Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- love####.ec
- e-rea####.####.uk
Запросы HTTP GET:
- e-rea####.####.uk/top100authors.php
- e-rea####.####.uk/cover/35/35569.jpg
- e-rea####.####.uk/bookbyauthor.php?author=####
- love####.ec/read_book.php?id=####&p=####
- love####.ec/read_book.php?id=####
- love####.ec/search.php?search=####
- e-rea####.####.uk/book.php?book=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/booklib2.dat.jar
- <Package Folder>/shared_prefs/fiverocks.xml.bak
- <Package Folder>/shared_prefs/tapjoyCacheData.xml
- <Package Folder>/files/Tapjoy/Cache/363fd2a890cfb629dc7aa8febfe5d4371581d327dde4ab5a080a24f27fbbfb83
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/files/Tapjoy/Cache/a77be758a287e3f5aa1f3c99bb73af00b2334c6496e79c2fedef89d0d1686d95
- <Package Folder>/files/Tapjoy/Cache/b2dbf695282cf51e2a9df8b14b68d70b6bad94eed347aa291a697128a08c5640
- <Package Folder>/shared_prefs/<Package>;BookCut.xml
- <Package Folder>/files/Tapjoy/Cache/f2389f076324d476fca6986e4c026c94005b1cebbbad2eec4b1e695b9ddea1c1
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/files/Tapjoy/Cache/760771fbd572a4fea4fb5958c473c4cdbe5d459bdbc53b244bc2e32e9b822804
- <Package Folder>/files/file
- <Package Folder>/cache/1459442732877.jar
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/tapjoyCacheData.xml.bak
- <Package Folder>/shared_prefs/tjcPrefrences.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/Tapjoy/Cache/d4df85a13557f81dec31fa4f3e36410449fd46a0feeae980494f063eec9e1836
- <Package Folder>/files/Tapjoy/Cache/f9027d6142eee7f05b9477d1be4013394dc6dfb8ed10b2bf1876deb2e1aa16bd
- <Package Folder>/app_fiverocks/install
- <Package Folder>/files/Tapjoy/Cache/c5e1706cd4387fea718e9ae3d0e9cbc687af83e83dd64534f40abc0fdf27e8f4
- <Package Folder>/cache/1459442732877.tmp
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1785281248.zip
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/files/Tapjoy/Cache/6c974ead6b403a4ccc27ff1980e8b1f385e335f617df38276ae7fd36a13b45bd
- <Package Folder>/files/Tapjoy/Cache/720f1c13bb5f274a42c765e1531f80cbfe3b9f2f173e0884a7251342ba52aca8
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/files/Tapjoy/Cache/ae6bc38af361a64d34222516d61ce883a148f02af1cbe74b3828dcd36dcdf205
- <Package Folder>/files/Tapjoy/Cache/25e8b8ab02eccf9915da4e770222c806ac0e4d51640ce9a32191412ccfc6e83b
- <Package Folder>/files/Tapjoy/Cache/399324a6cd38aaf37b1ee969d82c98c8f490db0508da2603cc18bca1ad037419
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/Tapjoy/Cache/fcb4c0267f2b358bd223e03ea8b1f34d1571bf9d12bf0d0217b82a9ea11f9b69
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/<Package>_UPDATE.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/Tapjoy/Cache/d4680d455a95c9ff6822ab0dc2f91dada368ce4c14ac1da5df9508dc2c85908f
- <Package Folder>/files/Tapjoy/Cache/ce474ca9929115d27d111456840875861155d65ed2597440016c9d821b1a88dc
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/files/Tapjoy/Cache/c536f32f5f9f27437a094bebc7dccd76307ede5f715040e14fa75448ee9eb1cc
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
