Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- a####.####.com
HTTP GET requests:
- a####.####.com/api/values.php
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.a.a.a.m.xml
- <Package Folder>/shared_prefs/branch_referral_shared_pref.xml
- <Package Folder>/shared_prefs/instabug.xml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionDevice.cls_temp
- <Package Folder>/app_app_apk/amdroid.dat.jar
- <Package Folder>/cache/conversations.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/branch_referral_shared_pref.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_8aaf40df-ca45-4bf4-aeb9-11c48b739052_1495006106672.tap
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap.tmp
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/cache/sessions.cache
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionOS.cls_temp
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-1542642610.zip
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CBeginSession.cls_temp
- <Package Folder>/files/file
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/BNC_Server_Request_Queue.xml
- <Package Folder>/databases/alarmDb.db-journal
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/nextAlarmNotification.xml
- <Package Folder>/shared_prefs/alarm.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionApp.cls_temp
- <Package Folder>/shared_prefs/alarm.xml.bak
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/591BFB9801C2-0001-0853-A8DE08B1443CSessionEvent0000000000.cls_temp
- <Package Folder>/cache/issues.cache
- <Package Folder>/shared_prefs/instabug.xml
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/app_outdex/amdroid.dat.dex
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/shared_prefs/nextAlarmNotification.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics.tap
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/cache/read_queue.cache
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/.Fabric/com.crashlytics.sdk.android;answers/session_analytics_to_send/sa_c4913e99-5b17-4ee8-b9c4-58c2b993abc1_1495006104569.tap
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
