Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1914.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) serv####.m####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) www.technol####.co.uk:80
- TCP(HTTP/1.1) www.technol####.net:80
- TCP(HTTP/1.1) www.btc-ro####.com:80
- TCP(HTTP/1.1) a####.hitthe####.mobi:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) t####.myonlin####.co:80
- TCP(HTTP/1.1) www.u####.com:80
- TCP(HTTP/1.1) adse####.hitthe####.mobi:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) gl####.ymtrac####.com:80
- TCP(HTTP/1.1) orangea####.com:80
- TCP(HTTP/1.1) rockt####.com:80
- TCP(HTTP/1.1) c####.today####.com:80
- TCP(HTTP/1.1) gl####.top####.com:9090
- TCP(HTTP/1.1) awi####.org:80
- TCP(HTTP/1.1) g####.peak####.com:80
- TCP(HTTP/1.1) t####.cpa.tapge####.com:80
- TCP(HTTP/1.1) layr####.go2af####.com:80
- TCP(HTTP/1.1) lpa.perfon####.com:80
- TCP(HTTP/1.1) www.u####.com:7079
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) a####.gold:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) layr####.go2af####.com:443
- TCP(TLS/1.0) waws-pr####.vip.azurewe####.####.net:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) billmsc####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
DNS requests:
- a####.gold
- a####.hitthe####.mobi
- adse####.hitthe####.mobi
- awi####.org
- billmsc####.com
- c####.today####.com
- f####.google####.com
- f####.gst####.com
- g####.peak####.com
- gl####.top####.com
- gl####.ymtrac####.com
- googl####.g.doublec####.net
- layr####.go2af####.com
- lpa.perfon####.com
- offer####.online
- orangea####.com
- pag####.googles####.com
- rockt####.com
- sconten####.xx.f####.net
- serv####.m####.com
- st####.xx.f####.net
- t####.bruce####.com
- t####.cpa.tapge####.com
- t####.dcypher####.net
- t####.myonlin####.co
- www.btc-ro####.com
- www.face####.com
- www.google-####.com
- www.lead####.mobi
- www.technol####.co.uk
- www.technol####.net
- www.u####.com
HTTP GET requests:
- a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
- a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
- a####.hitthe####.mobi/proc.php?1488e18####
- a####.hitthe####.mobi/proc.php?671ea24####
- c####.today####.com/?utm_medium=####&utm_campaign=####&1=QzoxM####&cid=#...
- c####.today####.com/?utm_term=####&clickverify=####&utm_content=####
- c####.today####.com/proc.php?6ddfecb####
- f####.google####.com/css?family=####&subset=####
- f####.google####.com/css?family=####&ver=####
- f####.gst####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
- f####.gst####.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
- f####.gst####.com/s/ubuntu/v10/4iCp6KVjbNBYlgoKejYHtFyLN4RNgYUJ.ttf
- f####.gst####.com/s/ubuntu/v10/4iCp6KVjbNBYlgoKejZPslyLN4RNgYUJ.ttf
- f####.gst####.com/s/ubuntu/v10/4iCp6KVjbNBYlgoKejZftVyLN4RNgYUJ.ttf
- f####.gst####.com/s/ubuntu/v10/4iCs6KVjbNBYlgoKew7znU6AFw.ttf
- f####.gst####.com/s/ubuntu/v10/4iCv6KVjbNBYlgoC1CzjtGyIPYZvgw.ttf
- f####.gst####.com/s/ubuntu/v10/4iCv6KVjbNBYlgoCjC3jtGyIPYZvgw.ttf
- f####.gst####.com/s/ubuntu/v10/4iCv6KVjbNBYlgoCxCvjtGyIPYZvgw.ttf
- g####.peak####.com/click?adv=####&i=####
- layr####.go2af####.com/disabled.html
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20170911/r20170110/show_ads_impl.js
- serv####.m####.com/119987?t=0.2861318832729012&ref=&lu=http://www.techno...
- serv####.m####.com/119987?t=0.32729392289184034&ref=&lu=http://www.techn...
- serv####.m####.com/119987?t=0.5944511624984443&ref=&lu=http://www.techno...
- t####.bruce####.com/ck.php?line_item_id=####&subid_spx=####&click_id=####
- t####.bruce####.com/ck_jump?id=cz0xMzcyNDY5NzkxNTM1OTAwNTImdD0xNTA1NDA1M...
- www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
- www.u####.com/ru/findbutton0718.js
- www.u####.com/ru/processurl0718.js
- www.u####.com/ru/simulationClickYes0718.js
HTTP POST requests:
- www.u####.com:7079/jsdk/sd.action?b=####
- www.u####.com:7079/jsdk/sd.action?b=####&ca=####&ica=####&re=####
Modified file system:
Creates the following files:
- <Package Folder>/app_jgu/<Package>.rm
- <Package Folder>/app_jgu/x.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/com.hyjt.app.android.india.prefer...ml.bak
- <Package Folder>/shared_prefs/com.hyjt.app.android.india.preferrence.xml
- <Package Folder>/shared_prefs/tip.xml
- <SD-Card>/SexVideo/20170804.txt
- <SD-Card>/commonsdk/findbutton0718.js
- <SD-Card>/commonsdk/processurl0718.js
- <SD-Card>/commonsdk/simulationClickYes0718.js
Miscellaneous:
Loads the following dynamic libraries:
- fish
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
Gains access to information about sent/received SMS messages.
