Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.15976
Network activity:
Connecting to:
- t####.####.com
- inte####.center
- we####.com:8081
- woo####.com:7077
- quede####.com
- woo####.com
HTTP GET requests:
- inte####.center/nl/2?s1=####&s2=####&voluumdata=####&sub1=####&sub2=####&sub3=####&utm_campaign=####&source_id=####
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/no-button-ph.png
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/select.js
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/current-month.js
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/steps.js
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/css.css
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/agree-button-ph.png
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/loading.gif
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/css.dms
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/yes-button-ph.png
- quede####.com/99Q12/OjkYdA/Ljpd/KjdMJ2k/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L/fGdNIjM1MlF86AX81vHIDmsL-rI-Xzk?jch=####
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/index-ph.css
- inte####.center/nl/2/?s1=####&s2=####&voluumdata=####&sub1=####&sub2=####&sub3=####&utm_campaign=####&source_id=####
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/ok-button-ph.png
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/5.gif
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/timer.js
- quede####.com/99Q12/Ljpd/ID5N/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L?KjM=####
- t####.####.com/c5e2f4d6-5051-45ed-b9f3-f706accd3959?sub1=####&sub2=####&sub3=####&utm_campaign=####&source_id=####
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/next-button-ph.png
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/jquery.js
- inte####.center/nl/2/U%20krijgt%20naakt%20foto%27s%20te%20zien%20van%20iemand%20die%20u%20kent.%20Wees%20discreet%21_files/analytics.html
HTTP POST requests:
- woo####.com/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=####
- woo####.com:7077/sdk/nsd.action?b=####
- we####.com:8081/sm/sr/rt/ry
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/20160121.xml
- /data/data/####/shared_prefs/ar.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/c201703312150.apk
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /sdcard/test
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/shared_prefs/20160121.xml.bak
- /data/data/####/files/201703312150.apk
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/ar.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/databases/bdownloaders.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000003
Sets the 'executable' attribute to the following files:
- /data/data/####/files/c201703312150.apk
Miscellaneous:
Executes next shell scripts:
- logcat -d -v time
- .hulu -c id
- c201703312150.apk
- sh
- .hulu
Contains functionality to send SMS messages automatically.
