Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) twi####.com:80
- TCP(HTTP/1.1) upto####.com.edg####.net:80
- TCP(HTTP/1.1) j####.ru:80
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) adman####.upto####.com:443
- TCP(TLS/1.0) upto####.com.edg####.net:443
- TCP(TLS/1.0) cs2-wa####.8####.e####.net:443
- TCP(TLS/1.0) syndica####.twi####.com:443
- TCP(TLS/1.0) ds-ak####.akam####.net.####.net:443
- TCP(TLS/1.0) twi####.com:443
- TCP(TLS/1.0) mo####.twi####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) 1####.217.20.78:443
DNS requests:
- adman####.upto####.com
- ds-ak####.akam####.net
- img.ut####.com
- j####.ru
- ma.t####.com
- mo####.twi####.com
- pbs.t####.com
- s####.g.doublec####.net
- stc.ut####.com
- syndica####.twi####.com
- twi####.com
- vulkani####.ru.upto####.com
- www.google-####.com
HTTP GET requests:
- j####.ru/34233/vulkan_minecraft
- twi####.com/
- upto####.com.edg####.net/android
Modified file system:
Creates the following files:
- /data/data/####/SKhlpDFeP
- /data/data/####/com.mojang.minecraftpemod_preferences.xml
- /data/data/####/minecraftpemod.dat.jar
- /data/data/####/multidex.version.xml
Miscellaneous:
Loads the following dynamic libraries:
- SKhlpDFeP
Uses administrator priveleges.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
