Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.10.origin
- Android.Loki.15.origin
Downloads the following detected threats from the Web:
- Android.Loki.10.origin
- Android.Loki.15.origin
Network activity:
Connecting to:
- 1####.####.140
- a####.####.com
- a####.####.org
- a####.####.tech
- apirepo####.####.com
- c####.####.com
- c####.####.net
- j####.####.com:8888
- l####.####.com
- o####.####.com
- r####.####.com
- real####.####.org
- ret####.com
- s####.####.com
- s####.####.net
- st####.####.ly
- t####.####.com
- t####.####.net
- trac####.####.com
HTTP GET requests:
- 1####.####.140/ma/z.php?c=####&n=####&subid=####&siteid=####
- a####.####.com/t/lj3d155538jgAwkhkzvfA6bqnnb249bt/?subpub=####&s2=####
- a####.####.org/op?platform=####&os_version=####&package_name=####&app_ve...
- a####.####.tech/common/promote/v1?ai=####&lo=####&mi=####&vc=####&lg=###...
- apirepo####.####.com/apiClick?ts=####&clickId=####&ifa=####&cidRev=####&...
- c####.####.com/assets/fonts/myriad-pro/MyriadPro-Light.ttf
- c####.####.com/click?transaction_id=####&aff_sub=####&aff_sub2=####&aff_...
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=...
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- j####.####.com:8888/rule?p=####
- l####.####.com/LJ3QIdMJJYtJKCkktSFQF93eU7MxGOl_Rt1GXVzJZ8WLH3ns22TSxB16F...
- o####.####.com/engine/a.aspx?id=####
- r####.####.com/offer/g3ydgljrg2yt1/?subpub=####&s2=####&ssid=####&affid=...
- real####.####.org/realtime?platform=####&os_version=####&package_name=##...
- ret####.com/redirect.php?demand=####&offer=####&id=####&aff=####&aff_sub...
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- s####.####.net/log?partner_id=####&p_name=####&aid=####&local=####×...
- st####.####.ly/themes/metronic3/assets/frontend/site/index/prod/20151027...
- t####.####.com/ck.php?line_item_id=####&subid_spx=####&ccuid=####
- t####.####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=#...
- t####.####.net/click/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####...
- trac####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
Modified file system:
Creates the following files:
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/databases/arrkii.asa.sdk.db
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/arrkii.native.sdk.db-journal
- <Package Folder>/databases/cleanup_apps.db-journal
- <Package Folder>/databases/sun_statistics.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/ISDZcyNXkTzQhwxvstub.jar
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1496215284293
- <Package Folder>/files/ahMZjZIyWHhwDbejdaemon.so
- <Package Folder>/files/feRrQMsTOymdlgJdsa.jar
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/librzKXgueSDvKSXJOpbootstrap.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/_has_set_default_values.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml
- <Package Folder>/shared_prefs/ak.native.sdk.xml.bak
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak (deleted)
- <Package Folder>/shared_prefs/clean_us.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml.bak
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/sharedpreferences_sunmobi_settings.xml
- <Package Folder>/shared_prefs/trigsdk.xml
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.salvia/tick
- <SD-Card>/Android/####/-544414181.0.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1946562586.0.tmp
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
