Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- c####.####.net
- d3v1lb8####.####.net
- events####.####.com
- eve####.####.com
HTTP GET requests:
- d3v1lb8####.####.net/output_static/ui/browser-forward-x1.png
- d3v1lb8####.####.net/output_static/ui/rocket-icon-embossed.png
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-confirm-normal-x2.png
- d3v1lb8####.####.net/output_static/ui/v4vc-alert-bg-x2.png
- d3v1lb8####.####.net/output_static/ui/browser-stop-x1.png
- d3v1lb8####.####.net/output_static/ui/browser-back-x1.png
- d3v1lb8####.####.net/output_static/ui/v4vc-bg-full.png
- d3v1lb8####.####.net/output_static/ui/end-card-replay-normal-x2.png
- d3v1lb8####.####.net/output_static/ui/browser-bar-background.png
- d3v1lb8####.####.net/output_static/ui/bg-applelinen-tile.png
- d3v1lb8####.####.net/output_static/ui/browser-close-x1.png
- d3v1lb8####.####.net/output_static/ui/browser-reload-x1.png
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-confirm-down-x2.png
- d3v1lb8####.####.net/output_static/ui/v4vc-alert-logo-x2.png
- d3v1lb8####.####.net/output_static/ui/browser-logo-tablet-x1.png
- c####.####.net/output/videos/hd_74430.m4v
- d3v1lb8####.####.net/output_static/ui/end-card-close-normal-x2.png
- d3v1lb8####.####.net/output_static/ui/end-card-close-down-x2.png
- d3v1lb8####.####.net/output_static/ui/tiny-glow.png
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-cancel-down-x2.png
- d3v1lb8####.####.net/mraid/production/adc_mraid-tablet-android.js
- d3v1lb8####.####.net/output_static/ui/end-card-replay-down-x2.png
- d3v1lb8####.####.net/output_static/ui/v4vc-btn-cancel-normal-x2.png
HTTP POST requests:
- eve####.####.com/t/5.0/install?pl=####
- events####.####.com/t/5.0/session_start?pl=####
Modified file system:
Creates the following files:
- /data/data/####/files/adc/media/1.png
- /data/data/####/files/adc/media/3.png
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/files/INSTALLATION
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml
- /data/data/####/files/adc/media/21.png
- /data/data/####/files/adc/data/media_info.txt
- /data/data/####/files/adc/media/22.png
- /data/data/####/shared_prefs/####_boundentrypreferences.xml
- /data/data/####/shared_prefs/####_migrationpreferences.xml
- /data/data/####/files/adc/media/4.png
- /data/data/####/files/adc/media/15.png
- /data/data/####/files/adc/media/17.png
- /data/data/####/shared_prefs/####_boundentrypreferences.xml.bak
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/files/gaClientId
- /data/data/####/files/adc/media/20.png
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/####_initpreferences.xml
- /data/data/####/cache/com.parse/applicationId
- /data/data/####/files/adc/data/tracking_info.txt
- /data/data/####/shared_prefs/####_startupserviceinfopreferences.xml.bak
- /data/data/####/shared_prefs/####_servertimeoffset.xml
- /data/data/####/files/adc/media/19.png
- /data/data/####/files/asdfg
- /data/data/####/app_Parse/installationId
- /data/data/####/files/adc/media/23.m4v
- /data/data/####/databases/db_metrica_####-journal
- /data/data/####/shared_prefs/####_startupinfopreferences.xml.bak
- /data/data/####/databases/cognito_dataset_cache.db-journal
- /data/data/####/files/adc/media/16.png
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/databases/metrica_data.db-journal
- /data/data/####/shared_prefs/####_startupinfopreferences.xml
- /data/data/####/files/adc/media/8.png
- /data/data/####/files/adc/media/9.png
- /data/data/####/shared_prefs/####_initpreferences.xml.bak
- /data/data/####/app_app_apk/hotelstory.dat.jar
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/adc/media/10.png
- /data/data/####/files/adc/media/12.png
- /data/data/####/files/adc/media/13.png
- /data/data/####/files/adc/media/18.js
- /data/data/####/files/adc/media/2.png
- /data/data/####/shared_prefs/####_serviceproviderspreferences.xml
- /data/data/####/files/adc/media/5.png
- /data/data/####/files/adc/media/6.png
- /data/data/####/app_Parse/currentUser
- /data/data/####/files/adc/media/14.png
- /data/data/####/files/adc/media/7.png
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-1847835108.zip
- /data/data/####/shared_prefs/com.amazonaws.android.auth.xml
- /data/data/####/files/adc/data/zone_state.txt
- /data/data/####/databases/awss3transfertable.db-journal
- /data/data/####/shared_prefs/com.happylabs.util.xml
- /data/data/####/files/save.dat
- /data/data/####/files/adc/media/11.png
- /data/data/####/files/adc/data/manifest.txt
- /data/data/####/app_sslcache/hs.hotel-story.com.443
- /data/data/####/files/credentials.dat
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
