Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1867.origin
Network activity:
Connecting to:
- t####.####.com:6566
- t####.####.com
- woo####.com:8082
- mo####.####.com
- gl####.####.com
- r####.####.com
- nltopof####.com
- woo####.com
- ro####.####.com
- m####.####.com
- pop####.net
- a####.####.com
HTTP GET requests:
- nltopof####.com/m/jpc/nl-6903/index.html?voluumdata=####&keyword=####&country=####&category=####&opsystem=####&modif=####
- nltopof####.com/m/jpc/nl-6903/style.css
- a####.####.com/ajax/libs/jquery/2.1.1/jquery.min.js
- mo####.####.com/donnexxx.com/znx/direct/t:0YEAADULTO2.SX.F01.NL.S03.N16.C000_PLR
- r####.####.com/red/?code=####&a=####
- nltopof####.com/m/jpc/nl-6903/alert.ogg
- t####.####.com:6566/app.aspx?offerid=####&affid=####&adrid=####&imei=####&sn=####
- r####.####.com/?m=####&a=####&PUBID=####
- mo####.####.com/donnexxx.com/znx/direct/t:0YEAADULTO2.SX.F01.NL.S03.N16.C000_PLR?prc_c=####&prc_r=####&prc_i=####&prc_ib=####&prc_h=####&jw=####&jh=##...
- m####.####.com/51f12311-83f5-4d0c-8ee8-d6e598388f07?keyword=####&country=####&category=####&opsystem=####&modif=####
- mo####.####.com/go/index.php
- pop####.net/world/sgo/9041/193097/2510170c748e45fd/aHR0cCUzQSUyRiUyRnBybW9iaWxlcy5jb20lMkZnbyUyRmluZGV4LnBocA==
- t####.####.com/APK_ADRedirect.aspx?offerid=####&cid=####&affid=####&phone=####&aff_sub=####&aff_sub2=####&aff_sub3=####&aff_sub4=####&aff_sub5=####
- pop####.net/world/go/9041/193097/aHR0cDovL3BybW9iaWxlcy5jb20vZ28vaW5kZXgucGhw
- gl####.####.com/trace?offer_id=####&aff_id=####&pid=####&cid=####&publish_id=####&aff_sub=####&aff_sub8=####
- ro####.####.com/redirect?err_msg####&aff_sub=####&pid=####&publish_id=####&aff_sub8=####&aff_id=####&offer_id=####&cid=####
- gl####.####.com/trace?offer_id=####&rotate=####&err_msg=####&aff_sub=####&pid=####&publish_id=####&aff_sub8=####&aff_id=####&cid=####&redirect=####&pr...
HTTP POST requests:
- woo####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- woo####.com/sdkwap/sd.action?b=####
- woo####.com:8082/sdkwap/sd.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/shared_prefs/com.powerctl.superbattery.util.PreferenceUtil.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/commonsdk/update.data
- /data/data/####/databases/webview.db-journal
- /data/data/####/fileswapsdk/local/localCopy.data
- /data/data/####/fileswapsdk/local/170126072232017.dex
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
