Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cf.cdn.inmob####.####.net:80
- TCP(HTTP/1.1) d830x8j####.cloudf####.net:80
- TCP(HTTP/1.1) cpsdk-####.app####.com:80
- TCP(HTTP/1.1) w.a####.ap####.####.com:80
- TCP(HTTP/1.1) d.exi####.com:80
- TCP(HTTP/1.1) w####.d.exi####.com:80
- TCP(HTTP/1.1) f####.ai####.jp:80
- TCP(HTTP/1.1) c####.adfur####.jp:80
- TCP(HTTP/1.1) and####.pu####.as####.net:80
- TCP(HTTP/1.1) ad.leadbol####.net:80
- TCP(HTTP/1.1) img.polymor####.jp:80
- TCP(HTTP/1.1) i####.as####.net:80
- TCP(HTTP/1.1) d2cjo8x####.cloudf####.net:80
- TCP(TLS/1.0) cpsdk-####.app####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
DNS requests:
- ad.leadbol####.net
- and####.pu####.as####.net
- c####.adfur####.jp
- cf.cdn.in####.com
- cpsdk-####.app####.com
- d.exi####.com
- d2cjo8x####.cloudf####.net
- d830x8j####.cloudf####.net
- f####.ai####.jp
- g####.vita####.jp
- i####.as####.net
- i####.as####.net
- img.polymor####.jp
- js.w.in####.com
- ssl.google-####.com
- w####.d.exi####.com
HTTP GET requests:
- ad.leadbol####.net/show_app_ad.js?section_id=####&dev_id=####
- and####.pu####.as####.net/ast00285o1q15vat22ba/mbget.cgi?size=####&ucd=#...
- and####.pu####.as####.net/getsess/g
- c####.adfur####.jp/store/banner/52ae50e9bc323c6d17000003_en1.gif
- c####.adfur####.jp/store/banner/52b7c4f0bb323ca46e000004_en1.gif
- c####.adfur####.jp/store/banner/52fdb2fdbc323cb23a000009_en1.gif
- cf.cdn.inmob####.####.net/ad/inmobi.js
- cpsdk-####.app####.com/html/wall/loading_and.html
- d.exi####.com/ad/json/?sid=####&orientation=####&app=####&count=####
- d2cjo8x####.cloudf####.net/adfurikun/api/rec-impression?app_id=####&loca...
- d830x8j####.cloudf####.net/adfurikun/api/getinfo/app_id/525b9637bb323ca7...
- f####.ai####.jp/getsess/g
- f####.ai####.jp/jp.vfja.android.1Ox2/mbget.cgi?ucd=####&idx=####
- i####.as####.net/uploads/00000000000000000285/0974ee2e231611476d436bf6e8...
- i####.as####.net/uploads/00000000000000000285/0b3192ff0072d0051e1e0ad297...
- i####.as####.net/uploads/00000000000000000285/1d85fdc532a5f4efd1c07ba562...
- i####.as####.net/uploads/00000000000000000285/29fe1d73ff0742313f5ce06e82...
- i####.as####.net/uploads/00000000000000000285/37b15461e75368352487017c47...
- i####.as####.net/uploads/00000000000000000285/3801c95d55ac10d1b7b1ee2876...
- i####.as####.net/uploads/00000000000000000285/436242cc6b345ad35fbca6a073...
- i####.as####.net/uploads/00000000000000000285/7c9142af78ff8d90c09cc101a9...
- i####.as####.net/uploads/00000000000000000285/84c84b8917c0e18057462b77e5...
- i####.as####.net/uploads/00000000000000000285/ba8b4dbc59a7d71e85fd60041b...
- i####.as####.net/uploads/00000000000000000285/c997f308a96773c7d4921a2143...
- i####.as####.net/uploads/00000000000000000285/f71c9d93cf1593f2a141705c95...
- img.polymor####.jp/creative/1446/1697/2356/13143.jpg
- img.polymor####.jp/creative/80f7f93fdb439a22/022745706635aa17/a083a4a1c8...
- w####.d.exi####.com/ad/json/?sid=####&orientation=####&app=####&count=####
- w.a####.ap####.####.com/showad?mk-siteid=####&mk-ad-slot=####&mk-ads=###...
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/1003_51cd5875df7c6b3a09000031.html
- /data/data/####/1005_51cd5875df7c6b3a09000033.html
- /data/data/####/1013_51cd5875df7c6b3a09000037.html
- /data/data/####/1024_51cd5875df7c6b3a0900003e.html
- /data/data/####/1025_51cd5875df7c6b3a0900003f.html
- /data/data/####/1546079324477.jar
- /data/data/####/1546079324544.jar
- /data/data/####/1546079324741.jar
- /data/data/####/1546079324743.jar
- /data/data/####/1546079324770.jar
- /data/data/####/1546079355421.jar
- /data/data/####/1546079355695.jar
- /data/data/####/1546079356425.jar
- /data/data/####/1546079356583.jar
- /data/data/####/1546079356699.jar
- /data/data/####/1546079374462.jar
- /data/data/####/1546079374630.jar
- /data/data/####/1546079374824.jar
- /data/data/####/1546079374987.jar
- /data/data/####/1546079375091.jar
- /data/data/####/73d19fb132fe93bc64ffb070a9924da1d791c5d2
- /data/data/####/9999_52ae50e9bc323c6d17000003.html
- /data/data/####/9999_52b7c4f0bb323ca46e000004.html
- /data/data/####/9999_52fdb2fdbc323cb23a000009.html
- /data/data/####/CPSDK_DATABASE-journal
- /data/data/####/GSPreference.xml
- /data/data/####/LocationType.xml
- /data/data/####/adfurikun_adpref.dat.xml
- /data/data/####/adfurikun_getinfo.dat
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dij.xml
- /data/data/####/dim.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v2.db-journal
- /data/data/####/highScore.dat
- /data/data/####/index
- /data/data/####/j-id.xml
- /data/data/####/mid.xml
- /data/data/####/type.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/xy.xml
- /data/media/####/12.dat
- /data/media/####/MID.DAT
- /data/media/####/names.dat
- /data/media/####/share.dat
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS7Padding
- DES
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Displays its own windows over windows of other apps.