Technical information
Malicious functions:
Sends SMS messages:
- 54999818: YMN SDK503ED 6Y
Network activity:
Connecting to:
- 2####.####.155
- and####.####.com
- ss####.com
- mobigif####.com
- trackme####.com
- woo####.com:7079
- prelan####.net
- for####.com
- x####.####.fr
- woo####.com
- gl####.####.com
- st####.####.com
- statist####.com
- mobiles####.mobi
- gl####.####.com:6566
- a####.####.com
- mobilep####.com
- tra####.####.com
- faceboo####.link
- c####.####.com
- d####.####.com
- of####.####.com
HTTP GET requests:
- prelan####.net/adult/dating/hardcore/en/1/v1/css/app.css
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi/js/jquery.js
- c####.####.com/landings/76902/1483451033/images/frl1.jpg
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi/images/thumbs.jpg
- gl####.####.com:6566/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub=####&aff_sub2=####&aff_sub3=####&aff_sub4=####
- x####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiwXe9DGqOZRsY1xVIPBRy/track1/Mobile/track2/894/pdv/auto/ex/0/exc_dl/1
- st####.####.com/landing/nl/tp/vpsdating/6/mobi/images/bg-android3.png
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.css
- trackme####.com/r/9acd769c-0550-11e7-80b7-1141961c8be1/0/
- trackme####.com/r/865d85e4-0550-11e7-aaa1-1141350aed19/0/
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/what-input/what-input.js
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_1.jpg
- of####.####.com/prelander/default_mai/mai.html?url=aHR####&co=####
- d####.####.com/d/33164576433fd4daa1?sub=####
- of####.####.com/prelander/lib/lib.js
- c####.####.com/landings/76902/1483451033/css/style.css?148345####
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.js
- faceboo####.link/c/da57dc555e50572d?s1=####&s2=####&s3=####&click_id=####&
- c####.####.com/landings/76902/1483451033/js/function.js?148345####
- for####.com/29A667/FtsG/AthB/BtVQv_8/VJAH5aPRtyHqTxBkOVps_nHQ8FhoJu_Odjy9VlmXI7NTWz_ixPg/UIVW7qfK4yfnSho3aFh0-zKco-36_BQ?jch=####
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/ajax-loader.gif
- 2####.####.155/cm-tracker/cmreqrec.do?pid=####&sysuid=####&cid=####&publish_id=####
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi?pt1=####&p=####&pi=####&ctrack=####
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick-theme.css
- a####.####.com/pool_link/1514/bmconv_20170310061511_cfb4921e_b4ca_4bfc_a51e_761da50a9b1a?domain=####
- a####.####.com/pool_link/1514/bmconv_20170310061516_c4497038_0f76_4ca3_8191_805f0cbf5e94?domain=####
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/foundation-sites/dist/foundation.js
- for####.com/get/iad/1-297-f4b41b1267f8a9d1ab8084d93d044e5b?cl=####&clickid=####&ext1=####&ext2=####&_uu=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_4.JPG
- c####.####.com/landings/76902/1483451033/images/pl5_l.jpg
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&pubID=####
- faceboo####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=####&s2=####&s3=####&s5=####
- c####.####.com/landings/76902/1483451033/images/frl3.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_2.jpg
- a####.####.com/pool_link/1514/bmconv_20170310061514_311d9758_3132_45d1_b5b8_f275f35c6886?domain=####
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi/js/script.js
- trackme####.com/r/9acd769c-0550-11e7-80b7-1141961c8be1/1/
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi/?pt1=####&p=####&pi=####&ctrack=####
- c####.####.com/landings/76902/1483451033/images/loading_ne5.gif
- trackme####.com/r/865d85e4-0550-11e7-aaa1-1141350aed19/1/
- x####.####.fr/hit/sponsor/wid=6189&site_id=4837&niche=52&dt=F00000NSXPMiwXe9DGqOZRsY1xVIPBRy&track1=Mobile&track2=894&pdv=auto&ex=0&exc_dl=1&type=4&of...
- mobigif####.com/landing/nl/tp/vpsdating/6/mobi/css/style.css
- c####.####.com/landings/76902/1483451033/images/frl4.jpg
- c####.####.com/landings/76902/1483451033/images/warning.png
- c####.####.com/landings/76902/1483451033/images/frl2.jpg
- for####.com/get/iad/1-297-ad8096f664aff24bf13ab044067e2e29?cl=####&clickid=####&ext1=####&ext2=####&_uu=####
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.css
- mobiles####.mobi/?sl=####&data1=####&data2=####&data3=####&data4=####
- tra####.####.com/?p=####&media_type=####&click_id=####
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/featherlight.min.js
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/jquery/dist/jquery.js
- c####.####.com/landings/76902/1483451033/js/avsc2.js?148345####
- st####.####.com/landing/nl/tp/vpsdating/6/mobi/images/logo-whatsapp.png
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_3.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/step1.html
- prelan####.net/adult/dating/hardcore/en/1/v1/js/app.js
- statist####.com/adv_pxl?pid=####&id=####
- ss####.com/?a=####&c=####&s1=####&s2=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/logo.png
- gl####.####.com/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub=####&aff_sub2=####&aff_sub3=####&aff_sub4=####
HTTP POST requests:
- and####.####.com/rqd/async
- woo####.com/jsdk/ss.action?b=####
- woo####.com:7079/jsdk/ss.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/com.hyjt.app.spf_wap_413.xml
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /sdcard/update.data
- /data/data/####/files/security_info
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.board.platform
Contains functionality to send SMS messages automatically.
