Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Mobikok.1.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.jq####.com:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) api.ki####.com:80
- TCP(HTTP/1.1) camspla####.com:80
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) www.sexpla####.com:80
- TCP(HTTP/1.1) ap####.mobi:80
- TCP(HTTP/1.1) c####.st####.cdn-sex####.com:80
- TCP(HTTP/1.1) ard.sexpla####.com:80
- TCP(TLS/1.0) h.online-####.net:443
- TCP(TLS/1.0) cd7qw1n####.d.aa.####.net:443
- TCP(TLS/1.0) c####.roya####.net:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
DNS requests:
- a####.google####.com
- ap####.mobi
- api.bi####.com
- api.ki####.com
- ard.sexpla####.com
- atp.sexpla####.com
- c####.jq####.com
- c####.p####.cdn-sex####.com
- c####.roya####.net
- c####.st####.cdn-sex####.com
- camspla####.com
- cd7qw1n####.d.aa.####.net
- digital####.com
- h.online-####.net
- ilv####.com
- m.sexpla####.com
- offer####.online
- ox.sexpla####.com
- s####.g.doublec####.net
- www.go####.com
- www.google-####.com
- www.sexpla####.com
HTTP GET requests:
- a####.google####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- ap####.mobi/red/fc487c12-bfa1-11e5-a414-0cc47a44dbaa/?alg=####&clickid=#...
- api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
- api.ki####.com/click?tid=####
- api.ki####.com/express?tid=####
- ard.sexpla####.com/trafficoptimizer/index.php?toid=####&r=####
- c####.jq####.com/jquery-1.11.1.min.js
- c####.jq####.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
- c####.st####.cdn-sex####.com/11/17/sexygirljeamy/profile/74x74.jpg
- c####.st####.cdn-sex####.com/14/7/sasha17000/profile/74x74.jpg
- c####.st####.cdn-sex####.com/18/16/lisaalyssa/profile/74x74.jpg
- c####.st####.cdn-sex####.com/8/21/angiebabe92/profile/74x74.jpg
- c####.st####.cdn-sex####.com/9/2/ladyjreene19/profile/74x74.jpg
- c####.st####.cdn-sex####.com/css/mobile/exports/core.3887430308.css
- c####.st####.cdn-sex####.com/fonts/mobile/open_sans/opensans-light-webfo...
- c####.st####.cdn-sex####.com/fonts/mobile/open_sans/opensans-semibold-we...
- c####.st####.cdn-sex####.com/fonts/mobile/oswald/oswald-regular-webfont....
- c####.st####.cdn-sex####.com/images/mobile/front/bg2_1024x768.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/bg3_1024x768.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/girl_1.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/girl_1.png
- c####.st####.cdn-sex####.com/images/mobile/front/girl_2.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/girl_3.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/girl_4.jpg
- c####.st####.cdn-sex####.com/images/mobile/front/girl_5.png
- c####.st####.cdn-sex####.com/images/mobile/icons/icon_alert.png
- c####.st####.cdn-sex####.com/images/mobile/icons/icon_listarrow.png
- c####.st####.cdn-sex####.com/images/mobile/loading.gif
- c####.st####.cdn-sex####.com/images/mobile/logo-new.png
- c####.st####.cdn-sex####.com/images/mobile/spacer.gif
- c####.st####.cdn-sex####.com/js/mobile/core.1060423203.js
- c####.st####.cdn-sex####.com/js/mobile/libs/modernizr/modernizr.22137420...
- camspla####.com/
- camspla####.com/images/camgirl.jpg
- camspla####.com/images/cfnm-webcams.jpg
- camspla####.com/images/escort-sex.jpg
- camspla####.com/images/free-live-chat.jpg
- camspla####.com/images/ipad-webcam-sex.jpg
- camspla####.com/images/live-webcam-sex.jpg
- camspla####.com/images/massage.jpg
- camspla####.com/images/swinger-webcams.jpg
- camspla####.com/images/webcam-chat.jpg
- camspla####.com/images/webcam-sex.jpg
- camspla####.com/styles/forms.css
- camspla####.com/styles/layout.css
- camspla####.com/styles/navi.css
- camspla####.com/styles/tables.css
- offer####.online/r/2ee2d9f8-00f5-11e8-99ba-1147f096c5af/0/
- offer####.online/r/2ee2d9f8-00f5-11e8-99ba-1147f096c5af/1/
- offer####.online/r/3edf0d04-00f5-11e8-a507-1147b8d32d51/0/
- offer####.online/r/3edf0d04-00f5-11e8-a507-1147b8d32d51/1/
- tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/r/collect?v=1&_v=j66&a=1455554705&t=pageview&_s=1&dl...
- www.sexpla####.com/?s=####&geo=####&ard=####&r=####&minimum_age=####&max...
- www.sexpla####.com/delivery/glasses.php?site=sexplaycam&zoneid=261&is_f4...
- www.sexpla####.com/delivery/glasses.php?site=sexplaycam&zoneid=262&is_f4...
- www.sexpla####.com/delivery/glasses.php?site=sexplaycam&zoneid=271&is_f4...
- www.sexpla####.com/delivery/lumber.php?timber_key=8d53a6ea3a900320ffc4f7...
- www.sexpla####.com/images/22d2ea9cdd7c97b972489d8b7d8ed751.gif
- www.sexpla####.com/images/c853af2604d5aaec843e73f5d5c74051.jpg
- www.sexpla####.com/images/mobile/front/girl_1.png
- www.sexpla####.com/images/mobile/video/girl_1/vid1.jpg
- www.sexpla####.com/main
- www.sexpla####.com/profile/lisaalyssa
- www.sexpla####.com/profiles/geo?gender=####&and_options[0]=####&and_opti...
- www.sexpla####.com/register
- www.sexpla####.com/zone/iframe?device=####&site=####&zone_label=####&is_...
HTTP POST requests:
- api.bi####.com/un
- www.sexpla####.com/register
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/index
- <Package Folder>/cache/cc.jar
- <Package Folder>/databases/####/file__0.localstorage-journal
- <Package Folder>/databases/####/http_m.sexplaycam.com_0.localst...ournal
- <Package Folder>/databases/####/https_h.online-metrix.net_0.loc...ournal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/MobikokCache_Type_1.xml
- <Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
- <Package Folder>/shared_prefs/SpZvShPrefs.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
