Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- a####.####.com
- c####.####.com
- i####.####.com
Запросы HTTP GET:
- a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
- c####.####.com/files/20960690036ac41585284ab8bca5c3ab
- i####.####.com/s
Запросы HTTP POST:
- a####.####.com/api/ads/connect
- a####.####.com/api/gota/connect
- a####.####.com/api/push/connect
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/cache/####/.DS_Store
- <Package Folder>/cache/####/JSToNativeService.js
- <Package Folder>/cache/####/MinikitApp.js
- <Package Folder>/cache/####/MinikitInfo.js
- <Package Folder>/cache/####/StringHelper.js
- <Package Folder>/cache/####/antivirus.png
- <Package Folder>/cache/####/btn_close.png
- <Package Folder>/cache/####/btn_close.svg
- <Package Folder>/cache/####/btn_download.png
- <Package Folder>/cache/####/btn_download.svg
- <Package Folder>/cache/####/btn_download_pressed.png
- <Package Folder>/cache/####/btn_download_pressed.svg
- <Package Folder>/cache/####/btn_play_video.png
- <Package Folder>/cache/####/btn_play_video.svg
- <Package Folder>/cache/####/button_back.png
- <Package Folder>/cache/####/button_back.svg
- <Package Folder>/cache/####/call.png
- <Package Folder>/cache/####/config.js
- <Package Folder>/cache/####/divider.png
- <Package Folder>/cache/####/email.png
- <Package Folder>/cache/####/faq.png
- <Package Folder>/cache/####/fastclick.js
- <Package Folder>/cache/####/fixmenu_shadow.png
- <Package Folder>/cache/####/flipsnap.js
- <Package Folder>/cache/####/guide.png
- <Package Folder>/cache/####/ic_downloads.png
- <Package Folder>/cache/####/ic_downloads.svg
- <Package Folder>/cache/####/ic_ranking.png
- <Package Folder>/cache/####/ic_ranking.svg
- <Package Folder>/cache/####/ic_tab_game.png
- <Package Folder>/cache/####/ic_tab_game.svg
- <Package Folder>/cache/####/ic_tab_others.png
- <Package Folder>/cache/####/ic_tab_others.svg
- <Package Folder>/cache/####/ic_tab_partner.png
- <Package Folder>/cache/####/ic_tab_partner.svg
- <Package Folder>/cache/####/ic_tab_recommend.png
- <Package Folder>/cache/####/ic_tab_recommend.svg
- <Package Folder>/cache/####/ic_tab_utility.png
- <Package Folder>/cache/####/ic_tab_utility.svg
- <Package Folder>/cache/####/ic_tag.png
- <Package Folder>/cache/####/ic_tag.svg
- <Package Folder>/cache/####/ic_tag_hot.png
- <Package Folder>/cache/####/ic_tag_hot.svg
- <Package Folder>/cache/####/index.html
- <Package Folder>/cache/####/info.html
- <Package Folder>/cache/####/iscroll-infinite.js
- <Package Folder>/cache/####/iscroll-lite.js
- <Package Folder>/cache/####/iscroll-probe.js
- <Package Folder>/cache/####/iscroll-zoom.js
- <Package Folder>/cache/####/iscroll.js
- <Package Folder>/cache/####/logo.png
- <Package Folder>/cache/####/mainbg.png
- <Package Folder>/cache/####/mask_description.png
- <Package Folder>/cache/####/mask_description.svg
- <Package Folder>/cache/####/mask_header.png
- <Package Folder>/cache/####/mask_header.svg
- <Package Folder>/cache/####/meta.js
- <Package Folder>/cache/####/minikit.css
- <Package Folder>/cache/####/preview.js
- <Package Folder>/cache/####/repairs-en.html
- <Package Folder>/cache/####/repairs-es.html
- <Package Folder>/cache/####/repairs-fr.html
- <Package Folder>/cache/####/repairs-iw.html
- <Package Folder>/cache/####/repairs-pt.html
- <Package Folder>/cache/####/reparation.png
- <Package Folder>/cache/####/scooch-style.css
- <Package Folder>/cache/####/scooch.css
- <Package Folder>/cache/####/scooch.js
- <Package Folder>/cache/####/style.css
- <Package Folder>/cache/####/swipe.js
- <Package Folder>/cache/####/tab_game.png
- <Package Folder>/cache/####/tab_others.png
- <Package Folder>/cache/####/tab_partner.png
- <Package Folder>/cache/####/tab_recommend.png
- <Package Folder>/cache/####/tab_utility.png
- <Package Folder>/cache/####/zepto.js
- <Package Folder>/cache/####/zepto.min.js
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/com.rock.Database-journal
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/databases/reach.database.push-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/com.rock.Storage.xml
- <Package Folder>/shared_prefs/default-settings.xml
- <SD-Card>/Android/####/.nomedia
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
