Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.76.origin
Network activity:
Connecting to:
- celery####.com
- v####.####.com
- b####.com
- j####.####.xyz
- t####.global
- bik####.com
- trackme####.com
- a####.####.com
HTTP GET requests:
- j####.####.xyz/?s3=####
- bik####.com/d/15143458cac3ab0e1bc?source=####&sub=####
- t####.global/view/lHTqZDHhsyHUOrZ4ihSalSksXYxTJcakGSMaWKX0Cs784MU?c=####...
- b####.com/rms/BingCore.Bundle/cj,nj/ea12a751/faef1996.js?bu=####
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- b####.com/az/hprichbg/rb/Dipper_ROW12905160494_768x1024.jpg
- trackme####.com/r/640dfb58-3fb2-11e7-9141-114198a5f591/1/
- celery####.com/06m03/W5tP/VZ9f/DdMJHqXB8rLFl49sNPvmB4qYnN93rrteAqjg5iEQh...
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- bik####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sourc...
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerMenuOnClick/cj,...
- a####.####.com/fd/ls/l?IG=####&CID=####&TYPE=####&DATA=####
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- b####.com/fd/ls/GLinkPing.aspx?IG=####&CID=####&ID=####
- b####.com/ImageResolution.aspx?w=####&h=####&hash=####&r=####
- t####.global/hrfp?url=####
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- b####.com/rms/rms%20answers%20Identity%20Mobile$MobileSnrWindowsLiveConn...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/?r=####
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- trackme####.com/r/640dfb58-3fb2-11e7-9141-114198a5f591/0/
- celery####.com/06m03/T5gKHQ/W5tP/X5ZeTvs/DdMJHqXB8rLFl49sNPvmB4qYnN93rrt...
- b####.com/Passport.aspx?popup=####
- b####.com/hpmob?r=####&IG=####&IID=####
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- b####.com/rms/AutoSug/cj,nj/2d1a3da6/dfed0777.js?bu=####
HTTP POST requests:
- b####.com/fd/ls/lsp.aspx?
- b####.com/fd/ls/lsp.aspx
- v####.####.com/api/u
- v####.####.com/api/l
- v####.####.com/api/o
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/jianrT_sharepreferenceFlag.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000023
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/shared_prefs/sp.xml
- <Package Folder>/cache/webviewCacheChromium/f_000018
- <Package Folder>/cache/webviewCacheChromium/f_000019
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000017
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/cache/webviewCacheChromium/f_00002c
- <Package Folder>/cache/webviewCacheChromium/f_00002b
- <Package Folder>/cache/webviewCacheChromium/f_00002a
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_www.instagram.com_0.localstorage-journal
- <Package Folder>/cache/webviewCacheChromium/f_00002e
- <Package Folder>/cache/webviewCacheChromium/f_00002d
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/jianrT_sharepreferenceFlag.xml
- <Package Folder>/cache/webviewCacheChromium/f_000025
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/shared_prefs/sp.xml.bak
- <Package Folder>/shared_prefs/admob.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/cache/webviewCacheChromium/f_000029
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000021
- <Package Folder>/cache/webviewCacheChromium/f_000020
- <Package Folder>/cache/webviewCacheChromium/f_000027
- <Package Folder>/cache/webviewCacheChromium/f_000026
- <Package Folder>/cache/1470286953684.jar
- <Package Folder>/cache/webviewCacheChromium/f_000024
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/databases/easv.data-journal
- <Package Folder>/cache/webviewCacheChromium/f_00001f
- <Package Folder>/cache/webviewCacheChromium/f_00001d
- <Package Folder>/cache/webviewCacheChromium/f_00001e
- <Package Folder>/cache/webviewCacheChromium/f_00001b
- <Package Folder>/cache/webviewCacheChromium/f_00001c
- <Package Folder>/cache/webviewCacheChromium/f_000022
- <Package Folder>/cache/webviewCacheChromium/f_00001a
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/admob.xml.bak
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/cache/1470286953684.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- <Package Folder>/cache/webviewCacheChromium/f_000028
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
