Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.627.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cp####.mobisma####.com:80
- TCP(HTTP/1.1) api.ap####.com:80
- TCP(HTTP/1.1) cl####.mob####.net:80
- TCP(HTTP/1.1) p####.admobc####.com:80
- TCP(HTTP/1.1) c####.appsc####.mobi:80
- TCP(HTTP/1.1) api.migh####.com:80
- TCP(HTTP/1.1) clinkad####.com:80
- TCP(HTTP/1.1) www.myapps4####.com:80
- TCP(HTTP/1.1) www.f####.com:80
- TCP(HTTP/1.1) t####.xgying####.com:80
- TCP(HTTP/1.1) t####.mobfire####.com:80
- TCP(HTTP/1.1) duc####.b####.com:80
- TCP(HTTP/1.1) trk.iskywo####.com:80
- TCP(HTTP/1.1) gl####.ymtrac####.com:80
- TCP(HTTP/1.1) c####.howdo####.net:80
- TCP(HTTP/1.1) t####.smard####.com:80
- TCP(HTTP/1.1) ssp.nan####.com:80
- TCP(HTTP/1.1) cdn.img.coo####.org:80
- TCP(HTTP/1.1) 5####.77.99.53:80
- TCP(HTTP/1.1) dsa.startap####.edg####.net:80
- TCP(HTTP/1.1) s####.adin####.com:80
- TCP(HTTP/1.1) c####.u.appco####.com:80
- TCP(HTTP/1.1) cl####.qh####.com:80
- TCP(SSL/3.0) a####.app####.com:443
- TCP(TLS/1.0) cl####.dis####.io:443
- TCP(TLS/1.0) t####.mob####.com:443
- TCP(TLS/1.0) t.api.y####.net:443
- TCP(TLS/1.0) bcd.lk####.com:443
- TCP(TLS/1.0) api-####.coo####.org:443
- TCP(TLS/1.0) www.f####.com:443
- TCP(TLS/1.0) a####.app####.com:443
DNS requests:
- a####.app####.com
- api-####.coo####.org
- api.ap####.com
- api.migh####.com
- bcd.lk####.com
- bulk-c####.startap####.com
- c####.appsc####.mobi
- c####.howdo####.net
- c####.u.appco####.com
- cdn.img.coo####.org
- cl####.dis####.io
- cl####.mob####.net
- cl####.qh####.com
- clinkad####.com
- cp####.mobisma####.com
- duc####.b####.com
- gl####.ymtrac####.com
- offers####.adflush####.com
- p####.admobc####.com
- s####.adin####.com
- ssp.nan####.com
- t####.mob####.com
- t####.mobfire####.com
- t####.smard####.com
- t####.xgying####.com
- t.api.y####.net
- t.mob####.net
- trk.iskywo####.com
- www.f####.com
- www.myapps4####.com
HTTP GET requests:
- api.ap####.com/link/buy/android/com.owl.clean/e1?clinkID=####&pubID=####...
- api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
- c####.appsc####.mobi/index.php?m=####&p=####&app_id=####&offer_id=####&a...
- c####.howdo####.net/aff_c?offer_id=####&affiliate_id=####&gaid=####&devi...
- c####.u.appco####.com/v1/click?oid=####&affid=####&package_name=####&tid...
- c####.u.appco####.com/v1/click?oid=####&affid=####&tid=####&sub_affid=##...
- cdn.img.coo####.org/2018-06-08/4304f0d5f63836a5dda722d02b0dd4a0.jar
- cl####.mob####.net/target/t.mobrand.net/tracking/aff/W2ffISZ9SweBY07DQw2...
- cl####.mob####.net/target/t.mobrand.net/tracking/aff/ntzEKHQdR6CrP1_kwqz...
- cl####.mob####.net/tracking/aff/W2ffISZ9SweBY07DQw2JaQ/atYa1hhdTJ2aaqreP...
- cl####.mob####.net/tracking/aff/ntzEKHQdR6CrP1_kwqzwNQ/dmbaD_HGSrqRVr4e0...
- cl####.qh####.com/index.php?m=####&p=####&app_id=####&offer_id=####&aff_...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid1=####&si...
- cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVGUFpYW...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&aff_sub=####&...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&google_aid=##...
- gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&aff_sub6...
- p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
- s####.adin####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=#...
- ssp.nan####.com/aff/ssp/click?channel=####&uuid=####&id=####&aoid=####&c...
- t####.mobfire####.com/data/click?cid=####&affid=####&sub_par####&gaid=##...
- t####.smard####.com/agentapi/click?cid=####&aid=####&ext1=####&ext2=####...
- t####.xgying####.com/aff?affid=####&oid=####&clickid=####&gaid=####&sub1...
- trk.iskywo####.com/click?id=####&aff=####&ost=####&aff_sub=####&click_id...
- www.f####.com/red.php?utm_source=####&app_id=####&country=####&package=#...
- www.myapps4####.com/apps?data=Qn####
HTTP POST requests:
- s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
- s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
Modified file system:
Creates the following files:
- /data/data/####/1195343759.jar
- /data/data/####/1195343793.jar
- /data/data/####/app_Ckcko.jar
- /data/data/####/ini.conf.xml
- /data/data/####/mc_cache.db-journal
- /data/data/####/tpaxf
- /data/data/####/webview.db-journal
- /data/data/####/wqsgmh
- /data/media/####/2e248f2f6eaeabd5cca797314a7b92c8.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /proc/cpuinfo
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Loads the following dynamic libraries:
- tpaxf
Uses the following algorithms to encrypt data:
- AES
- Des-ECB-NoPadding
Uses the following algorithms to decrypt data:
- AES
- Des-ECB-NoPadding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
