Android.Packed.22266

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.1.origin

Network activity:

Connecting to:

c####.####.net
a####.####.net
r####.####.com
s####.####.info
a####.####.com
st####.####.com
moreade####.com:8080
moreade####.com

HTTP GET requests:

moreade####.com/notify/?sdk_version=####&android_sdk=####&device_type=##...
r####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
r####.####.com/nad?v1=####&model=####&dx=####&dy=####&accept=####&slot_c...
c####.####.net/images/8dcacf602866c5f2ce03f18a9b93f4e9.jpg
moreade####.com/ads/?sdk_version=####&android_sdk=####&device_type=####&...
r####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...
st####.####.com/magicera.jpg

HTTP POST requests:

r####.####.com/device?api_key=####
r####.####.com/pix?event=####&ts=####&platform=####&model=####&package_n...
a####.####.net/show_t
a####.####.net/register_t
a####.####.com/app_logs
moreade####.com:8080/ads/
s####.####.info/stat3.php
moreade####.com/register/

Modified file system:

Creates the following files:

<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
<Package Folder>/shared_prefs/MobilerStats.xml.xml
<Package Folder>/cache/1468357373244.jar
<Package Folder>/shared_prefs/appsflyer-data.xml.bak
<Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
<Package Folder>/shared_prefs/uuid.xml.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml
<Package Folder>/files/file
<Package Folder>/shared_prefs/appsflyer-data.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/achievement_data.xml
<Package Folder>/shared_prefs/achievement_data.xml.bak
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
<Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes1941216895.zip
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
<Package Folder>/cache/1468357373244.tmp
<Package Folder>/app_app_apk/racingmoto.dat.jar
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/code_cache/secondary-dexes/MultiDex.lock
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/MoreExchangeAdvertiserState.xml
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0