Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- i####.####.com
- z####.ru
- i####.com
- sp####.####.com
- o####.####.com
- p####.####.com
- c####.####.com
- e####.####.com
- b####.####.com
- tr####.####.com
- mo####.com
- modam####.es
- google-####.com
- pag####.####.com
HTTP GET requests:
- pag####.####.com/pagead/js/r20170206/r20170110/show_ads_impl.js
- c####.####.com/build/js/rev2.min.js?v=####&del=####&lg=####&ci=####&ab=####&ldr=####&ht=####
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmcs=####&utmsr=####&utmvp=####&utmsc=####&utmul=####&utmje=####&utmfl=####&utm...
- modam####.es/i/elsa%20pataky%20pelo%20corto1.jpg
- modam####.es/i/sneakers%20moda.jpg
- sp####.####.com/mobiledirect/?aid=####&uid=####&wsid=####&subid=####
- modam####.es/i/peinados%20verano%202013%20tendencias.jpg
- i####.com/img/logo_mixto_trans.png
- p####.####.com/pixel;r=1048177302;a=p-aD1qr93XuF6aC;labels=Publishers.Publisher-18331%2CWidgets.Widget-50333;fpan=1;fpa=P0-1560540337-1485418827547;ns...
- modam####.es/ico/estrellas16.png
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- b####.####.com/b?c1=####&c2=####&c3=####&ns__t=####&ns_c=####&cv=####&c8=####&c7=####&c9=####
- c####.####.com/index.php?idpagina=####&idcodigo=####&lgid=####
- e####.####.com/quant.js
- google-####.com/ga.js
- b####.####.com/b?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c7=####&c9=####
- modam####.es/i/bikinisblancoportada1.jpg
- modam####.es/i/peto-vaquero-para-mujer3.jpg
- p####.####.com/pc.php?s=####&m=####&a=####&c=####&unsold=####&pc=####&coad=####
- modam####.es/i/camisa.jpg
- modam####.es/i/sandalias_zara1.jpg
- c####.####.com/?a=####&c=####&p=####&E=####&s1=####&s2=####
- modam####.es/vacio.php
- c####.####.com/build/css/rev2.min.css?v=####
- modam####.es/i/Primeriti-Botines-Pilar-Abril1.jpg
- sp####.####.com/mobiledirect/?aid=####&uid=####&cwsid=####&subid=####
- b####.####.com/b2?c1=####&c2=####&ns__t=####&ns_c=####&cv=####&c8=####&c7=####&c9=####
- pag####.####.com/pagead/js/adsbygoogle.js
- tr####.####.com/seg.php?callback=####&widgets=####&creatives=####&_=####
- mo####.com/images/cerrar.png
- tr####.####.com/serve.js.php?w=####&t=####&c=####&width=####&referer=####
- modam####.es/buscar.php?enviar=####&b=####&Submit=####
- modam####.es/i/mango34.jpg
- google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmcs=####&utmsr=####&utmvp=####&utmsc=####&utmul=####&utmje=####&utmfl=####&utmdt...
- modam####.es/i/camisa-blanca.jpg
- b####.####.com/beacon.js
- modam####.es/index_IW.php?utm_source=####&utm_medium=####&utm_term=####&utm_campaign=####&formato=####
- modam####.es/i/clutch%20bolso%20de%20mano%201%20copia.jpg
- z####.ru/sh?keyword=####
- mo####.com/js/cookies.js?ref=####
- i####.com/img/rss_transparente.png
- modam####.es/Las-camisas-blancas-siempre-de-moda./195
- modam####.es/i/17.jpg
- i####.####.com/?url=####&static=####&pos=####&h=####&w=####&static=####&fmt=####
- p####.####.com/pixel/p-aD1qr93XuF6aC.gif?labels=####
- pag####.####.com/pagead/show_ads.js
- o####.####.com/?m=####&a=####&idoferta=####&fc=####&alt=####&coad=####
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/qwerty
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/app_app_apk/wifipasswordcracker.dat.jar
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-157423062.zip
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
