Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) shep####.sb.a####.com:80
- TCP(TLS/1.0) a####.ff.a####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) shep####.ff.a####.com:443
DNS requests:
- a####.ff.a####.com
- g####.face####.com
- shep####.ff.a####.com
- shep####.sb.a####.com
HTTP POST requests:
- shep####.sb.a####.com/V1/MD/0016A5255208F6A800000163BEEF1DFB643036623535...
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/CookiePersistence.xml
- /data/data/####/MultiDex.lock
- /data/data/####/burger.xml
- /data/data/####/com.avast.android.mobilesecurity-1.apk.classes-...28.zip
- /data/data/####/com.avast.android.mobilesecurity-1.apk.classes3...26.zip
- /data/data/####/com.avast.android.mobilesecurity-1.apk.classes9...18.zip
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/journal.tmp
- /data/data/####/mobilesecurity.dat.jar
- /data/data/####/multidex.version.xml
- /data/data/####/myOnneapR
- /data/data/####/preferences-secure.xml
- /data/data/####/sb.key
- /data/data/####/shepherd.config
- /data/data/####/shepherd.xml
- /data/data/####/shepherd2.config
- /data/data/####/shepherd2.xml
- /data/data/####/tmp-com.avast.android.mobilesecurity-1.apk.clas...18.zip
- /data/data/####/tmp-com.avast.android.mobilesecurity-1.apk.clas...26.zip
- /data/data/####/tmp-com.avast.android.mobilesecurity-1.apk.clas...53.zip
- /data/data/####/tmp-com.avast.android.mobilesecurity-1.apk.clas...83.zip
- /data/data/####/tmp-com.avast.android.mobilesecurity-1.apk.clas...84.zip
- /data/data/####/uuid.prefs.xml
Miscellaneous:
Executes next shell scripts:
- getprop
Loads the following dynamic libraries:
- myOnneapR
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
