Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.79.origin
Network activity:
Connecting to:
- trac####.####.com
- ce####.####.org
- con####.####.nl
- w####.####.com
- b####.####.com
- s####.####.com
- i####.####.com
- teleg####.####.nl
- google-####.com
- p####.####.com
- f####.####.com
- gl####.####.com
- s####.####.net
- st####.####.com
- pag####.####.com
- im####.####.com
- c6ba1cd####.####.com
- c####.####.org
- m####.####.nl
- be####.####.net
- a####.####.io
- gst####.com
- h####.com
- a####.####.com
- t####.####.com
- c####.####.net
- cloudfr####.####.com
- c####.####.com
- d####.####.com
- j####.####.net
- a276f7d####.####.net
HTTP GET requests:
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- c####.####.org/2017-04-06/3a2b0b996231360cb1062ab0898e4cf3.jpg!240
- im####.####.com/js/core/bridge3.169.1_en.html
- c####.####.org/2017-04-07/a7500f39164a6ab62bcf9ef7b667a07e.jpg!240
- ce####.####.org/v3/system/countrys.json
- b####.####.com/p2?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12...
- h####.com/js/bundles/partner-article.js?squizard?bust=####
- teleg####.####.nl/static/build/site_759acf5a9278.min.js
- m####.####.nl/static/img/icon-share.png
- m####.####.nl/hls/account=Kx1PKc/item=07VErYYRmo6l/07VErYYRmo6l.m3u8
- h####.com/content?url=####
- st####.####.com/image/adchoices/nl/13/153,153,153/0/1.png
- c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
- a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
- s####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
- c####.####.net/userdata/get?pub=####&technographics=####&callback=####
- s####.####.net/instream/video/client.js
- gst####.com/cv/js/sender/v1/cast_sender.js
- con####.####.nl/img/account=Kx1PKc/item=6jdFlI8C4s2B/thumbid=2/image.jpg
- pag####.####.com/pagead/gen_204?id=####&v=####&r=####&efm=####&if=####&s...
- google-####.com/analytics.js
- con####.####.nl/img/account=Kx1PKc/item=07VErYYRmo6l/thumbid=16/image.jpg
- m####.####.nl/tv/vndg/article/28249847/indrukwekkende-stilte-bij-toppers
- teleg####.####.nl/tv/vndg/28249847/__Indrukwekkende_stilte_bij_Toppers__...
- teleg####.####.nl/static/build/site_article_87251f30adaf.min.js
- c####.####.org/2017-04-06/a9aaf531a1ddfc24b1edd0ddb588985b.jpg!240
- con####.####.nl/img/account=Kx1PKc/item=wgMEnsuRkd6l/thumbid=2/image.jpg
- teleg####.####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e...
- h####.com/css/fonts/roboto-v15-latin-regular.ttf
- h####.com/js/bundles/cookies.js
- w####.####.com/6ed84a8b77cf.js?lv=####
- c####.####.net/pixel?google_nid=####&googl####&id=####
- con####.####.nl/img/account=Kx1PKc/item=gLdMj8qTyZ6B/thumbid=2/image.jpg
- c####.####.com/js/2759701342.js
- st####.####.com/imageserver/c/37555/28250789/94/70/17280.jpg
- h####.com/article/58e7098b66f6003903b7e795?view=####
- con####.####.nl/img/account=Kx1PKc/item=i4UMhuqBzc6B/thumbid=11/image.jpg
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- cloudfr####.####.com/x.png
- h####.com/css/fonts/roboto-v15-latin-500.ttf
- c####.####.net/controltag?confid=####
- c####.####.org/2017-04-07/fabf27abf6c51b63b710bf1963db5604.jpg!240
- st####.####.com/imageserver/c/37555/28250394/94/70/16425.jpg
- con####.####.nl/img/account=Kx1PKc/item=3odMj8sBrlaB/thumbid=2/image.jpg
- con####.####.nl/player/js/streamone-player-v2.adblock-detect.min.js
- m####.####.nl/static/img/whatsapp-share-button.png
- f####.####.com/event/?friendid=####&frienddomainid=####&widgetid=####&it...
- st####.####.com/image/resized/c/30595/0ai2TuaOgdI3s53_1_147464080457e53b...
- con####.####.nl/dot.gif?item=####&ts=####&progress=####&il=####&event=##...
- be####.####.net/usermatch.gif?partner=####&partner_uid=####
- con####.####.nl/player/plugins/dist/tmg-analytics/tmg-analytics.min.js
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- p####.####.com/sync/img?redir=####
- st####.####.com/async/c8ba1b9de1a55b69829e5f72/PLISTA.js
- st####.####.com/image/adchoices/nl/10/999999/0/2.png
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.1.js?utv=####
- con####.####.nl/embed/account=Kx1PKc/player=QoRMw6uC0x01/item=07VErYYRmo...
- c6ba1cd####.####.com/58e7098b66f6003903b7e795_500x333.jpg
- c####.####.org/2017-04-07/9f18a7ed2ea7a3ee62b4247ce5055033.jpg!240
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.8.js?utv=####
- im####.####.com/js/sdkloader/loader.js
- m####.####.nl/static/img/abonnementen.png
- i####.####.com/s
- h####.com/js/jquery.js
- c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
- c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
- t####.####.com/38645a54-e22a-423a-ac19-3d3ab0c47678?app_id=####&cid=####
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&clickId=####&s...
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.js
- pag####.####.com/pagead/gen_204?request_type=####&lid=####&sdkv=####&e=#...
- c####.####.org/2017-05-02/a58184d0c91bbef500c711bd1d4ad0b3.jpg
- con####.####.nl/img/account=Kx1PKc/item=yCNEpIORt9ah/thumbid=17/image.jpg
- be####.####.net/usermatch.gif?adnxs_uid=####
- j####.####.net/G07609/b3/Z/3/120814/640732347.js?D=####&C=####&asidi=####
- teleg####.####.nl/graphics/videopage/play25.474a26e5402cfd0d640965345065...
- c####.####.org/2017-04-06/dfe80d77f63081f012ce0d4dec9f3595.jpg!240
- pag####.####.com/pagead/js/r20170522/r20170110/show_ads_impl.js
- con####.####.nl/img/account=Kx1PKc/item=SRdFqO8B00-l/thumbid=2/image.jpg
- ce####.####.org/v3/system/initcountrytopic.json
- t####.####.com/tm42098.js
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.5.js?utv=####
- c####.####.org/v2/content/article1-46765834-c54d3c7cc841493e345a3ab53f05...
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1495006####
- pag####.####.com/pagead/gen_204?rt=####&lid=####&sdkv=####&e=####&id=###...
- c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
- c####.####.org/v2/system/version-1-96.json
- c####.####.org/2017-04-06/fc92bd8697c828ca6f0e9a91343c180a.jpg!240
- teleg####.####.nl/static/build/app.2fc85aff6ebb99a0ac57c2bc7d8b89e5.js
- ce####.####.org/v2/content/getItemDetails-46765834.json
- c####.####.org/v2/system/startimg-NL.json
- s####.####.com/audience_sync/9?redir=####
- t####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
- c####.####.com/index.php?service=####&pub=####&offer_id=####&subpub=####
- a####.####.io/latest?base=####
- a276f7d####.####.net/test.png
- pag####.####.com/pagead/js/adsbygoogle.js
- con####.####.nl/img/account=Kx1PKc/item=ygcNr6uBlY-B/thumbid=2/image.jpg
- con####.####.nl/img/account=Kx1PKc/item=RrFEmaoTqMWl/thumbid=10/image.jpg
- d####.####.com/deploy/js_visitor_settings.php?v=####&a=####&url=####&ran...
- con####.####.nl/player/skin/default/streamone.css
- c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
- im####.####.com/js/sdkloader/ima3.js
- c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
- be####.####.net/optout_check?callback=####
- m####.####.nl/hls/account=Kx1PKc/item=07VErYYRmo6l/0acNjYeBm8WF-RSUEjIKD...
- c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.sync.js
- p####.####.com/sync/img?redir=####&mm####&mm####
- t####.####.com/oz/feeds/krux/tokens?afu=####
- teleg####.####.nl/static/img/placeholder.png
- st####.####.com/image/logo_plista_small_aaaaaa.png
- con####.####.nl/img/account=Kx1PKc/item=oAdNhYKSiYyl/thumbid=6/image.jpg
- c####.####.org/v2/system/languages.json
- teleg####.####.nl/static/build/site_1489061730.min.css
- j####.####.net/gateway/gw.js?csid=####&auto=####
- t####.####.com/agentapi/click?cid=####&aid=####&postbac####
- d####.####.com/v.gif?a=####&d=####&u=####&h=####&r=####
- st####.####.com/async.js
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####
- con####.####.nl/img/account=Kx1PKc/item=DRVMgYMRiF6F/thumbid=11/image.jpg
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.20.js?utv=####
- f####.####.com/async_lib.js?json=####&x=####
- c####.####.org/v2/system/models-96.json
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.14.js?utv=####
- i####.####.com/bounce?%2Fgetu####
- c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
- c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
- c####.####.net/ctjs/controltag.js.7dbac51c9aa7b4135991e8daeb9ced57
- c####.####.net/controltag/qxniyymwl.js
- h####.com/css/partner-article.css?bust=####
- con####.####.nl/player/js/lang/all-languages.js
- ce####.####.org/v2/content/recommend-c54d3c7cc841493e345a3ab53f057cf5-NL...
- st####.####.com/c/hotjar-27367.js?sv=####
- st####.####.com/image/resized/c/36024/z71CyT4Zwd3bdu5.1456486126_4_14889...
- c####.####.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
- c####.####.org/2017-04-06/99dc1ad8e6f6c1531ba0b43126184f33.jpg!240
- be####.####.net/pixel.gif?source=####&fired=####&confid=####&_kpid=####&...
- i####.####.com/getuid?http://beacon.krxd.net/usermatch.gif?adnxs_uid=####
- con####.####.nl/playlist/account=Kx1PKc/item=07VErYYRmo6l/player=QoRMw6u...
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- pag####.####.com/pagead/gen_204?pid=####&d####&if=####&lid=####&sdkv=###...
- m####.####.nl/static/img/nixel.gif
- con####.####.nl/img/account=Kx1PKc/item=zAMMl6OTlo-l/thumbid=2/image.jpg
- f####.####.com/iframeShowItem.php?itemid%5B0%5D=####&type=####&bv=####
- m####.####.nl/?utm_source=####&utm_medium=####&utm_campaign=####&utm_con...
- st####.####.com/imageserver/c/37555/28246742/94/70/16378.jpg
- s####.####.com/genericusersync.ashx?dpid=####
- ce####.####.org/v3/commentlist-46765834-c54d3c7cc841493e345a3ab53f057cf5...
- b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=...
- j####.####.net/G07609/b3/0/3/120814/640732347.js?D=####&C=####
- t####.####.com/utag/tiqapp/utag.v.js?a=####&cb=####
- t####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
- t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.26.js?utv=####
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/api/ads/fetch?_s=####
- a####.####.com/api/ads/connect
- ce####.####.org/auth/gather
- a####.####.com/ad-service/ad/mark
Modified file system:
Creates the following files:
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/files/.yflurryfreqcap.-3604fbe1ac7f4f1c
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/files/.yflurrydatasenderblock.5dcfe33a-6e65-420d-bc7a-4a0aa3fd1f51
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/files/.yflurryreport.-3604fbe1ac7f4f1c
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/sessions/sessionFile
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/.yflurryadlog.-3604fbe1ac7f4f1c
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/files/.imprint
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/cache/webviewCacheChromium/f_00001c
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/shared_prefs/v2_local_login.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/validatorFile
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/cache/webviewCacheChromium/f_00001d
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_XS7MGCQYH4WTKK82VNTC_216
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
