Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1867.origin
- Android.SmsSend.1875.origin
Network activity:
Connecting to:
- s####.####.com
- go####.com
- b####.com
- tr####.com
- 1####.####.63
- daily-o####.com
- c####.####.net
- b####.mobi
- opent####.com
- gl####.####.com:9090
- buongi####.####.org
- c####.####.com
- j####.####.xyz
- t####.global
- a####.####.com
- go####.nl
- u####.com:7079
- trackme####.com
- transr####.com
- u####.com
- o####.camp
HTTP GET requests:
- u####.com/ru/ru0518findbutton20161226.js
- go####.com/
- j####.####.xyz/?s3=####
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####...
- t####.global/hrfp?url=####
- b####.com/rms/BingCore.Bundle/cj,nj/ea12a751/faef1996.js?bu=####
- opent####.com/d/34443576b8c500e456?sub=####&sub2=####
- trackme####.com/r/22ec7560-3f11-11e7-b39a-114195797a36/1/
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- go####.nl/gb/images/qi1_36e7b564.png
- o####.camp/serve/?n=fHN7a####
- gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
- b####.com/Identity/Hamburger?n=####&r=####&IID=####&IG=####&ru=####
- o####.camp/offer?a=####&o=####&t=####&subid=####&subid4=####&pt=####&pid...
- go####.nl/images/hpp/gsa_super_g-64.gif
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- daily-o####.com/?flux_fts=####&flux_cost=####&aff_id=####&aff_sub2=####&...
- go####.nl/images/nav_logo242.png
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerIdentityUpdate/...
- b####.com/fd/s/a/sbbtn.png
- go####.nl/images/nav_logo242_hr.png
- go####.nl/gen_204?atyp=####&ct=####&cad=####&ogsr=####&id=####&ic=####&o...
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- a####.####.com/fd/ls/l?IG=####&CID=####&TYPE=####&DATA=####
- b####.com/AS/Suggestions?pt=####&mkt=####&qry=####&cp=####&css=####&cvid...
- o####.camp/jmp2/?n=fHN7a####&adv=####
- trackme####.com/r/3c59a46e-3f11-11e7-9fb8-1141967048dc/1/
- b####.com/ImageResolution.aspx?w=####&h=####&hash=####&r=####
- b####.mobi/path/lp.php?trvid=####&trvx=####&extid=####&amount=####&pubid...
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- transr####.com/89p18/ZFwY/cF9V/dFJEowc/JhcZ9FUV7aldC9fCjaJwHqLB6jetNehzF...
- b####.com/sa/simg/hamburger_icons_sprite2x_mysaves_1_bf.png
- b####.com/sa/simg/anon_200px.png
- go####.nl/xjs/_/js/k=xjs.qs.nl.zvFc2Sz4wIY.O/m=sx,c,sb_mob,bct,cdos,elog...
- b####.com/rms/rms%20answers%20Identity%20Mobile$MobileSnrWindowsLiveConn...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/?r=####
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- transr####.com/89p18/cF9V/fltF/JhcZ9FUV7aldC9fCjaJwHqLB6jetNehzF-dfdSLT-...
- o####.camp/offer?a=####&o=####&t=####&subid=####&subid4=####&_uu=####
- u####.com/ru/ru0522processurl.js
- opent####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sub...
- trackme####.com/r/22ec7560-3f11-11e7-b39a-114195797a36/0/
- u####.com/ru/ru0518simulationClickYes.js
- o####.camp/jmp1/?n=fHN7a####&adv=####&s=####
- b####.com/rms/AutoSug/cj,nj/e438a744/63535cc2.js?bu=####
- buongi####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub...
- c####.####.com/offer.php?code=####&affid=####&clickid=####
- b####.com/az/hprichbg/rb/LakePowellStorm_ROW9784695902_800x480.jpg
- 1####.####.63/dlv/c.php?cca=####&ccz=####&clickid=####
- go####.nl/xjs/_/js/k=xjs.qs.nl.zvFc2Sz4wIY.O/m=aa,abd,async,dvl,foot,ipv...
- go####.nl/images/branding/googlelogo/2x/googlelogo_color_160x56dp.png
- b####.com/Passport.aspx?popup=####
- go####.nl/gen_204?atyp=####&ct=####&cad=####&tt=####&ei=####&zx=####
- b####.com/hpmob?r=####&IG=####&IID=####
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- go####.nl/gen_204?s=####&atyp=####&ei=####&imc=####&imn=####&imp=####&ad...
- trackme####.com/r/3c59a46e-3f11-11e7-9fb8-1141967048dc/0/
- tr####.com/direct?cid=####&tid=####&sid=####
- s####.####.com/click?pid=####&offer_id=####&sub1=####&sub2=####&sub3=####
- b####.com/az/hprichbg/rb/LakePowellStorm_ROW9784695902_320x240.jpg
- go####.nl/?gfe_rd=####&ei=####
HTTP POST requests:
- b####.com/fd/ls/lsp.aspx?
- b####.com/fd/ls/lsp.aspx
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- u####.com/jsdk/sd.action?b=####
- u####.com:7079/jsdk/sd.action?b=####
Modified file system:
Creates the following files:
- <Package Folder>/fileswapsdk/local/170517072827588.dex
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/fileswapsdk/local/go.png
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/files/wapsdk/run.dex
- <Package Folder>/fileswapsdk/local/localCopy.data
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
