Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(TLS/1.0) www.face####.com:443
Запросы DNS:
- www.face####.com
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/ACRA-INSTALLATION
- <Package Folder>/app_acra-reports/020553f8-c159-4517-afdb-043a4...leted)
- <Package Folder>/app_acra-reports/060a6c3b-784d-4eb2-b93c-8f658...ktrace
- <Package Folder>/app_acra-reports/0fb6683c-578c-4257-a6dd-fba6d...leted)
- <Package Folder>/app_acra-reports/15fc99ee-b2cd-426f-b6bc-ef35a...ktrace
- <Package Folder>/app_acra-reports/1f21ede3-c8c4-458f-a36a-9deac...ktrace
- <Package Folder>/app_acra-reports/27f7cb3e-8b09-4858-bfd7-6d72d...ktrace
- <Package Folder>/app_acra-reports/2fab2b37-bb7e-4628-8dc5-1ed89...ktrace
- <Package Folder>/app_acra-reports/3d9b247f-7959-474d-8a2f-fe050...ktrace
- <Package Folder>/app_acra-reports/49ccd232-16a6-469a-abc9-6af7d...leted)
- <Package Folder>/app_acra-reports/58448e97-a28a-4735-b7dc-4fa7e...leted)
- <Package Folder>/app_acra-reports/5a5485fa-50cc-4379-8c7a-4229a...leted)
- <Package Folder>/app_acra-reports/618cf2c4-f32a-428f-ad2d-e7b97...leted)
- <Package Folder>/app_acra-reports/62807066-f40f-40e7-ab53-82e15...ktrace
- <Package Folder>/app_acra-reports/6e133c3d-f3b0-4be7-9786-144d1...leted)
- <Package Folder>/app_acra-reports/73dbc8f7-d049-4c45-9a18-18818...leted)
- <Package Folder>/app_acra-reports/75891745-b5bb-4042-892d-fc979...leted)
- <Package Folder>/app_acra-reports/75e89c8f-ba00-4574-be64-59c66...leted)
- <Package Folder>/app_acra-reports/8102cb10-eef0-4e8e-80db-0bfdd...ktrace
- <Package Folder>/app_acra-reports/8666e906-22dd-4064-ba29-ae76c...leted)
- <Package Folder>/app_acra-reports/8bff2a90-b86c-4c0b-a955-335e8...ktrace
- <Package Folder>/app_acra-reports/93063718-5160-412b-8880-d6d09...leted)
- <Package Folder>/app_acra-reports/9471cee9-4f7d-4446-8044-2ae38...ktrace
- <Package Folder>/app_acra-reports/a1103258-4bec-4cc1-90d3-cd71d...leted)
- <Package Folder>/app_acra-reports/a71c50a7-54ca-4135-a438-30029...leted)
- <Package Folder>/app_acra-reports/a980748f-76b9-44fd-b113-9acf2...ktrace
- <Package Folder>/app_acra-reports/b591f511-4261-414a-a776-22a24...ktrace
- <Package Folder>/app_acra-reports/c2743433-cc60-461e-b0f0-71c1a...ktrace
- <Package Folder>/app_acra-reports/cdc84676-a171-4ac4-8aba-ed344...leted)
- <Package Folder>/app_acra-reports/d00df943-2de5-4927-b596-db10f...ktrace
- <Package Folder>/app_acra-reports/d0258f74-e48f-45e8-a42d-30cfe...leted)
- <Package Folder>/app_acra-reports/e9412d75-9d94-4ed1-840f-3227a...leted)
- <Package Folder>/app_acra-reports/ea1155a0-5cc9-43aa-8a4e-2f4f7...leted)
- <Package Folder>/app_acra-reports/f0479410-6256-4404-b32a-81d8d...leted)
- <Package Folder>/app_acra-reports/f131d6ea-30aa-4f25-aab7-f935a...ktrace
- <Package Folder>/app_acra-reports/f327606d-e813-4960-bce9-f7408...ktrace
- <Package Folder>/app_acra-reports/f9c445b0-f22a-44d6-8ec1-e9c9e...ktrace
- <Package Folder>/app_acra-reports/fa4e5f5c-fccb-4e15-992e-3a194...ktrace
- <Package Folder>/app_acra-reports/reportfile.prealloc
- <Package Folder>/app_app_apk/lite.dat.jar
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-12...19.zip
- <Package Folder>/files/eRwNlPVfI
- <Package Folder>/lib-main/dso_deps
- <Package Folder>/lib-main/dso_lock
- <Package Folder>/lib-main/dso_manifest
- <Package Folder>/lib-main/dso_state
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/<Package>.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Запускает следующие shell-скрипты:
- /system/bin/ls -l /proc/self/fd
- /system/bin/ls -lR <Package Folder>
Загружает динамические библиотеки:
- eRwNlPVfI
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
