Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.1.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.MobiDash.1.origin
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/care.dat.jar
- <Package Folder>/app_outdex/care.dat.dex (deleted)
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-655437519.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes22020478.zip
- <Package Folder>/files/####/592E6573029E-0001-0835-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E6573029E-0001-0835-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E6573029E-0001-0835-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E6573029E-0001-0835-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E657402FE-0001-085A-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E657402FE-0001-085A-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E657402FE-0001-085A-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E657402FE-0001-085A-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65750348-0001-0878-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E657B0341-0001-0898-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E657B0341-0001-0898-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E657B0341-0001-0898-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E657B0341-0001-0898-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E6582015A-0001-08B8-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E6582015A-0001-08B8-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E6582015A-0001-08B8-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E6582015A-0001-08B8-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65880230-0001-08D9-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65880230-0001-08D9-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65880230-0001-08D9-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65880230-0001-08D9-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E658F0219-0001-08FE-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E658F0219-0001-08FE-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E658F0219-0001-08FE-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E658F0219-0001-08FE-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65960360-0001-091E-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65960360-0001-091E-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65960360-0001-091E-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65960360-0001-091E-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E659D0251-0001-0940-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E659D0251-0001-0940-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E659D0251-0001-0940-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E659D0251-0001-0940-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65A40189-0001-0963-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65A40189-0001-0963-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65A40189-0001-0963-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65A40189-0001-0963-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65AA039D-0001-09A1-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65AA039D-0001-09A1-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65AA039D-0001-09A1-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65AA039D-0001-09A1-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65B101AB-0001-0A02-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65B101AB-0001-0A02-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65B101AB-0001-0A02-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65B101AB-0001-0A02-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/592E65B8022A-0001-0A3E-34D18FDEE81DBeginSession.cls_temp
- <Package Folder>/files/####/592E65B8022A-0001-0A3E-34D18FDEE81DSessionApp.cls_temp
- <Package Folder>/files/####/592E65B8022A-0001-0A3E-34D18FDEE81DSessionDevice.cls_temp
- <Package Folder>/files/####/592E65B8022A-0001-0A3E-34D18FDEE81DSessionOS.cls_temp
- <Package Folder>/files/####/sa_f468bd4f-aaf6-4258-b25e-c8bbd08bb51f_1496212851737.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/mglFzyZRj
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
