Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.15976
Network activity:
Connecting to:
- we####.com:8081
- google-####.com
- woo####.com:7077
- quede####.com
- woo####.com
- googlet####.com
- n####.####.com
HTTP GET requests:
- n####.####.com/fe/img/bitcoin_icon_small.png
- n####.####.com/fe/img/logo-footer.png
- n####.####.com/fe/js/lazyLoad.min.js
- n####.####.com/fe/js/jquery-picture-min.js
- n####.####.com/fe/css/style.css
- n####.####.com/fe/img/foto.png
- n####.####.com/escorts/?&utm_source=####&utm_medium=####&utm_content=###...
- n####.####.com/fe/img/arrow-right.png
- n####.####.com/fe/img/arrow-top.png
- n####.####.com/escorts?&utm_source=####&utm_medium=####&utm_content=####...
- n####.####.com/fe/img/body.png
- n####.####.com/fe/img/arrow-right-path.png
- quede####.com/99Q12/Ljpd/ID5N/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRB...
- n####.####.com/fe/img/open-white.png
- n####.####.com/fe/img/open-menu.png
- n####.####.com/fe/img/flags_sprite_small.png
- n####.####.com/fe/img/paysite_icon_small.png
- google-####.com/analytics.js
- n####.####.com/fe/img/close.png
- n####.####.com/fe/inc/warning/avviso_categoriaminori18A_dut.php
- n####.####.com/fe/css/elenco-alternativo.css
- n####.####.com/fe/img/paysafe_icon_small.png
- n####.####.com/fe/img/placeholder.png
- n####.####.com/fe/js/jquery-ui-1.9.2.min.js
- n####.####.com/fe/css/reset.css
- n####.####.com/fe/img/registrati.png
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&d...
- n####.####.com/fe/js/enscroll-0.6.0.min.js
- n####.####.com/fe/inc/warning/warning_annunci_dut.php
- n####.####.com/fe/img/logo/logo_big_skokka.com.png
- n####.####.com/fe/js/public.js?v=####
- n####.####.com/fe/js/jquery-1.9.1.min.js
- googlet####.com/gtm.js?id=####
- quede####.com/99Q12/OjkQ/Ljpd/KjdMJ2k/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1...
- n####.####.com/fe/img/accedi.png
- n####.####.com/fe/css/style-additions.css
- n####.####.com/fe/img/footer-bg.png
- n####.####.com/fe/img/home_skk/map_pin.png
- n####.####.com/fe/js/utility.js
- n####.####.com/fe/img/social/blog.png
HTTP POST requests:
- woo####.com/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=####
- woo####.com:7077/sdk/nsd.action?b=####
- we####.com:8081/sm/sr/rt/ry
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_000001
- /sdcard/test
- /data/data/####/shared_prefs/20160121.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/shared_prefs/ar.xml.bak
- /data/data/####/databases/bdownloaders.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/c201704111850.apk
- /data/data/####/shared_prefs/20160121.xml
- /data/data/####/shared_prefs/duspf6030945.xml
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/shared_prefs/ar.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/201704111850.apk
Sets the 'executable' attribute to the following files:
- /data/data/####/files/c201704111850.apk
Miscellaneous:
Executes next shell scripts:
- logcat -d -v time
- .hulu -c id
- sh
- c201704111850.apk
- .hulu
Contains functionality to send SMS messages automatically.
