Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) 1####.217.17.46:443
DNS requests:
- ads.finger####.net
- mt####.go####.com
- www.google-####.com
HTTP GET requests:
- www.google-####.com/__utm.gif?utmwv=####&utmn=####&utmcs=####&utmsr=####...
Modified file system:
Creates the following files:
- /data/data/####/ADMANAGER_SETTINGS.xml
- /data/data/####/DCwwnAXLU
- /data/data/####/MultiDex.lock
- /data/data/####/_tf_ab.xml
- /data/data/####/_tf_deviceid.txt
- /data/data/####/_tf_pinkerton.json
- /data/data/####/_tf_store.xml
- /data/data/####/androeed.xml
- /data/data/####/benjibananas.dat.jar
- /data/data/####/cbPrefs.xml
- /data/data/####/com.fingersoft.benjibananas_preferences.xml
- /data/data/####/google_analytics.db
- /data/data/####/google_analytics.db-journal
- /data/data/####/mq_scores.json
- /data/data/####/multidex.version.xml
- /data/data/####/scores.xml
- /data/data/####/settings.conf
- /data/data/####/tmp-com.fingersoft.benjibananas-1.apk.classes15...50.zip
- /data/data/####/webview.db
- /data/data/####/webview.db-shm
- /data/data/####/webview.db-wal
- /data/data/####/webviewCookiesChromium.db
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db
Miscellaneous:
Loads the following dynamic libraries:
- DCwwnAXLU
- jni
Displays its own windows over windows of other applications.
