop.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/whichSmasher.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml.bak
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
- <Package Folder>/databases/vungle-journal
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/app_app_apk/antsmasher.dat.jar
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/cache/54027eb639743d94bbeb4d2eeb5e4503db98fce3
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-801229835.zip
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/RevMob.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android.crashlytics-core;com.crashlytics.android.core.CrashlyticsCore.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9B0204-0001-083A-0618A8A7EA82SessionApp.cls
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9B0204-0001-083A-0618A8A7EA82BeginSession.cls
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
