Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- m####.####.mobi
- i####.####.com
- r####.####.com
- appm####.ml
- a####.####.com
Запросы HTTP GET:
- appm####.ml/wsa/titleimg.png
- a####.####.com/request/banner?ad_space_id=####&dm_ver=####&bidfloor=####...
- i####.####.com/sound_on.png
- i####.####.com/sound_off.png
- r####.####.com/o903c61a/0e0bf3ed2d59f64139d2033fd8d0061542562f01_v21_pho...
- appm####.ml/wsa/bgimg.png
- i####.####.com/1380229154.js
- i####.####.com/jquery.knob.js
- r####.####.com/o903c61a/5548e1067bae4326b6514ecaf5df7c15eab1f9bd_v23_pho...
- r####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
- i####.####.com/1453805258_768x1024.jpeg
- i####.####.com/jquery-1.9.1.min.js
- r####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...
- appm####.ml/wsa/icon.png
- appm####.ml/wsa/
- r####.####.com/nad?v1=####&model=####&dx=####&dy=####&accept=####&slot_c...
- a####.####.com/request/banner?ad_space_id=####&dm_ver=####&dm_ver=####&b...
- i####.####.com/1453805255_570x320_opt_v1.mp4
- a####.####.com/request/video?ad_space_id=####&dm_ver=####&bidfloor=####&...
- r####.####.com/o903c61a/3a7e6c6b5016fb02b513f8d5cdd92719346a719a_v21_pho...
- i####.####.com/1453805261_1024x768_opt_v1.jpeg
- m####.####.mobi/simpleM2M/requestEnhancedHtmlAd?aid=####&v=####&bid=####...
Запросы HTTP POST:
- r####.####.com/device?api_key=####
- r####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
- s####.####.com/api/pb?action=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1684313590.zip
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/appodeal.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/app_app_apk/brickclassicfallingblocks.dat.jar
- <Package Folder>/app_working/flurry.dex
- <Package Folder>/files/com.appbrain.ping
- <Package Folder>/app_working/facebook.dex
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/Appodeal.xml
- <Package Folder>/shared_prefs/freq.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/1478228129219.jar
- <Package Folder>/shared_prefs/ab_sdk_pref.xml.bak
- <Package Folder>/cache/1478228129219.tmp
- <Package Folder>/shared_prefs/ab_pref_int.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1970885244.zip
- <Package Folder>/app_working/yandex.dex
- <Package Folder>/shared_prefs/appodeal.xml
- <Package Folder>/app_working/revmob.dex
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
- <Package Folder>/app_working/vungle.dex
- <Package Folder>/app_working/adcolony.dex
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/ab_sdk_pref.xml
- <Package Folder>/shared_prefs/RateThisAppBrickClassic.xml
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
