Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- i####.####.com
- z####.ru
- sp####.####.com
- p####.####.com
- c####.####.com
- alda####.net
HTTP GET requests:
- i####.####.com/ad/9/a/3/1482160867_7abccd98b31a.js
- c####.####.com/mobile/1.3.2/jquery.mobile-1.3.2.min.js
- alda####.net/wingames/mobile_master/themes/style.min.css
- sp####.####.com/mobiledirect/?aid=####&uid=####&wsid=####&subid=####
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- i####.####.com/ad/b/a/s/1482160850_1f9489272733.js
- c####.####.com/mobile/1.3.2/images/icons-18-white.png
- alda####.net/wingames/mobile_master/themes/iphone/img_00.jpg
- alda####.net/wingames/mobile_nl-iphone/index.php?utm_campaign=####&utm_source=####&pk_origen=####
- c####.####.com/jquery-1.9.1.min.js
- i####.####.com/ad/c/9/4/1482160882_fac8eea8cf87.js
- alda####.net/js/getByCp/getByCp_v2.js
- sp####.####.com/mobiledirect/?aid=####&uid=####&cwsid=####&subid=####
- p####.####.com/info_flux.php?op=####&id=####&of=####&ul=####
- c####.####.com/?a=####&c=####&p=####&E=####&s1=####&s2=####
- alda####.net/wingames/mobile_master/js/mutecoac.min.js
- alda####.net/wingames/premiumgift_nl-iphone/index.php
- alda####.net/js/master_system/mailCheck/loadmailcheck.min.js?_=####
- alda####.net/js/master_system/mailCheck/mailcheck.min.js?_=####
- c####.####.com/mobile/1.3.2/images/ajax-loader.gif
- i####.####.com/ad/v/k/x/1482160874_32da67abcccf.js
- z####.ru/sh?keyword=####
- alda####.net/wingames/index.php?pk_campania=####&partner_param=####&partner_param2=####&partner_param3=####
- c####.####.com/mobile/1.3.2/jquery.mobile-1.3.2.min.css
- c####.####.com/jquery-migrate-1.2.1.min.js
HTTP POST requests:
- alda####.net/api/wingame/tv
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-19070512.zip
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/asdfg
- /data/data/####/app_app_apk/nfcrelay.dat.jar
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/shared_prefs/multidex.version.xml
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
