Android.Packed.22561

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.MobiDash.1.origin

Сетевая активность:

Подключается к:

d239g0z####.####.net
newfeat####.####.com
f####.####.com
r####.####.com

Запросы HTTP GET:

d239g0z####.####.net/featurescreen/3DPoolBall.jpg
d239g0z####.####.net/icons/icon_FidgetSpinner.png
r####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
r####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...

Запросы HTTP POST:

f####.####.com/feature_server/geo-ip/test.php
f####.####.com/feature_server/fullScreen/get.php
newfeat####.####.com/featureview/getfeatureview/
r####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
newfeat####.####.com/featureview/gettime/

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
<Package Folder>/shared_prefs/ThreatMetrixMobileSDK.xml
<Package Folder>/shared_prefs/.dmgames_prefs.xml
<Package Folder>/files/aHR0cDovL2QyMzlnMHo2N2pjdGVkLmNsb3VkZnJvbnQubmV0L2ljb25zL2ljb25fRmlkZ2V0U3Bpbm5lci5wbmc=
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/.flurrydatasenderblock.a686aee2-8b4d-4a59-93f3-af993cfcec67
<Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes752905994.zip
<Package Folder>/files/.flurrydatasenderblock.dd2b7c02-4b6c-4967-8262-acdc8eda8e7a
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml
<Package Folder>/files/file
<Package Folder>/files/gaClientId
<Package Folder>/files/.FlurrySenderIndex.info.AnalyticsData_8WYVRFWFS55NYC5FGPQR_172
<Package Folder>/files/.flurrydatasenderblock.8f634091-440e-4746-9122-2940e7146c78
<Package Folder>/files/.FlurrySenderIndex.info.AnalyticsMain
<Package Folder>/app_sslcache/h.online-metrix.net.443
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
<Package Folder>/files/.flurrydatasenderblock.3a1222a4-39c3-4821-91b6-aad27fe93d04
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
<Package Folder>/files/.flurryagent.32f875ff
<Package Folder>/shared_prefs/tjcPrefrences.xml
<Package Folder>/files/aHR0cDovL2QyMzlnMHo2N2pjdGVkLmNsb3VkZnJvbnQubmV0L2ZlYXR1cmVzY3JlZW4vM0RQb29sQmFsbC5qcGc=
<Package Folder>/app_app_apk/waterslide.dat.jar
<Package Folder>/code_cache/secondary-dexes/MultiDex.lock
<Package Folder>/files/.flurrydatasenderblock.196ff729-571c-4b21-8f53-5f3549dd8272
<Package Folder>/shared_prefs/.dmgames_prefs.xml.bak
<Package Folder>/files/.flurrydatasenderblock.05b067b0-cb39-4ab9-8ee9-d8251ffc2197
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml