Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.79.origin
Downloads the following detected threats from the Web:
- Android.HiddenAds.79.origin
Network activity:
Connecting to:
- 3####.####.com
- t####.####.com
- trac####.####.com
- r####.####.com
- zn3vg####.####.net
- i####.####.com
- i2-phhm####.####.net
- c####.####.cc
- apirepo####.####.com
- p####.####.com
- ne####.####.com
- c####.####.com
- incapsu####.####.com
- fastlyb####.####.com
- clinkad####.com
- akab####.####.com
- chinac####.####.com
- glo####.####.com
- a####.####.com
- ced####.####.net
HTTP GET requests:
- c####.####.com/loading03.html
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- ne####.####.com/node2/275bmin.html?rnd=####
- t####.####.com/agentapi/click?cid=####&aid=####&postbac####
- r####.####.com/1495742568/radar.js
- a####.####.com/api/ads/record/click/?_s=####&oc1=####&oc2=####&provider=...
- a####.####.com/api/ads/record/si.installing/?_s=####&oc1=####&oc2=####&n...
- r####.####.com/f1/_CgJqMRAUGC4iBggBEOaTASi7mpHDDTDen1s43tKlyQVArYWrFUoUC...
- r####.####.com/n1/0/1495006161752/0/0/0/0/1495006161752/1495006161752/14...
- r####.####.com/1/18918/radar.js
- 3####.####.com/mscomtest/cedtest/r20.gif?rnd=####
- i2-phhm####.####.net/i2/1/18918/j1/20/46/1495006151/providers.json?image...
- i####.####.com/s
- akab####.####.com/node2/287min.html?rnd=####
- a####.####.com/api/ads/record/si.open.link/?_s=####&oc1=####&oc2=####&na...
- a####.####.com/api/ads/record/si.downloading/?_s=####&oc1=####&oc2=####&...
- glo####.####.com/ops/akamai/images/r20.gif?rnd=####
- incapsu####.####.com/img/r20.gif?rnd=####
- zn3vg####.####.net/img/214/r20.gif?rnd=####
- p####.####.com/img/482/r20.gif?rnd=####
- p####.####.com/img/221/r20.gif?rnd=####
- a####.####.com/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=##...
- apirepo####.####.com/apiClick?ts=####&clickId=####&ifa=####&cidRev=####&...
- a####.####.com/api/ads/record/si.downloaded/?_s=####&oc1=####&oc2=####&n...
- c####.####.com/loading03.gif
- r####.####.com/n1/0/1495006150039/0/0/0/0/1495006150039/1495006150039/14...
- fastlyb####.####.com/node_id.js?rnd=####
- ced####.####.net/img/32715/r20.gif?rnd=####
- fastlyb####.####.com/img/90/r20.gif?rnd=####
- p####.####.com/img/259/r20.gif?rnd=####
- a####.####.com/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=...
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- ne####.####.com/img/275/r20.gif?rnd=####
- p####.####.com/img/258/r20.gif?rnd=####
- chinac####.####.com/img/17/r20.gif?rnd=####
- c####.####.cc/files/gp/com.solidunion.callrecorder
- clinkad####.com/tracking?camp=####&gaid=####&pubid=####&sid=####&sid2=##...
- c####.####.com/files/da4b893d0926530e9f6764493d6675e1
- i2-phhm####.####.net/i2/1/18918/j1/20/46/1495006161/providers.json?image...
- r####.####.com/f1/_CgJqMRAUGC4iBggBEOaTASiTj7KPCDDen1s46dKlyQVArYWr9QRKF...
- chinac####.####.com/node2/17min.html?rnd=####
- akab####.####.com/img/287/r20.gif?rnd=####
HTTP POST requests:
- a####.####.com/api/data/d
- a####.####.com/api/ads/fetch?_s=####
- a####.####.com/api/push/connect
- a####.####.com/api/ads/record/si.goto/?_s=####&oc1=####&oc2=####&name=##...
- a####.####.com/api/ads/connect
Modified file system:
Creates the following files:
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/databases/reach.database.push-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
