Android.MobiDash.7423

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.27.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) dts.startap####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) rr16---####.g####.com:443
TCP(TLS/1.0) trackdo####.startap####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) sdk-exc####.startap####.com:443
TCP(TLS/1.0) infoe####.startap####.com:443
TCP(TLS/1.0) adsmeta####.startap####.com:443
TCP(TLS/1.0) 1####.250.150.94:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) gmscomp####.google####.com:443
TCP(TLS/1.0) irlma####.com:443
TCP(TLS/1.0) rr8---s####.g####.com:443
TCP(TLS/1.2) 1####.250.150.94:443
TCP(TLS/1.2) and####.google####.com:443
UDP and####.google####.com:443

DNS requests:

adsmeta####.startap####.com
and####.a####.go####.com
and####.google####.com
app-mea####.com
dts.startap####.com
firebas####.google####.com
gmscomp####.google####.com
i####.startap####.com
im####.startap####.com
infoe####.startap####.com
irlma####.com
p####.google####.com
pla####.google####.com
rr16---####.g####.com
rr18---####.g####.com
rr8---s####.g####.com
sdk-exc####.startap####.com
trackdo####.startap####.com

HTTP GET requests:

adsmeta####.startap####.com:443/adsmetadata/api/v1.0/getadsmetadata?prod...
dts.startap####.com:443/InApp/resources/back_.png
dts.startap####.com:443/InApp/resources/back_dark.png
dts.startap####.com:443/InApp/resources/browser_icon_dark.png
dts.startap####.com:443/InApp/resources/close_button.png
dts.startap####.com:443/InApp/resources/empty_star.png
dts.startap####.com:443/InApp/resources/filled_star.png
dts.startap####.com:443/InApp/resources/forward_.png
dts.startap####.com:443/InApp/resources/forward_dark.png
dts.startap####.com:443/InApp/resources/half_star.png
dts.startap####.com:443/InApp/resources/info_ex_l.png
dts.startap####.com:443/InApp/resources/info_ex_s.png
dts.startap####.com:443/InApp/resources/info_l.png
dts.startap####.com:443/InApp/resources/info_s.png
dts.startap####.com:443/InApp/resources/logo.png
dts.startap####.com:443/InApp/resources/x_dark.png
sdk-exc####.startap####.com:443/1.5/gethtmlad?productId=####&testMode=##...
trackdo####.startap####.com:443/trackdownload/api/1.0/trackdownload?prod...

HTTP POST requests:

gmscomp####.google####.com:443/v1/projects/textbook-0524/installations
infoe####.startap####.com:443/infoevent/api/v1.0/info
infoe####.startap####.com:443/tracking/infoEvent
irlma####.com:443/

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/2622edff94d7bc37_0
/data/data/####/73df9ab6a86b325d_0
/data/data/####/Cookies-journal
/data/data/####/Databases.db-journal
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo3NzA5NzE3...j.json
/data/data/####/PersistedInstallation203141259tmp
/data/data/####/PersistedInstallation848160873tmp
/data/data/####/QuotaManager-journal
/data/data/####/StartApp-6d5362e8ecc8a910.xml
/data/data/####/StartApp-790ba54ab8e69f2f.xml
/data/data/####/StartApp-9b9bfdb86df82dad.xml
/data/data/####/StartApp-d6864f2502af7851-journal
/data/data/####/StartappAdInfoMetadata
/data/data/####/StartappAdsMetadata
/data/data/####/StartappBannerMetadata
/data/data/####/StartappCacheMetadata
/data/data/####/StartappMetadata
/data/data/####/StartappSplashMetadata
/data/data/####/VJtGjTdIH.dex
/data/data/####/VJtGjTdIH.dex.flock (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a
/data/data/####/a-journal
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/back_.png
/data/data/####/back_dark.png
/data/data/####/browser_icon_dark.png
/data/data/####/close_button.png
/data/data/####/com.fini.magiccalculator_preferences.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.firebase.auth.internal.ProcessDeathHelper.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml.bak
/data/data/####/com.startapp.sdk.xml
/data/data/####/com.startapp.sdk.xml.bak
/data/data/####/d666758191a2f330_0
/data/data/####/e3b3f42421b2fb61_0
/data/data/####/empty_star.png
/data/data/####/filled_star.png
/data/data/####/forward_.png
/data/data/####/forward_dark.png
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/half_star.png
/data/data/####/index
/data/data/####/logo.png
/data/data/####/magiccalculator.dat.dex
/data/data/####/magiccalculator.dat.dex.flock (deleted)
/data/data/####/magiccalculator.dat.jar
/data/data/####/magiccalculator.db
/data/data/####/magiccalculator.db-journal (deleted)
/data/data/####/magiccalculator.ext.dex
/data/data/####/magiccalculator.ext.dex.flock (deleted)
/data/data/####/magiccalculator.ext.jar
/data/data/####/magiccalculator.irs.dex
/data/data/####/magiccalculator.irs.dex.flock (deleted)
/data/data/####/magiccalculator.irs.jar
/data/data/####/magiccalculator.stp.dex
/data/data/####/magiccalculator.stp.dex.flock (deleted)
/data/data/####/magiccalculator.stp.jar
/data/data/####/magiccalculator.uni.dex
/data/data/####/magiccalculator.uni.dex.flock (deleted)
/data/data/####/magiccalculator.uni.jar
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/shared_prefs_sdk_ad_prefs
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/x_dark.png
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/netcfg

Loads the following dynamic libraries:

libsqlcipher

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about active device administrators.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial