Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.HiddenAds.79.origin
- Android.HiddenAds.76.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- trac####.####.com
- c####.####.cc
- glo####.####.com
- g####.####.com
- fastlyb####.####.com
- c####.####.net
- s####.####.com
- i2-tszb####.####.net
- r####.####.com
- c####.####.com
- 2-01-33####.####.net
- cl####.####.com
- i####.####.cc
- akab####.####.com
- down####.####.net
- a-ced####.####.net
- p####.####.cc
- c####.####.co
- a####.####.com
HTTP GET requests:
- r####.####.com/releases/1495144866/radar.js
- s####.####.com/cr/sdk/dynV17041701D/des_onlydyV17041701Dj1so32.zip
- p####.####.cc/api/ads/record/si.open.link/?_s=####&oc1=####&oc2=####&nam...
- i####.####.cc/s
- p####.####.cc/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=###...
- c####.####.net/80B30D/cedexis/img/24/r20.gif?rnd=####
- p####.####.cc/api/ads/record/si.downloading/?_s=####&oc1=####&oc2=####&n...
- r####.####.com/f1/_CgJqMRAUGCwiBggBEOaTASiTx-mWDzDon1s46OGNyQVArYWnNUoUC...
- p####.####.cc/api/ads/record/si.downloaded/?_s=####&oc1=####&oc2=####&na...
- cl####.####.com/tracking/click?trafficsource=####&clickid=####&offerid=#...
- c####.####.cc/files/gp/com.mobile.legends
- r####.####.com/1/18918/radar.js
- p####.####.cc/api/ads/record/si.installing/?_s=####&oc1=####&oc2=####&na...
- c####.####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_p...
- i2-tszb####.####.net/i2/1/18918/j1/20/44/1495016896/providers.json?image...
- c####.####.net/80B30D/cedexis/img/359/r20.gif?rnd=####
- akab####.####.com/node2/287min.html?rnd=####
- glo####.####.com/ops/akamai/images/r20.gif?rnd=####
- c####.####.net/80B30D/cedexis/img/359c/r20.gif?rnd=####
- c####.####.net/80B30D/cedexis/node2/24min.html?rnd=####
- p####.####.cc/api/ads/record/click/?_s=####&oc1=####&oc2=####&provider=#...
- c####.####.net/80B30D/cedexis/img/24c/r20.gif?rnd=####
- c####.####.com/loading01.gif
- a####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub4=####&aff_sub=###...
- r####.####.com/n1/0/1495016894442/0/0/0/0/1495016894442/1495016894442/14...
- 2-01-33####.####.net/img/17741/r20.gif?rnd=####
- g####.####.com/cr/sv/getGoFile?name=####
- fastlyb####.####.com/node_id.js?rnd=####
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- fastlyb####.####.com/img/90/r20.gif?rnd=####
- trac####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=...
- a####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- c####.####.com/files/8fe40a303ea61f48892764fefdd7de71
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- a-ced####.####.net/img/21222/r20.gif?rnd=####
- p####.####.cc/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=#...
- c####.####.com/loading01.html
- trac####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- 2-01-33####.####.net/node2/17741min.html?rnd=####
- down####.####.net/mscomtest/cedtest/r20.gif?rnd=####
- c####.####.net/80B30D/cedexis/node2/359min.html?rnd=####
- akab####.####.com/img/287/r20.gif?rnd=####
HTTP POST requests:
- p####.####.cc/api/ads/record/si.goto/?_s=####&oc1=####&oc2=####&name=###...
- g####.####.com/cr/sv/getEPList
- p####.####.cc/api/ads/fetch?_s=####
- p####.####.cc/api/ads/connect
Modified file system:
Creates the following files:
- <Package Folder>/app_dex/mocean-sdk.zip.tmp
- <Package Folder>/databases/mocean.database.ad-journal
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/files/na1l2t/ntmp21172131
- <Package Folder>/app_tmpdex/mocean-sdk.zip
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/stickercamera2<System Property>4/5stickercamera2<System Property>46
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/files/23<System Property>32/<Package>12x862
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/shared_prefs/MO.xml.bak
- <Package Folder>/files/1495016864440_onlydyV17041701Dj1so32.so
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/app_dex/mocean-sdk.zip
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- getenforce
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- chmod 0771 <Package Folder>/.syslib-
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm -f <Package Folder>/files/hftJcw46N.dex
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 8cf9cce002f64956b35ac122f648553a <Package Folder>/.syslib-
- chmod 0771 /data/data/####/.syslib-
- rm <Package Folder>/files/hftJcw46N.jar
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 8cf9cce002f64956b35ac122f648553a /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- rm -f <Package Folder>/files/hftJcw46N.jar
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- <dexopt>
Contains functionality to send SMS messages automatically.
