Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.MobiDash.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) www.machine####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(TLS/1.0) ne####.bootstr####.com:443
Запросы DNS:
- f####.google####.com
- f####.gst####.com
- ne####.bootstr####.com
- www.machine####.com
Запросы HTTP GET:
- f####.google####.com/css?family=####&subset=####
- f####.gst####.com/s/opensans/v15/DXI1ORHCpsQm3Vp6mXoaTY3LH2FgLjViKkqswU-...
- f####.gst####.com/s/opensans/v15/EInbV5DfGHOiMmvb1Xr-ho3LH2FgLjViKkqswU-...
- f####.gst####.com/s/opensans/v15/k3k702ZOKiLJc3WVjuplzI3LH2FgLjViKkqswU-...
- f####.gst####.com/s/opensans/v15/u-WUoqrET9fUeobQW7jkRSZ2oysoEQEeKwjgmXL...
- www.machine####.com/
- www.machine####.com/android
- www.machine####.com/android/
- www.machine####.com/wp-content/plugins/easy-facebook-likebox/public/asse...
- www.machine####.com/wp-content/themes/Divi/epanel/shortcodes/css/shortco...
- www.machine####.com/wp-content/themes/Divi/fonts/ETmodules_v2.ttf
- www.machine####.com/wp-content/themes/Divi/js/custom.js?ver=####
- www.machine####.com/wp-content/themes/Divi/js/jquery.easypiechart.js?ver...
- www.machine####.com/wp-content/themes/Divi/js/jquery.fitvids.js?ver=####
- www.machine####.com/wp-content/themes/Divi/js/jquery.magnific-popup.js?v...
- www.machine####.com/wp-content/themes/Divi/js/waypoints.min.js?ver=####
- www.machine####.com/wp-content/themes/Divi/style.css?ver=####
- www.machine####.com/wp-content/uploads/2015/05/CD_Box.png
- www.machine####.com/wp-content/uploads/2015/05/Light-IIIHD.jpg
- www.machine####.com/wp-content/uploads/2015/05/Sanatorium-II.jpg
- www.machine####.com/wp-content/uploads/2015/05/St-Abandon.jpg
- www.machine####.com/wp-content/uploads/2015/05/empty8x8.png
- www.machine####.com/wp-content/uploads/2015/05/logo_224.png
- www.machine####.com/wp-content/uploads/2015/05/screen.png
- www.machine####.com/wp-content/uploads/Abandoned-Staircase1.jpg
- www.machine####.com/wp-content/uploads/Android.png
- www.machine####.com/wp-content/uploads/Android_background.jpg
- www.machine####.com/wp-content/uploads/Android_phone.png
- www.machine####.com/wp-content/uploads/Cube_trans.png
- www.machine####.com/wp-content/uploads/D01H_01.png
- www.machine####.com/wp-content/uploads/D01H_02.png
- www.machine####.com/wp-content/uploads/D01_01.png
- www.machine####.com/wp-content/uploads/D01_02.png
- www.machine####.com/wp-content/uploads/D02H_01.png
- www.machine####.com/wp-content/uploads/D02H_02.png
- www.machine####.com/wp-content/uploads/D02_01.png
- www.machine####.com/wp-content/uploads/D02_02.png
- www.machine####.com/wp-content/uploads/D03H_01.png
- www.machine####.com/wp-content/uploads/D03H_02.png
- www.machine####.com/wp-content/uploads/D03_01.png
- www.machine####.com/wp-content/uploads/D03_02.png
- www.machine####.com/wp-content/uploads/D04H_01.png
- www.machine####.com/wp-content/uploads/D04H_02.png
- www.machine####.com/wp-content/uploads/D04_01.png
- www.machine####.com/wp-content/uploads/D04_02.png
- www.machine####.com/wp-content/uploads/D05H_01.png
- www.machine####.com/wp-content/uploads/D05H_02.png
- www.machine####.com/wp-content/uploads/D05_01.png
- www.machine####.com/wp-content/uploads/D05_02.png
- www.machine####.com/wp-content/uploads/Death-Valley-National-Park_s.jpg
- www.machine####.com/wp-content/uploads/Editor.ico
- www.machine####.com/wp-content/uploads/Files_w.jpg
- www.machine####.com/wp-content/uploads/Flickr.png
- www.machine####.com/wp-content/uploads/GangnamStation.jpg
- www.machine####.com/wp-content/uploads/Google_play.png
- www.machine####.com/wp-content/uploads/M01.png
- www.machine####.com/wp-content/uploads/M02.png
- www.machine####.com/wp-content/uploads/M03.png
- www.machine####.com/wp-content/uploads/M04.png
- www.machine####.com/wp-content/uploads/M06.png
- www.machine####.com/wp-content/uploads/M07.png
- www.machine####.com/wp-content/uploads/M08.png
- www.machine####.com/wp-content/uploads/M09.png
- www.machine####.com/wp-content/uploads/M10.png
- www.machine####.com/wp-content/uploads/M11.png
- www.machine####.com/wp-content/uploads/M12.png
- www.machine####.com/wp-content/uploads/M13.png
- www.machine####.com/wp-content/uploads/M14.png
- www.machine####.com/wp-content/uploads/M15.png
- www.machine####.com/wp-content/uploads/M16.png
- www.machine####.com/wp-content/uploads/M17.png
- www.machine####.com/wp-content/uploads/M18.png
- www.machine####.com/wp-content/uploads/M19.png
- www.machine####.com/wp-content/uploads/M20.png
- www.machine####.com/wp-content/uploads/M21.png
- www.machine####.com/wp-content/uploads/M22.png
- www.machine####.com/wp-content/uploads/News_Background.jpg
- www.machine####.com/wp-content/uploads/Parzival011.jpg
- www.machine####.com/wp-content/uploads/Windows.png
- www.machine####.com/wp-content/uploads/background1600.jpg
- www.machine####.com/wp-includes/js/comment-reply.min.js?ver=####
- www.machine####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- www.machine####.com/wp-includes/js/jquery/jquery.js?ver=####
- www.machine####.com/wp-includes/js/wp-embed.min.js?ver=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_app_apk/hdr.dat.jar
- <Package Folder>/files/####/<Package>-1.apk.classes1133293.zip
- <Package Folder>/files/caDWxfQIO
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/MachineryAktywnosc.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <SD-Card>/Pictures/####/Picture_HDR1.jpg
Другие:
Загружает динамические библиотеки:
- caDWxfQIO
- machinery
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
