Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- c####.####.com
- s####.####.com
- fulmi####.####.org
HTTP GET requests:
- fulmi####.####.org/version.txt
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=####&subpub=####
Modified file system:
Creates the following files:
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/app_app_apk/wpswpatester.dat.jar
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_boundentrypreferences.xml.bak
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/wpa_cli
- /data/data/####/files/asdfg
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/no_backup/com.google.android.gms.appid-no-backup
- /data/data/####/pin4.db
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/google_app_measurement_local.db-journal
- /data/data/####/shared_prefs/presage.xml
- /data/data/####/shared_prefs/####_startupinfopreferences.xml
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/shared_prefs/####_initpreferences.xml.bak
- /data/data/####/shared_prefs/####_initpreferences.xml
- /data/data/####/vendor.db
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/termsofuse.xml
- /data/data/####/shared_prefs/####_serviceproviderspreferences.xml
- /data/data/####/databases/google_app_measurement_local.db
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-157423062.zip
- /data/data/####/shared_prefs/com.google.android.gms.appid.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/credentials.dat
Sets the 'executable' attribute to the following files:
- /data/data/####/wpa_cli
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
