Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v####.ge####.mobi:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) crea-d####.nl:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) eventlo####.ge####.com:80
- TCP(HTTP/1.1) www.crea-d####.nl:80
- TCP(TLS/1.0) www.googlea####.com:443
- TCP(TLS/1.0) www.ge####.com:443
- TCP(TLS/1.0) ne####.bootstr####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) st####.ge####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) tpc.googles####.com:443
Запросы DNS:
- a####.google####.com
- adser####.go####.com
- adser####.go####.nl
- cl####.ge####.com
- crea-d####.nl
- eventlo####.ge####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- ne####.bootstr####.com
- pag####.googles####.com
- s####.g.doublec####.net
- st####.ak.con####.####.com
- st####.ge####.com
- tpc.googles####.com
- v####.ge####.mobi
- www.crea-d####.nl
- www.ge####.com
- www.go####.com
- www.google-####.com
- www.googlea####.com
Запросы HTTP GET:
- crea-d####.nl/shop/?gjclnt=####
- crea-d####.nl/shop/?zenid=####&gjclnt=####
- crea-d####.nl/shop/alle-artikelen?gjclnt=####
- crea-d####.nl/shop/glitter-tattoos/glitter-tattoo-starter-sets/frozen-xl...
- crea-d####.nl/shop/images/Button frontpage UV producten.JPG
- crea-d####.nl/shop/images/Button frontpage als kadootje.JPG
- crea-d####.nl/shop/images/Button frontpage ballonnen.JPG
- crea-d####.nl/shop/images/Button frontpage boeken.JPG
- crea-d####.nl/shop/images/Button frontpage glitter tattoos - starter set...
- crea-d####.nl/shop/images/Button frontpage glitter tattoos.JPG
- crea-d####.nl/shop/images/Button frontpage hair chalk - hair chalk.JPG
- crea-d####.nl/shop/images/Button frontpage nagel stempelen.JPG
- crea-d####.nl/shop/images/Button frontpage schmink cursus.JPG
- crea-d####.nl/shop/images/Button frontpage schmink.jpg
- crea-d####.nl/shop/images/Button frontpage special effects.JPG
- crea-d####.nl/shop/images/Button_kadobon.jpg
- crea-d####.nl/shop/images/CD01838.jpg
- crea-d####.nl/shop/images/CD09013.jpg
- crea-d####.nl/shop/images/CD09015.JPG
- crea-d####.nl/shop/images/CD09019.jpg
- crea-d####.nl/shop/images/CD09040.jpg
- crea-d####.nl/shop/images/CD09050.jpg
- crea-d####.nl/shop/images/CD09107.jpg
- crea-d####.nl/shop/images/CD09119.jpg
- crea-d####.nl/shop/images/CD09127.jpg
- crea-d####.nl/shop/images/CD09128.jpg
- crea-d####.nl/shop/images/CD09129.jpg
- crea-d####.nl/shop/images/CD09130.jpg
- crea-d####.nl/shop/images/CD09131.jpg
- crea-d####.nl/shop/images/CD09159.jpg
- crea-d####.nl/shop/images/CD09160.jpg
- crea-d####.nl/shop/images/CD09161.jpg
- crea-d####.nl/shop/images/CD09162.jpg
- crea-d####.nl/shop/images/CD09163.jpg
- crea-d####.nl/shop/images/CD09164.jpg
- crea-d####.nl/shop/images/CD10052_new.jpg
- crea-d####.nl/shop/images/CD10057.JPG
- crea-d####.nl/shop/images/CD10094.JPG
- crea-d####.nl/shop/images/CD10099.jpg
- crea-d####.nl/shop/images/CD10111.jpg
- crea-d####.nl/shop/images/CD10112.jpg
- crea-d####.nl/shop/images/CD10133.JPG
- crea-d####.nl/shop/images/CD10134.jpg
- crea-d####.nl/shop/images/CD10211.jpeg
- crea-d####.nl/shop/images/CD31005.JPG
- crea-d####.nl/shop/images/CD31016.JPG
- crea-d####.nl/shop/images/CD31017.JPG
- crea-d####.nl/shop/images/CD32003.JPG
- crea-d####.nl/shop/images/CD32004.JPG
- crea-d####.nl/shop/images/CD32005.JPG
- crea-d####.nl/shop/images/CD36005.jpg
- crea-d####.nl/shop/images/CD36006.jpg
- crea-d####.nl/shop/images/CD36007.jpg
- crea-d####.nl/shop/images/Cursus_basis.jpg
- crea-d####.nl/shop/images/Cursus_regenboog.jpg
- crea-d####.nl/shop/images/categories/Button frontpage flash tattoo.JPG
- crea-d####.nl/shop/images/categories/Button frontpage hotdeal.jpg
- crea-d####.nl/shop/images/cd00309.jpg
- crea-d####.nl/shop/images/cd00413.jpg
- crea-d####.nl/shop/images/cd00732.jpg
- crea-d####.nl/shop/images/cd01221.jpg
- crea-d####.nl/shop/images/cd01913.jpg
- crea-d####.nl/shop/images/cd02700.jpg
- crea-d####.nl/shop/images/cd10040.jpg
- crea-d####.nl/shop/images/cd31011.jpg
- crea-d####.nl/shop/images/cd31012.jpg
- crea-d####.nl/shop/images/cd32000.jpg
- crea-d####.nl/shop/images/cd32001.jpg
- crea-d####.nl/shop/images/cd32002.jpg
- crea-d####.nl/shop/images/facebook-32x32.png
- crea-d####.nl/shop/images/holland_button.jpg
- crea-d####.nl/shop/images/twitter-32x32.png
- crea-d####.nl/shop/includes/general.js
- crea-d####.nl/shop/includes/modules/pages/product_info/jscript_textarea_...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_add_...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_in_c...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_next...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_prev...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_retu...
- crea-d####.nl/shop/includes/templates/ice_cold/buttons/dutch/button_sear...
- crea-d####.nl/shop/includes/templates/ice_cold/css/print_stylesheet.css
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet.css
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_coin-slide...
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_cookie_con...
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_css_button...
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_facebook_b...
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_social_med...
- crea-d####.nl/shop/includes/templates/ice_cold/css/stylesheet_zen_lightb...
- crea-d####.nl/shop/includes/templates/ice_cold/images/banner.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/facebook.png
- crea-d####.nl/shop/includes/templates/ice_cold/images/idealbanner.gif
- crea-d####.nl/shop/includes/templates/ice_cold/images/shopping-basket.png
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-1_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-2_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-3_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-4_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-5_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-6_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/slide-7_nl.jpg
- crea-d####.nl/shop/includes/templates/ice_cold/images/twitter.png
- crea-d####.nl/shop/includes/templates/ice_cold/jscript/jquery-1.4.4.min.js
- crea-d####.nl/shop/includes/templates/ice_cold/jscript/jscript_1.7.1.js
- crea-d####.nl/shop/includes/templates/ice_cold/jscript/jscript_coin-slid...
- crea-d####.nl/shop/winkelmandje?gjclnt=####
- f####.google####.com/css?family=####
- f####.gst####.com/s/oxygen/v7/WNVARKadHCfwbQ2n3MQeIOvvDin1pK8aKteLpeZ5c0...
- v####.ge####.mobi/views/mobile/img/logo.png
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=1&_v=j65&a=1118554076&t=pageview&_s=1&dl=h...
- www.google-####.com/collect?v=1&_v=j65&a=1529390526&t=pageview&_s=1&dl=h...
- www.google-####.com/collect?v=1&_v=j65&a=1746356830&t=pageview&_s=1&dl=h...
- www.google-####.com/collect?v=1&_v=j65&a=25065683&t=pageview&_s=1&dl=htt...
- www.google-####.com/collect?v=1&_v=j65&a=508428746&t=pageview&_s=1&dl=ht...
- www.google-####.com/collect?v=1&_v=j65&a=703571128&t=pageview&_s=1&dl=ht...
- www.google-####.com/r/collect?v=1&_v=j65&a=1227332584&t=pageview&_s=1&dl...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/clientprotro.dat.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/index
- <Package Folder>/code_cache/####/MultiDex.lock
- <Package Folder>/code_cache/####/tmp-<Package>-1.apk.classes-272365463.zip
- <Package Folder>/databases/GetJarDB-journal
- <Package Folder>/databases/GetJarDBEvents-journal
- <Package Folder>/databases/GetJarDBRunning-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/xpXOdJyjG
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/GetJarClientPrefs.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/timestamp.xml
Другие:
Загружает динамические библиотеки:
- xpXOdJyjG
Использует права администратора.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
