Technical information
Malicious functions:
Sends SMS messages:
- 54999818: YMN SDK503ED 6Y
Network activity:
Connecting to:
- lan####.net
- woo####.com:7079
- mobilep####.com
- x####.####.fr
- tra####.####.com
- 2####.####.155
- prelan####.net
- gl####.####.com:6566
- mobiles####.mobi
- d####.####.com
- woo####.com
- halla####.com
- gl####.####.com
- p####.####.fr
- st####.####.com
- a####.####.com
- hots####.me
HTTP GET requests:
- prelan####.net/adult/dating/hardcore/en/1/v1/css/app.css
- lan####.net/wps/PA_SDPSmartAPI/images/class5/subscribe.png
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/js/script.js
- gl####.####.com:6566/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub=####&aff_sub2=####&aff_sub3=####&aff_sub4=####
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_1.jpg
- hots####.me/images/cgimage/airtel/CGImage1.jpg
- tra####.####.com/?p=####&media_type=####&click_id=####
- p####.####.fr/hit/sponsor/wid=6189&site_id=4837&niche=52&dt=F00000NSXPMiyDKSvXtnIMvX0771qCsM&track1=Mobile&track2=894&pdv=auto&ex=0&exc_dl=1&type=4&of...
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/images/check.png
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/what-input/what-input.js
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.css
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/ajax-loader.gif
- 2####.####.155/cm-tracker/cmreqrec.do?pid=####&sysuid=####&cid=####&publish_id=####
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/images/3.gif
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick-theme.css
- x####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiyDKSvXtnIMvX0771qCsM/track1/Mobile/track2/894/pdv/auto/ex/0/exc_dl/1
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/foundation-sites/dist/foundation.js
- lan####.net/apk.php
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_4.JPG
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&pubID=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_2.jpg
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/css/style.css
- a####.####.com/pool_link/1514/bmconv_20170313115248_19fb54d5_0190_4322_a983_6381cbb826bd?domain=####
- d####.####.com/d/33164576433fd4daa1?sub=####
- halla####.com/landing/nl/tp/vpsdating/5/mobi/?pt1=####&p=####&pi=####&ctrack=####
- d####.####.com/ngw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- halla####.com/landing/nl/tp/vpsdating/5/mobi?pt1=####&p=####&pi=####&ctrack=####
- lan####.net/demo.php
- halla####.com/landing/nl/tp/vpsdating/5/mobi/js/countdown.js
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.css
- p####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiyDKSvXtnIMvX0771qCsM/track1/Mobile/track2/894/pdv/auto/ex/0/exc_dl/1
- mobiles####.mobi/?sl=####&data1=####&data2=####&data3=####&data4=####
- a####.####.com/pool_link/1514/bmconv_20170313115309_3fd85707_89dd_4635_ab6b_e3569f255fc1?domain=####
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/js/jquery.js
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.js
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.js
- a####.####.com/pool_link/1514/bmconv_20170313115255_3a50a4bc_6e62_4086_971b_79da11739783?domain=####
- gl####.####.com/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub=####&aff_sub2=####&aff_sub3=####&aff_sub4=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_3.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/js/app.js
- prelan####.net/adult/dating/hardcore/en/1/v1/step1.html
- prelan####.net/adult/dating/hardcore/en/1/v1/images/logo.png
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/jquery/dist/jquery.js
- st####.####.com/landing/nl/tp/vpsdating/5/mobi/images/loading4.gif
HTTP POST requests:
- woo####.com/jsdk/ss.action?b=####
- woo####.com:7079/jsdk/ss.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/com.hyjt.app.spf_wap_413.xml
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
Miscellaneous:
Contains functionality to send SMS messages automatically.
