Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- a####.####.org
- a####.####.ru
- capa####.com
- con####.####.com
- hotdate####.com
- i####.####.com
- incl####.####.com
- ip####.com
- jssd####.####.com
- nudee####.com
- p####.####.link
- seet####.com
- stat####.####.com
- syndica####.####.com
Запросы HTTP GET:
- a####.####.org/20temmuz17/ana.php
- a####.####.ru/click?id=####&ts=####&hash=####&jsuid=####
- capa####.com/nland31M/index.php
- con####.####.com/en_US/sdk.js
- hotdate####.com/media/exit-new/exit-popup.css
- i####.####.com/2016/11/16/1d935cc5-a1e7-4779-bdfa-20fd7a60724c.jpg@!640_...
- incl####.####.com/lang/en/version/f8627256abb880f/globals.css
- ip####.com/json/?lang=####
- jssd####.####.com/js/v1/b1a000907912e046bdc32580ff3b03ca/mparticle.js
- nudee####.com/
- p####.####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=##...
- seet####.com/
- stat####.####.com/connect/xd_arbiter/r/XBwzv5Yrm_1.js?version=####
- syndica####.####.com/ads-priv.php?i=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.0.tmp
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.1.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.0.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
Другие:
Использует права администратора.
Отрисовывает собственные окна поверх других приложений.
