Android.MobiDash.1108

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.apk.v-####.mobi:80
TCP(HTTP/1.1) log.apk.v-####.mobi:80
TCP(HTTP/1.1) sdkupg####.ins####.u####.com:80
TCP(HTTP/1.1) ogr####.xyz:80
TCP(HTTP/1.1) i4.y####.com:80
TCP(HTTP/1.1) res.apk.vid####.net:80
TCP(HTTP/1.1) img.vidmate####.org.####.net:80
TCP(HTTP/1.1) v####.apk.v-####.mobi:80
TCP(HTTP/1.1) gj.ap####.uc.cn:80
TCP(HTTP/1.1) recom####.apk.v-####.mobi:80
TCP(HTTP/1.1) ins####.u####.com:80
TCP(HTTP/1.1) video####.mobi:80
TCP(TLS/1.0) s####.vid####.mobi:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443

DNS requests:

and####.cli####.go####.com
api.apk.v-####.mobi
g####.face####.com
gj.ap####.uc.cn
i4.y####.com
img.vidmate####.org
ins####.u####.com
log.apk.v-####.mobi
ogr####.xyz
recom####.apk.v-####.mobi
res.apk.vid####.net
s####.vid####.mobi
sdkupg####.ins####.u####.com
v####.apk.v-####.mobi
v####.apk.vid####.net
video####.mobi
x####.apk.v-####.mobi

HTTP GET requests:

i4.y####.com/vi/52IgFtWLAug/mqdefault.jpg
i4.y####.com/vi/CFND44Dupzw/mqdefault.jpg
i4.y####.com/vi/CGNi4Ca7XVU/mqdefault.jpg
i4.y####.com/vi/GtfhHSE0CtA/hqdefault.jpg
i4.y####.com/vi/iTbGBVitx1o/hqdefault.jpg
i4.y####.com/vi/xmFZjBorUyo/mqdefault.jpg
img.vidmate####.org.####.net/d4/pic/cms/misc/nav/images/icon3/dailymotio...
img.vidmate####.org.####.net/d4/pic/cms/misc/nav/images/icon3/instagram-...
img.vidmate####.org.####.net/d4/pic/cms/misc/nav/images/icon3/youtube-2....
res.apk.vid####.net/downloadso/libcrashsdk.so
v####.apk.v-####.mobi/images/icon3/dailymotion-2.png
v####.apk.v-####.mobi/images/icon3/facebook-2.png
v####.apk.v-####.mobi/images/icon3/whatsappdaily-2.png
v####.apk.v-####.mobi/images/icon3/youtube-2.png

HTTP POST requests:

api.apk.v-####.mobi/check_app_update
api.apk.v-####.mobi/config
api.apk.v-####.mobi/gcm_conf_get
api.apk.v-####.mobi/home_tab
api.apk.v-####.mobi/pingv2
api.apk.v-####.mobi/setup
api.apk.v-####.mobi/signin
api.apk.v-####.mobi/update_get
api.apk.v-####.mobi/update_list
api.apk.v-####.mobi/v3/home
api.apk.v-####.mobi/video_tab_conf
api.apk.v-####.mobi/welcome_get2
gj.ap####.uc.cn/collect?enc=####&zip=####&pf=####&pn=####&ve=####&vc=###...
gj.ap####.uc.cn/collect?zip=####&app=####&uuid=####&vno=####&chk=####
ins####.u####.com/sdkserver/fetch_config
log.apk.v-####.mobi/log
ogr####.xyz/
recom####.apk.v-####.mobi/allhotkey
recom####.apk.v-####.mobi/video_recommend_list
sdkupg####.ins####.u####.com/sdkserver/getupgradesdk
v####.apk.v-####.mobi/check_nav
v####.apk.v-####.mobi/get_nav
video####.mobi/domain

Modified file system:

Creates the following files:

/data/data/####/1532175527128.wa
/data/data/####/1532175542148.wa
/data/data/####/2285DB089745E9F5.xml
/data/data/####/Alvin2.xml
/data/data/####/AppDcom.nemo.vidmate.xml
/data/data/####/AppDcom.nemo.vidmate.xml.bak
/data/data/####/ContextData.xml
/data/data/####/DownloadGuideAdCache.db
/data/data/####/ECBMD-2078-1532175495635
/data/data/####/ECBMD-2078-1532175495651
/data/data/####/ECBMD-2078-1532175529499
/data/data/####/ECBMD-2078-1532175529528
/data/data/####/ECBMD-2078-1532175530019
/data/data/####/ECPMD-2078-1532175495630
/data/data/####/EROC1ETAMDIV0OMEN0MOC.end
/data/data/####/EROC1ETAMDIV0OMEN0MOC.meminfo
/data/data/####/EROC1ETAMDIV0OMEN0MOC.pid
/data/data/####/EROC1ETAMDIV0OMEN0MOC.ps
/data/data/####/EROC1ETAMDIV0OMEN0MOC.start
/data/data/####/EROC1ETAMDIV0OMEN0MOC.status
/data/data/####/EROC1ETAMDIV0OMEN0MOC.time
/data/data/####/EROC1ETAMDIV0OMEN0MOC.uptime
/data/data/####/GlobalConfigDcom.nemo.vidmate.xml
/data/data/####/HOME_TAB_ALL
/data/data/####/HomeGuideAdCache.db
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.end
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.meminfo
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.pid
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.ps
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.start
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.status
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.time
/data/data/####/NOMEAD1ETAMDIV0OMEN0MOC.uptime
/data/data/####/PBUD-2078-1532175495609
/data/data/####/SMDcom.nemo.vidmate.xml
/data/data/####/UnionDcom.nemo.vidmate.xml
/data/data/####/VMDataList.db
/data/data/####/VidMate.xml
/data/data/####/VidMate.xml (deleted)
/data/data/####/VidMate.xml.bak (deleted)
/data/data/####/VideoDetailGuideAdCache.db
/data/data/####/VqDLXfYjy
/data/data/####/adn_keep_alive.xml
/data/data/####/clean_white_list.db
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.google.android.gcm.xml
/data/data/####/com.nemo.vidmate-1.apk.classes1693891723.zip
/data/data/####/com.nemo.vidmate-1.apk.classes2053010434.zip
/data/data/####/com.nemo.vidmate_preferences.xml
/data/data/####/e2aad38bca9c01210dbcd93163dac1a98fded021.xml
/data/data/####/gaClientId
/data/data/####/google_analytics_v2.db-journal
/data/data/####/libcrash_1.9.1.0.so
/data/data/####/libcrash_1.9.1.0.so.part0.tmp
/data/data/####/libcrash_1.9.1.0.so.part1.tmp
/data/data/####/libcrash_1.9.1.0.so.part2.tmp
/data/data/####/libcrash_1.9.1.0.so.part3.tmp
/data/data/####/multidex.version.xml
/data/data/####/p.l
/data/data/####/p_vidmate.xml
/data/data/####/p_vidmate_new.sp
/data/data/####/p_vidmate_new.sp.bak
/data/data/####/pkgcache_basic.db
/data/data/####/pushmessage-journal
/data/data/####/sdk.bk
/data/data/####/sdk.jar
/data/data/####/sdk_pref.xml
/data/data/####/sp_replace_flag.sp
/data/data/####/sp_replace_flag.sp.bak
/data/data/####/swof_setting.xml
/data/data/####/unique
/data/data/####/upgrade_info
/data/data/####/ver
/data/data/####/vidmate.dat.jar
/data/data/####/vidmate.db
/data/data/####/vidmate.db-journal
/data/media/####/-2088103286
/data/media/####/-720066289
/data/media/####/.nomedia
/data/media/####/1155678567
/data/media/####/1532175494269
/data/media/####/1532175500703
/data/media/####/1532175529499
/data/media/####/1690787869
/data/media/####/1790842066
/data/media/####/2be1db05bcf9bab637f0d18907fca877dacdb5ff852e43....0.tmp
/data/media/####/4f65f8c2d279769c8d5fe899ba4871947f2e9a3c2ff44b....0.tmp
/data/media/####/597493799
/data/media/####/62219f55260819ec7630021182f072e23958a5e9115267....0.tmp
/data/media/####/77ffb5eda5bd81c6afbbbf858e3873b05c7ca4d1161707....0.tmp
/data/media/####/7870b5269b60e7ab8b5e634ca67287054de3ad546b3314....0.tmp
/data/media/####/7aa10fbe23a607c60341b1fe890bdfb8fa18d137b0d925....0.tmp
/data/media/####/9770849234740007ac4c766c07718880e072e1afe351cb....0.tmp
/data/media/####/9cf918dc2ebc224cef424a2ba203c31d0c14ed68e119bb....0.tmp
/data/media/####/AdvanceDownload
/data/media/####/Alvin2.xml
/data/media/####/Alvin2.xml (deleted)
/data/media/####/ContextData.xml
/data/media/####/ContextData.xml (deleted)
/data/media/####/a366ce97d81f8fc962d11a7541d0716044b96c8d40ef0f....0.tmp
/data/media/####/bin.-1023037926
/data/media/####/bin.-1026730799
/data/media/####/bin.-1057135752
/data/media/####/bin.-1206480048
/data/media/####/bin.-1265412596
/data/media/####/bin.-1414086022
/data/media/####/bin.-1702359196
/data/media/####/bin.-1891146264
/data/media/####/bin.-1893293266
/data/media/####/bin.-239987183
/data/media/####/bin.-27124237
/data/media/####/bin.-370204352
/data/media/####/bin.-384643725
/data/media/####/bin.-573744307
/data/media/####/bin.-591311717
/data/media/####/bin.-754378529
/data/media/####/bin.-818939083
/data/media/####/bin.-829420972
/data/media/####/bin.-883123340
/data/media/####/bin.1146626281
/data/media/####/bin.1193578314
/data/media/####/bin.1336096918
/data/media/####/bin.1389311627
/data/media/####/bin.1523974732
/data/media/####/bin.1547117727
/data/media/####/bin.1943521122
/data/media/####/bin.2001520517
/data/media/####/bin.2122898808
/data/media/####/bin.2130571586
/data/media/####/bin.284768489
/data/media/####/bin.336537290
/data/media/####/bin.342655310
/data/media/####/bin.867170217
/data/media/####/c163e79727310be227e9503426329e5fe2e2dbb45e91db....0.tmp
/data/media/####/c6981f378bdae1b08f9ff634ebcbd1eaea456eaeea6632....0.tmp
/data/media/####/d96a4c4615e5954697979f2d0731f1f920df18e70df1ec....0.tmp
/data/media/####/ef317b28553b21e141f8ab23b5f0ccd5af63c61c55770a....0.tmp
/data/media/####/journal.tmp
/data/media/####/task-journal
/data/media/####/torrents.db-journal

Miscellaneous:

Executes next shell scripts:

cat /sys/class/net/wlan0/address
ps

Loads the following dynamic libraries:

VqDLXfYjy
daemon
key
libcrash_1.9.1.0
m9secure
uninstall

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial