Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1867.origin
- Android.SmsSend.1875.origin
Network activity:
Connecting to:
- tra####.####.com
- 2####.####.155
- u####.com:7079
- p####.####.com
- d####.####.com
- c####.####.com
- x####.####.fr
- gl####.####.com
- show####.xyz
- gl####.####.com:6566
- statist####.com
- u####.com
- a####.####.com
HTTP GET requests:
- c####.####.com/landings/87511/1489511222/js/showhide.js?148951####
- gl####.####.com/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub...
- c####.####.com/landings/87511/1489511222/js/steps.js?148951####
- d####.####.com/d/33164576433fd4daa1?sub=####&do=####&test=####
- c####.####.com/landings/87511/1489511222/css/styles.css?148951####
- a####.####.com/pool_link/1514/bmconv_20170414113609_8c1cb1c7_8d38_49a6_b...
- c####.####.com/landings/87511/1489511222/js/progressButton.js?148951####
- p####.####.com/c/da57dc555e50572d?s1=####&s2=####&click_id=####
- c####.####.com/landings/87511/1489511222/js/classie.js?148951####
- x####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiy...
- c####.####.com/landings/87511/1489511222/js/modernizer.js?148951####
- p####.####.com/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=###...
- d####.####.com/d/33164576433fd4daa1?sub=####
- u####.com/in/processurl20170405.js
- c####.####.com/landings/87511/1489511222/css/button.css?148951####
- show####.xyz/adult/_files/imgs/r_general1/img-4fuck.gif
- tra####.####.com/?p=####&media_type=####&click_id=####
- x####.####.fr/hit/sponsor/wid=6189&site_id=4837&niche=52&dt=F00000NSXPMi...
- gl####.####.com:6566/AdRedirect.aspx?offerid=####&cid=####&affid=####&af...
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&te...
- a####.####.com/pool_link/1514/bmconv_20170414113625_d1d2a797_3b34_4c22_8...
- 2####.####.155/cm-tracker/cmreqrec.do?pid=####&sysuid=####&cid=####&publ...
- c####.####.com/landings/87511/1489511222/js/avsc2.js?148951####
- statist####.com/adv_pxl?pid=####&id=####
- c####.####.com/landings/87511/1489511222/css/bootstrap.css?148951####
HTTP POST requests:
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- u####.com:7079/jsdk/sd.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/fileswapsdk/local/170126081658684.dex
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/fileswapsdk/local/localCopy.data
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/fileswapsdk/local/go.png
- /data/data/####/files/target.dex
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/commonsdk/processurl20170405.js
Miscellaneous:
Contains functionality to send SMS messages automatically.
