Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- a####.####.org
- google-####.com
- cou####.####.ru
- p####.####.org
- keno####.####.tech
- pag####.####.com
HTTP GET requests:
- pag####.####.com/pagead/js/r20170130/r20170110/show_ads_impl.js
- google-####.com/analytics.js
- a####.####.org/androidgame_img/grand_theft_auto_vice_city/thumbs/grand_theft_auto_vice_city.jpg
- keno####.####.tech/3xXhJK
- p####.####.org/sort_popular_down/
- cou####.####.ru/hit;m_mob_org?q;t42.3####
- pag####.####.com/pagead/show_ads.js
- a####.####.org/androidgame_img/grand_theft_auto_iii/thumbs/grand_theft_auto_iii.jpg
- pag####.####.com/pagead/js/adsbygoogle.js
- a####.####.org/androidgame_img/pes_2012_pro_evolution_soccer/thumbs/pes_2012_pro_evolution_soccer.jpg
- a####.####.org/androidgame_img/minecraft/thumbs/minecraft.jpg
- cou####.####.ru/hit;m_mob_org?t42.3;r####
- a####.####.org/androidgame_img/the_amazing_spider_man_2/thumbs/the_amazing_spider_man_2.jpg
- a####.####.org/androidgame_img/need_for_speed_most_wanted/thumbs/need_for_speed_most_wanted.jpg
- a####.####.org/androidgame_img/geometry_dash/thumbs/geometry_dash.jpg
- a####.####.org/androidgame_img/gangstar_rio_city_of_saints/thumbs/gangstar_rio_city_of_saints.jpg
- keno####.####.tech/apk/PlayMobMarket.apk?utm_pakage=####
- a####.####.org/androidgame_img/tanks/thumbs/tanks.jpg
- a####.####.org/androidgame_img/grand_theft_auto_san_andreas/thumbs/grand_theft_auto_san_andreas.jpg
- a####.####.org/androidgame_img/wwe_2k/thumbs/wwe_2k.jpg
- a####.####.org/androidgame_img/sid_story/thumbs/sid_story.jpg
HTTP POST requests:
- keno####.####.tech/gJrFWX?utm_pakage=####
Modified file system:
Creates the following files:
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/databases/db_metrica_####_13-journal
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/databases/metrica_client_data.db-journal
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/databases/metrica_client_data.db
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/files/metrica_client_data.db.lock
- /sdcard/Download/game.apk
- /data/data/####/databases/db_metrica_####_20799a27-fa80-4b36-b2db-0f8141f24180-journal
- /data/data/####/files/credentials.dat
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
