Android.MobiDash.7424

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.MobiDash.27.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) r.m####.net:443
TCP(TLS/1.0) be####.com:443
TCP(TLS/1.0) i####.startap####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) vaste####.startap####.com:443
TCP(TLS/1.0) rr16---####.g####.com:443
TCP(TLS/1.0) infoe####.startap####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) 1####.250.150.94:443
TCP(TLS/1.0) sdk-exc####.startap####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.250.150.94:443

DNS requests:

adsmeta####.startap####.com
and####.a####.go####.com
and####.google####.com
app-mea####.com
be####.com
dts.startap####.com
firebas####.google####.com
gmscomp####.google####.com
i####.startap####.com
infoe####.startap####.com
p####.google####.com
pla####.google####.com
r.m####.net
rr16---####.g####.com
sdk-exc####.startap####.com
sdk-exc####.startap####.com.####.8
trackdo####.startap####.com
vaste####.startap####.com

HTTP GET requests:

i####.startap####.com:443/InApp/resources/back_.png
i####.startap####.com:443/InApp/resources/back_dark.png
i####.startap####.com:443/InApp/resources/browser_icon_dark.png
i####.startap####.com:443/InApp/resources/close_button.png
i####.startap####.com:443/InApp/resources/empty_star.png
i####.startap####.com:443/InApp/resources/filled_star.png
i####.startap####.com:443/InApp/resources/forward_.png
i####.startap####.com:443/InApp/resources/forward_dark.png
i####.startap####.com:443/InApp/resources/half_star.png
i####.startap####.com:443/InApp/resources/info_ex_l.png
i####.startap####.com:443/InApp/resources/info_ex_s.png
i####.startap####.com:443/InApp/resources/info_l.png
i####.startap####.com:443/InApp/resources/info_s.png
i####.startap####.com:443/InApp/resources/logo.png
i####.startap####.com:443/InApp/resources/x_dark.png
infoe####.startap####.com:443/adsmetadata/api/v1.0/getadsmetadata?produc...
r.m####.net:443/img/81/AC9421.mp4
sdk-exc####.startap####.com:443/1.5/gethtmlad?productId=####&testMode=##...
vaste####.startap####.com:443/trackdownload/api/1.0/trackdownload?produc...
vaste####.startap####.com:443/vastevent/api/v1.0/errorvast?d=IAAAA####&e...

HTTP POST requests:

be####.com:443/
infoe####.startap####.com:443/infoevent/api/v1.0/info
infoe####.startap####.com:443/tracking/infoEvent
p####.google####.com:443/v1/projects/textbook-0524/installations

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/27bf1f57bd75d51e_0
/data/data/####/CachedAds
/data/data/####/Cookies-journal
/data/data/####/Databases.db-journal
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo3NzA5NzE3...j.json
/data/data/####/PersistedInstallation1361519554tmp
/data/data/####/PersistedInstallation1501176627tmp
/data/data/####/QuotaManager-journal
/data/data/####/S2qX3kxLdc1It8jTMNOoDQ_.mp4
/data/data/####/S2qX3kxLdc1It8jTMNOoDQ_.mp4.temp
/data/data/####/SZEvJqZEj.dex
/data/data/####/SZEvJqZEj.dex.flock (deleted)
/data/data/####/StartApp-6d5362e8ecc8a910.xml
/data/data/####/StartApp-790ba54ab8e69f2f.xml
/data/data/####/StartApp-9b9bfdb86df82dad.xml
/data/data/####/StartApp-d6864f2502af7851-journal
/data/data/####/StartappAdInfoMetadata
/data/data/####/StartappAdsMetadata
/data/data/####/StartappBannerMetadata
/data/data/####/StartappCacheMetadata
/data/data/####/StartappMetadata
/data/data/####/StartappSplashMetadata
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a
/data/data/####/a-journal
/data/data/####/androidx.work.workdb-journal
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/back_.png
/data/data/####/back_dark.png
/data/data/####/browser_icon_dark.png
/data/data/####/close_button.png
/data/data/####/color_fcross.dat.dex
/data/data/####/color_fcross.dat.dex.flock (deleted)
/data/data/####/color_fcross.dat.jar
/data/data/####/color_fcross.db
/data/data/####/color_fcross.db-journal (deleted)
/data/data/####/color_fcross.ext.dex
/data/data/####/color_fcross.ext.dex.flock (deleted)
/data/data/####/color_fcross.ext.jar
/data/data/####/color_fcross.irs.dex
/data/data/####/color_fcross.irs.dex.flock (deleted)
/data/data/####/color_fcross.irs.jar
/data/data/####/color_fcross.stp.dex
/data/data/####/color_fcross.stp.dex.flock (deleted)
/data/data/####/color_fcross.stp.jar
/data/data/####/color_fcross.uni.dex
/data/data/####/color_fcross.uni.dex.flock (deleted)
/data/data/####/color_fcross.uni.jar
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml
/data/data/####/com.startapp.android.publish.CookiePrefsFile.xml.bak
/data/data/####/com.startapp.sdk.xml
/data/data/####/empty_star.png
/data/data/####/filled_star.png
/data/data/####/forward_.png
/data/data/####/forward_dark.png
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/half_star.png
/data/data/####/index
/data/data/####/logo.png
/data/data/####/metrics_guid
/data/data/####/org.popapp.color_fcross_preferences.xml
/data/data/####/org.popapp.color_fcross_preferences.xml.bak
/data/data/####/proc_auxv
/data/data/####/shared_prefs_sdk_ad_prefs
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/x_dark.png
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/netcfg

Loads the following dynamic libraries:

libsqlcipher

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about active device administrators.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial