Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.MobiDash.1.origin
Сетевая активность:
Подключается к:
- a####.####.com
- p####.####.com
Запросы HTTP GET:
- a####.####.com/m/ad?id=####&nsv=####&dn=####&bundle=####&z=####&o=####&w...
Запросы HTTP POST:
- p####.####.com/api/q/a/3db355750bea842d8ee0cece950aa5ecd
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/phairsalon.dat.jar
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes1798117159.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes2092550355.zip
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/databases/vungle-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_NCMX2V5HPXJG5PYPDZY4_216
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.yflurrydatasenderblock.01271605-e485-4d7d-b2e8-dba5729100de
- <Package Folder>/files/.yflurrydatasenderblock.026686c6-4326-4df6-abd8-4762359f3aa8
- <Package Folder>/files/.yflurrydatasenderblock.040dad56-57cd-485a-b7c2-93607f878457
- <Package Folder>/files/.yflurrydatasenderblock.05cac2a3-706f-4260-84ee-693042e3261d
- <Package Folder>/files/.yflurrydatasenderblock.17fe8450-bd85-4b12-a519-ec4e398dabb4
- <Package Folder>/files/.yflurrydatasenderblock.1e413504-4898-461c-b0fe-e110b3a564f0
- <Package Folder>/files/.yflurrydatasenderblock.2212a681-f460-468a-a021-e330e1a2734d
- <Package Folder>/files/.yflurrydatasenderblock.29ed010a-345b-4ec1-9d36-daf970784e5d
- <Package Folder>/files/.yflurrydatasenderblock.36bcb4b3-7aba-48f3-9405-5460cfb98950
- <Package Folder>/files/.yflurrydatasenderblock.37e85fec-e808-4c58-bad7-e0e015a9e8c4
- <Package Folder>/files/.yflurrydatasenderblock.4092017b-7af2-4886-937e-ac54d67b88ea
- <Package Folder>/files/.yflurrydatasenderblock.435ba5f7-2373-4a42-82e2-3783868bf2d3
- <Package Folder>/files/.yflurrydatasenderblock.45a188e2-ee48-4865-a813-84d47eeefb7f
- <Package Folder>/files/.yflurrydatasenderblock.4c36c764-efc6-4361-84d7-8e9967dcb2db
- <Package Folder>/files/.yflurrydatasenderblock.5f049bf0-db7b-4cb9-89a1-c61f611b8797
- <Package Folder>/files/.yflurrydatasenderblock.60334593-9e7e-40e7-a8fd-ae585fba042e
- <Package Folder>/files/.yflurrydatasenderblock.6db08839-d21d-4d8c-a504-bba66ddef2fc
- <Package Folder>/files/.yflurrydatasenderblock.810b366e-4ba2-41dd-ad77-bd9a1f74c490
- <Package Folder>/files/.yflurrydatasenderblock.921a6658-b828-41a1-8a37-5a870e051885
- <Package Folder>/files/.yflurrydatasenderblock.95eff0c5-a02a-497f-bc8e-c32b66e283a8
- <Package Folder>/files/.yflurrydatasenderblock.e3fb4ef6-001d-49af-940e-02edb75db618
- <Package Folder>/files/.yflurrydatasenderblock.e76fa9d3-6f0e-4a89-a175-2a1bb1dbaad0
- <Package Folder>/files/.yflurrydatasenderblock.e96580f4-35c7-4dc4-b52b-d0555612e1ff
- <Package Folder>/files/.yflurrydatasenderblock.f1793831-4bda-4c24-a2a6-89d0990938c0
- <Package Folder>/files/.yflurryreport.6363b1d0fb504784
- <Package Folder>/files/.yflurryreport.6363b1d0fb504784 (deleted)
- <Package Folder>/files/file
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/files/trackers.db-journal (deleted)
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml
- <Package Folder>/shared_prefs/SHARED_PRENFERENCE_LOCAL_ADDRESS.xml.bak
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/VUNGLE_PUB_APP_INFO.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/shared_prefs/fiverocks.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/shared_prefs/pref_file.xml.bak
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/tjcPrefrences.xml
- <SD-Card>/.tcookieid
- <SD-Card>/Android/####/.nomedia
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
