Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1867.origin
- Android.SmsSend.1888.origin
Network activity:
Connecting to:
- t####.####.com
- go####.nl
- affshar####.com
- c####.####.net
- gl####.####.com:9090
- c####.####.com
- go####.com
- p####.####.link
- gl####.####.com
- statist####.com
- u####.com
HTTP GET requests:
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_3.gif
- c####.####.com/landings/58300/1492784968/images/body_2.jpg
- go####.com/
- c####.####.com/landings/52883/1482505366/images/4.gif
- c####.####.com/landings/52883/1482505366/images/loading.gif
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_5.gif
- go####.nl/gb/images/qi1_36e7b564.png
- c####.####.com/landings/52883/1482505366/js/avsc2.js?148250####
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_1.gif
- go####.nl/images/hpp/gsa_super_g-64.gif
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_6.gif
- go####.nl/images/nav_logo242.png
- go####.nl/images/nav_logo242_hr.png
- go####.nl/gen_204?atyp=####&ct=####&cad=####&ogsr=####&id=####&ic=####&o...
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_2.gif
- c####.####.com/landings/58300/1492784968/js/avsc2.js?149278####
- c####.####.com/landings/58300/1492784968/css/1bccb5a6116838231b3333b28e3...
- c####.####.com/landings/58300/1492784968/images/body_1.jpg
- c####.####.com/landings/58300/1492784968/images/main_girl.jpg
- c####.####.com/landings/58300/1492784968/images/loading_bar.gif
- c####.####.com/landings/58300/1492784968/images/age_2.jpg
- gl####.####.com/trace?offer_id=####&aff_id=####&pid=####&cid=####&publis...
- p####.####.link/c/da57dc555e50572d?s1=####&s2=####&click_id=####
- c####.####.com/landings/58300/1492784968/images/cancel.png
- c####.####.com/landings/52883/1482505366/images/logo.png
- c####.####.com/landings/58300/1492784968/images/ok.png
- c####.####.com/landings/58300/1492784968/images/jump_nl_mol_4.gif
- c####.####.com/landings/58300/1492784968/js/b040f9f4da7e868eabeee13dfd48...
- go####.nl/logos/doodles/2017/ferdinand-monoyers-181st-birthday-510593909...
- gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
- t####.####.com/click?cid=####&s1=####&s2=####
- go####.nl/gen_204?atyp=####&ct=####&cad=####&tt=####&ei=####&zx=####
- c####.####.com/landings/58300/1492784968/images/relation_1.jpg
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- go####.nl/xjs/_/js/k=xjs.qs.nl.jDjm49QCb44.O/m=sy7,syi,em3,syh,aa,abd,sy...
- c####.####.com/landings/52883/1482505366/js/3a7fdc641354412698b8fd956002...
- p####.####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=##...
- c####.####.com/landings/58300/1492784968/images/age_1.jpg
- affshar####.com/mzARocGO-v?l2=####&l1=####
- go####.nl/gen_204?s=####&atyp=####&ei=####&imc=####&imn=####&imp=####&ad...
- c####.####.com/landings/58300/1492784968/images/relation_2.jpg
- statist####.com/adv_pxl?pid=####&id=####
- go####.nl/xjs/_/js/k=xjs.qs.nl.jDjm49QCb44.O/m=sx,c,sb_mob,bct,cdos,elog...
- c####.####.com/landings/52883/1482505366/css/48d987a611ca056488f760fcf73...
- t####.####.com/ck.php?id=####&transaction_id=####&subid_spx=####
- go####.nl/?gfe_rd=####&ei=####
HTTP POST requests:
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- u####.com/jsdk/sd.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/fileswapsdk/local/170502125740008.dex
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/wapsdk/run.dex
- /data/data/####/fileswapsdk/local/localCopy.data
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/shared_prefs/.xml
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 43 40 288800 /data/data/####/fileswapsdk/local/170502125740008.dex 1252621808 -1763713442 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/e
- /system/bin/dexopt --dex 27 40 40 37784 /data/data/####/files/wapsdk/run.dex 1252621699 -917542249 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
Contains functionality to send SMS messages automatically.
