Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- a####.####.com
Запросы HTTP GET:
- a####.####.com/images/VideoPlayer/mdpi/icon.png
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
- a####.####.com/images/instaget/mdpi/icon.png
- a####.####.com/images/PC/mdpi/icon.png
- a####.####.com/images/InCollage/mdpi/icon.png
Запросы HTTP POST:
- a####.####.com/thirty_days
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/gaClientId
- <Package Folder>/cache/data/-203038941
- <Package Folder>/shared_prefs/thirtyDayFit.xml
- <Package Folder>/cache/data/91135632
- <Package Folder>/cache/data/1758757418
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ServerConfig.xml
- <Package Folder>/cache/data/2129330615
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E6F9A01CC-0001-0834-56EB51DA897ESessionOS.cls_temp
- <Package Folder>/cache/data/1990885896
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_1bca149e-36c2-432f-8bb7-3df92732a10b_1496215450524.tap
- <Package Folder>/cache/image_manager_disk_cache/journal
- <Package Folder>/files/file
- <Package Folder>/shared_prefs/Global.xml
- <Package Folder>/cache/data/1846562692
- <Package Folder>/cache/data/-1102038472
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/cache/data/1787386569
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E6F9A01CC-0001-0834-56EB51DA897ESessionDevice.cls_temp
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/cache/image_manager_disk_cache/ec6105419fbbc8aa6d033d773b0838e2c8ceb88e7387adf9a698bb1632817c5d.0.tmp
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.m.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/cache/data/-1433711020
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_072a0784-ae6c-4030-99b3-277b960902e3_1496215451591.tap
- <Package Folder>/shared_prefs/instaget.xml
- <Package Folder>/cache/image_manager_disk_cache/784447b599c486cecdf0155448aa16680d595a2656b9d0f81ea69da6fb784e1c.0.tmp
- <Package Folder>/cache/data/1817933541
- <Package Folder>/cache/image_manager_disk_cache/a69c1a2daae3226ec522debf2dbe842f94ce11a0345933f2b1847ef1b64241bf.0.tmp
- <Package Folder>/cache/data/-1130667623
- <Package Folder>/cache/data/-996617216
- <Package Folder>/shared_prefs/SevenMins-TTS.xml
- <Package Folder>/cache/data/-757572581
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1660667980.zip
- <Package Folder>/cache/data/-231668092
- <Package Folder>/cache/ads-1091337840.jar
- <Package Folder>/cache/webviewCacheChromium/data_0
- <Package Folder>/shared_prefs/thirtyDayFit.xml.bak
- <Package Folder>/cache/data/-1250437838
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E6F9A01CC-0001-0834-56EB51DA897ESessionApp.cls_temp
- <Package Folder>/shared_prefs/SevenMins-TTS.xml.bak
- <Package Folder>/cache/image_manager_disk_cache/ab5d1771850861c3d16df8624bd9fe7dcdbb18104fb312ec620ad20475ba2f9e.0.tmp
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/data/1001130859
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/data/-782625197
- <Package Folder>/cache/data/-1279066989
- <Package Folder>/cache/data/-1246361676
- <Package Folder>/cache/data/-1274990827
- <Package Folder>/cache/data/-1405081869
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/cache/data/-786201732
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/cache/data/-967988065
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E6F9A01CC-0001-0834-56EB51DA897EBeginSession.cls_temp
- <Package Folder>/cache/data/1029760010
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/data/1962256745
- <Package Folder>/cache/image_manager_disk_cache/5ee91e2c26aa285ed7f6a642d1dcb155a4b3728758dbecbdaceb744997d229a6.0.tmp
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/ServerConfig.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1743540823.zip
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/app_app_apk/thirtydayfitnesschallenge.dat.jar
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/data/-77024061
- <Package Folder>/cache/data/-48394910
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
