Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Mobby.7
Downloads the following detected threats from the Web:
- Adware.Mobby.7
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) abt-pro####.s####.com:80
- TCP(HTTP/1.1) revolu####.space:80
- TCP(TLS/1.0) l####.chartb####.com:443
DNS requests:
- 2####.api.s####.com
- 2####.con####.s####.com
- l####.chartb####.com
- revolu####.space
HTTP GET requests:
- abt-pro####.s####.com/api/1/user_resources_and_campaigns?orientation=###...
- revolu####.space/config?device_id=####&app_id=####&vc=####&vn=####&brand...
- revolu####.space/error?what=sdk&message=Error+occurred+while+executing+i...
- revolu####.space/lashatemikantare.apk
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/databases/DownloadsDB-journal
- <Package Folder>/databases/swrve.db-journal
- <Package Folder>/files/####/virtual families 20.ldw
- <Package Folder>/files/####/virtual families 21.ldw
- <Package Folder>/files/####/virtual families 221.ldw
- <Package Folder>/files/####/wc.dat
- <Package Folder>/files/3.apk
- <Package Folder>/shared_prefs/<Package>.appirater.xml
- <Package Folder>/shared_prefs/LbJ7mA16PfBrJIZMc9ei.xml
- <Package Folder>/shared_prefs/MainActivity.xml
- <Package Folder>/shared_prefs/The anime adaptation won m.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/com.android.vending.licensing.APK...cy.xml
- <Package Folder>/shared_prefs/swrve_prefs.xml
- <SD-Card>/Google/google.id
Miscellaneous:
Loads the following dynamic libraries:
- VirtualFamilies2
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
