Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- a####.####.com
- d####.####.cn
- e####.####.cn
- n####.####.com
- set####.####.com
Запросы HTTP GET:
- a####.####.com/images/NPC/mdpi/icon.png
- a####.####.com/m/ad?v=####&id=####&nv=####&dn=####&bundle=####&z=####&o=...
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
Запросы HTTP POST:
- e####.####.cn/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_Backup_db/fakecall.db
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1460683162801.dex
- <Package Folder>/cache/1460683162801.jar
- <Package Folder>/cache/1460683162801.tmp
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/fakecall
- <Package Folder>/databases/fakecall-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7BeginSession.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7SessionApp.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7SessionCrash.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7SessionDevice.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7SessionOS.cls_temp
- <Package Folder>/files/####/592E66D40131-0001-0AC1-AF31E6E259C7SessionUser.cls_temp
- <Package Folder>/files/####/592E66DE012B-0002-0AC1-AF31E6E259C7BeginSession.cls_temp
- <Package Folder>/files/####/592E66DE012B-0002-0AC1-AF31E6E259C7SessionApp.cls_temp
- <Package Folder>/files/####/592E66DE012B-0002-0AC1-AF31E6E259C7SessionDevice.cls_temp
- <Package Folder>/files/####/592E66DE012B-0002-0AC1-AF31E6E259C7SessionOS.cls_temp
- <Package Folder>/files/####/592E670902E8-0001-0BC4-AF31E6E259C7BeginSession.cls_temp
- <Package Folder>/files/####/592E670902E8-0001-0BC4-AF31E6E259C7SessionApp.cls_temp
- <Package Folder>/files/####/592E670902E8-0001-0BC4-AF31E6E259C7SessionDevice.cls_temp
- <Package Folder>/files/####/592E670902E8-0001-0BC4-AF31E6E259C7SessionOS.cls_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/crash_marker
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_dd492d5b-bf25-4857-adfc-a0f339959371_1496213204382.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/Global.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/ServerConfig.xml
- <Package Folder>/shared_prefs/ServerConfig.xml.bak
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak (deleted)
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.l.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/shared_prefs/rate.xml
- <Package Folder>/shared_prefs/rate.xml.bak
- <Package Folder>/shared_prefs/shareMessage.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/Download/####/4.6_lvs.jar
- <SD-Card>/dt/restime.dat
- <SD-Card>/fakecall/####/7669f86ba938fdd8217e692be9a84322
- <SD-Card>/fakecall/####/7951908a0d3c9c1aa58ca48f2eeba518
- <SD-Card>/fakecall/####/82c3f2984600456c0515fe74bd089d74
- <SD-Card>/fakecall/####/bae99e57d7172175d17dae1ca8b8136b
- <SD-Card>/fakecall/####/d69d67f3facc4b5e0e3cc6a433d2afd1
- <SD-Card>/fakecall/####/e752be07da2980bf68127ec9a8770200
- <SD-Card>/fakecall/####/f8e674e8981ce3609b8a022c2e42c36f
- <SD-Card>/fakecall/####/fakecall.db
- <SD-Card>/fakecall/####/fb4b5153e52cc8ba23391c98780639ae
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
