Android.MobiDash.847

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cleanpo####.tclcl####.com.####.com:80
TCP(HTTP/1.1) api.mob####.com:80
TCP(HTTP/1.1) api.mo####.sdk.####.com:80
TCP(HTTP/1.1) ya####.online:80
TCP(TLS/1.0) cleanpo####.tclcl####.com.####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) sec.tclcl####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) rep####.crashly####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) t.appsf####.com:443

DNS requests:

api.mo####.sdk.####.com
api.mob####.com
cleanpo####.tclcl####.com
d####.fl####.com
e.crashly####.com
ev####.appsf####.com
g####.face####.com
googl####.g.doublec####.net
gwrtdp-####.tclcl####.com
rep####.crashly####.com
sec.tclcl####.com
sett####.crashly####.com
t.appsf####.com
ya####.online

HTTP GET requests:

api.mo####.sdk.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&ve...
api.mo####.sdk.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####...

HTTP POST requests:

api.mob####.com/poly/aapi/getad/iaNative
api.mob####.com/poly/config/levInit
cleanpo####.tclcl####.com.####.com/appDirectory/save.json
cleanpo####.tclcl####.com.####.com/appPackage/save.json
ya####.online/

Modified file system:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.YFlurrySenderIndex.info.AnalyticsData_V4G2F492...FQ_228
/data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/.lock
/data/data/####/.temp
/data/data/####/.yflurrydatasenderblock.a053233c-d05d-478f-9bc5...16044b
/data/data/####/.yflurrydatasenderblock.b6acdbbe-e7e2-4d14-b852...96f98c
/data/data/####/.yflurryreport.-460ebebf4ce560
/data/data/####/1.tmp
/data/data/####/1478228129219.jar
/data/data/####/1478228129219.tmp
/data/data/####/1510833490155
/data/data/####/1510833490791
/data/data/####/2.tmp
/data/data/####/5A0D7D4E0011-0001-083E-DFE99F1BB6A0BeginSession.cls_temp
/data/data/####/5A0D7D4E0011-0001-083E-DFE99F1BB6A0SessionApp.cls_temp
/data/data/####/5A0D7D4E0011-0001-083E-DFE99F1BB6A0SessionDevice.cls_temp
/data/data/####/5A0D7D4E0011-0001-083E-DFE99F1BB6A0SessionOS.cls_temp
/data/data/####/5A0D7D4E0027-0001-0828-DFE99F1BB6A0BeginSession.cls_temp
/data/data/####/5A0D7D4E0027-0001-0828-DFE99F1BB6A0SessionApp.cls_temp
/data/data/####/5A0D7D4E0027-0001-0828-DFE99F1BB6A0SessionDevice.cls_temp
/data/data/####/5A0D7D4E0027-0001-0828-DFE99F1BB6A0SessionOS.cls_temp
/data/data/####/5A0D7D4E0027-0001-0828-DFE99F1BB6A0SessionUser.cls_temp
/data/data/####/5A0D7D4F00E6-0001-0877-DFE99F1BB6A0BeginSession.cls_temp
/data/data/####/5A0D7D4F00E6-0001-0877-DFE99F1BB6A0SessionApp.cls_temp
/data/data/####/5A0D7D4F00E6-0001-0877-DFE99F1BB6A0SessionDevice.cls_temp
/data/data/####/5A0D7D4F00E6-0001-0877-DFE99F1BB6A0SessionOS.cls_temp
/data/data/####/5A0D7D5001AE-0001-08DF-DFE99F1BB6A0BeginSession.cls_temp
/data/data/####/5A0D7D5001AE-0001-08DF-DFE99F1BB6A0SessionApp.cls_temp
/data/data/####/5A0D7D5001AE-0001-08DF-DFE99F1BB6A0SessionDevice.cls_temp
/data/data/####/5A0D7D5001AE-0001-08DF-DFE99F1BB6A0SessionOS.cls_temp
/data/data/####/8f8eb61e0b9b42427cd210779ba6f3e2.0.tmp
/data/data/####/8f8eb61e0b9b42427cd210779ba6f3e2.1.tmp
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/ApplicationCache.db-journal
/data/data/####/CleanSdk_secular_config_sp_name.xml
/data/data/####/DATAREOPRT.xml
/data/data/####/FBAdPrefs.xml
/data/data/####/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/SDKIDFA.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/_toolbox_prefs.xml
/data/data/####/adSdk.xml
/data/data/####/admob.xml
/data/data/####/adv_desc_1.0.6.db
/data/data/####/adv_desc_1.0.6.db-journal
/data/data/####/adv_path_1.0.6.db
/data/data/####/adv_path_1.0.6.db-journal
/data/data/####/analytics_name.db
/data/data/####/analytics_name.db-journal
/data/data/####/analytics_name.db-journal (deleted)
/data/data/####/applock.xml
/data/data/####/appsflyer-data.xml
/data/data/####/authorization_mgr.xml
/data/data/####/boost_pref.xml
/data/data/####/cache_1.0.1.db
/data/data/####/cache_1.0.1.db-journal
/data/data/####/cache_hf_en20170424091130.db
/data/data/####/cache_hf_en20170424091130.db-journal
/data/data/####/cert
/data/data/####/cleancloud_pref.xml
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.ehawk.antivirus.applock.wifi-1.apk.classes-...32.zip
/data/data/####/com.ehawk.antivirus.applock.wifi-1.apk.classes1...97.zip
/data/data/####/com.ehawk.antivirus.applock.wifi-1.apk.classes8...69.zip
/data/data/####/com.ehawk.antivirus.applock.wifi.common.xml
/data/data/####/com.ehawk.antivirus.applock.wifi_preferences.xm...leted)
/data/data/####/com.ehawk.antivirus.applock.wifi_preferences.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/countrycode.db
/data/data/####/cpu_tem.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_9767d3d8163b8d222a8743d9e430410dhk_ad.db-journal
/data/data/####/db_applock.db-journal
/data/data/####/db_cde98aac5fdf26dce4ed184bf280f796hk_ad.db-journal
/data/data/####/du_ad_cache.db-journal
/data/data/####/du_ad_parse.db-journal
/data/data/####/du_ad_ts.db-journal
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/ignore_list.db-journal
/data/data/####/index
/data/data/####/initDru.tmp
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;m.a.a.a.m.xml
/data/data/####/isec.virus.scan.xml
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/junkprocess_en_1.0.2.filter
/data/data/####/leftover_cache_1.0.1.db
/data/data/####/leftover_cache_1.0.1.db-journal
/data/data/####/leftover_pkg_cache_1.0.1.db
/data/data/####/leftover_pkg_cache_1.0.1.db-journal
/data/data/####/main_list.db-journal
/data/data/####/multidex.version.xml
/data/data/####/nt_pkg_list.xml
/data/data/####/nullarpcache
/data/data/####/phone_util.xml
/data/data/####/process_list.db
/data/data/####/process_list.db-journal
/data/data/####/process_tips.db
/data/data/####/residual_dir_hf_en_20170401064643.db
/data/data/####/residual_dir_hf_en_20170401064643.db-journal
/data/data/####/sa_6614f66c-f4aa-41f5-ba3d-464f2754afa8_1510833486239.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/space_datareport_config_sp_name.xml
/data/data/####/swpf-0.dat
/data/data/####/tcl_notificaiton.db-journal
/data/data/####/tcl_virus.db-journal
/data/data/####/uijFKpJtc
/data/data/####/video_pref_def.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/wifi-security.xml
/data/data/####/wifi.dat.jar

Miscellaneous:

Executes next shell scripts:

mount

Loads the following dynamic libraries:

mcseng
uijFKpJtc
un7z

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Gains access to information about contacts from the Contact list.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней