Android.MobiDash.1879

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) googl####.g.doublec####.net:80
TCP(TLS/1.0) ads.fl####.com:443
TCP(TLS/1.0) cdn.fl####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) v2.chartb####.com:443
TCP(TLS/1.0) l####.chartb####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) v5.chartb####.com:443

DNS requests:

a3.chartb####.com
ads.fl####.com
cdn.fl####.com
d####.fl####.com
googl####.g.doublec####.net
l####.chartb####.com
v2.chartb####.com
v5.chartb####.com

HTTP GET requests:

googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40-load...
googl####.g.doublec####.net/mads/static/sdk/native/sdk-core-v40.js

File system changes:

Creates the following files:

/data/data/####/.0x7f61a480.fscache (deleted)
/data/data/####/.0x7f61a950.fscache (deleted)
/data/data/####/.0x7f61aa00.fscache (deleted)
/data/data/####/.0x7f61ac10.fscache (deleted)
/data/data/####/.0x7f61acc0.fscache (deleted)
/data/data/####/.0x7f61aed0.fscache (deleted)
/data/data/####/.0x7f61af80.fscache (deleted)
/data/data/####/.0x7f61b190.fscache (deleted)
/data/data/####/.0x7f61b450.fscache (deleted)
/data/data/####/.0x7f61b5b0.fscache (deleted)
/data/data/####/.0x7f61bb30.fscache (deleted)
/data/data/####/.0x7f61bdf0.fscache (deleted)
/data/data/####/.0x7f6201c0.fscache (deleted)
/data/data/####/.0x7f620270.fscache (deleted)
/data/data/####/.0x7f620530.fscache (deleted)
/data/data/####/.0x7f620690.fscache (deleted)
/data/data/####/.0x7f6208a0.fscache (deleted)
/data/data/####/.0x7f620950.fscache (deleted)
/data/data/####/.0x7f620ab0.fscache (deleted)
/data/data/####/.0x7f621190.fscache (deleted)
/data/data/####/.0x7f621450.fscache (deleted)
/data/data/####/.0x7f6215b0.fscache (deleted)
/data/data/####/.0x7f623a00.fscache (deleted)
/data/data/####/.0x7f623ab0.fscache (deleted)
/data/data/####/.0x7f6240e0.fscache (deleted)
/data/data/####/.0x7f624a80.fscache (deleted)
/data/data/####/.0x7f624b30.fscache (deleted)
/data/data/####/.0x7f624be0.fscache (deleted)
/data/data/####/.0x7f624c90.fscache (deleted)
/data/data/####/.0x7f624d40.fscache (deleted)
/data/data/####/.0x7f624df0.fscache (deleted)
/data/data/####/.0x7f634450.fscache (deleted)
/data/data/####/.0x7f637270.fscache (deleted)
/data/data/####/.0x7f637480.fscache (deleted)
/data/data/####/.0x7f6375e0.fscache (deleted)
/data/data/####/.0x7f637b60.fscache (deleted)
/data/data/####/.0x7f638190.fscache (deleted)
/data/data/####/.FlurrySenderIndex.info.AnalyticsData_9GVDQXPFH...MN_171
/data/data/####/.FlurrySenderIndex.info.AnalyticsMain
/data/data/####/.flurryadlog.2f7bf603
/data/data/####/.flurryads.mediaassets.tmp
/data/data/####/.flurryads.mediaassets.tmp (deleted)
/data/data/####/.flurryagent.2f7bf603
/data/data/####/.flurrycachedasset.2f7bf603
/data/data/####/.flurrydatasenderblock.164c41a9-3ce7-40f0-9b06-...80cff8
/data/data/####/.flurrydatasenderblock.3a61868e-81cc-4a8e-bd5a-...a52635
/data/data/####/.flurrydatasenderblock.85e2cc3d-389a-40ec-ad69-...373cc7
/data/data/####/.flurrydatasenderblock.b15f3a68-5732-49c2-9363-...efb513
/data/data/####/.flurrydatasenderblock.b1813e3b-7d58-4211-8aec-...ad7859
/data/data/####/.flurryfreqcap.2f7bf603
/data/data/####/87106819190
/data/data/####/Cookies
/data/data/####/Cookies-journal
/data/data/####/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/FlappyCrush.dat.jar
/data/data/####/GameCenterData
/data/data/####/GameCenterData.tmp1
/data/data/####/GameCenterData.tmp2
/data/data/####/GameState
/data/data/####/GameState.tmp3
/data/data/####/GameState.tmp4
/data/data/####/MultiDex.lock
/data/data/####/Notifications
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a3.chartboost.com.443
/data/data/####/ads-1048470369.jar
/data/data/####/cbPrefs.xml
/data/data/####/cb_previous_session_info
/data/data/####/com.tarekmongy.FlappyCrush-1.apk.classes2.zip
/data/data/####/com.tarekmongy.FlappyCrush.plist
/data/data/####/com.tarekmongy.FlappyCrush.xml
/data/data/####/com.tarekmongy.FlappyCrush_preferences.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/index
/data/data/####/multidex.version.xml
/data/data/####/rList-com.apportable.activity.VerdeActivity
/data/data/####/savegame.xml
/data/data/####/tmp-com.tarekmongy.FlappyCrush-1.apk.classes-10...69.zip
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/zNVGTCDOQ
/data/media/####/5b77d191a36bbe198cea9881_320-1534579089.mp4
/data/media/####/5b77d358b43666319a5d1c76_320-1534579544.mp4
/data/media/####/5bfbb9dcaa64ad4b786034e9_320-1543223773.mp4
/data/media/####/5c5d4e9aa9a0800af11a9746_320-1549618842.mp4
/data/media/####/5c5d4f8da9a0800aeb48653f_320-1549619085.mp4
/data/media/####/5c5d537e5f292b0b52565a74_320-1549620094.mp4
/data/media/####/7e265867124e773e7ee5144c9e05b36f20fe43bc.png
/data/media/####/abcce95ff069a1f8a3692d2b27d0766357cfda31.png
/data/media/####/afe5f4dc3d915e254aa61d9f38039da318c41650.png
/data/media/####/journal
/data/media/####/journal.tmp

Miscellaneous:

Loads the following dynamic libraries:

Application
AudioFile
AudioToolbox
AudioUnit
BridgeKit
CFNetwork
CommonCrypto
CoreAudio
CoreFoundation
CoreGraphics
CoreText
Foundation
GraphicsServices
OpenAL
Security
System
SystemConfiguration
crypto_1_01k
cxx
gles_apportable
icu
pango
sqlite_3_7_5
ssl_1_01k
v
xml2
zNVGTCDOQ

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial