Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Locker.1561.origin
Сетевая активность:
Подключается к:
- UDP(???) acco####.go####.com:443
- UDP(???) googl####.g.doublec####.net:443
- UDP(???) f####.gst####.com:443
- UDP(???) www.you####.com:443
- UDP(???) m.you####.com:443
- UDP(???) content####.google####.com:443
- UDP(???) i.y####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) content####.google####.com:443
- TCP(TLS/1.0) i.y####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) gst####.com:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) www.you####.com:443
- TCP(TLS/1.0) m.you####.com:443
- TCP(TLS/1.0) st####.doublec####.net:443
Запросы DNS:
- acco####.go####.com
- clients####.google####.com
- content####.google####.com
- ed####.me.g####.com
- f####.gst####.com
- googl####.g.doublec####.net
- gst####.com
- i.y####.com
- m.you####.com
- st####.doublec####.net
- up####.google####.com
- www.go####.com
- www.gst####.com
- www.you####.com
Изменения в файловой системе:
Создает следующие файлы:
- /app_webview/BrowserMetrics/BrowserMetrics-6A641D44-C80.pma (deleted)
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/Databases.db
- /app_webview/Default/####/Databases.db-journal
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/QuotaManager
- /app_webview/Default/QuotaManager-journal
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /cache/WebView/####/f0db537070bd0e92_0
- /data/data/####/.org.chromium.Chromium.2tBuOj (deleted)
- /data/data/####/.org.chromium.Chromium.EAUURU
- /data/data/####/.org.chromium.Chromium.pwPJSp
- /data/data/####/000001.dbtmp
- /data/data/####/016f8f8d2dca0cd6_0
- /data/data/####/02d07c1cb4be05e2_0
- /data/data/####/068a150d8fa1c0c1_0
- /data/data/####/06c49d2fa0ad4bcd_0
- /data/data/####/0b3bd81b114681fa_0
- /data/data/####/0daf4bb389aa1f6b_0
- /data/data/####/0fc2a893360f8d92_0
- /data/data/####/10235a0475594b61_0
- /data/data/####/113c3fe2a5c6469b_0
- /data/data/####/165fcc1a116db3fe_0
- /data/data/####/179872ac4492afa0_0
- /data/data/####/18e8e3fcce8897c6_0
- /data/data/####/1ec48e5a645df45a_0
- /data/data/####/22d7371a8c551ece_0
- /data/data/####/23e6e2574cfed390_0
- /data/data/####/2605dabe6db345f1_0
- /data/data/####/2605dabe6db345f1_s
- /data/data/####/2755a3add97dee31_0
- /data/data/####/290a47f397ca87e0_0
- /data/data/####/2c2bf9feb74f8316_0
- /data/data/####/2e95109a9d24df25_0
- /data/data/####/2f67a4237d07aea7_0
- /data/data/####/3084a14fbb8518d2_0
- /data/data/####/3107558eea9ba321_0
- /data/data/####/3279fab3f18fa839_0
- /data/data/####/34647102f13bd201_0
- /data/data/####/3486bc9c0a5135ca_0
- /data/data/####/375db0c2ac836167_0
- /data/data/####/383152c2a19b4e8f_0
- /data/data/####/38c4d455397a6318_0
- /data/data/####/3a84ba1184e51806_0
- /data/data/####/3b8f736f150f895f_0
- /data/data/####/40957c0ca78bd5d4_0
- /data/data/####/43d377ea9fa44c05_0
- /data/data/####/44fdad3a201128f8_0
- /data/data/####/46bc3149eadc0bd3_0
- /data/data/####/4a4613e96457dba0_0
- /data/data/####/4b7fd321030fcc17_0
- /data/data/####/4d53af58bf8f4a20_0
- /data/data/####/4f984f577e10252c_0
- /data/data/####/566a4c198915aae0_0
- /data/data/####/57976939f24b399a_0
- /data/data/####/57996f0e277d286a_0
- /data/data/####/5b404a04f7e95655_0
- /data/data/####/5cf133f80081fa72_0
- /data/data/####/5db7af23e33c0c27_0
- /data/data/####/63f34f26a414a9e7_0
- /data/data/####/6594c48635a2827f_0
- /data/data/####/66af87fd1164f81b_0
- /data/data/####/6b7efb9015d090a8_0
- /data/data/####/6b991611054a2e9f_0
- /data/data/####/6da74487d5e22277_0
- /data/data/####/6ecff411ebdd076c_0
- /data/data/####/6ecff411ebdd076c_s
- /data/data/####/7a9a87b7f0b5b4d6_0
- /data/data/####/7b84a63cde266abc_0
- /data/data/####/7eb5927ba96812f3_0
- /data/data/####/8059ab2dc6262984_0
- /data/data/####/81cd206aec6a5b31_0
- /data/data/####/822828db7e624e87_0
- /data/data/####/876829f3ab4350de_0
- /data/data/####/894151690903a4cf_0
- /data/data/####/8ab4bfc157c68e03_0
- /data/data/####/8b74f42ca7f9d4ce_0
- /data/data/####/8cc1735fd5384541_0
- /data/data/####/8fe704abb7b155b8_0
- /data/data/####/92f3fbe0cc645cda_0
- /data/data/####/94ff05448dcc1e88_0
- /data/data/####/97de5abfe883dbcf_0
- /data/data/####/98d5ca85ac0e55f9_0
- /data/data/####/9f53df6e1ea07485_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/Cookies-journal
- /data/data/####/LOCK
- /data/data/####/LOG
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a4b3b8c09b589267_0
- /data/data/####/a8d32f6c6ab8fb7e_0
- /data/data/####/aacc86440df2d7e7_0
- /data/data/####/ac4be60b26fb5511_0
- /data/data/####/ac934598e1fcd018_0
- /data/data/####/ade4aea8dda20890_0
- /data/data/####/ae78c7d679de7856_0
- /data/data/####/ae7c7d49e53dbdf9_0
- /data/data/####/affd53249db46476_0
- /data/data/####/b0456dd2e74ac449_0
- /data/data/####/b152edbbb3f9ce1b_0
- /data/data/####/b2141b088ee5e98c_0
- /data/data/####/b3f87b55d8dbfa47_0
- /data/data/####/b52df7de6f8c13ea_0
- /data/data/####/b924469dce8b9a89_0
- /data/data/####/bad2061f4b39c627_0
- /data/data/####/bb24e8cb1b7404e6_0
- /data/data/####/bbb4a09f4ec75040_0
- /data/data/####/bcce36bf763749f1_0
- /data/data/####/c01c3521f74474f6_0
- /data/data/####/c01c3521f74474f6_s
- /data/data/####/c168b9359aadfc31_0
- /data/data/####/c8f1d7cfbef30cc4_0
- /data/data/####/cc0192b0ff9d1148_0
- /data/data/####/cde968a267e2506f_0
- /data/data/####/d3d3117da1954c11_0
- /data/data/####/d463bf383609120f_0
- /data/data/####/d57fe2c6b1537486_0
- /data/data/####/d70101caa587a552_0
- /data/data/####/d9c11c411f175c45_0
- /data/data/####/d9e32b08f2890562_0
- /data/data/####/dcdbfc17f14e67d9_0
- /data/data/####/e00a14b7237f316a_0
- /data/data/####/e473655d92074272_0
- /data/data/####/e615f0381b03f986_0
- /data/data/####/e6f0739a95f4caab_0
- /data/data/####/e7bc07ee5b01ed4b_0
- /data/data/####/e86e7671a29e87b4_0
- /data/data/####/e8f209bb953d0431_0
- /data/data/####/ea8757ff56f6c660_0
- /data/data/####/ea8757ff56f6c660_s
- /data/data/####/ea8e2ee83e5f58aa_0
- /data/data/####/eb879885b32032b7_0
- /data/data/####/f5cf31a8c1542a56_0
- /data/data/####/f7d87e9c65f44131_0
- /data/data/####/fad7b2239e784870_0
- /data/data/####/fc4f3470600a378b_0
- /data/data/####/fcb5e6b82b1cb827_0
- /data/data/####/fd6dea090b146684_0
- /data/data/####/fdd89d27c13f85e5_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/gUXLfheCXOmmzE.dex (deleted)
- /data/data/####/gUXLfheCXOmmzE.dex.cur.prof
- /data/data/####/gUXLfheCXOmmzE.vdex
- /data/data/####/index
- /data/data/####/index.txt
- /data/data/####/index.txt.tmp
- /data/data/####/invYBFLS.dex
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_016f8f8d2dca0cd6_0_1 (deleted)
- /data/data/####/todelete_06c49d2fa0ad4bcd_0_1 (deleted)
- /data/data/####/todelete_0b3bd81b114681fa_0_1 (deleted)
- /data/data/####/todelete_179872ac4492afa0_0_1 (deleted)
- /data/data/####/todelete_1850276ebc2ba69c_0_1 (deleted)
- /data/data/####/todelete_233d6a3236b82bc6_0_1 (deleted)
- /data/data/####/todelete_26975a554102da88_0_1 (deleted)
- /data/data/####/todelete_3107558eea9ba321_0_1 (deleted)
- /data/data/####/todelete_3279fab3f18fa839_0_1 (deleted)
- /data/data/####/todelete_375db0c2ac836167_0_1 (deleted)
- /data/data/####/todelete_383152c2a19b4e8f_0_1 (deleted)
- /data/data/####/todelete_44fdad3a201128f8_0_1 (deleted)
- /data/data/####/todelete_51baa3d5660a106a_0_1 (deleted)
- /data/data/####/todelete_5212eac1492a2e4c_0_1 (deleted)
- /data/data/####/todelete_56f5fa1d6a22e26f_0_1 (deleted)
- /data/data/####/todelete_57976939f24b399a_0_1 (deleted)
- /data/data/####/todelete_69d885c11e67b64f_0_1 (deleted)
- /data/data/####/todelete_6b991611054a2e9f_0_1 (deleted)
- /data/data/####/todelete_8059ab2dc6262984_0_1 (deleted)
- /data/data/####/todelete_894151690903a4cf_0_1 (deleted)
- /data/data/####/todelete_8ab4bfc157c68e03_0_1 (deleted)
- /data/data/####/todelete_8b74f42ca7f9d4ce_0_1 (deleted)
- /data/data/####/todelete_92f3fbe0cc645cda_0_1 (deleted)
- /data/data/####/todelete_97de5abfe883dbcf_0_1 (deleted)
- /data/data/####/todelete_a4b3b8c09b589267_0_1 (deleted)
- /data/data/####/todelete_aacc86440df2d7e7_0_1 (deleted)
- /data/data/####/todelete_ac4be60b26fb5511_0_1 (deleted)
- /data/data/####/todelete_b2141b088ee5e98c_0_1 (deleted)
- /data/data/####/todelete_b3f87b55d8dbfa47_0_1 (deleted)
- /data/data/####/todelete_b924469dce8b9a89_0_1 (deleted)
- /data/data/####/todelete_cde968a267e2506f_0_1 (deleted)
- /data/data/####/todelete_d3d3117da1954c11_0_1 (deleted)
- /data/data/####/todelete_d57fe2c6b1537486_0_1 (deleted)
- /data/data/####/todelete_d70101caa587a552_0_1 (deleted)
- /data/data/####/todelete_e00a14b7237f316a_0_1 (deleted)
- /data/data/####/todelete_e8f209bb953d0431_0_1 (deleted)
- /data/data/####/todelete_ea8e2ee83e5f58aa_0_1 (deleted)
- /data/data/####/todelete_efeb0650d9085d43_0_1 (deleted)
- /data/data/####/todelete_f0db537070bd0e92_0_1 (deleted)
- /data/data/####/todelete_f5cf31a8c1542a56_0_1 (deleted)
- /data/data/####/todelete_f7d87e9c65f44131_0_1 (deleted)
- /data/data/####/todelete_fc4f3470600a378b_0_1 (deleted)
- /data/data/####/todelete_fd6dea090b146684_0_1 (deleted)
- /data/data/####/todelete_fdd89d27c13f85e5_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/data/####/zhDisnW.dex
- /data/misc/####/primary.prof
Другие:
Отрисовывает собственные окна поверх других приложений.
Пытается определить окружение песочницы.
