Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.125.origin
Downloads the following detected threats from the Web:
- Android.HiddenAds.125.origin
Network activity:
Connecting to:
- 2####.####.68:8288
- a####.####.com
- a####.####.org
- admobim####.com
- b####.####.com
- busi####.####.com
- c####.####.com
- co####.####.com
- d####.####.com
- f####.####.com
- face####.com
- g####.####.net
- j####.####.com
- m####.####.com
- mmmmmm####.com
- n####.####.com
- p####.####.com
- pag####.####.com
- pl####.####.com
- r####.####.com
- real####.####.org
- s####.####.com
- serv####.####.com
- t####.####.com
- t####.####.info
- technol####.####.uk
- trac####.####.com
- u####.####.com
HTTP GET requests:
- a####.####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pro...
- a####.####.org/rule?platform=####&os_version=####&package_name=####&app_...
- b####.####.com/beacon.js
- c####.####.com/?a=####&c=####&E=####&s1=####&s2=####
- c####.####.com/c/a5a2b7d0919aed13?click_id=####&install=####&pub=####&ga...
- c####.####.com/i.js
- c####.####.com/postback/getOfferjurl?info=####&adc=####&retry=####
- co####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=###...
- d####.####.com/M01/01/AC/CvJJDVlaMoyAHcWJAAX9MWSOHIg426.zip
- f####.####.com/css?family=####&ver=####
- f####.####.com/proc.php?7965df3####
- f####.####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4.ttf
- face####.com/plugins/likebox.php?href=####&w####&height=####&colorscheme...
- g####.####.net//prod/upload/adunion/images/304/244_244_e44ae4a84de7a07a....
- j####.####.com/t/e/technologycraze.net.105160.js?t=####
- m####.####.com/mghtml/framehtml/c/t/e/technologycraze.net.105160.html
- n####.####.com/get?model=####&signmd5=####&op=####&vendor=####&locale=##...
- pag####.####.com/pagead/js/adsbygoogle.js
- real####.####.org/realtime?platform=####&os_version=####&package_name=##...
- s####.####.com/public/uploads/dsp-files/apk/d34c8063f6a82577e7cf76371ad7...
- serv####.####.com/119987?t=####&ref=####&lu=####
- t####.####.com/c/hTjpw01gEuhkMDq4Qk3yboSv-c9PH1wKnqu2rHGQF-U/CF?subid1=#...
- t####.####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=#...
- t####.####.info/click?_type=####&sdk_redir=####&campid=####&sub_channel=...
- technol####.####.uk/wp-content/plugins/wp-share-buttons/style/front.end....
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&clickid=###...
- u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod...
HTTP POST requests:
- 2####.####.68:8288/logsp.do
- a####.####.com/detail/getOfferListNew?enc=####
- admobim####.com/surl/api2_reg.action
- busi####.####.com/business/request
- mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####&cid...
- p####.####.com/api/data?token=####&tk=####&sv=####
- pl####.####.com/ad_dex.php
- r####.####.com/business/active
- s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/block/mmcblk0/device/cid
- /system/bin/cat /sys/block/mmcblk1/device/cid
- /system/bin/cat /sys/block/mmcblk2/device/cid
- /system/bin/cat /sys/block/mmcblk3/device/cid
- <dexopt>
