Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.b####.com:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) ak.im####.com.####.net:80
- TCP(HTTP/1.1) nate####.com:80
- TCP(HTTP/1.1) su####.g.doublec####.net:80
- TCP(HTTP/1.1) global-####.w####.com.####.net:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) mcc.god####.com:80
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) www.go####.nl:443
Запросы DNS:
- adser####.go####.com
- adser####.go####.nl
- ak2.im####.com
- b####.com
- i####.w####.com
- mcc.god####.com
- nate####.com
- sett####.crashly####.com
- ssl.google-####.com
- ssl.gst####.com
- su####.g.doublec####.net
- www.b####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
Запросы HTTP GET:
- ak.im####.com.####.net/images/99_prk_pg_background.jpg
- ak.im####.com.####.net/images/GDPPC_CAF_Search3.png
- ak.im####.com.####.net/images/bul_blacksquare.png
- ak.im####.com.####.net/images/new_logo_GDTrans.png
- ak.im####.com.####.net/images/or2.png
- ak.im####.com.####.net/images/v4Slice.png
- ak.im####.com.####.net/script/jquery-1.3.1.min.js
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w4.ttf
- global-####.w####.com.####.net/ux/fonts/1.0/ttf/w8.ttf
- mcc.god####.com/park/o3M0pJfhpTW6
- nate####.com/themes/wallpaper/materialthings/xxhdpi.js
- su####.g.doublec####.net/async_survey?site=####
- su####.g.doublec####.net/gk/prompt?t=####&site=####&random=####&ref=####...
- su####.g.doublec####.net/insights/consumersurveys/static/407056381852021...
- www.b####.com/
- www.b####.com/?reqp=####&reqr=####
- www.b####.com/NmbVZ/
- www.b####.com/img.aspx?q=L3MkW####
- www.go####.com/adsense/domains/caf.js
- www.go####.com/afs/ads/i/iframe.html
- www.go####.com/complete/search?hl=####&client=####&q=####
- www.go####.com/dp/ads?r=m&domain_name=bigdx.com&client=dp-godaddy2_xml&c...
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/materialthings.dat.jar
- <Package Folder>/databases/Nate+Wren+-+Graphic+Design-journal
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/files/####/5A0D7D460210-0001-081C-FF5A061AD40E...s_temp
- <Package Folder>/files/####/5A0D7D48009D-0002-081C-FF5A061AD40E...02.cls
- <Package Folder>/files/####/5A0D7D48009D-0002-081C-FF5A061AD40E...06.cls
- <Package Folder>/files/####/5A0D7D48009D-0002-081C-FF5A061AD40E...19.cls
- <Package Folder>/files/####/5A0D7D48009D-0002-081C-FF5A061AD40E...21.cls
- <Package Folder>/files/####/5A0D7D48009D-0002-081C-FF5A061AD40E...s_temp
- <Package Folder>/files/####/<Package>-1.apk.classes1040973297.zip
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_d126dd09-c905-4da5-8310-95dcdc71...96.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/gaClientId
- <Package Folder>/files/jaVdCCbRN
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.c.a.a.c.xml
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/muzeiartsource_Material Things.xml
- <Package Folder>/shared_prefs/my_prefs.xml
- <Package Folder>/shared_prefs/my_walls.xml
Другие:
Загружает динамические библиотеки:
- jaVdCCbRN
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
