Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Locker.17522
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) o####.vk.com:443
- TCP(TLS/1.0) p####.io:443
- TCP(TLS/1.0) cdn1-sm####.ph####.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) www.go####.ru:443
- TCP(TLS/1.0) www.por####.com:443
- TCP(TLS/1.0) sto####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) 1####.194.73.94:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) analy####.go####.com:443
- TCP(TLS/1.0) st####.vk.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) 2####.239.34.223:443
- TCP(TLS/1.0) ei.ph####.com:443
- TCP(TLS/1.2) 1####.194.73.94:443
- TCP(TLS/1.2) 74.1####.131.138:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 1####.177.14.106:443
- UDP 2####.239.34.223:443
Запросы DNS:
- analy####.go####.com
- and####.a####.go####.com
- and####.google####.com
- cdn1-sm####.ph####.com
- ei.ph####.com
- gmscomp####.google####.com
- i####.vk.com
- m####.traffic####.net
- o####.vk.com
- p####.io
- rr2---s####.g####.com
- rr9---s####.g####.com
- s####.g.doublec####.net
- st####.vk.com
- sto####.google####.com
- www.go####.ru
- www.google####.com
- www.google-####.com
- www.googlet####.com
- www.por####.com
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/000001.dbtmp
- /data/data/####/000ea2897275d26a_0
- /data/data/####/000ea2897275d26a_0 (deleted)
- /data/data/####/000ea2897275d26a_1
- /data/data/####/00d69ab73bc8b4d3_0
- /data/data/####/00d69ab73bc8b4d3_0 (deleted)
- /data/data/####/016e868c8ca3af42_0 (deleted)
- /data/data/####/03b96d6bc0a1a923_0 (deleted)
- /data/data/####/05c1d49486f6f2e6_0
- /data/data/####/0732337eae818f20_0
- /data/data/####/0732337eae818f20_0 (deleted)
- /data/data/####/07ae9a969133002a_0 (deleted)
- /data/data/####/07cebf55634e28eb_0 (deleted)
- /data/data/####/07de92ffe72a6ff1_0
- /data/data/####/07de92ffe72a6ff1_0 (deleted)
- /data/data/####/08d1000232f0c15e_0
- /data/data/####/08d1000232f0c15e_0 (deleted)
- /data/data/####/0e1b375339ed9e45_0 (deleted)
- /data/data/####/0e34842844223e30_0
- /data/data/####/0e34842844223e30_0 (deleted)
- /data/data/####/0e6cec66fe5833ef_0
- /data/data/####/0e6cec66fe5833ef_0 (deleted)
- /data/data/####/11e6d0c100ef6553_0
- /data/data/####/11e6d0c100ef6553_0 (deleted)
- /data/data/####/11e6d0c100ef6553_1
- /data/data/####/16e8f44120f1c681_0
- /data/data/####/16e8f44120f1c681_0 (deleted)
- /data/data/####/1761732a4fc66a92_0
- /data/data/####/1761732a4fc66a92_0 (deleted)
- /data/data/####/1c5d6a62a81b0393_0
- /data/data/####/1c5d6a62a81b0393_0 (deleted)
- /data/data/####/2408197cbdac2a65_0
- /data/data/####/2408197cbdac2a65_0 (deleted)
- /data/data/####/272577471147083e_0
- /data/data/####/272577471147083e_0 (deleted)
- /data/data/####/2792ec578d45b8f3_0
- /data/data/####/2792ec578d45b8f3_0 (deleted)
- /data/data/####/281bbe4b77217eb2_0
- /data/data/####/281bbe4b77217eb2_0 (deleted)
- /data/data/####/2940195bd9870d6e_0
- /data/data/####/2940195bd9870d6e_1
- /data/data/####/2aa40f21e067b5a3_0
- /data/data/####/2aa40f21e067b5a3_0 (deleted)
- /data/data/####/2b4edd0b707a8526_0
- /data/data/####/2b4edd0b707a8526_0 (deleted)
- /data/data/####/2cc80dabc69f58b6_0
- /data/data/####/30e122884861e2c3_0
- /data/data/####/30e122884861e2c3_0 (deleted)
- /data/data/####/347e1594221e6827_0
- /data/data/####/347e1594221e6827_0 (deleted)
- /data/data/####/34941b8d3f29773a_0
- /data/data/####/34941b8d3f29773a_0 (deleted)
- /data/data/####/376e07450b704a15_0 (deleted)
- /data/data/####/3b6bdcf968d670aa_0
- /data/data/####/3b6bdcf968d670aa_0 (deleted)
- /data/data/####/3d0345a433d07890_0
- /data/data/####/3d0345a433d07890_0 (deleted)
- /data/data/####/3dc2e6ea90cea6e0_0
- /data/data/####/3dc2e6ea90cea6e0_0 (deleted)
- /data/data/####/3ea4d78ea985ea67_0
- /data/data/####/3f272aca370f27d2_0
- /data/data/####/3f272aca370f27d2_0 (deleted)
- /data/data/####/41118fa45db1ad75_0
- /data/data/####/423e030f8d74b293_0
- /data/data/####/423e030f8d74b293_0 (deleted)
- /data/data/####/42eac35dda646a22_0 (deleted)
- /data/data/####/42fc944eba61798c_0
- /data/data/####/42fc944eba61798c_0 (deleted)
- /data/data/####/43b3d8dfffd565e6_0
- /data/data/####/43b3d8dfffd565e6_0 (deleted)
- /data/data/####/43b3d8dfffd565e6_1
- /data/data/####/4459d09c6c0faa4b_0 (deleted)
- /data/data/####/45fe8392074de467_0 (deleted)
- /data/data/####/494718cda1db5c3c_0
- /data/data/####/494718cda1db5c3c_0 (deleted)
- /data/data/####/4bd329e4a243992f_0
- /data/data/####/4bd329e4a243992f_0 (deleted)
- /data/data/####/4cb013792b196a35_0
- /data/data/####/4cb013792b196a35_1
- /data/data/####/4cb1eb70d1e537be_0 (deleted)
- /data/data/####/4f646edc5ef3a947_0
- /data/data/####/4f646edc5ef3a947_0 (deleted)
- /data/data/####/527b6584888194b7_0 (deleted)
- /data/data/####/53865d91823a3fd4_0
- /data/data/####/5aedd949887a2695_0
- /data/data/####/5aedd949887a2695_0 (deleted)
- /data/data/####/5ce8339d2393b7a8_0
- /data/data/####/5ce8339d2393b7a8_0 (deleted)
- /data/data/####/5de344d139aa3f04_0
- /data/data/####/5de344d139aa3f04_0 (deleted)
- /data/data/####/5f8f4e631b68f014_0
- /data/data/####/5f8f4e631b68f014_0 (deleted)
- /data/data/####/5fc88acfa5b55087_0 (deleted)
- /data/data/####/60b63aef190e7358_0
- /data/data/####/60b63aef190e7358_0 (deleted)
- /data/data/####/60b63aef190e7358_1
- /data/data/####/62c7a4b13f61aac3_0
- /data/data/####/635d2b7279674c0e_0
- /data/data/####/635d2b7279674c0e_1
- /data/data/####/65bcd27c3907cc2d_0
- /data/data/####/65bcd27c3907cc2d_0 (deleted)
- /data/data/####/67e81f99c2fd6869_0 (deleted)
- /data/data/####/6cf85c365b6423f0_0
- /data/data/####/6cf85c365b6423f0_0 (deleted)
- /data/data/####/6eeafb7ac29e101a_0 (deleted)
- /data/data/####/72615d20c8ef421b_0
- /data/data/####/72615d20c8ef421b_0 (deleted)
- /data/data/####/7377144df34ad266_0
- /data/data/####/7377144df34ad266_0 (deleted)
- /data/data/####/76deb2888985ac88_0
- /data/data/####/76deb2888985ac88_0 (deleted)
- /data/data/####/77891d98bdbcdec5_0 (deleted)
- /data/data/####/77b80fad05360e38_0 (deleted)
- /data/data/####/787ec462046ff91f_0
- /data/data/####/787ec462046ff91f_0 (deleted)
- /data/data/####/790630dffc701245_0
- /data/data/####/790630dffc701245_0 (deleted)
- /data/data/####/79e5bc1361e41a40_0
- /data/data/####/79e5bc1361e41a40_0 (deleted)
- /data/data/####/79e7d479835f187f_0
- /data/data/####/79e7d479835f187f_0 (deleted)
- /data/data/####/7c5974298f0c99eb_0 (deleted)
- /data/data/####/7ead62db7d6ee2c6_0
- /data/data/####/7ead62db7d6ee2c6_0 (deleted)
- /data/data/####/7fe37af56d8c5304_0
- /data/data/####/8248eff6e1010470_0
- /data/data/####/8248eff6e1010470_0 (deleted)
- /data/data/####/852c59b59be895b9_0
- /data/data/####/852c59b59be895b9_0 (deleted)
- /data/data/####/8888bac454c36fa6_0
- /data/data/####/8888bac454c36fa6_1
- /data/data/####/8a2b7e1685f77704_0 (deleted)
- /data/data/####/8a67cec6ff1ad307_0 (deleted)
- /data/data/####/8d274946d6d1e611_0 (deleted)
- /data/data/####/8f0441fa6288b9f1_0 (deleted)
- /data/data/####/8fcd807dfe8b01ba_0
- /data/data/####/8fcd807dfe8b01ba_0 (deleted)
- /data/data/####/92a22d9164fba013_0 (deleted)
- /data/data/####/9402ef73a016ffbb_0
- /data/data/####/946f25a3f1bbec8b_0
- /data/data/####/946f25a3f1bbec8b_0 (deleted)
- /data/data/####/95cae56d052c205b_0
- /data/data/####/9b96fefa493d6daf_0
- /data/data/####/9b96fefa493d6daf_0 (deleted)
- /data/data/####/9f4a0923c5efa46a_0
- /data/data/####/9f4a0923c5efa46a_0 (deleted)
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/Databases.db-journal
- /data/data/####/KjqsYqlhD.dex
- /data/data/####/KjqsYqlhD.dex.flock (deleted)
- /data/data/####/MANIFEST-000001
- /data/data/####/MoKrttxoSectw.dex
- /data/data/####/MoKrttxoSectw.dex.flock (deleted)
- /data/data/####/QuotaManager-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a1a0eb390b604316_0
- /data/data/####/a1a0eb390b604316_1
- /data/data/####/a314fe11d6cc2308_0
- /data/data/####/a314fe11d6cc2308_0 (deleted)
- /data/data/####/a396f5fdf71eedf6_0
- /data/data/####/a396f5fdf71eedf6_0 (deleted)
- /data/data/####/a3b35b450c6ecfe6_0
- /data/data/####/a3b35b450c6ecfe6_0 (deleted)
- /data/data/####/a782a8ddb7b8f066_0
- /data/data/####/a782a8ddb7b8f066_0 (deleted)
- /data/data/####/aaIMLZi.dex
- /data/data/####/aaaa02601625a2d4_0
- /data/data/####/aaaa02601625a2d4_0 (deleted)
- /data/data/####/abeac27b2d88bf02_0
- /data/data/####/abeac27b2d88bf02_0 (deleted)
- /data/data/####/ac494745fec3b90a_0
- /data/data/####/ac494745fec3b90a_0 (deleted)
- /data/data/####/aeafe34adc808330_0
- /data/data/####/aeafe34adc808330_0 (deleted)
- /data/data/####/aeafe34adc808330_1
- /data/data/####/b375355d63337e03_0
- /data/data/####/b375355d63337e03_0 (deleted)
- /data/data/####/b54bfee4d389106b_0
- /data/data/####/b54bfee4d389106b_0 (deleted)
- /data/data/####/b6a66ebc6614d217_0
- /data/data/####/b6a66ebc6614d217_0 (deleted)
- /data/data/####/b90bf5aea061c292_0
- /data/data/####/b90bf5aea061c292_0 (deleted)
- /data/data/####/bba3236dd2e52a81_0 (deleted)
- /data/data/####/be97427b03d8575a_0
- /data/data/####/be97427b03d8575a_0 (deleted)
- /data/data/####/bedd6220d4604ad3_0
- /data/data/####/bedd6220d4604ad3_0 (deleted)
- /data/data/####/c5c048d299ef0a86_0
- /data/data/####/c5c048d299ef0a86_0 (deleted)
- /data/data/####/c796025cf1f88a68_0 (deleted)
- /data/data/####/c873ff80ede303eb_0
- /data/data/####/c873ff80ede303eb_0 (deleted)
- /data/data/####/c87a64b0bec2ea5a_0
- /data/data/####/c87a64b0bec2ea5a_0 (deleted)
- /data/data/####/c8f2c24b1f8d510a_0
- /data/data/####/c8f2c24b1f8d510a_0 (deleted)
- /data/data/####/ca68c4edc511164c_0
- /data/data/####/ca68c4edc511164c_0 (deleted)
- /data/data/####/cbbacc0e3aa63a46_0
- /data/data/####/cbbacc0e3aa63a46_0 (deleted)
- /data/data/####/ccb6ae163afebfc0_0
- /data/data/####/ccb6ae163afebfc0_0 (deleted)
- /data/data/####/com.ogr_preferences.xml
- /data/data/####/d29a39020d1cdc92_0
- /data/data/####/d29a39020d1cdc92_0 (deleted)
- /data/data/####/d4dd4bf3e1229ed3_0
- /data/data/####/d4dd4bf3e1229ed3_0 (deleted)
- /data/data/####/d5f844eb23a0f3d8_0
- /data/data/####/d6138bf2a4ed2569_0
- /data/data/####/d6138bf2a4ed2569_0 (deleted)
- /data/data/####/d9f4fb996e287c33_0
- /data/data/####/d9f4fb996e287c33_0 (deleted)
- /data/data/####/db14992a08cd2518_0
- /data/data/####/db14992a08cd2518_0 (deleted)
- /data/data/####/dc7f469f77ac9d0b_0
- /data/data/####/dc7f469f77ac9d0b_0 (deleted)
- /data/data/####/dda50aac43094094_0
- /data/data/####/dda50aac43094094_0 (deleted)
- /data/data/####/ddf372632ea29c5b_0
- /data/data/####/e04ecf0bca57320a_0
- /data/data/####/e04ecf0bca57320a_0 (deleted)
- /data/data/####/e0eebf949b211e0a_0
- /data/data/####/e0eebf949b211e0a_0 (deleted)
- /data/data/####/e3f00f0c80c21553_0
- /data/data/####/e3f00f0c80c21553_0 (deleted)
- /data/data/####/e56d9ca6bdf8da09_0
- /data/data/####/e56d9ca6bdf8da09_0 (deleted)
- /data/data/####/e5fd71537e65275e_0
- /data/data/####/e5fd71537e65275e_0 (deleted)
- /data/data/####/e70ea88ab2d97d6d_0
- /data/data/####/e70ea88ab2d97d6d_0 (deleted)
- /data/data/####/e70ea88ab2d97d6d_1
- /data/data/####/e9830367d54ccf54_0
- /data/data/####/e9830367d54ccf54_0 (deleted)
- /data/data/####/ec4863abca9d7e1e_0
- /data/data/####/ec4863abca9d7e1e_0 (deleted)
- /data/data/####/effd37cf07a9b470_0 (deleted)
- /data/data/####/f2e0788f0284b6bc_0
- /data/data/####/f2e0788f0284b6bc_0 (deleted)
- /data/data/####/f5fa9c6556e1c73b_0 (deleted)
- /data/data/####/f966e41234fa91d3_0
- /data/data/####/f966e41234fa91d3_0 (deleted)
- /data/data/####/fa9a2d77a279047a_0
- /data/data/####/fa9a2d77a279047a_0 (deleted)
- /data/data/####/fc38d6f032010cfc_0
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/zCXXZQGFKgBdMS.dex
- /data/data/####/zCXXZQGFKgBdMS.dex.flock (deleted)
- /data/misc/####/primary.prof
Другие:
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
