Android.SpyMax.852

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Android.Packed.31.origin
Android.Siggen.Susp.5440
Android.SpyMax.65

Сетевая активность:

Подключается к:

UDP(???) pla####.google####.com:443
UDP(DNS) <Google DNS>
TCP(TLS/1.0) devicei####.google####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.2) 74.1####.131.147:443
TCP(TLS/1.2) 74.1####.131.95:443
TCP(TLS/1.2) 1####.194.222.95:443
TCP(TLS/1.2) 1####.194.73.102:443
TCP(TLS/1.2) p####.google####.com:443

Запросы DNS:

and####.a####.go####.com
and####.google####.com
android####.go####.com
connect####.gst####.com
devicei####.google####.com
firebas####.google####.com
p####.google####.com
pla####.google####.com
www.google####.com

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
/data/data/####/15KRmfDmpj72mX7t24AsHyiEs1KpEcHv.dex
/data/data/####/15KRmfDmpj72mX7t24AsHyiEs1KpEcHv.dex.flock (deleted)
/data/data/####/17MHA8raYkH2occ3bgdBvoD5ptPVtVdL.dex
/data/data/####/17MHA8raYkH2occ3bgdBvoD5ptPVtVdL.dex.flock (deleted)
/data/data/####/1hsGGTrbPCrT9r7xZ6AN0zPMIHEGWLcQ.dex
/data/data/####/1hsGGTrbPCrT9r7xZ6AN0zPMIHEGWLcQ.dex.flock (deleted)
/data/data/####/1lReSo52zEiA9rV4umHAQAR3ZY57mHFQ.dex
/data/data/####/1lReSo52zEiA9rV4umHAQAR3ZY57mHFQ.dex.flock (deleted)
/data/data/####/1x6TmTFyzDATAy24w2ikO8EC6qKb2pVQ.dex
/data/data/####/2h4d8wgKDNM8ZyjWgzeh2UPVTgrZh8Kp.dex
/data/data/####/2h4d8wgKDNM8ZyjWgzeh2UPVTgrZh8Kp.dex.flock (deleted)
/data/data/####/3KnhTlyxx8Ga4QU7Gqw2NWz7TjBTV42G.dex
/data/data/####/3KnhTlyxx8Ga4QU7Gqw2NWz7TjBTV42G.dex.flock (deleted)
/data/data/####/4jDBJAF1GYYhV2hX6pb2PLQJINM5ynKp.dex
/data/data/####/4jDBJAF1GYYhV2hX6pb2PLQJINM5ynKp.dex.flock (deleted)
/data/data/####/53ygp0yNP2P7Y9kG3RhvUJwy0OLqyxDa.dex
/data/data/####/53ygp0yNP2P7Y9kG3RhvUJwy0OLqyxDa.dex.flock (deleted)
/data/data/####/5VGn4THNw0IBzHK1BxdhjZ2l2PHsi09c.dex
/data/data/####/5VGn4THNw0IBzHK1BxdhjZ2l2PHsi09c.dex.flock (deleted)
/data/data/####/5uKOhSp3LnELY7xLl2Hab4fXv7OqHntx.dex
/data/data/####/5uKOhSp3LnELY7xLl2Hab4fXv7OqHntx.dex.flock (deleted)
/data/data/####/6sFw8UyrS95pZAHKX7XLwS1dhzcyGD4E.dex
/data/data/####/6sFw8UyrS95pZAHKX7XLwS1dhzcyGD4E.dex.flock (deleted)
/data/data/####/76rXWWcJanfPCAtwTlMfMOaDMEo3ddTD.dex
/data/data/####/76rXWWcJanfPCAtwTlMfMOaDMEo3ddTD.dex.flock (deleted)
/data/data/####/7htcTpI3syeMHcKH2lKMkUaFIULDmHJQ.dex
/data/data/####/7htcTpI3syeMHcKH2lKMkUaFIULDmHJQ.dex.flock (deleted)
/data/data/####/85ZwX0IeVHy1xi3y0s5368crKnStmNVj.dex
/data/data/####/85ZwX0IeVHy1xi3y0s5368crKnStmNVj.dex.flock (deleted)
/data/data/####/8UsNMpJPS3hjJlUH4UavQD9y57kViBnP.dex
/data/data/####/8UsNMpJPS3hjJlUH4UavQD9y57kViBnP.dex.flock (deleted)
/data/data/####/8jhBXEtYlQJNxu1NaGTKpwW86oWGuORX.dex
/data/data/####/8jhBXEtYlQJNxu1NaGTKpwW86oWGuORX.dex.flock (deleted)
/data/data/####/92O7SwY8R5ulDHFFO9feCn90DCbnYTWG.dex
/data/data/####/92O7SwY8R5ulDHFFO9feCn90DCbnYTWG.dex.flock (deleted)
/data/data/####/9embyz03j3I1ciAX0jdpBt2Pdz6oAqrJ.dex
/data/data/####/9embyz03j3I1ciAX0jdpBt2Pdz6oAqrJ.dex.flock (deleted)
/data/data/####/A6EFTYQ0DwKna9RvBBDhTd2Qh9BJ8ykb.dex
/data/data/####/A6EFTYQ0DwKna9RvBBDhTd2Qh9BJ8ykb.dex.flock (deleted)
/data/data/####/AgUuIcaEzkYkPzt7Fx2cc8RaJVofbjdn.dex
/data/data/####/AgUuIcaEzkYkPzt7Fx2cc8RaJVofbjdn.dex.flock (deleted)
/data/data/####/AllMszn35uHcbsK24755jVGCXUNY56lT.dex
/data/data/####/AllMszn35uHcbsK24755jVGCXUNY56lT.dex.flock (deleted)
/data/data/####/BI8ZZEV0lr9tmMuvC2SNlLBH9UbLgjNK.dex
/data/data/####/BI8ZZEV0lr9tmMuvC2SNlLBH9UbLgjNK.dex.flock (deleted)
/data/data/####/Bm8EFWO713AY9R3kMRoi7DuDVR2t14Qz.dex
/data/data/####/Bm8EFWO713AY9R3kMRoi7DuDVR2t14Qz.dex.flock (deleted)
/data/data/####/DuYKDIWTWv1J7ZmNGy06VaUnYvAdVJc9.dex
/data/data/####/DuYKDIWTWv1J7ZmNGy06VaUnYvAdVJc9.dex.flock (deleted)
/data/data/####/F2qyVqlAXUl0TmyuTuIB2Ox2B6SG2AtK.dex
/data/data/####/F2qyVqlAXUl0TmyuTuIB2Ox2B6SG2AtK.dex.flock (deleted)
/data/data/####/FKN9ZksQTTe5WmJMtBiAfvoUa0EyNoRl.dex
/data/data/####/FKN9ZksQTTe5WmJMtBiAfvoUa0EyNoRl.dex.flock (deleted)
/data/data/####/FRZb2tLHgaFkvBIraMWvXfwVNKqDYmn7.dex
/data/data/####/FRZb2tLHgaFkvBIraMWvXfwVNKqDYmn7.dex.flock (deleted)
/data/data/####/GxaLEM81eYf8H2b4RsiB2dgQHdRMXBjC.dex
/data/data/####/GxaLEM81eYf8H2b4RsiB2dgQHdRMXBjC.dex.flock (deleted)
/data/data/####/HnSsvQmXjiZ2yS4tdK3TAKrHd4vO9E4n.dex
/data/data/####/HnSsvQmXjiZ2yS4tdK3TAKrHd4vO9E4n.dex.flock (deleted)
/data/data/####/JCfFUdtStNDnOZROZbtb0Sv9FVbhuy6F.dex
/data/data/####/JCfFUdtStNDnOZROZbtb0Sv9FVbhuy6F.dex.flock (deleted)
/data/data/####/KCxfylDsp5oJUQRgoXzCMK4IANuMgzhL.dex
/data/data/####/KCxfylDsp5oJUQRgoXzCMK4IANuMgzhL.dex.flock (deleted)
/data/data/####/Kg3EIrZkhrV6i9fQdPWBMIPjpEKCpwmM.dex
/data/data/####/Kg3EIrZkhrV6i9fQdPWBMIPjpEKCpwmM.dex.flock (deleted)
/data/data/####/Ksr9BeaBU7Rb1fC9aeSrVqnan7qqm7eu.dex
/data/data/####/Ksr9BeaBU7Rb1fC9aeSrVqnan7qqm7eu.dex.flock (deleted)
/data/data/####/Lrlvb4FS1ftvVND5wZgddKwKPPOfdB1O.dex
/data/data/####/Lrlvb4FS1ftvVND5wZgddKwKPPOfdB1O.dex.flock (deleted)
/data/data/####/M0HGLu0uC4DxENWbVfSwZ0iyhv0Efs6L.dex
/data/data/####/M0HGLu0uC4DxENWbVfSwZ0iyhv0Efs6L.dex.flock (deleted)
/data/data/####/MultiDex.lock
/data/data/####/My8jII8R7C07ljxlCjrWCvJOkz33GCfy.dex
/data/data/####/My8jII8R7C07ljxlCjrWCvJOkz33GCfy.dex.flock (deleted)
/data/data/####/N6s0Vnscu0s0BunqcMbBR9MERBdis04E.dex
/data/data/####/N6s0Vnscu0s0BunqcMbBR9MERBdis04E.dex.flock (deleted)
/data/data/####/NLSK7dreDh52ixO9h6NARUYsQOJNKwYx.dex
/data/data/####/NLSK7dreDh52ixO9h6NARUYsQOJNKwYx.dex.flock (deleted)
/data/data/####/NOmEgm87S3VgnYcivbHcOFpTauKDpi8O.dex
/data/data/####/NOmEgm87S3VgnYcivbHcOFpTauKDpi8O.dex.flock (deleted)
/data/data/####/NtrW3dNMk5wXpfWKdjdEHOV5PXrTAX06.dex
/data/data/####/NtrW3dNMk5wXpfWKdjdEHOV5PXrTAX06.dex.flock (deleted)
/data/data/####/OFKM8KjcR8ZmX8wMqPS0WSxcjGhmRSI9.dex
/data/data/####/OFKM8KjcR8ZmX8wMqPS0WSxcjGhmRSI9.dex.flock (deleted)
/data/data/####/P1QAx6PLJEnRj3oJM7pCwBGhAfg29p2l.dex
/data/data/####/P1QAx6PLJEnRj3oJM7pCwBGhAfg29p2l.dex.flock (deleted)
/data/data/####/PD7pBXN0pSYfMJ88a9jrI26hkfK70yYT.dex
/data/data/####/PD7pBXN0pSYfMJ88a9jrI26hkfK70yYT.dex.flock (deleted)
/data/data/####/PkGzUMiPJVnzRzeRNUmy4whYVD8z8HQ3.dex
/data/data/####/PkGzUMiPJVnzRzeRNUmy4whYVD8z8HQ3.dex.flock (deleted)
/data/data/####/QMV5kc0BX26ZG2Z4SlS95hLNvXtUqJJW.dex
/data/data/####/QMV5kc0BX26ZG2Z4SlS95hLNvXtUqJJW.dex.flock (deleted)
/data/data/####/SE4aqCB702DCqkcLMxI6HO3TA2ukbCTX.dex
/data/data/####/SE4aqCB702DCqkcLMxI6HO3TA2ukbCTX.dex.flock (deleted)
/data/data/####/SIkOjcKqJGox3h60DdwkHpGwEYTtz9m2.dex
/data/data/####/SIkOjcKqJGox3h60DdwkHpGwEYTtz9m2.dex.flock (deleted)
/data/data/####/SXvma7RhR3fvBRhZTTLO2k2PAgGkZwlV.dex
/data/data/####/SXvma7RhR3fvBRhZTTLO2k2PAgGkZwlV.dex.flock (deleted)
/data/data/####/SYLyQj5hGSZFGDqgTTUktbrMd74QIv76.dex
/data/data/####/SYLyQj5hGSZFGDqgTTUktbrMd74QIv76.dex.flock (deleted)
/data/data/####/Sy8waaEBnMVJAL9frqQNLp3UA1Zp3bQv.dex
/data/data/####/Sy8waaEBnMVJAL9frqQNLp3UA1Zp3bQv.dex.flock (deleted)
/data/data/####/T5WpCAjJzrCvjCzVJkqR2DDZ5E4uNa95.dex
/data/data/####/T5WpCAjJzrCvjCzVJkqR2DDZ5E4uNa95.dex.flock (deleted)
/data/data/####/UUtTed3mkDgM498URbL9tRHLlVpvcTvE.dex
/data/data/####/UUtTed3mkDgM498URbL9tRHLlVpvcTvE.dex.flock (deleted)
/data/data/####/V2JcfUCj1asxwpHNp2vTVVmthxvcApa1.dex
/data/data/####/V2JcfUCj1asxwpHNp2vTVVmthxvcApa1.dex.flock (deleted)
/data/data/####/VD7UHA7K36TrqY3kkBewEI4QyxDPYY5x.dex
/data/data/####/VD7UHA7K36TrqY3kkBewEI4QyxDPYY5x.dex.flock (deleted)
/data/data/####/Wg1W20FdnmBa9FeelZsjxBIYAVOv8E75.dex
/data/data/####/Wg1W20FdnmBa9FeelZsjxBIYAVOv8E75.dex.flock (deleted)
/data/data/####/WgUfHyTqiDIOd33GmO3Tim2ZmKmOtjpl.dex
/data/data/####/WgUfHyTqiDIOd33GmO3Tim2ZmKmOtjpl.dex.flock (deleted)
/data/data/####/X6uX1jP6IbgmpQGSg8E7ux7SGJxkIiKn.dex
/data/data/####/X6uX1jP6IbgmpQGSg8E7ux7SGJxkIiKn.dex.flock (deleted)
/data/data/####/YG0abRZRQbrWAxwvTnEe05NfmpGlqRi8.dex
/data/data/####/YG0abRZRQbrWAxwvTnEe05NfmpGlqRi8.dex.flock (deleted)
/data/data/####/Z1LkdgtXCVWVJ0Y8OwlqF3Iah1iQjwdp.dex
/data/data/####/Z1LkdgtXCVWVJ0Y8OwlqF3Iah1iQjwdp.dex.flock (deleted)
/data/data/####/a5zyFCEibZUiovbzumG4waxhqimXvhu0.dex
/data/data/####/a5zyFCEibZUiovbzumG4waxhqimXvhu0.dex.flock (deleted)
/data/data/####/aiTzSfhHZgjmpfAwzMxR2Y2csUM0ZqMy.dex
/data/data/####/aiTzSfhHZgjmpfAwzMxR2Y2csUM0ZqMy.dex.flock (deleted)
/data/data/####/avNq7A7bP6Oi5VcLUJK177wRvX2L7wP0.dex
/data/data/####/avNq7A7bP6Oi5VcLUJK177wRvX2L7wP0.dex.flock (deleted)
/data/data/####/bP7Hc6VCdBZCKhxxV3tz0DL9TfRuZKrp.dex
/data/data/####/bP7Hc6VCdBZCKhxxV3tz0DL9TfRuZKrp.dex.flock (deleted)
/data/data/####/base.apk.classes1.dex
/data/data/####/base.apk.classes1.dex.flock (deleted)
/data/data/####/base.apk.classes1.zip
/data/data/####/base.apk.classes2.dex
/data/data/####/base.apk.classes2.dex.flock (deleted)
/data/data/####/base.apk.classes2.zip
/data/data/####/base.apk.classes3.dex
/data/data/####/base.apk.classes3.dex.flock (deleted)
/data/data/####/base.apk.classes3.zip
/data/data/####/base.apk.classes4.dex
/data/data/####/base.apk.classes4.dex.flock (deleted)
/data/data/####/base.apk.classes4.zip
/data/data/####/bh09BBW40Rh9eAYOHB5gFUnfKz0Xnd7U.dex
/data/data/####/bh09BBW40Rh9eAYOHB5gFUnfKz0Xnd7U.dex.flock (deleted)
/data/data/####/du4i6Fx8yBDlNyLF85Zbfoql5jwqHY14.dex
/data/data/####/du4i6Fx8yBDlNyLF85Zbfoql5jwqHY14.dex.flock (deleted)
/data/data/####/fEi9JRIqSHVZUzzDpSz6hkssBQ4CGsde.dex
/data/data/####/fPWMVHSuExWwtPYQdZjfyql7WIVmtVLb.dex
/data/data/####/fPWMVHSuExWwtPYQdZjfyql7WIVmtVLb.dex.flock (deleted)
/data/data/####/fuTNJuV1NswymcTMhwJrvCPOobxSDU0K.dex
/data/data/####/fuTNJuV1NswymcTMhwJrvCPOobxSDU0K.dex.flock (deleted)
/data/data/####/g7qOxrqfFWhTmI0t4Fr1r9lV92VTiSe3.dex
/data/data/####/g7qOxrqfFWhTmI0t4Fr1r9lV92VTiSe3.dex.flock (deleted)
/data/data/####/hemkVYjiXEUX9ZOlkQip2IjryLFFqksl.dex
/data/data/####/hemkVYjiXEUX9ZOlkQip2IjryLFFqksl.dex.flock (deleted)
/data/data/####/hfKUzt1m7rYSxsFBzbewZUucMrMyyXhy.dex
/data/data/####/hfKUzt1m7rYSxsFBzbewZUucMrMyyXhy.dex.flock (deleted)
/data/data/####/hn6k1JWBPV7kTx2o6kT2Yxl85TFLaiHh.dex
/data/data/####/hn6k1JWBPV7kTx2o6kT2Yxl85TFLaiHh.dex.flock (deleted)
/data/data/####/hvWDweRgvdm5k1hTOFX94xbqQK4rT7hk.dex
/data/data/####/hvWDweRgvdm5k1hTOFX94xbqQK4rT7hk.dex.flock (deleted)
/data/data/####/iBu8G1cvRuYN1b07oa8YBC0dmKM7Q3o4.dex
/data/data/####/iBu8G1cvRuYN1b07oa8YBC0dmKM7Q3o4.dex.flock (deleted)
/data/data/####/iIbYlXqSL4zHZHk71gvVXcsL0oU8cih9.dex
/data/data/####/iIbYlXqSL4zHZHk71gvVXcsL0oU8cih9.dex.flock (deleted)
/data/data/####/ircOw0jW2ADndKQhzt4BOR8Af0BD0iOu.dex
/data/data/####/ircOw0jW2ADndKQhzt4BOR8Af0BD0iOu.dex.flock (deleted)
/data/data/####/jBanqG85ej9Uub4OHIt0tDbUFMgfdQIk.dex
/data/data/####/jBanqG85ej9Uub4OHIt0tDbUFMgfdQIk.dex.flock (deleted)
/data/data/####/jEbCQxqLc38yI96SKVF2WSMysArmbUi1.dex
/data/data/####/jEbCQxqLc38yI96SKVF2WSMysArmbUi1.dex.flock (deleted)
/data/data/####/jY8C78RmxkxXYYSyFlygLjdlgBhMDFzf.dex
/data/data/####/jY8C78RmxkxXYYSyFlygLjdlgBhMDFzf.dex.flock (deleted)
/data/data/####/ji40btLx3in87GTMOBRiovLuNDi35Ab1.dex
/data/data/####/ji40btLx3in87GTMOBRiovLuNDi35Ab1.dex.flock (deleted)
/data/data/####/jnwRZ3NmhzcCtTzPc7wc5pO5f2WEH7va.dex
/data/data/####/jnwRZ3NmhzcCtTzPc7wc5pO5f2WEH7va.dex.flock (deleted)
/data/data/####/kVFt6K2bNg9gwioQrrFHiZDmKIPKdpkF.dex
/data/data/####/kVFt6K2bNg9gwioQrrFHiZDmKIPKdpkF.dex.flock (deleted)
/data/data/####/lPHKlxULK2jWJeq2iXg4KI4xHffH0SDs.dex
/data/data/####/lPHKlxULK2jWJeq2iXg4KI4xHffH0SDs.dex.flock (deleted)
/data/data/####/lVepwrtnE8hDQ01LZ4QrVg0azuNQALVO.dex
/data/data/####/lVepwrtnE8hDQ01LZ4QrVg0azuNQALVO.dex.flock (deleted)
/data/data/####/lgkUt9HZqse6tOIBCBkww8IUXato2LGs.dex
/data/data/####/lgkUt9HZqse6tOIBCBkww8IUXato2LGs.dex.flock (deleted)
/data/data/####/lxmYFAUB3aE7FOzliqS5K9kQEHYDuUpY.dex
/data/data/####/lxmYFAUB3aE7FOzliqS5K9kQEHYDuUpY.dex.flock (deleted)
/data/data/####/mI2aFxI8pzob9B4F9lVVfhmp3H9TkBiR.dex
/data/data/####/mI2aFxI8pzob9B4F9lVVfhmp3H9TkBiR.dex.flock (deleted)
/data/data/####/mRQpH79Sr05K4Y3cRuZLabJmeBIMSHtc.dex
/data/data/####/mRQpH79Sr05K4Y3cRuZLabJmeBIMSHtc.dex.flock (deleted)
/data/data/####/mZoFXYgH0VuT6WLfZ1ilBAxMB0pETqkJ.dex
/data/data/####/mZoFXYgH0VuT6WLfZ1ilBAxMB0pETqkJ.dex.flock (deleted)
/data/data/####/multidex.version.xml
/data/data/####/oKkfT4CJpvM6vVtlusSKAFCXu6JVJx7n.dex
/data/data/####/oKkfT4CJpvM6vVtlusSKAFCXu6JVJx7n.dex.flock (deleted)
/data/data/####/pTuX7iPjNyxUBnnSFIxX98k05CrHEYZh.dex
/data/data/####/pTuX7iPjNyxUBnnSFIxX98k05CrHEYZh.dex.flock (deleted)
/data/data/####/proc_auxv
/data/data/####/qGdBaHrDX3upsOA8bDdM0Y1pWv6BYtlT.dex
/data/data/####/qGdBaHrDX3upsOA8bDdM0Y1pWv6BYtlT.dex.flock (deleted)
/data/data/####/qHJ6Lucmk1J2X1f6q00EwnUfI9D0sGL1.dex
/data/data/####/qHJ6Lucmk1J2X1f6q00EwnUfI9D0sGL1.dex.flock (deleted)
/data/data/####/qNty3GGy9rygMG5MmiN1SfQhIj8YLE9T.dex
/data/data/####/qNty3GGy9rygMG5MmiN1SfQhIj8YLE9T.dex.flock (deleted)
/data/data/####/qhIAvTICMy1k2VFyc8ez1VZmQyih2YVr.dex
/data/data/####/qhIAvTICMy1k2VFyc8ez1VZmQyih2YVr.dex.flock (deleted)
/data/data/####/rN8gDVgLuz17kLSslUQhg40KxwPWEqxM.dex
/data/data/####/rN8gDVgLuz17kLSslUQhg40KxwPWEqxM.dex.flock (deleted)
/data/data/####/rP8q9jOWpSBU9u2v3aAg07S4xUkvvtH1.dex
/data/data/####/rP8q9jOWpSBU9u2v3aAg07S4xUkvvtH1.dex.flock (deleted)
/data/data/####/rVIDJuxTQ14iR7PcK3Mw1pLdvMLRC0cM.dex
/data/data/####/rVIDJuxTQ14iR7PcK3Mw1pLdvMLRC0cM.dex.flock (deleted)
/data/data/####/s2ta4olxgh5wUXHk5z4zsmxDeAOECRhq.dex
/data/data/####/s2ta4olxgh5wUXHk5z4zsmxDeAOECRhq.dex.flock (deleted)
/data/data/####/tmp-base.apk.classes1036341319.zip
/data/data/####/tmp-base.apk.classes1049598786.zip
/data/data/####/tmp-base.apk.classes1072477067.zip
/data/data/####/tmp-base.apk.classes1078514732.zip
/data/data/####/tmp-base.apk.classes1084962946.zip
/data/data/####/tmp-base.apk.classes1107723095.zip
/data/data/####/tmp-base.apk.classes1120308526.zip
/data/data/####/tmp-base.apk.classes1131034734.zip
/data/data/####/tmp-base.apk.classes1173225475.zip
/data/data/####/tmp-base.apk.classes1177134428.zip
/data/data/####/tmp-base.apk.classes12139747.zip
/data/data/####/tmp-base.apk.classes1214760338.zip
/data/data/####/tmp-base.apk.classes1249903597.zip
/data/data/####/tmp-base.apk.classes1263869125.zip
/data/data/####/tmp-base.apk.classes1284158823.zip
/data/data/####/tmp-base.apk.classes1291981957.zip
/data/data/####/tmp-base.apk.classes1320800027.zip
/data/data/####/tmp-base.apk.classes1353074630.zip
/data/data/####/tmp-base.apk.classes1359244799.zip
/data/data/####/tmp-base.apk.classes1375817013.zip
/data/data/####/tmp-base.apk.classes138404230.zip
/data/data/####/tmp-base.apk.classes1385879002.zip
/data/data/####/tmp-base.apk.classes1405384743.zip
/data/data/####/tmp-base.apk.classes1437314216.zip
/data/data/####/tmp-base.apk.classes1462409703.zip
/data/data/####/tmp-base.apk.classes1472064253.zip
/data/data/####/tmp-base.apk.classes1489685234.zip
/data/data/####/tmp-base.apk.classes1508954713.zip
/data/data/####/tmp-base.apk.classes1509972875.zip
/data/data/####/tmp-base.apk.classes1515392241.zip
/data/data/####/tmp-base.apk.classes1515911524.zip
/data/data/####/tmp-base.apk.classes1521798311.zip
/data/data/####/tmp-base.apk.classes152744950.zip
/data/data/####/tmp-base.apk.classes1554966466.zip
/data/data/####/tmp-base.apk.classes156110127.zip
/data/data/####/tmp-base.apk.classes1564064864.zip
/data/data/####/tmp-base.apk.classes1577454803.zip
/data/data/####/tmp-base.apk.classes1599471046.zip
/data/data/####/tmp-base.apk.classes1599855787.zip
/data/data/####/tmp-base.apk.classes1624699931.zip
/data/data/####/tmp-base.apk.classes1659659028.zip
/data/data/####/tmp-base.apk.classes1681766685.zip
/data/data/####/tmp-base.apk.classes169367346.zip
/data/data/####/tmp-base.apk.classes1695630805.zip
/data/data/####/tmp-base.apk.classes1698099763.zip
/data/data/####/tmp-base.apk.classes1716365206.zip
/data/data/####/tmp-base.apk.classes1721563786.zip
/data/data/####/tmp-base.apk.classes1743665543.zip
/data/data/####/tmp-base.apk.classes1784547816.zip
/data/data/####/tmp-base.apk.classes1809125553.zip
/data/data/####/tmp-base.apk.classes1827108391.zip
/data/data/####/tmp-base.apk.classes1827206638.zip
/data/data/####/tmp-base.apk.classes1831230975.zip
/data/data/####/tmp-base.apk.classes1840931767.zip
/data/data/####/tmp-base.apk.classes1841448219.zip
/data/data/####/tmp-base.apk.classes1845828016.zip
/data/data/####/tmp-base.apk.classes1846510824.zip
/data/data/####/tmp-base.apk.classes1881040048.zip
/data/data/####/tmp-base.apk.classes1882470433.zip
/data/data/####/tmp-base.apk.classes1893552204.zip
/data/data/####/tmp-base.apk.classes1906508242.zip
/data/data/####/tmp-base.apk.classes1926010590.zip
/data/data/####/tmp-base.apk.classes1926084005.zip
/data/data/####/tmp-base.apk.classes195426518.zip
/data/data/####/tmp-base.apk.classes1964142772.zip
/data/data/####/tmp-base.apk.classes1984227874.zip
/data/data/####/tmp-base.apk.classes2010420303.zip
/data/data/####/tmp-base.apk.classes2010568071.zip
/data/data/####/tmp-base.apk.classes2012223717.zip
/data/data/####/tmp-base.apk.classes2024157295.zip
/data/data/####/tmp-base.apk.classes2036060168.zip
/data/data/####/tmp-base.apk.classes2038159861.zip
/data/data/####/tmp-base.apk.classes2039736473.zip
/data/data/####/tmp-base.apk.classes2056037801.zip
/data/data/####/tmp-base.apk.classes205848388.zip
/data/data/####/tmp-base.apk.classes2060004924.zip
/data/data/####/tmp-base.apk.classes2115634886.zip
/data/data/####/tmp-base.apk.classes2123220901.zip
/data/data/####/tmp-base.apk.classes2135597009.zip
/data/data/####/tmp-base.apk.classes2145984475.zip
/data/data/####/tmp-base.apk.classes270894237.zip
/data/data/####/tmp-base.apk.classes30395526.zip
/data/data/####/tmp-base.apk.classes316301413.zip
/data/data/####/tmp-base.apk.classes325482608.zip
/data/data/####/tmp-base.apk.classes340587089.zip
/data/data/####/tmp-base.apk.classes34806231.zip
/data/data/####/tmp-base.apk.classes356659001.zip
/data/data/####/tmp-base.apk.classes379308001.zip
/data/data/####/tmp-base.apk.classes383397447.zip
/data/data/####/tmp-base.apk.classes394528639.zip
/data/data/####/tmp-base.apk.classes399385046.zip
/data/data/####/tmp-base.apk.classes402851674.zip
/data/data/####/tmp-base.apk.classes416826636.zip
/data/data/####/tmp-base.apk.classes459303989.zip
/data/data/####/tmp-base.apk.classes469588705.zip
/data/data/####/tmp-base.apk.classes470901642.zip
/data/data/####/tmp-base.apk.classes481305187.zip
/data/data/####/tmp-base.apk.classes489724630.zip
/data/data/####/tmp-base.apk.classes524413114.zip
/data/data/####/tmp-base.apk.classes542209781.zip
/data/data/####/tmp-base.apk.classes545125885.zip
/data/data/####/tmp-base.apk.classes613342208.zip
/data/data/####/tmp-base.apk.classes617799163.zip
/data/data/####/tmp-base.apk.classes625100303.zip
/data/data/####/tmp-base.apk.classes627722663.zip
/data/data/####/tmp-base.apk.classes630798990.zip
/data/data/####/tmp-base.apk.classes631472588.zip
/data/data/####/tmp-base.apk.classes664248820.zip
/data/data/####/tmp-base.apk.classes665259274.zip
/data/data/####/tmp-base.apk.classes673340233.zip
/data/data/####/tmp-base.apk.classes706805326.zip
/data/data/####/tmp-base.apk.classes726839529.zip
/data/data/####/tmp-base.apk.classes731171157.zip
/data/data/####/tmp-base.apk.classes734870762.zip
/data/data/####/tmp-base.apk.classes747443678.zip
/data/data/####/tmp-base.apk.classes763562852.zip
/data/data/####/tmp-base.apk.classes782012631.zip
/data/data/####/tmp-base.apk.classes799152403.zip
/data/data/####/tmp-base.apk.classes802758506.zip
/data/data/####/tmp-base.apk.classes809880747.zip
/data/data/####/tmp-base.apk.classes811450391.zip
/data/data/####/tmp-base.apk.classes813875739.zip
/data/data/####/tmp-base.apk.classes822753543.zip
/data/data/####/tmp-base.apk.classes832703445.zip
/data/data/####/tmp-base.apk.classes834331208.zip
/data/data/####/tmp-base.apk.classes864454002.zip
/data/data/####/tmp-base.apk.classes869916900.zip
/data/data/####/tmp-base.apk.classes892719347.zip
/data/data/####/tmp-base.apk.classes930731572.zip
/data/data/####/tmp-base.apk.classes932278696.zip
/data/data/####/tmp-base.apk.classes948131420.zip
/data/data/####/tmp-base.apk.classes968979405.zip
/data/data/####/w04Wehv0eCLtnBlBcbvWm22XSzsR0tlz.dex
/data/data/####/w04Wehv0eCLtnBlBcbvWm22XSzsR0tlz.dex.flock (deleted)
/data/data/####/w1Sca7RfYs4XQurWbFCgXPeResR5y29y.dex
/data/data/####/w1Sca7RfYs4XQurWbFCgXPeResR5y29y.dex.flock (deleted)
/data/data/####/w35Cxf52gq6K3uSulGeSyjAdElfPVNu0.dex
/data/data/####/w35Cxf52gq6K3uSulGeSyjAdElfPVNu0.dex.flock (deleted)
/data/data/####/xFlFQapv8Y8UgXh8ej0OrQcPXmrOuaG1.dex
/data/data/####/xFlFQapv8Y8UgXh8ej0OrQcPXmrOuaG1.dex.flock (deleted)
/data/data/####/xcQyguEb1LIfJ16gmftRD9Y46MLMpVbg.dex
/data/data/####/xcQyguEb1LIfJ16gmftRD9Y46MLMpVbg.dex.flock (deleted)
/data/data/####/y6bKKBwNuJoij1GhL8GFWMaZizdl5Arf.dex
/data/data/####/y6bKKBwNuJoij1GhL8GFWMaZizdl5Arf.dex.flock (deleted)
/data/data/####/yquvlIv2Uj9UaCpz3uGFOk1mLqQ3mPqn.dex
/data/data/####/yquvlIv2Uj9UaCpz3uGFOk1mLqQ3mPqn.dex.flock (deleted)
/data/data/####/zDcdL8wnMzi8ynZ7kDGRQTfDE52kh0c2.dex
/data/data/####/zDcdL8wnMzi8ynZ7kDGRQTfDE52kh0c2.dex.flock (deleted)
/data/data/####/zaJvfLqX232GorWumzJguYb4Vt6jiXvt.dex
/data/data/####/zaJvfLqX232GorWumzJguYb4Vt6jiXvt.dex.flock (deleted)

Другие:

Запускает следующие shell-скрипты:

rm -r/data/user/0/<Package>/app_ded/15KRmfDmpj72mX7t24AsHyiEs1KpEcHv.dex
rm -r/data/user/0/<Package>/app_ded/17MHA8raYkH2occ3bgdBvoD5ptPVtVdL.dex
rm -r/data/user/0/<Package>/app_ded/1hsGGTrbPCrT9r7xZ6AN0zPMIHEGWLcQ.dex
rm -r/data/user/0/<Package>/app_ded/1lReSo52zEiA9rV4umHAQAR3ZY57mHFQ.dex
rm -r/data/user/0/<Package>/app_ded/1x6TmTFyzDATAy24w2ikO8EC6qKb2pVQ.dex
rm -r/data/user/0/<Package>/app_ded/2h4d8wgKDNM8ZyjWgzeh2UPVTgrZh8Kp.dex
rm -r/data/user/0/<Package>/app_ded/3KnhTlyxx8Ga4QU7Gqw2NWz7TjBTV42G.dex
rm -r/data/user/0/<Package>/app_ded/4jDBJAF1GYYhV2hX6pb2PLQJINM5ynKp.dex
rm -r/data/user/0/<Package>/app_ded/53ygp0yNP2P7Y9kG3RhvUJwy0OLqyxDa.dex
rm -r/data/user/0/<Package>/app_ded/5VGn4THNw0IBzHK1BxdhjZ2l2PHsi09c.dex
rm -r/data/user/0/<Package>/app_ded/5uKOhSp3LnELY7xLl2Hab4fXv7OqHntx.dex
rm -r/data/user/0/<Package>/app_ded/6sFw8UyrS95pZAHKX7XLwS1dhzcyGD4E.dex
rm -r/data/user/0/<Package>/app_ded/76rXWWcJanfPCAtwTlMfMOaDMEo3ddTD.dex
rm -r/data/user/0/<Package>/app_ded/7htcTpI3syeMHcKH2lKMkUaFIULDmHJQ.dex
rm -r/data/user/0/<Package>/app_ded/85ZwX0IeVHy1xi3y0s5368crKnStmNVj.dex
rm -r/data/user/0/<Package>/app_ded/8UsNMpJPS3hjJlUH4UavQD9y57kViBnP.dex
rm -r/data/user/0/<Package>/app_ded/8jhBXEtYlQJNxu1NaGTKpwW86oWGuORX.dex
rm -r/data/user/0/<Package>/app_ded/92O7SwY8R5ulDHFFO9feCn90DCbnYTWG.dex
rm -r/data/user/0/<Package>/app_ded/9embyz03j3I1ciAX0jdpBt2Pdz6oAqrJ.dex
rm -r/data/user/0/<Package>/app_ded/A6EFTYQ0DwKna9RvBBDhTd2Qh9BJ8ykb.dex
rm -r/data/user/0/<Package>/app_ded/AgUuIcaEzkYkPzt7Fx2cc8RaJVofbjdn.dex
rm -r/data/user/0/<Package>/app_ded/AllMszn35uHcbsK24755jVGCXUNY56lT.dex
rm -r/data/user/0/<Package>/app_ded/BI8ZZEV0lr9tmMuvC2SNlLBH9UbLgjNK.dex
rm -r/data/user/0/<Package>/app_ded/Bm8EFWO713AY9R3kMRoi7DuDVR2t14Qz.dex
rm -r/data/user/0/<Package>/app_ded/DuYKDIWTWv1J7ZmNGy06VaUnYvAdVJc9.dex
rm -r/data/user/0/<Package>/app_ded/F2qyVqlAXUl0TmyuTuIB2Ox2B6SG2AtK.dex
rm -r/data/user/0/<Package>/app_ded/FKN9ZksQTTe5WmJMtBiAfvoUa0EyNoRl.dex
rm -r/data/user/0/<Package>/app_ded/FRZb2tLHgaFkvBIraMWvXfwVNKqDYmn7.dex
rm -r/data/user/0/<Package>/app_ded/GxaLEM81eYf8H2b4RsiB2dgQHdRMXBjC.dex
rm -r/data/user/0/<Package>/app_ded/HnSsvQmXjiZ2yS4tdK3TAKrHd4vO9E4n.dex
rm -r/data/user/0/<Package>/app_ded/JCfFUdtStNDnOZROZbtb0Sv9FVbhuy6F.dex
rm -r/data/user/0/<Package>/app_ded/KCxfylDsp5oJUQRgoXzCMK4IANuMgzhL.dex
rm -r/data/user/0/<Package>/app_ded/Kg3EIrZkhrV6i9fQdPWBMIPjpEKCpwmM.dex
rm -r/data/user/0/<Package>/app_ded/Ksr9BeaBU7Rb1fC9aeSrVqnan7qqm7eu.dex
rm -r/data/user/0/<Package>/app_ded/Lrlvb4FS1ftvVND5wZgddKwKPPOfdB1O.dex
rm -r/data/user/0/<Package>/app_ded/M0HGLu0uC4DxENWbVfSwZ0iyhv0Efs6L.dex
rm -r/data/user/0/<Package>/app_ded/My8jII8R7C07ljxlCjrWCvJOkz33GCfy.dex
rm -r/data/user/0/<Package>/app_ded/N6s0Vnscu0s0BunqcMbBR9MERBdis04E.dex
rm -r/data/user/0/<Package>/app_ded/NLSK7dreDh52ixO9h6NARUYsQOJNKwYx.dex
rm -r/data/user/0/<Package>/app_ded/NOmEgm87S3VgnYcivbHcOFpTauKDpi8O.dex
rm -r/data/user/0/<Package>/app_ded/NtrW3dNMk5wXpfWKdjdEHOV5PXrTAX06.dex
rm -r/data/user/0/<Package>/app_ded/OFKM8KjcR8ZmX8wMqPS0WSxcjGhmRSI9.dex
rm -r/data/user/0/<Package>/app_ded/P1QAx6PLJEnRj3oJM7pCwBGhAfg29p2l.dex
rm -r/data/user/0/<Package>/app_ded/PD7pBXN0pSYfMJ88a9jrI26hkfK70yYT.dex
rm -r/data/user/0/<Package>/app_ded/PkGzUMiPJVnzRzeRNUmy4whYVD8z8HQ3.dex
rm -r/data/user/0/<Package>/app_ded/QMV5kc0BX26ZG2Z4SlS95hLNvXtUqJJW.dex
rm -r/data/user/0/<Package>/app_ded/SE4aqCB702DCqkcLMxI6HO3TA2ukbCTX.dex
rm -r/data/user/0/<Package>/app_ded/SIkOjcKqJGox3h60DdwkHpGwEYTtz9m2.dex
rm -r/data/user/0/<Package>/app_ded/SXvma7RhR3fvBRhZTTLO2k2PAgGkZwlV.dex
rm -r/data/user/0/<Package>/app_ded/SYLyQj5hGSZFGDqgTTUktbrMd74QIv76.dex
rm -r/data/user/0/<Package>/app_ded/Sy8waaEBnMVJAL9frqQNLp3UA1Zp3bQv.dex
rm -r/data/user/0/<Package>/app_ded/T5WpCAjJzrCvjCzVJkqR2DDZ5E4uNa95.dex
rm -r/data/user/0/<Package>/app_ded/UUtTed3mkDgM498URbL9tRHLlVpvcTvE.dex
rm -r/data/user/0/<Package>/app_ded/V2JcfUCj1asxwpHNp2vTVVmthxvcApa1.dex
rm -r/data/user/0/<Package>/app_ded/VD7UHA7K36TrqY3kkBewEI4QyxDPYY5x.dex
rm -r/data/user/0/<Package>/app_ded/Wg1W20FdnmBa9FeelZsjxBIYAVOv8E75.dex
rm -r/data/user/0/<Package>/app_ded/WgUfHyTqiDIOd33GmO3Tim2ZmKmOtjpl.dex
rm -r/data/user/0/<Package>/app_ded/X6uX1jP6IbgmpQGSg8E7ux7SGJxkIiKn.dex
rm -r/data/user/0/<Package>/app_ded/YG0abRZRQbrWAxwvTnEe05NfmpGlqRi8.dex
rm -r/data/user/0/<Package>/app_ded/Z1LkdgtXCVWVJ0Y8OwlqF3Iah1iQjwdp.dex
rm -r/data/user/0/<Package>/app_ded/a5zyFCEibZUiovbzumG4waxhqimXvhu0.dex
rm -r/data/user/0/<Package>/app_ded/aiTzSfhHZgjmpfAwzMxR2Y2csUM0ZqMy.dex
rm -r/data/user/0/<Package>/app_ded/avNq7A7bP6Oi5VcLUJK177wRvX2L7wP0.dex
rm -r/data/user/0/<Package>/app_ded/bP7Hc6VCdBZCKhxxV3tz0DL9TfRuZKrp.dex
rm -r/data/user/0/<Package>/app_ded/bh09BBW40Rh9eAYOHB5gFUnfKz0Xnd7U.dex
rm -r/data/user/0/<Package>/app_ded/du4i6Fx8yBDlNyLF85Zbfoql5jwqHY14.dex
rm -r/data/user/0/<Package>/app_ded/fEi9JRIqSHVZUzzDpSz6hkssBQ4CGsde.dex
rm -r/data/user/0/<Package>/app_ded/fPWMVHSuExWwtPYQdZjfyql7WIVmtVLb.dex
rm -r/data/user/0/<Package>/app_ded/fuTNJuV1NswymcTMhwJrvCPOobxSDU0K.dex
rm -r/data/user/0/<Package>/app_ded/g7qOxrqfFWhTmI0t4Fr1r9lV92VTiSe3.dex
rm -r/data/user/0/<Package>/app_ded/hemkVYjiXEUX9ZOlkQip2IjryLFFqksl.dex
rm -r/data/user/0/<Package>/app_ded/hfKUzt1m7rYSxsFBzbewZUucMrMyyXhy.dex
rm -r/data/user/0/<Package>/app_ded/hn6k1JWBPV7kTx2o6kT2Yxl85TFLaiHh.dex
rm -r/data/user/0/<Package>/app_ded/hvWDweRgvdm5k1hTOFX94xbqQK4rT7hk.dex
rm -r/data/user/0/<Package>/app_ded/iBu8G1cvRuYN1b07oa8YBC0dmKM7Q3o4.dex
rm -r/data/user/0/<Package>/app_ded/iIbYlXqSL4zHZHk71gvVXcsL0oU8cih9.dex
rm -r/data/user/0/<Package>/app_ded/ircOw0jW2ADndKQhzt4BOR8Af0BD0iOu.dex
rm -r/data/user/0/<Package>/app_ded/jBanqG85ej9Uub4OHIt0tDbUFMgfdQIk.dex
rm -r/data/user/0/<Package>/app_ded/jEbCQxqLc38yI96SKVF2WSMysArmbUi1.dex
rm -r/data/user/0/<Package>/app_ded/jY8C78RmxkxXYYSyFlygLjdlgBhMDFzf.dex
rm -r/data/user/0/<Package>/app_ded/ji40btLx3in87GTMOBRiovLuNDi35Ab1.dex
rm -r/data/user/0/<Package>/app_ded/jnwRZ3NmhzcCtTzPc7wc5pO5f2WEH7va.dex
rm -r/data/user/0/<Package>/app_ded/kVFt6K2bNg9gwioQrrFHiZDmKIPKdpkF.dex
rm -r/data/user/0/<Package>/app_ded/lPHKlxULK2jWJeq2iXg4KI4xHffH0SDs.dex
rm -r/data/user/0/<Package>/app_ded/lVepwrtnE8hDQ01LZ4QrVg0azuNQALVO.dex
rm -r/data/user/0/<Package>/app_ded/lgkUt9HZqse6tOIBCBkww8IUXato2LGs.dex
rm -r/data/user/0/<Package>/app_ded/lxmYFAUB3aE7FOzliqS5K9kQEHYDuUpY.dex
rm -r/data/user/0/<Package>/app_ded/mI2aFxI8pzob9B4F9lVVfhmp3H9TkBiR.dex
rm -r/data/user/0/<Package>/app_ded/mRQpH79Sr05K4Y3cRuZLabJmeBIMSHtc.dex
rm -r/data/user/0/<Package>/app_ded/mZoFXYgH0VuT6WLfZ1ilBAxMB0pETqkJ.dex
rm -r/data/user/0/<Package>/app_ded/oKkfT4CJpvM6vVtlusSKAFCXu6JVJx7n.dex
rm -r/data/user/0/<Package>/app_ded/pTuX7iPjNyxUBnnSFIxX98k05CrHEYZh.dex
rm -r/data/user/0/<Package>/app_ded/qGdBaHrDX3upsOA8bDdM0Y1pWv6BYtlT.dex
rm -r/data/user/0/<Package>/app_ded/qHJ6Lucmk1J2X1f6q00EwnUfI9D0sGL1.dex
rm -r/data/user/0/<Package>/app_ded/qNty3GGy9rygMG5MmiN1SfQhIj8YLE9T.dex
rm -r/data/user/0/<Package>/app_ded/qhIAvTICMy1k2VFyc8ez1VZmQyih2YVr.dex
rm -r/data/user/0/<Package>/app_ded/rN8gDVgLuz17kLSslUQhg40KxwPWEqxM.dex
rm -r/data/user/0/<Package>/app_ded/rP8q9jOWpSBU9u2v3aAg07S4xUkvvtH1.dex
rm -r/data/user/0/<Package>/app_ded/rVIDJuxTQ14iR7PcK3Mw1pLdvMLRC0cM.dex
rm -r/data/user/0/<Package>/app_ded/s2ta4olxgh5wUXHk5z4zsmxDeAOECRhq.dex
rm -r/data/user/0/<Package>/app_ded/w04Wehv0eCLtnBlBcbvWm22XSzsR0tlz.dex
rm -r/data/user/0/<Package>/app_ded/w1Sca7RfYs4XQurWbFCgXPeResR5y29y.dex
rm -r/data/user/0/<Package>/app_ded/w35Cxf52gq6K3uSulGeSyjAdElfPVNu0.dex
rm -r/data/user/0/<Package>/app_ded/xFlFQapv8Y8UgXh8ej0OrQcPXmrOuaG1.dex
rm -r/data/user/0/<Package>/app_ded/xcQyguEb1LIfJ16gmftRD9Y46MLMpVbg.dex
rm -r/data/user/0/<Package>/app_ded/y6bKKBwNuJoij1GhL8GFWMaZizdl5Arf.dex
rm -r/data/user/0/<Package>/app_ded/yquvlIv2Uj9UaCpz3uGFOk1mLqQ3mPqn.dex
rm -r/data/user/0/<Package>/app_ded/zDcdL8wnMzi8ynZ7kDGRQTfDE52kh0c2.dex
rm -r/data/user/0/<Package>/app_ded/zaJvfLqX232GorWumzJguYb4Vt6jiXvt.dex

Загружает динамические библиотеки:

libdasqin

Использует следующие алгоритмы для расшифровки данных:

AES
AES-ECB-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байт-кода.

Имеет подозрительные повреждения, типичные для вредоносных файлов.

Пытается определить окружение песочницы.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней