Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- co####.####.com
- a####.####.com
- i####.####.com
Запросы HTTP GET:
- a####.####.com/m/imp?appid=####&cid=####&city=####&ckv=####&country_code...
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
Запросы HTTP POST:
- i####.####.com/showad.asm
- co####.####.com/config-server/v1/config/secure.cfg
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/com.im.keyValueStore.config_store.xml.bak
- <Package Folder>/app_app_apk/hideitpro.dat.jar
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.im.keyValueStore.uid_store.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/databases/com.im_6.1.1.db-journal
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes946558405.zip
- <Package Folder>/files/file
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_abe5f6bd-36fd-4dfa-a9a3-d484c816b2b4_1496212844783.tap
- <Package Folder>/shared_prefs/com.im.keyValueStore.uid_store.xml.bak
- <Package Folder>/shared_prefs/com.im.keyValueStore.sdk_version_store.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E656C027F-0001-082E-F0CEC903D1BCSessionApp.cls_temp
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E656C027F-0001-082E-F0CEC903D1BCBeginSession.cls_temp
- <Package Folder>/shared_prefs/com.im.keyValueStore.config_store.xml
- <Package Folder>/cache/1478228129219.jar
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/cache/1478228129219.tmp
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E656C027F-0001-082E-F0CEC903D1BCSessionOS.cls_temp
- <Package Folder>/shared_prefs/com.im.keyValueStore.aes_key_store.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/com.im.keyValueStore.sdk_version_store.xml.bak
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;b.a.a.a.m.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/shared_prefs/admob.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/592E656C027F-0001-082E-F0CEC903D1BCSessionDevice.cls_temp
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_12f256bb-790f-4fee-a50b-42c7c9976793_1496212845463.tap
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android.crashlytics-core;com.crashlytics.android.core.CrashlyticsCore.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
