Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- p####.####.com
- a####.####.com
Запросы HTTP GET:
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
Запросы HTTP POST:
- p####.####.com/api/q/a/302f13ac5ae648d100217e0d1bb529b5d
- p####.####.com/api/statis/302f13ac5ae648d100217e0d1bb529b5d/game-83154C8...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/.yflurrydatasenderblock.3f1ddd8d-4e89-4c25-bc8b-bdfbc1d9d6d8
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1361224608.zip
- <Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/files/.yflurryreport.6363b1d0fb504784
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes705708267.zip
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/pref_file.xml.bak
- <Package Folder>/files/.yflurrydatasenderblock.5e1c4559-6c2d-4397-9a9a-e3c13c919c1b
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/files/.yflurrydatasenderblock.7cee0149-f1a0-48c9-9f78-10f15d4d413e
- <Package Folder>/shared_prefs/fiverocks.xml.bak
- <Package Folder>/files/.yflurrydatasenderblock.c873c5ef-bb21-4ae4-864d-b71ab04a5907
- <Package Folder>/files/.yflurrydatasenderblock.96be7530-8abb-4b35-bb15-6562ccbc2c5a
- <Package Folder>/files/.yflurrydatasenderblock.1241b295-957c-44ae-85be-0b8b9e8457e5
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/files/.yflurrydatasenderblock.b2bfd5cc-b47f-41e8-ba06-079f168e93d7
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/files/.yflurrydatasenderblock.e004cdd4-f06a-4b90-9986-912e0351fc79
- <Package Folder>/files/.yflurrydatasenderblock.a424dfb4-f767-4970-9d8f-b14cfc213678
- <Package Folder>/files/file
- <Package Folder>/files/.yflurrydatasenderblock.75b4f706-d072-4911-b9d2-88fea25dac52
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/files/.yflurrydatasenderblock.4bf2a758-876d-4f75-abd2-ad4e7f128ec8
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/files/.yflurrydatasenderblock.ad8e7db2-d7e9-4921-9d5c-d4a1ee44dc50
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/files/.yflurrydatasenderblock.44339860-9edb-4a16-98aa-17319e3392d5
- <Package Folder>/shared_prefs/tjcPrefrences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/cache/.chartboost/session/cb_previous_session_info
- <Package Folder>/files/trackers.db-journal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/files/.yflurrydatasenderblock.4749d0d5-882c-422d-800e-d84333ee02f4
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/app_fiverocks/install
- <Package Folder>/app_app_apk/phairsalon.dat.jar
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/files/.yflurrydatasenderblock.3de30392-2ae4-4b30-a633-52b11095574b
- <Package Folder>/files/.yflurrydatasenderblock.9f90ecf6-759e-4ff7-b998-7b30ba92dda6
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_NCMX2V5HPXJG5PYPDZY4_216
- <Package Folder>/app_fiverocks/usages-journal
- <Package Folder>/files/.yflurrydatasenderblock.ef15ea49-4343-4d63-8c19-d48ababca467
- <Package Folder>/files/.yflurrydatasenderblock.375ebb95-0a4a-4b7f-a05d-a55a37b1bf9a
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/files/.yflurrydatasenderblock.998a5821-a9d5-423d-93fd-e5521fd48171
- <Package Folder>/files/.yflurrydatasenderblock.a0c3afe9-b15f-4b47-87c1-8d495376af48
- <Package Folder>/files/.yflurrydatasenderblock.ca45179d-4e39-42d4-9743-30fd8d591d77
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/302f13ac5ae648d100217e0d1bb529b5d|account_file.xml
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/files/.yflurrydatasenderblock.27a3067a-ddfa-4155-ad50-e8cf1b53a2f9
- <Package Folder>/files/.yflurrydatasenderblock.748d1569-de13-44f7-8e60-ce8c862b4fa2
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/vungle-journal
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
