Adware.Ninebox.878

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Ninebox.4.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.217.168.202:443
TCP(TLS/1.2) 1####.251.36.14:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP(TLS/1.2) 1####.217.19.202:443
TCP(TLS/1.2) 1####.250.179.195:443
UDP p####.google####.com:443
UDP 1####.217.168.202:443

DNS requests:

and####.google####.com
m####.go####.com
md####.google####.com
p####.google####.com
s####.uni####.com
s####.uni####.com.####.8

File system changes:

Creates the following files:

/data/data/####/.hptc.cache_.timeStoppermod
/data/data/####/07928d02571263df7100c7993ce981f2
/data/data/####/0b7652e2fecffab8ceab320eb2589221
/data/data/####/0ea4262205479da7ec82d300507de84c
/data/data/####/1115841705247bc5482b79c80cc51596
/data/data/####/139c667ab2e36172acc3a30397f45c53
/data/data/####/13b112cd64f5b81a0de38b460e8c5a0f
/data/data/####/1628240091080.dex
/data/data/####/1628240091080.dex.flock (deleted)
/data/data/####/1628240091080.jar
/data/data/####/1628240091446.dex
/data/data/####/1628240091446.dex.flock (deleted)
/data/data/####/1628240091446.jar
/data/data/####/1628240091754.dex
/data/data/####/1628240091754.dex.flock (deleted)
/data/data/####/1628240091754.jar
/data/data/####/1628240092036.dex (deleted)
/data/data/####/1628240092036.dex.flock (deleted)
/data/data/####/1628240092036.jar
/data/data/####/1628240092088.dex
/data/data/####/1628240092088.dex.flock (deleted)
/data/data/####/1628240092088.jar
/data/data/####/1628240095644.dex
/data/data/####/1628240095644.dex.flock (deleted)
/data/data/####/1628240095644.jar
/data/data/####/1628240098124.dex
/data/data/####/1628240098124.dex.flock (deleted)
/data/data/####/1628240098124.jar
/data/data/####/1628240098544.dex
/data/data/####/1628240098544.dex.flock (deleted)
/data/data/####/1628240098544.jar
/data/data/####/1628240098822.dex
/data/data/####/1628240098822.dex.flock (deleted)
/data/data/####/1628240098822.jar
/data/data/####/1628240099484.dex
/data/data/####/1628240099484.dex.flock (deleted)
/data/data/####/1628240099484.jar
/data/data/####/1a85daa734075707f3161a0bae568002
/data/data/####/1ba0dd294e1d45458ca180018c8c88f7
/data/data/####/1df0e923456b621d8d25f5bfa99e5f70
/data/data/####/1f793976abda925189ebbc6efeafdd67
/data/data/####/20c30f6b3d304e9e1b58bc4f2c0f909e
/data/data/####/20d3cd5cf109a8d9b8728a06a841d4cb
/data/data/####/21ca58fab1e6661f688769fe4dab2b2f
/data/data/####/22f6c7c2576414ec90d7a47b488d6f5f
/data/data/####/239f329976620846ffe9579ce7f2922b
/data/data/####/23aebb12372d0a36943bdd95dd22b820
/data/data/####/257205f5c7d3930d6fc05defa86c3195
/data/data/####/29ab6f9c8e6c56e7b4ea52b93243578f
/data/data/####/2b21e9c8b509c4a4df9e95deac45d299
/data/data/####/2c797107dbb89730e00a8b9f03d01d79
/data/data/####/2ea419eff2fa3e8e713319d3602a4443
/data/data/####/30fc6974912b72b97a3c5438188689e3
/data/data/####/319fc229cefe75e0845bf04a2ebbc79f
/data/data/####/332cc604db1cdc1140f1e0e169aca357
/data/data/####/3a71fe2725fa456a76495e098b36a413
/data/data/####/3b497180ba33ede3a3ee4cbe5e0c817f
/data/data/####/3e1f80eff075e65011f29ca856b4f84e
/data/data/####/3e74bc8664eb3caec432da951bf22b2f
/data/data/####/423d5fd1a67ae41e09810e90535bd59d
/data/data/####/4522f55a01fef8bd7f6e9b939407c8e4
/data/data/####/476a62de79de59a8c2433c4c9a167a90
/data/data/####/477f61cbe519f94edaa44354e9c12b68
/data/data/####/48c941012bad572c9a9256c35ca82936
/data/data/####/4e4d1aa0ede2f5bd478bca30a35c1d49
/data/data/####/511f036959d89efc9c50c80db2bb6d62
/data/data/####/5233d165e670b43743e65279f8a72396
/data/data/####/5863f0f7e46ac4c938b8f6602f7c569d
/data/data/####/58ee2d157363ed5cc350d84effe35f4c
/data/data/####/59cabe74724f7ae64583a31ce6a74156
/data/data/####/5ae360fee53a7428a7e44cd632887f67
/data/data/####/5bbd06e2e85f4cb69362ec854ea6d621
/data/data/####/621757c12645133d07e657a817ca5140
/data/data/####/63ad2e22fec0d30e90c45e6f9dab97a3
/data/data/####/650a91efd956c0b0b5a33ed1e00ac85b
/data/data/####/66f9658b5eadd1a289403f24e108a74b
/data/data/####/6c014edff98db8e04e400d1a8abd3bea
/data/data/####/6de3b9a2611d3347997589ee1178561e
/data/data/####/6f4cdb5db43bbd7c39b4a7616bb756bc
/data/data/####/6f78b7b78baa6fc4c4ec45520bda1ffb
/data/data/####/71a53a369407bc4550dde3c925f395f6
/data/data/####/727e056e25e6d9d832882503602eb8c7
/data/data/####/7739cdb127b1cba14acf6ea7d3b95350
/data/data/####/774c9fdfea927b47f958ab15345c868e
/data/data/####/7c4e596a1cfa310f10e17b1f06d54f91
/data/data/####/7cc9b3f76025c2670b22fde42962c8b3
/data/data/####/7d681d3fa9ea307102d0f54f36d8ef05
/data/data/####/7f6b12b6efcf4502d8c0055c78d31150
/data/data/####/80072ca48f596463af2b85ee5cb01b75
/data/data/####/81e531031a87dd0c34e79d247f03802b
/data/data/####/8522515b23eb4933e14e58e62ebab611
/data/data/####/85f8527e67aebe1d6a9fbdcd4d0f4889
/data/data/####/891df0a600595637f598fa4941e7efd5
/data/data/####/8ae74acab61d8b4a55348fe32b0eae03
/data/data/####/8bea49028ef74cbe2288c148251b35f0
/data/data/####/8ccaa89acccb59958610517710fe43f8
/data/data/####/8efcf401171fe30de1d08dc4afc61773
/data/data/####/8fd0a976c9d1a94915fbe311d717e23d
/data/data/####/90497ca3deb1c53ca59b0ab1e24f6c6d
/data/data/####/9689b64343f4fbdd7223ebc895c9bd1a
/data/data/####/980c3d74b2a36c6782d03495dc28de1f
/data/data/####/989b205d49d7d6294688d5bd27a2796b
/data/data/####/a05132b5bf7a80f1236e440b956c9c6f
/data/data/####/a6b7276c4db0d76f8611cb31571a29fd
/data/data/####/a7faa533393fea32ee34d1c978da55ae
/data/data/####/a81ed5e7b86f39b9e7957a4e43035a19
/data/data/####/ab057056bba1d64ae1d610cee2e17b25
/data/data/####/afc8ec261dd4228512e79922f6af1868
/data/data/####/b2578ccb6f7ce7a0c5f9af2d3abe5b6c
/data/data/####/b364eb66f259c60ab11f04a70c42ddc9
/data/data/####/bid.xml
/data/data/####/c45c58fc1b7dd9bdd311d18ee55b448b
/data/data/####/c4db128520a61ab31eaaeb7be4e9e516
/data/data/####/c6ca52f8a94c175f905667bd559af78b
/data/data/####/cb252d82e308b77c1205f8129a3e1ea5
/data/data/####/cb822cd0be30bd5678b5fa98a1c12fd3
/data/data/####/cd2191077b072b970bd09357411eb479
/data/data/####/cf6bba18b7768925477de17888603284
/data/data/####/com.android.opengl.shaders_cache
/data/data/####/com.dreamyTyper.timeStoppermod.v2.playerprefs.xml
/data/data/####/config
/data/data/####/d12974d97703af8bf6c1ac848b34c4cf
/data/data/####/d36855175d46b678a2338692ff643cf1
/data/data/####/d4a7fe60b8f62fdb78f5b7192d9978d2
/data/data/####/db908b2d498d303413fbfa6b66e9bfcc
/data/data/####/dbb4680b0bcc1d31a68fb4786c2a4adf
/data/data/####/dc28d303d0637b57a3671b97f3132e54
/data/data/####/e
/data/data/####/e16c15a1b05e5cf990ac35be308745e7
/data/data/####/e31830e2871e032b8463bcc344bd9915
/data/data/####/e6fdc4a2eb89ed4a977d4477b2260ec0
/data/data/####/e80ad857867c7ccc56f939e4553c671b
/data/data/####/e89c80dc13ee5251be7ad1d2159d4c41
/data/data/####/ebfafcf1ff87c8d5d21adf24e9314126
/data/data/####/ed65f37a78370feca7f7909d5db939ec
/data/data/####/ed757493988f742607b36837910836d9
/data/data/####/ee2b24cee5591a528d6935a7aa71389c
/data/data/####/ef7f1c1a80ba9c10a705be99a2d30a3d
/data/data/####/ef9d0172a972a7cd8238794b7bb1beb8
/data/data/####/eid.xml
/data/data/####/f0286104a6cbc8a63ecadf0a2017abcd
/data/data/####/f240a06c4cb2b2a611813d22e87c34d6
/data/data/####/f4c0d234268037587660270cce09004f
/data/data/####/f7be997606cf7de244e04cadec10c8c4
/data/data/####/fa0ba040b28c5146f5ff3e24484e259d
/data/data/####/fa18b3e9af04c71575f7dffb7ffdc554
/data/data/####/fab4ee09152f6210b37187f7bfbdd92a
/data/data/####/fb5682f3f426ea08a7ea9c40f17987e5
/data/data/####/fb7ab1458bf8d3673d1941412f34803d
/data/data/####/pid.xml
/data/data/####/pim.xml
/data/data/####/proc_auxv
/data/data/####/s
/data/data/####/savegame.xml
/data/data/####/scid.xml
/data/data/####/values
/data/media/####/MID.DAT

Miscellaneous:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial