Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- u####.####.com
- set####.####.com
- a####.####.net
- c####.####.com
- n####.####.net
- n####.####.com
- a####.####.com
- orio####.####.com
Запросы HTTP GET:
- c####.####.com/rpc/gcm/report?regid=####&phonelanguage=####&mcc=####&app...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&only...
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
- a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&from_sd...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
- n####.####.net/news/channels?app_lan=####&mnc=####&nmcc=####&display=###...
- orio####.####.com/liehu/20161025/1477402944buxs1_M.jpg
- u####.####.com/r/?ac=####&posid=####&cl=####&nt=####&pid=####&intl=####&...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
- a####.####.com/m/ad?id=####&nsv=####&dn=####&bundle=####&z=####&o=####&w...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
Запросы HTTP POST:
- a####.####.net/native/v2/recommend
- n####.####.net/news/report
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/dmc_report-journal
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
- <Package Folder>/shared_prefs/.cmtracer.xml.bak
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212846863.ich
- <Package Folder>/app_deep_cloud_config/cloudmsgadv.json
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212853490.ich
- <Package Folder>/files/infoc_1/newsindia_listaction_1496212879966.ich
- <Package Folder>/files/infoc_0/newsindia_videotab_1496212881990.ich
- <Package Folder>/cache/volley/-515249652-975763097
- <Package Folder>/files/kfmt.dat
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212853440.ich
- <Package Folder>/cache/volley/1476601132-2088827470
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849303.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212904483.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212846984.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212846897.ich
- <Package Folder>/shared_prefs/<Package>_newsad_preferences.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212854873.ich
- <Package Folder>/files/infoc_0/newsindia_act2_1496212847504.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849253.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212846962.ich
- <Package Folder>/shared_prefs/<Package>_sdk_preferences.xml.bak
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1012182921.zip
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212904483.ich
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1843189096.zip
- <Package Folder>/shared_prefs/.ch.xml
- <Package Folder>/cache/ads1883179782.jar
- <Package Folder>/shared_prefs/dmc_default.xml
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212904864.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849332.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212904867.ich
- <Package Folder>/shared_prefs/<Package>_ui_preferences.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849163.ich
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/onews.db-journal
- <Package Folder>/cache/volley/1476601132-443290439
- <Package Folder>/files/infoc_1/newsindia_listaction_1496212871320.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849264.ich
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/infoc_0/newsindia_language_1496212853298.ich
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/infoc_1/newsindia_listaction_1496212861430.ich
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_settings.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849332.ich
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/files/dmc/receiver_history_list.dat
- <Package Folder>/files/infoc_0/newsindia_listaction_1496212870305.ich
- <Package Folder>/cache/volley/14766011321352288339
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212846918.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849326.ich
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/app_app_apk/indianews.dat.jar
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849059.ich
- <Package Folder>/shared_prefs/<Package>_gsm_preferences.xml.bak
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212854872.ich
- <Package Folder>/files/infoc_1/newsindia_listaction_1496212879968.ich
- <Package Folder>/files/infoc_0/newsindia_listaction_1496212879969.ich
- <Package Folder>/files/infoc_1/newsindia_listaction_1496212870300.ich
- <Package Folder>/cache/volley/1294558280-1671383261
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212853443.ich
- <Package Folder>/files/infoc_1/newsindia_language_1496212853297.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212848963.ich
- <Package Folder>/files/kctrl.dat
- <Package Folder>/shared_prefs/<Package>_ui_preferences.xml.bak
- <Package Folder>/shared_prefs/cloudconfig.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849017.ich
- <Package Folder>/shared_prefs/<Package>_gsm_preferences.xml
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849301.ich
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849183.ich
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/files/infoc_0/newsindia_listaction_1496212879966.ich
- <Package Folder>/shared_prefs/.cmtracer.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212846903.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849172.ich
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/cache/volley/14766011321766766629
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/infoc_1/newsindia_videotab_1496212881989.ich
- <Package Folder>/cache/volley/12945582802111198746
- <Package Folder>/shared_prefs/<Package>_sdk_preferences.xml
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849107.ich
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212846889.ich
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/files/infoc_1/newsindia_act2_1496212847503.ich
- <Package Folder>/shared_prefs/.etc.xml
- <Package Folder>/databases/market.db-journal
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212849275.ich
- <Package Folder>/shared_prefs/market_config.xml
- <Package Folder>/files/infoc_0/newsindia_listaction_1496212861431.ich
- <Package Folder>/shared_prefs/market_config.xml.bak
- <Package Folder>/shared_prefs/cmadsdk_1226.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/files/infoc_0/newsindia_juhe_1496212846938.ich
- <Package Folder>/files/AppEventsLogger.persistedsessioninfo
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849034.ich
- <Package Folder>/shared_prefs/sharedpreferences_batmobi_offers.xml
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849073.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849128.ich
- <Package Folder>/files/infoc_0/newsindia_listaction_1496212871320.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849325.ich
- <Package Folder>/databases/bat_statistics.db-journal
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212849244.ich
- <Package Folder>/files/infoc_1/newsindia_juhe_1496212853487.ich
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- ls -l /system/bin/su
- <dexopt>
Может автоматически отправлять СМС-сообщения.
