Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/htdc.dat.jar
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes232161981.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes583256172.zip
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes748046597.zip
- <Package Folder>/files/####/5984694A03B8-0001-082C-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984694A03B8-0001-082C-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984694A03B8-0001-082C-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984694A03B8-0001-082C-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984694B03C4-0001-0850-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984694B03C4-0001-0850-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984694B03C4-0001-0850-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984694B03C4-0001-0850-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/59846952032F-0001-08A7-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/59846952032F-0001-08A7-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/59846952032F-0001-08A7-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/59846952032F-0001-08A7-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/59846958036C-0001-08D2-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/59846958036C-0001-08D2-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/59846958036C-0001-08D2-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/59846958036C-0001-08D2-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984695E0314-0001-08F4-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984695E0314-0001-08F4-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984695E0314-0001-08F4-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984695E0314-0001-08F4-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984696402A0-0001-091A-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984696402A0-0001-091A-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984696402A0-0001-091A-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984696402A0-0001-091A-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984696A02E1-0001-094A-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984696A02E1-0001-094A-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984696A02E1-0001-094A-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984696A02E1-0001-094A-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/598469700303-0001-0970-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/598469700303-0001-0970-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/598469700303-0001-0970-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/598469700303-0001-0970-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/598469760359-0001-099D-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/598469760359-0001-099D-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/598469760359-0001-099D-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/598469760359-0001-099D-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984697C02E1-0001-09C5-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984697C02E1-0001-09C5-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984697C02E1-0001-09C5-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984697C02E1-0001-09C5-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/598469820276-0001-09EA-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/598469820276-0001-09EA-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/598469820276-0001-09EA-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/598469820276-0001-09EA-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984698802BF-0001-0A46-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984698802BF-0001-0A46-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984698802BF-0001-0A46-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984698802BF-0001-0A46-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/5984698E0273-0001-0A7E-915D576827DDBeginSession.cls_temp
- <Package Folder>/files/####/5984698E0273-0001-0A7E-915D576827DDSessionApp.cls_temp
- <Package Folder>/files/####/5984698E0273-0001-0A7E-915D576827DDSessionDevice.cls_temp
- <Package Folder>/files/####/5984698E0273-0001-0A7E-915D576827DDSessionOS.cls_temp
- <Package Folder>/files/####/sa_162af026-9bec-4374-8359-eb33a1b3fe57_1501849930981.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/TvDlNuOUh
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Загружает динамические библиотеки:
- TvDlNuOUh
- realm-jni
Использует следующие алгоритмы для расшифровки данных:
- AES
