Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- ip####.com
- taiho####.net
Запросы HTTP GET:
- ip####.com/json
- taiho####.net/app/com.steam.photoeditor?mobileId=####&country=####&andro...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_ACRA-unapproved/2017-05-31T06;40;49.706+00;00-IS_SILENT.stacktrace
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1459442732877.jar
- <Package Folder>/cache/1459442732877.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703BeginSession.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703SessionApp.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703SessionCrash.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703SessionDevice.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703SessionOS.cls_temp
- <Package Folder>/files/####/592E656E0046-0001-083E-3F43267D2703SessionUser.cls_temp
- <Package Folder>/files/####/592E6571027C-0002-083E-3F43267D2703BeginSession.cls_temp
- <Package Folder>/files/####/592E6571027C-0002-083E-3F43267D2703SessionApp.cls_temp
- <Package Folder>/files/####/592E6571027C-0002-083E-3F43267D2703SessionDevice.cls_temp
- <Package Folder>/files/####/592E6571027C-0002-083E-3F43267D2703SessionOS.cls_temp
- <Package Folder>/files/####/592E6571027C-0002-083E-3F43267D2703SessionUser.cls_temp
- <Package Folder>/files/####/592E65710386-0001-0899-3F43267D2703BeginSession.cls_temp
- <Package Folder>/files/####/592E65710386-0001-0899-3F43267D2703SessionApp.cls_temp
- <Package Folder>/files/####/592E65710386-0001-0899-3F43267D2703SessionDevice.cls_temp
- <Package Folder>/files/####/592E65710386-0001-0899-3F43267D2703SessionOS.cls_temp
- <Package Folder>/files/####/592E65710386-0001-0899-3F43267D2703SessionUser.cls_temp
- <Package Folder>/files/####/592E657303B1-0001-08B8-3F43267D2703BeginSession.cls_temp
- <Package Folder>/files/####/592E657303B1-0001-08B8-3F43267D2703SessionApp.cls_temp
- <Package Folder>/files/####/592E657303B1-0001-08B8-3F43267D2703SessionDevice.cls_temp
- <Package Folder>/files/####/592E657303B1-0001-08B8-3F43267D2703SessionOS.cls_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/crash_marker
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_bd78b999-db35-4809-b761-101916e7586a_1496212846173.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/ACRA-INSTALLATION
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/<Package>.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/LioneMessi10.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.m.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- dumpsys meminfo 2110
- logcat -t 100 -v time
Использует права администратора.
