Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.110.origin
- Android.RemoteCode.93.origin
- Android.Xiny.1.origin
- Android.Xiny.197
- Android.Xiny.232.origin
Downloads the following detected threats from the Web:
- Android.RemoteCode.110.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) 2####.177.13.68:8288
- TCP(HTTP/1.1) r####.adsb####.com:80
- TCP(HTTP/1.1) www.univers####.com:80
- TCP(HTTP/1.1) clk.ar####.co:80
- TCP(HTTP/1.1) trac####.le####.com:80
- TCP(HTTP/1.1) trac####.suma####.com:80
- TCP(HTTP/1.1) www.cu####.com:80
- TCP(HTTP/1.1) aws.smarter####.net:80
- TCP(HTTP/1.1) cl####.ads####.com:80
- TCP(HTTP/1.1) s####.mob####.b####.com:80
- TCP(HTTP/1.1) ali.f####.cdn.####.com:80
- TCP(HTTP/1.1) a####.bat####.net:80
- TCP(HTTP/1.1) www.zfr####.com:80
- TCP(HTTP/1.1) camspla####.com:80
- TCP(HTTP/1.1) mo.freeind####.com:80
- TCP(HTTP/1.1) i.cdn####.com:80
- TCP(HTTP/1.1) tra####.tc-cl####.com:80
- TCP(HTTP/1.1) t####.confirm####.online:80
- TCP(HTTP/1.1) www.admobim####.com:80
- TCP(HTTP/1.1) bkmsoft####.com:80
- TCP(HTTP/1.1) api.mob####.b####.com:80
- TCP(HTTP/1.1) js.parking####.net:80
- TCP(HTTP/1.1) 1####.243.199.134:80
- TCP(HTTP/1.1) tango####.com:80
- TCP(HTTP/1.1) koolmed####.com:80
- TCP(HTTP/1.1) www.jp####.com:80
- TCP(HTTP/1.1) www.mmmmmm####.com:80
- TCP(HTTP/1.1) ea.sno####.1####.com:8088
- TCP(HTTP/1.1) ap####.mobisen####.com:80
- TCP(HTTP/1.1) parking####.net:80
- TCP(HTTP/1.1) c####.gowa####.com:80
- TCP(HTTP/1.1) ea.sno####.1####.com:18088
- TCP(TLS/1.0) p####.lead####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) g####.gl:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) formula####.com:443
- TCP(TLS/1.0) clk.tap####.com:443
- TCP(TLS/1.0) c####.roya####.net:443
DNS requests:
- a####.bat####.net
- akw.e####.space
- ali.f####.cdn.####.com
- ap####.mobisen####.com
- api.migh####.com
- api.mob####.b####.com
- app.ad####.com
- aws.smarter####.net
- bkmsoft####.com
- c####.gowa####.com
- c####.roya####.net
- c.s####.co
- camspla####.com
- cl####.ads####.com
- clk.ar####.co
- clk.tap####.com
- ea.sno####.1####.com
- en.sno####.1####.com
- formula####.com
- g####.gl
- googl####.g.doublec####.net
- i.cdn####.com
- js.parking####.net
- koolmed####.com
- mo.freeind####.com
- offer####.online
- p####.lead####.com
- parking####.net
- r####.adsb####.com
- s####.mob####.b####.com
- t####.confirm####.online
- tango####.com
- tra####.tc-cl####.com
- trac####.le####.com
- trac####.suma####.com
- www.admobim####.com
- www.cu####.com
- www.jp####.com
- www.mmmmmm####.com
- www.univers####.com
- www.zfr####.com
HTTP GET requests:
- a####.bat####.net/call/v2/ad/click?recommend_id=####&ads_id=####&aff_id=...
- ali.f####.cdn.####.com/20171213102849-snowfox_v19i154.jar
- ap####.mobisen####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- api.mob####.b####.com/index.php?r=####
- api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
- api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
- aws.smarter####.net/index.php?m=####&p=####&app_id=####&offer_id=####&ga...
- bkmsoft####.com/hindiloveshayariimages/get_all_products.php?
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (31).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (32).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (33).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (35).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (37).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (38).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (40).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (41).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (42).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (43).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (44).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (45).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (46).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (47).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (48).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (49).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (50).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (51).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (52).png
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (53).png
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (55).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (56).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (59).jpg
- bkmsoft####.com/hindiloveshayariimages/image/hindi love shayari (60).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (36).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (37).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (38).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (39).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (40).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (41).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (42).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (43).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (44).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (45).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (46).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (47).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (48).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (49).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (50).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (51).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (52).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (53).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (54).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (55).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (56).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (57).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (58).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (59).jpg
- bkmsoft####.com/hindiloveshayariimages/image/love_ (60).jpg
- bkmsoft####.com/sunstarappstudio/get_all_products.php?
- bkmsoft####.com/sunstarappstudio/image/3D Photo Gallery-Photo Manager-Ph...
- bkmsoft####.com/sunstarappstudio/image/Blur_Photo_Editor.png
- bkmsoft####.com/sunstarappstudio/image/Body Plastic Surgery Photo Editor...
- bkmsoft####.com/sunstarappstudio/image/Crorepati live app_banner.png
- bkmsoft####.com/sunstarappstudio/image/Ghost_Camera.png
- bkmsoft####.com/sunstarappstudio/image/Good Morning Wishes.png
- bkmsoft####.com/sunstarappstudio/image/Letter Wallpaper.png
- bkmsoft####.com/sunstarappstudio/image/My_name_ringtone_yams.png
- bkmsoft####.com/sunstarappstudio/image/Photo Video Maker With Music-Movi...
- bkmsoft####.com/sunstarappstudio/image/Steam Photo Editor.png
- bkmsoft####.com/sunstarappstudio/image/Video Converter.png
- bkmsoft####.com/sunstarappstudio/image/Video song statusWhatsap status v...
- bkmsoft####.com/sunstarappstudio/image/Video to mp3 converter-Mp4 to mp3...
- bkmsoft####.com/sunstarappstudio/image/Video to mp3_vanila.png
- bkmsoft####.com/sunstarappstudio/image/Weather Channel.png
- bkmsoft####.com/sunstarappstudio/image/X Collage Photo Editor.png
- bkmsoft####.com/sunstarappstudio/image/ad_bodyslimmer.png
- bkmsoft####.com/sunstarappstudio/image/adicon_cutpaste.png
- bkmsoft####.com/sunstarappstudio/image/adicon_photo_editor.png
- bkmsoft####.com/sunstarappstudio/image/adicon_prizma.png
- bkmsoft####.com/sunstarappstudio/image/adicon_song_cutter.png
- bkmsoft####.com/sunstarappstudio/image/adicon_videotpmp3.png
- bkmsoft####.com/sunstarappstudio/image/bit camera.png
- bkmsoft####.com/sunstarappstudio/image/blouse_design.png
- bkmsoft####.com/sunstarappstudio/image/girlfriend photo editor.png
- bkmsoft####.com/sunstarappstudio/image/goodmorningimage1.png
- bkmsoft####.com/sunstarappstudio/image/letter wallpaper_sunstar.png
- bkmsoft####.com/sunstarappstudio/image/love good morning image.png
- bkmsoft####.com/sunstarappstudio/image/mobile_number_tracker_banner.png
- bkmsoft####.com/sunstarappstudio/image/video_convertrt_banner.png
- c####.gowa####.com/click?transaction_id=wadogo_WAdvPubNativeNewAPI_30359...
- c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
- camspla####.com/
- camspla####.com/styles/forms.css
- camspla####.com/styles/layout.css
- camspla####.com/styles/navi.css
- camspla####.com/styles/tables.css
- cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
- clk.ar####.co/aff_c?offer_id=####&aff_id=####&aff_sub=####&sub_channel=#...
- i.cdn####.com/themes/assets/style.css
- i.cdn####.com/themes/registrar/style_namecheap.css
- js.parking####.net/assets/scripts/jsparkcaf.js
- js.parking####.net/assets/scripts/registrar-caf/243142.js
- js.parking####.net/assets/scripts/tier2caf.js
- js.parking####.net/scripts/feedmeCaf.php?q=####&ip=####&max=####&hl=####...
- js.parking####.net/track.php?domain=####&toggle=####&uid=MTU####
- koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/0/
- koolmed####.com/r/76c96dd4-e85b-11e7-97d2-1144879f22ea/1/
- koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/0/
- koolmed####.com/r/77729f62-e85b-11e7-b06b-1142e8499c68/1/
- parking####.net/jsparkcaf.php?regcn=####&_v=####&_h=####&_t=####
- r####.adsb####.com/c/67e4f89dc239c781?c3=####&c2=####&c1=####
- t####.confirm####.online/?utm_medium=####&utm_campaign=####&c3=####&c2=#...
- tango####.com/66291_nl_4247_android?rpm=0.2&fallbackUrl=https://formulaw...
- tra####.tc-cl####.com/?p=####&media_type=####&click_id=####&pi=####
- trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&click_id=...
- trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
- trac####.suma####.com/aff_r?offer_id=328149&aff_id=3599&url=http://click...
- www.cu####.com/20171212103437.201712121030.zip
- www.jp####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=####&...
- www.univers####.com/Adminpanel/CategoryJson.php?a####
- www.univers####.com/Adminpanel/image/adicon_photo_editor.png
- www.univers####.com/Adminpanel/image/adicon_videotpmp3.png
HTTP POST requests:
- ea.sno####.1####.com:18088/ping
- ea.sno####.1####.com:18088/sdk/api/checklib
- ea.sno####.1####.com:18088/sdk/api/regclient
- ea.sno####.1####.com:8088/sdk/api/ad/hull_v2
- ea.sno####.1####.com:8088/sdk/api/log/record
- js.parking####.net/ls.php
- mo.freeind####.com/detail/getOfferListNew?enc=####
- s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- www.admobim####.com/surl/api2_reg.action?ecy=####
- www.jp####.com/tracking/ds?sdk_version=####&platform=####&app_version=##...
- www.jp####.com/tracking/uc?sdk_version=####&platform=####&app_version=##...
- www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
- www.mmmmmm####.com/osp/oaen_reg.action
- www.zfr####.com/up.do?enc=####
Modified file system:
Creates the following files:
- <Package Folder>/app_lib/libmosel.so
- <Package Folder>/cache/####/-6065482491758265024
- <Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.0.tmp
- <Package Folder>/cache/####/2ae288efb005fe37c024795562e4f78d.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.0.tmp
- <Package Folder>/cache/####/e3a85dc5698cbcee15b35c7c9d7b33a6.1.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ads-1702544704.jar
- <Package Folder>/databases/adblib.db
- <Package Folder>/databases/adblib.db-journal
- <Package Folder>/databases/db_snowfox.db
- <Package Folder>/databases/db_snowfox.db-journal
- <Package Folder>/databases/mc_cache.db-journal
- <Package Folder>/databases/my.db
- <Package Folder>/databases/my.db-journal
- <Package Folder>/databases/snowfoxad_msg.db
- <Package Folder>/databases/snowfoxad_msg.db-journal
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/412293793
- <Package Folder>/files/####/412293793.data
- <Package Folder>/files/d.dex
- <Package Folder>/files/d.dex (deleted)
- <Package Folder>/files/d.zip
- <Package Folder>/files/dtemp.apk
- <Package Folder>/files/f.zip
- <Package Folder>/files/google.db
- <Package Folder>/files/lib.dat
- <Package Folder>/files/mesosphere.jar
- <Package Folder>/files/ob.dex
- <Package Folder>/files/ob.zip
- <Package Folder>/files/snowfox_v19i.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/ActivatePreUtil.xml
- <Package Folder>/shared_prefs/AdsBusiness-data.xml
- <Package Folder>/shared_prefs/BusinessPreUtil.xml
- <Package Folder>/shared_prefs/D824hunter_config.xml
- <Package Folder>/shared_prefs/D824other_config.xml
- <Package Folder>/shared_prefs/D824service_config.xml
- <Package Folder>/shared_prefs/D824sp_config.xml
- <Package Folder>/shared_prefs/D824upgrade_config.xml
- <Package Folder>/shared_prefs/LoginPreUtil.xml
- <Package Folder>/shared_prefs/OfferPreUtil.xml
- <Package Folder>/shared_prefs/aps.xml
- <Package Folder>/shared_prefs/apsad.xml
- <Package Folder>/shared_prefs/apscomm.xml
- <Package Folder>/shared_prefs/device_info.xml
- <Package Folder>/shared_prefs/isupdate.xml
- <Package Folder>/shared_prefs/m_cfg.xml
- <Package Folder>/shared_prefs/s_sdk_pro_pref.xml
- <Package Folder>/shared_prefs/snowfoxprf.xml
- <Package Folder>/shared_prefs/songcutter.xml
- <Package Folder>/shared_prefs/songcutter.xml.bak
- <Package Folder>/shared_prefs/sp_cache.xml
- <Package Folder>/shared_prefs/t_ini.xml
- <SD-Card>/.androidsystem/####/gads.db
- <SD-Card>/Android/####/-1062533969.tmp
- <SD-Card>/Android/####/-1086172752.tmp
- <SD-Card>/Android/####/-1104036827.tmp
- <SD-Card>/Android/####/-1145160013.tmp
- <SD-Card>/Android/####/-1337003050.tmp
- <SD-Card>/Android/####/-1439710467.tmp
- <SD-Card>/Android/####/-1468339618.tmp
- <SD-Card>/Android/####/-1496968769.tmp
- <SD-Card>/Android/####/-1525597920.tmp
- <SD-Card>/Android/####/-1554227071.tmp
- <SD-Card>/Android/####/-1564193885.tmp
- <SD-Card>/Android/####/-1582856222.tmp
- <SD-Card>/Android/####/-1611485373.tmp
- <SD-Card>/Android/####/-1625934241.tmp
- <SD-Card>/Android/####/-1640114524.tmp
- <SD-Card>/Android/####/-1668743675.tmp
- <SD-Card>/Android/####/-1687893651.tmp
- <SD-Card>/Android/####/-1697372826.tmp
- <SD-Card>/Android/####/-1741293962.tmp
- <SD-Card>/Android/####/-1842361681.tmp
- <SD-Card>/Android/####/-30729599.tmp
- <SD-Card>/Android/####/-335305928.tmp
- <SD-Card>/Android/####/-437385515.tmp
- <SD-Card>/Android/####/-456042742.tmp
- <SD-Card>/Android/####/-484671893.tmp
- <SD-Card>/Android/####/-541930195.tmp
- <SD-Card>/Android/####/-555181129.tmp
- <SD-Card>/Android/####/-599188497.tmp
- <SD-Card>/Android/####/-627817648.tmp
- <SD-Card>/Android/####/-633003976.tmp
- <SD-Card>/Android/####/-656446799.tmp
- <SD-Card>/Android/####/-809869145.tmp
- <SD-Card>/Android/####/-91933070.tmp
- <SD-Card>/Android/####/-962233324.tmp
- <SD-Card>/Android/####/1001733394.tmp
- <SD-Card>/Android/####/1022991165.tmp
- <SD-Card>/Android/####/1051620316.tmp
- <SD-Card>/Android/####/1080249467.tmp
- <SD-Card>/Android/####/1089931412.tmp
- <SD-Card>/Android/####/1113732709.tmp
- <SD-Card>/Android/####/1118560563.tmp
- <SD-Card>/Android/####/1147195418.tmp
- <SD-Card>/Android/####/1175824569.tmp
- <SD-Card>/Android/####/1233077167.tmp
- <SD-Card>/Android/####/1261706318.tmp
- <SD-Card>/Android/####/1340004261.tmp
- <SD-Card>/Android/####/1347593771.tmp
- <SD-Card>/Android/####/1396925414.tmp
- <SD-Card>/Android/####/1435943698.tmp
- <SD-Card>/Android/####/1710090789.tmp
- <SD-Card>/Android/####/1738719940.tmp
- <SD-Card>/Android/####/1767349091.tmp
- <SD-Card>/Android/####/1795978242.tmp
- <SD-Card>/Android/####/1796613605.tmp
- <SD-Card>/Android/####/1824607393.tmp
- <SD-Card>/Android/####/1853236544.tmp
- <SD-Card>/Android/####/1881865695.tmp
- <SD-Card>/Android/####/1910494846.tmp
- <SD-Card>/Android/####/1939123997.tmp
- <SD-Card>/Android/####/1967753148.tmp
- <SD-Card>/Android/####/1977435093.tmp
- <SD-Card>/Android/####/202427731.tmp
- <SD-Card>/Android/####/231056882.tmp
- <SD-Card>/Android/####/259686033.tmp
- <SD-Card>/Android/####/288315184.tmp
- <SD-Card>/Android/####/316944335.tmp
- <SD-Card>/Android/####/34119042.tmp
- <SD-Card>/Android/####/345573486.tmp
- <SD-Card>/Android/####/374202637.tmp
- <SD-Card>/Android/####/402831788.tmp
- <SD-Card>/Android/####/418845980.tmp
- <SD-Card>/Android/####/431460939.tmp
- <SD-Card>/Android/####/460090090.tmp
- <SD-Card>/Android/####/540860186.tmp
- <SD-Card>/Android/####/628605191.tmp
- <SD-Card>/Android/####/885713867.tmp
- <SD-Card>/Android/####/935554585.tmp
- <SD-Card>/Android/####/978977308.tmp
- <SD-Card>/Android/####/994362014.tmp
- <SD-Card>/Android/####/dev_f53bc04.txt
- <SD-Card>/Android/####/imei.txt
- <SD-Card>/Android/####/pid
- <SD-Card>/Android/####/ua.dat
- <SD-Card>/LogN/####/sp
- <SD-Card>/Write On Photo/image1510835503036.png
- <SD-Card>/Write On Photo/image1510835529254.png
- <SD-Card>/baidu/####/journal
- <SD-Card>/baidu/####/journal.tmp
- <SD-Card>/baidu/.cuid
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.cgt.esv.Fz
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- chmod 777 <Package Folder>/bmosel
- dd if <Package Folder>/lib/libmosel.so of <Package Folder>/bmosel
- dd if=<Package Folder>/lib/libmosel.so of=<Package Folder>/bmosel
- sh
Loads the following dynamic libraries:
- libmosel
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
