Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) san-as####.adob####.com.####.net:80
- TCP(HTTP/1.1) cf.biwe####.com:80
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) pris####.112.2o7.net:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) app.biwe####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) cdn.comun####.com:443
- TCP(TLS/1.0) m.face####.com:443
- TCP(TLS/1.0) e.crashly####.com:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) face####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) 2####.58.212.174:443
- TCP(TLS/1.0) f####.net:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) f####.com:443
Запросы DNS:
- a####.google####.com
- app.biwe####.com
- as####.adob####.com
- b.scoreca####.com
- cdn.comun####.com
- cf.biwe####.com
- e.crashly####.com
- f####.com
- f####.google####.com
- f####.gst####.com
- f####.net
- face####.com
- g####.face####.com
- m.face####.com
- pris####.112.2o7.net
- s####.g.doublec####.net
- sconten####.xx.f####.net
- sett####.crashly####.com
- st####.xx.f####.net
- www.go####.com
- www.go####.nl
- www.google-####.com
Запросы HTTP GET:
- f####.gst####.com/s/opensans/v15/DXI1ORHCpsQm3Vp6mXoaTZS3E-kSBmtLoNJPDtb...
- f####.gst####.com/s/opensans/v15/EInbV5DfGHOiMmvb1Xr-hpS3E-kSBmtLoNJPDtb...
- f####.gst####.com/s/opensans/v15/MTP_ySUJH_bn48VBG8sNSpS3E-kSBmtLoNJPDtb...
- f####.gst####.com/s/opensans/v15/PRmiXeptR36kaC0GEAetxjdGNerWpg2Hn6A-BxW...
- f####.gst####.com/s/opensans/v15/PRmiXeptR36kaC0GEAetxkdJXfhP-2RmnAuS9A2...
- f####.gst####.com/s/opensans/v15/PRmiXeptR36kaC0GEAetxt6Naowg1QhaIq8kLGt...
- f####.gst####.com/s/opensans/v15/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXL...
- f####.gst####.com/s/opensans/v15/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtb...
- f####.gst####.com/s/opensans/v15/xjAJXh38I15wypJXxuGMBiwlidHJgAgmTjOEEzw...
- san-as####.adob####.com.####.net/577c3689ea990d22d8d98c00c4aa568bec64a42...
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=1&_v=j65&a=653161432&t=pageview&_s=2&dl=ht...
- www.google-####.com/collect?v=1&_v=j65&a=653161432&t=pageview&_s=3&dl=ht...
- www.google-####.com/collect?v=1&_v=j65&a=653161432&t=pageview&_s=4&dl=ht...
- www.google-####.com/collect?v=1&_v=j65&a=653161432&t=pageview&_s=5&dl=ht...
- www.google-####.com/r/collect?v=1&_v=j65&a=653161432&t=pageview&_s=1&dl=...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/app.dat.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes352832264.zip
- <Package Folder>/databases/####/http_app.biwenger.com_0.localst...ournal
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/files/####/59FA51D80192-0001-0827-45CAB2CBCFAF...s_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/crashlytics-userlog-59FA51D80192-00...F.temp
- <Package Folder>/files/####/crashlytics-userlog-59FA51D80192-00...mp.tmp
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_65603b27-fc23-4e9c-8fe1-268f600b...08.tap
- <Package Folder>/files/####/sa_a3974b8b-eaba-4794-92f0-4c28e82d...19.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/files/upUzyfeNU
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android.crash...re.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answe...gs.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences...GS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.f...ng.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Загружает динамические библиотеки:
- upUzyfeNU
Осуществляет доступ к информации о сети.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
