Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.79.origin
Network activity:
Connecting to:
- s####.####.com
- t####.####.com
- ced####.####.com
- g####.####.com
- i####.####.cc
- t####.####.net
- c####.####.co
- r####.####.com
- c####.####.com
- cedexi####.####.net
- deazs14####.####.net
- i2-ewcf####.####.net
- wa####.####.org
- fastlyb####.####.com
- gl####.####.com
- a-ced####.####.net
- p####.####.cc
- hibe####.####.com
- sf####.####.com
- a####.####.com
HTTP GET requests:
- p####.####.cc/api/ads/record/si.open.link/?_s=####&oc1=####&oc2=####&nam...
- i####.####.cc/s
- p####.####.cc/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=###...
- c####.####.com/files/09aab56a5a7eb8d1b88f16ec56776650
- deazs14####.####.net/img/14/r20.gif?rnd=####
- t####.####.com/c/kioQXOTe45pddgYWT0tYg66QTbWHt8DDIOD94UrbLHU/CF?subid1=#...
- wa####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=##...
- c####.####.com/tracking/index/58f19af93432e?gaid=####&idfa=####&andid=##...
- wa####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- t####.####.com/api/v4/click?_iptags=####&campaign_id=####&publisher_id=#...
- c####.####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_p...
- i2-ewcf####.####.net/i2/1/18918/j1/20/32/1485418243/providers.json?image...
- a####.####.com/cr/sdk/goplaysdk_statistics_all_1704100.dat
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&a...
- t####.####.net/click/click?offer_id=####&aff_id=####&campaign=####&insta...
- r####.####.com/1/18918/radar.js
- cedexi####.####.net/node.js?rnd=####
- r####.####.com/releases/1490721830/radar.js
- p####.####.cc/api/ads/record/click/?_s=####&oc1=####&oc2=####&provider=#...
- hibe####.####.com/img/14784/r20.gif?rnd=####
- c####.####.com/loading01.gif
- r####.####.com/f1/_CgJqMRAUGCAiBggBEOaTASjD0JSUBTDq1Fo49dDMxwVArYWnlQZKF...
- cedexi####.####.net/img/25/r20.gif?rnd=####
- sf####.####.com/img/102/r20.gif?rnd=####
- a####.####.com/s2s/click/2d394627b4e64e24bd4713e91a560ab0?offerid=####&a...
- fastlyb####.####.com/node_id.js?rnd=####
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- fastlyb####.####.com/img/90/r20.gif?rnd=####
- g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- ced####.####.com/img/489/r20.gif?rnd=####
- a####.####.com/cr/sdk/des_V17040502Aj1so32.zip
- a-ced####.####.net/img/21222/r20.gif?rnd=####
- s####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
- p####.####.cc/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=#...
- deazs14####.####.net/node2/14min.html?rnd=####
- c####.####.com/loading01.html
- g####.####.com/cr/sv/getGoFile?name=####
- s####.####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
- r####.####.com/n1/0/1485418242074/0/0/0/0/1485418242074/1485418242074/14...
HTTP POST requests:
- p####.####.cc/api/ads/record/si.goto/?_s=####&oc1=####&oc2=####&name=###...
- a####.####.com/app_logs
- g####.####.com/cr/sv/getEPList
- p####.####.cc/api/ads/fetch?_s=####
- p####.####.cc/api/ads/connect
Modified file system:
Creates the following files:
- /data/data/####/files/.S1CH1S/7DEEC5C413510591EA0B904790315E54
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/SSPPrefe.xml
- /sdcard/csdcynpahts/adrateti.jar
- /sdcard/Android/data/####/cache/reach.image.service/9434E1AFDB0C3830F5832E26E30E1AD2
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/databases/cc.db
- /data/data/####/files/617.jar
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/app_dex/mocean-sdk.zip
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/ua.db-journal
- /data/data/####/shared_prefs/SSPPrefe.xml.bak
- /sdcard/csdcynpahts/deadrateti.jar
- /data/data/####/files/.play/test
- /data/data/####/databases/mocean.database.ad-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/reach.image.service/3E94B4B35BBDD2ED30059597D24D95EF
- /data/data/####/files/1485418226684_V17040502Aj1so32.so
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/files/cr3d2DB8520H4/5cr3d2DB8520H46
- /data/data/####/files/.S1CH1S/1449A068C434B87B9346632108B87328
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/app.manager-journal
- /data/data/####/files/exid.dat
- /data/data/####/app_dex/mocean-sdk.zip.tmp
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/files/playerData
- /data/data/####/shared_prefs/MO.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/.S1CH1S/AF3C01FA07B91EC7F41AF1FBD0547D72
- /data/data/####/files/54e3315cf8905368883c130e1a50fbf7
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/.gepd/gpdu
- /data/data/####/app_mmxcache/####1485418224645.jar
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.play/.md
- /data/data/####/app_tmpdex/mocean-sdk.zip
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/shared_prefs/MO.xml
- /data/data/####/files/Android-x86112.jar
- /data/data/####/files/23DB8520H32/####12x862
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/610.jar
Sets the 'executable' attribute to the following files:
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/files/.play/test
Miscellaneous:
Executes next shell scripts:
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 8d3037e5822e497ca3a7bbf1cf30d80a /data/data/####/.syslib-
- chmod 770 /data/data/####/files/.play/test
- getenforce
- chmod 0771 /data/data/####/.syslib-
- /data/data/####/files/.play/test /data/data/####/files/.play/ 8d3037e5822e497ca3a7bbf1cf30d80a
Contains functionality to send SMS messages automatically.
