Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.32.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) fk-conf####.ray####.com:443
- TCP(TLS/1.0) tech####.org:443
- TCP(TLS/1.0) d####.w####.gv.at:443
DNS requests:
- clients####.google####.com
- confi####.ray####.com
- d####.w####.gv.at
- m####.w####.gv.at
- m####.w####.gv.at
- m####.w####.gv.at
- m####.w####.gv.at
- tech####.org
- up####.google####.com
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /cache/WebView/####/39ffb4349bf4a841_0
- /cache/WebView/####/c8f69ab638ad5ab0_0
- /data/data/####/.org.chromium.Chromium.n7S6I1
- /data/data/####/.org.chromium.Chromium.puPYXX
- /data/data/####/000001.dbtmp
- /data/data/####/1582c94636815601_0
- /data/data/####/1c5e0ad283ce70e9_0
- /data/data/####/239881253dddd2cc_0
- /data/data/####/265fdb5402ae2da2_0
- /data/data/####/311e3522e036a161_0
- /data/data/####/31f38907caeca3e2_0
- /data/data/####/3a4d2809c88988d0_0
- /data/data/####/4228fb9868365048_0
- /data/data/####/4414ccc229414216_0
- /data/data/####/46bc9acd9d36bd7f_0
- /data/data/####/48c4aa23ae0d9267_0
- /data/data/####/4b800939b8e7399e_0
- /data/data/####/4b8a9b08e3a94da0_0
- /data/data/####/4c46f46dead19c3a_0
- /data/data/####/4c4800b545368eea_0
- /data/data/####/5288ae7d01f86054_0
- /data/data/####/569e5f705588f5e5_0
- /data/data/####/5d8a332ef47f1887_0
- /data/data/####/5da49b779b8bf686_0
- /data/data/####/6cad5db394fbdef5_0
- /data/data/####/7549e56c3f1c037c_0
- /data/data/####/7d5bc060d4262a42_0
- /data/data/####/7d9274b4a7250f24_0
- /data/data/####/828e42053222990a_0
- /data/data/####/9ce207d8cbb6a4c4_0
- /data/data/####/9ded4bca6cf6af38_0
- /data/data/####/Anonymous-DexFile@107028425.vdex
- /data/data/####/Anonymous-DexFile@1314347207.vdex
- /data/data/####/Anonymous-DexFile@1933584435.vdex
- /data/data/####/Anonymous-DexFile@2478148922.vdex
- /data/data/####/Anonymous-DexFile@2722673195.vdex
- /data/data/####/Anonymous-DexFile@3002186444.vdex
- /data/data/####/Anonymous-DexFile@326883948.vdex
- /data/data/####/Anonymous-DexFile@3296008151.vdex
- /data/data/####/Anonymous-DexFile@3588563593.vdex
- /data/data/####/Anonymous-DexFile@3935093949.vdex
- /data/data/####/BrowserMetrics-spare.pma
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/NativeStorage.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/a5d64a9a5a56dff1_0
- /data/data/####/a6772d1ffe524358_0
- /data/data/####/adc734e7d4b2ae2a_0
- /data/data/####/b53a196ab77dde9f_0
- /data/data/####/be1ef8fcf18734de_0
- /data/data/####/c8a19d7085d1be0f_0
- /data/data/####/cca4202ead67075d_0
- /data/data/####/cfc06fb473525344_0
- /data/data/####/d07e6dcc699b4f31_0
- /data/data/####/d171fc15504465a9_0
- /data/data/####/d6a98455f69be2f1_0
- /data/data/####/d6e20a4cf06cb8f1_0
- /data/data/####/d794cab9c584d956_0
- /data/data/####/d830ee4bde4143b4_0
- /data/data/####/df32333eee8fd060_0
- /data/data/####/e10e23e4cd818689_0
- /data/data/####/e587a44b0b6c8974_0
- /data/data/####/eae36a2dd8b4b4b6_0
- /data/data/####/ec7f0331509f5f11_0
- /data/data/####/f0427a80d7a0fee9_0
- /data/data/####/fd48bcc62f35b179_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/org.ldtvpru.pyj.whaddiu_preferences.xml
- /data/data/####/org.ldtvpru.pyj.whaddiu_preferences.xml.bak
- /data/data/####/res.apk
- /data/data/####/res2.apk
- /data/data/####/res3.apk
- /data/data/####/res4.apk
- /data/data/####/res5.apk
- /data/data/####/res6.apk
- /data/data/####/settings.dat
- /data/data/####/supersonic_shared_preferen.xml
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_437c0a169d2948f9_0_1 (deleted)
- /data/data/####/todelete_8309c87f3b8ee7d9_0_1 (deleted)
- /data/data/####/todelete_c72b853d808087c4_0_1 (deleted)
- /data/data/####/todelete_efd5003b8aa8448c_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/data/####/whaddiu.act.jar
- /data/data/####/whaddiu.dat.jar
- /data/data/####/whaddiu.db
- /data/data/####/whaddiu.ext.jar
- /data/data/####/whaddiu.mdt.jar
- /databases/whaddiu.db
Miscellaneous:
Requests the system alert window permission.
Attempts to detect sandbox environment.