Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- ssl-l####.com
- q####.####.com
- c####.####.com
- pro-tan####.ru
- keno####.####.tech
- a####.####.com
HTTP GET requests:
- c####.####.com/assets/campaigns/iphone7/devices/real/jet-black-right.png
- c####.####.com/assets/campaigns/iphone7/devices/real/silver-left.png
- c####.####.com/thumb/media/384/60/015f74763af1c1434e652a3b04f02bc44771.png
- c####.####.com/thumb/media/384/60/2e3527dc3fd4e256806fe4ee7a4773374509.jpg
- ssl-l####.com/?a=####&c=####&s1=?utm####&s2=####
- a####.####.com/t/lj3d1nkz38lgAwtkhA9q/?s1=####&s2=####&s3=####
- c####.####.com/assets/campaigns/iphone7/devices/real/gold-right.png
- c####.####.com/assets/campaigns/iphone7/devices/real/rose-gold-left.png
- c####.####.com/data/cache/ed280a0ea3cc38f3cbbc747acfbef47d.gif
- c####.####.com/assets/campaigns/iphone7/devices/real/jet-black-left.png
- keno####.####.tech/sVPVDS?utm_pakage=####
- ssl-l####.com/?a=####&c=####&s1=?utm####&s2=####&ckmguid=####
- c####.####.com/assets/campaigns/iphone7/devices/real/gold-left.png
- keno####.####.tech/jJknHN?utm_pakage=####
- q####.####.com/api/front/coregs/db7e36102fb0a4a9d0bb710c895d5985/get
- q####.####.com/offer/g3ydgljz/?s1=####&s2=####&s3=####&affid=####
- c####.####.com/data/cache-cmp5/24edec5fe6dc85b2aa0c8172fe3c60e7.css
- c####.####.com/assets/campaigns/iphone7/devices/real/black-left.png
- c####.####.com/assets/campaigns/iphone7/devices/real/silver-right.png
- c####.####.com/assets/campaigns/iphone7/devices/real/black-right.png
- c####.####.com/thumb/media/384/60/45185fd45001556ded77c5ade1e591d74834.png
- c####.####.com/data/cache-cmp5/aed207b0bdc940235b8401f8523f27c1.js
- c####.####.com/assets/campaigns/iphone7/devices/real/rose-gold-right.png
- pro-tan####.ru/tds/MRkzPQ
HTTP POST requests:
- q####.####.com/api/coreg/submit
- q####.####.com/api/session/start?s1=####&s2=####&s3=####&affid=####
- q####.####.com/api/legal/load
- q####.####.com/api/track
Modified file system:
Creates the following files:
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/files/file
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/app_app_apk/box.dat.jar
- /data/data/####/code_cache/secondary-dexes/MultiDex.lock
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/credentials.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 40 40 271232 /data/data/####/app_app_apk/box.dat.jar 1252438308 1031838015 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
