Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- sp####.####.com
- z####.ru
- p####.####.com
- adse####.####.mobi
- c####.####.com
- msmtrak####.com
- trackme####.com
- of####.####.com
HTTP GET requests:
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/css/animate.css
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/3.png
- sp####.####.com/mobiledirect/?aid=####&uid=####&wsid=####&subid=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/5.png
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- of####.####.com/prelander/lib/lib.js
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/galaxy.png
- sp####.####.com/mobiledirect/?aid=####&uid=####&cwsid=####&subid=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/33.png
- trackme####.com/r/eecd2540-f032-11e6-82dd-114141af4f72/1/
- c####.####.com/?a=####&c=####&p=####&E=####&s1=####&s2=####
- trackme####.com/r/eecd2540-f032-11e6-82dd-114141af4f72/0/
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/22.png
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/4.png
- adse####.####.mobi/tracker/click.php?link=####&click_id=####&id_pub=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/css/sweetalert.css
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/44.png
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/bg.jpg
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/1.png
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/2.png
- z####.ru/sh?keyword=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/images/11.png
- msmtrak####.com/get/iad/1-297-ad8096f664aff24bf13ab044067e2e29?cl=####&clickid=####&ext1=####&ext2=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/hard/index_nl.html?url=aHR####&co=####
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/js/jquery.js
- of####.####.com/prelander/cpl/roulette/iphone7/sv2/soft/css/styles.css
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes815273588.zip
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_app_apk/statsguruforspss.dat.jar
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/asdfg
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/shared_prefs/multidex.version.xml
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
