Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) trietha####.com:80
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) a####.mo####.com:80
- TCP(HTTP/1.1) t####.snapbac####.com:80
- TCP(HTTP/1.1) appserv####.com:80
- TCP(HTTP/1.1) l####.adsbt####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) offence####.accountant:80
- TCP(HTTP/1.1) ads.cumd####.com:80
- TCP(HTTP/1.1) www.girlzvi####.mobi:80
- TCP(HTTP/1.1) t####.appserv####.com:80
- TCP(HTTP/1.1) www.pornra####.com:80
- TCP(HTTP/1.1) epom####.com:80
- TCP(SSL/3.0) vjs.ze####.net:443
- TCP(TLS/1.0) vjs.ze####.net:443
- TCP(TLS/1.0) img.mo####.com:443
- TCP(TLS/1.0) normale####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) js-a####.newr####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) sx.lead####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) m.pornra####.com:443
- TCP(TLS/1.0) cdn3-m####.pornra####.com:443
DNS requests:
- a####.google####.com
- a####.mo####.com
- ads.cumd####.com
- appserv####.com
- cdn3-m####.pornra####.com
- epom####.com
- f####.google####.com
- f####.gst####.com
- hy####.com
- img.mo####.com
- js-a####.newr####.com
- m.pornra####.com
- normale####.com
- offence####.accountant
- offer####.online
- ssl.google-####.com
- sx.lead####.com
- t####.appserv####.com
- t####.bruce####.com
- t####.bruce####.com
- t####.snapbac####.com
- vjs.ze####.net
- www.ads.cumd####.com
- www.girlzvi####.mobi
- www.go####.com
- www.google-####.com
- www.pornra####.com
- x####.social-####.com
- y####.instagi####.com
HTTP GET requests:
- a####.google####.com/css?family=####
- a####.mo####.com/sdk/service.php?id_zone=####&company=####&width=####
- ads.cumd####.com/categories
- ads.cumd####.com/media/categories/video/1.jpg
- ads.cumd####.com/media/categories/video/10.jpg
- ads.cumd####.com/media/categories/video/11.jpg
- ads.cumd####.com/media/categories/video/12.jpg
- ads.cumd####.com/media/categories/video/13.jpg
- ads.cumd####.com/media/categories/video/14.jpg
- ads.cumd####.com/media/categories/video/15.jpg
- ads.cumd####.com/media/categories/video/16.jpg
- ads.cumd####.com/media/categories/video/17.jpg
- ads.cumd####.com/media/categories/video/18.jpg
- ads.cumd####.com/media/categories/video/19.jpg
- ads.cumd####.com/media/categories/video/2.jpg
- ads.cumd####.com/media/categories/video/20.jpg
- ads.cumd####.com/media/categories/video/21.jpg
- ads.cumd####.com/media/categories/video/23.jpg
- ads.cumd####.com/media/categories/video/3.jpg
- ads.cumd####.com/media/categories/video/4.jpg
- ads.cumd####.com/media/categories/video/5.jpg
- ads.cumd####.com/media/categories/video/6.jpg
- ads.cumd####.com/media/categories/video/7.jpg
- ads.cumd####.com/media/categories/video/8.jpg
- ads.cumd####.com/media/categories/video/9.jpg
- ads.cumd####.com/media/videos/tmb/57622/3.jpg
- ads.cumd####.com/media/videos/tmb/57624/3.jpg
- ads.cumd####.com/media/videos/tmb/57641/1.jpg
- ads.cumd####.com/media/videos/tmb/57643/1.jpg
- ads.cumd####.com/media/videos/tmb/57652/3.jpg
- ads.cumd####.com/media/videos/tmb/57669/3.jpg
- ads.cumd####.com/media/videos/tmb/57682/3.jpg
- ads.cumd####.com/media/videos/tmb/57683/3.jpg
- ads.cumd####.com/media/videos/tmb/57733/1.jpg
- ads.cumd####.com/media/videos/tmb/57734/1.jpg
- ads.cumd####.com/media/videos/tmb/57735/1.jpg
- ads.cumd####.com/media/videos/tmb/57736/3.jpg
- ads.cumd####.com/media/videos/tmb/57737/3.jpg
- ads.cumd####.com/media/videos/tmb/57738/3.jpg
- ads.cumd####.com/media/videos/tmb/57739/3.jpg
- ads.cumd####.com/media/videos/tmb/57740/3.jpg
- ads.cumd####.com/media/videos/tmb/57741/3.jpg
- ads.cumd####.com/templates/frontend/dark-magenta/css/bootstrap.css
- ads.cumd####.com/templates/frontend/dark-magenta/css/colors.css
- ads.cumd####.com/templates/frontend/dark-magenta/css/font-awesome.min.css
- ads.cumd####.com/templates/frontend/dark-magenta/css/responsive.css
- ads.cumd####.com/templates/frontend/dark-magenta/css/style.css
- ads.cumd####.com/templates/frontend/dark-magenta/fonts/fontawesome-webfo...
- ads.cumd####.com/templates/frontend/dark-magenta/fonts/glyphicons-halfli...
- ads.cumd####.com/templates/frontend/dark-magenta/img/loading-bubbles.svg
- ads.cumd####.com/templates/frontend/dark-magenta/js/jquery.video-0.2.js
- ads.cumd####.com/templates/frontend/dark-magenta/js/jquery.voting-video-...
- ads.cumd####.com/video/57738/amateur-big-tits-babe-flashes-tits-for-to-g...
- ads.cumd####.com/videos?c=####
- appserv####.com/no-impression.gif?p=####&ch=####&h=####&l=####&sh=####&s...
- epom####.com/ads-api-v4?cp.version=####&key=####&ch=####&ADTYPE=####&net...
- f####.gst####.com/s/opensans/v15/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXL...
- f####.gst####.com/s/opensans/v15/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtb...
- l####.adsbt####.com/c/679efeecdc3b4d07?&click_id=####&s1=####&s2=####&s3...
- l####.adsbt####.com/c/da57dc555e50572d?s1=####&s2=####&s5=Qzo3####&s3=Uz...
- offence####.accountant/10.jpg
- offence####.accountant/11.jpg
- offence####.accountant/7.jpg
- offence####.accountant/8.jpg
- offence####.accountant/9.jpg
- offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
- offence####.accountant/favicon.ico
- offence####.accountant/flag.png
- offence####.accountant/index.html
- offence####.accountant/ip7.png
- offence####.accountant/iphone6.jpg
- offence####.accountant/iphone7.jpg
- offence####.accountant/item1.png
- offence####.accountant/item2.png
- offence####.accountant/item3.png
- offence####.accountant/like.png
- offence####.accountant/search.png
- offer####.online/favicon.ico
- offer####.online/r/f7e0eab0-eb34-11e7-8ceb-114500a26546/0/
- offer####.online/r/f7e0eab0-eb34-11e7-8ceb-114500a26546/1/
- t####.bruce####.com/ck.php?line_item_id=####&subid_spx=####&click_id=####
- t####.bruce####.com/ck_jump?id=cz03####&__if=####&__type=####&__ref=####
- t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
- trietha####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKh...
- www.girlzvi####.mobi/?sl=####&data1=####&data2=8####&data3=####
- www.pornra####.com/embed/35701087/
HTTP POST requests:
- t####.appserv####.com/trackcnt/QRFpVfD3fbg3t9qb/?data=####&bid=####&v=##...
Modified file system:
Creates the following files:
- <Package Folder>/app_app_apk/app.dat.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/index
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/<Package>-1.apk.classes1040973297.zip
- <Package Folder>/files/####/<Package>-1.apk.classes845619369.zip
- <Package Folder>/files/HIZCmVLEW
- <Package Folder>/files/cookies.storage
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Miscellaneous:
Loads the following dynamic libraries:
- HIZCmVLEW
Uses administrator priveleges.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
