Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Packed.21893
Предлагает установить сторонние приложения.
Сетевая активность:
Подключается к:
- secure####.com
- 4####.####.com
- ssl-l####.com
- pro-tan####.ru
- c####.####.com
- keno####.####.tech
- a####.####.com
Запросы HTTP GET:
- c####.####.com/assets/campaigns/iphone7/devices/real/jet-black-right.png
- c####.####.com/assets/campaigns/iphone7/devices/real/silver-left.png
- 4####.####.com/api/front/coregs/8d8ebe8c083e45111943185836378212/get
- c####.####.com/assets/fonts/myriad-pro/MyriadPro-Bold.ttf
- c####.####.com/assets/campaigns/iphone7/img/bg.jpg
- ssl-l####.com/?a=####&c=####&s1=?utm####&s2=####
- c####.####.com/data/cache-cmp5/d3beb91fcc91e87ae244816041ec6dcd.css
- c####.####.com/assets/campaigns/iphone7/devices/real/rose-gold-left.png
- c####.####.com/assets/campaigns/iphone7/devices/real/gold-right.png
- secure####.com/?a=####&c=####&s1=?utm####&s2=####&ckmguid=####
- c####.####.com/thumb/media/384/60/940c0ce5ffdce13131b3deed3f7e7c925431.png
- c####.####.com/data/cache/ed280a0ea3cc38f3cbbc747acfbef47d.gif
- c####.####.com/assets/campaigns/iphone7/img/apple.svg
- 4####.####.com/offer/g3ydgljz/?s1=####&s2=####&s3=####&affid=####
- c####.####.com/assets/campaigns/iphone7/devices/real/jet-black-left.png
- keno####.####.tech/sVPVDS?utm_pakage=####
- c####.####.com/assets/campaigns/iphone7/img/check.png
- c####.####.com/assets/campaigns/iphone7/devices/real/gold-left.png
- pro-tan####.ru/apk/Geometry.apk
- keno####.####.tech/jJknHN?utm_pakage=####
- c####.####.com/assets/campaigns/iphone7/img/nav.svg
- c####.####.com/assets/fonts/myriad-pro/MyriadPro-Regular.ttf
- c####.####.com/assets/campaigns/iphone7/devices/real/black-left.png
- c####.####.com/assets/campaigns/iphone7/devices/real/silver-right.png
- c####.####.com/assets/campaigns/iphone7/devices/real/black-right.png
- c####.####.com/data/cache-cmp5/a9ecc7115bdb0c590e1df39f95cac54a.js
- 4####.####.com/favicon.ico
- c####.####.com/assets/fonts/myriad-pro/MyriadPro-Light.ttf
- c####.####.com/assets/fonts/myriad-pro/MyriadPro-Semibold.ttf
- c####.####.com/assets/campaigns/iphone7/devices/real/rose-gold-right.png
- a####.####.com/t/lj3d1nkz38lgAwtkhA9q/?s1=####&s2=####&s3=####
Запросы HTTP POST:
- 4####.####.com/api/session/start?s1=####&s2=####&s3=####&affid=####
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
