Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- b####.gdn
- adperi####.####.com
- mar####.xyz
- prelan####.net
- pro-tan####.ru
- mobilec####.com
- hstr####.com
- findbet####.com
- oxoc####.com
- t####.global
- x####.####.com
- d32ffat####.####.net
- mediapr####.com
- h####.com
- mobilec####.mobi
HTTP GET requests:
- mar####.xyz/track.php?toggle=####&domain=####&uid=####
- mobilec####.mobi/?sl=####&data1=####&data2=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/index.css
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####&pid=####&tid=####&site=####
- oxoc####.com/aff_c?offer_id=####&aff_id=####&source=####&aff_sub5=####
- h####.com/
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.min.js
- hstr####.com/l?link=####&source=####&adult=####<=####
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/jquery.squishy.js
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/script.js
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/logo_sm.png
- mediapr####.com/r/482b15f6-e4c2-11e6-94e1-1140048435d4/1/
- pro-tan####.ru/tds/SHxp1s
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/apple-iphone7.png
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/step1.html
- x####.####.com/?s1=####&kw=####&s3=####&s4=####&noaudio=####
- b####.gdn/style.css
- d32ffat####.####.net/scripts/jquery-2.1.4.min.js
- t####.global/hrfp?url=####
- d32ffat####.####.net/themes/assets/skenzo.css
- prelan####.net/mainstream/sweepstakes/iphone/en/7/v1/loader.gif
- mar####.xyz/
- mobilec####.com/?flux_action=####
- d32ffat####.####.net/themes/assets/style.css
- h####.com/?dm_jmp=####
- mobilec####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&pubID=####
- adperi####.####.com/click?aid=####&linkid=####&s1=####&s2=####&s####&s####&s####
- findbet####.com/?dn=####&pid=####
- mediapr####.com/r/482b15f6-e4c2-11e6-94e1-1140048435d4/0/
- b####.gdn/
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-1431859727.zip
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/app_app_apk/nkdiiiiiiiiiii.dat.jar
- /data/data/####/files/asdfg
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/multidex.version.xml
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
