Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- beac####.net
- l####.direct
- nyct####.com
- searcht####.com
- 25wfbnp####.ru
- google-####.com
- p####.####.com
- cloudfr####.####.com
- r####.####.com
- c####.####.com
- 5####.####.196
- searcha####.com
- a34998d####.####.net
- f####.####.com
- f####.news
- b####.####.com
- statcou####.com
- ds-ak####.####.net
HTTP GET requests:
- b####.####.com/css/subscribe-button-modal.min.css?h=####
- b####.####.com/css/subscribe-button.min.css?h=####
- f####.news/wp-content/themes/15zine/library/js/cb-ext.js?ver=####
- f####.news/wp-content/plugins/bloom/js/idle-timer.min.js?ver=####
- f####.news/wp-content/plugins/content_timeline/css/frontend/awesome/fontawesome-webfont.ttf?v=####
- f####.news/wp-content/themes/15zine/library/css/style.css?ver=####
- b####.####.com/static/button/i/54/59F/BE6/54DFB5305182A933.json
- f####.news/wp-content/themes/15zine/plugins/login-with-ajax/login-with-ajax.js?ver=####
- google-####.com/analytics.js
- f####.news/wp-includes/js/jquery/ui/widget.min.js?ver=####
- f####.news/wp-content/plugins/bloom/js/jquery.uniform.min.js?ver=####
- f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2Pk.ttf
- 25wfbnp####.ru/Look%20Search%20Trace_files/style.css
- nyct####.com/js/63601.js
- r####.####.com/log?key=####&action=####
- ds-ak####.####.net/2/149921/b?dE=####&cS=####&cE=####&rqS=####&rsS=####&rsE=####&sS=####&dl=####&di=####&fp=####&dlS=####&dlE=####&dc=####&leS=####&le...
- b####.####.com/js/sb.min.js?v=####
- searcht####.com/jquery-1.11.0.min.js
- f####.news/wp-content/plugins/buddypress/bp-core/js/widget-members.min.js?ver=####
- c####.####.com/t.php?sc_project=####&java=####&security=####&u1=####&sc_random=####&jg=####&rr=####&resolution=####&h=####&camefrom=####&u=####&t=####...
- s####.####.com/js/gprofiles.js?ver=####
- f####.news/wp-content/plugins/content_timeline/css/frontend/timeline.css?ver=####
- f####.news/wp-content/plugins/addthis/css/output.css?ver=####
- f####.news/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-scroll-to.min.js?ver=####
- f####.news/wp-content/themes/15zine/library/css/font-awesome-4.4.0/css/font-awesome.min.css?ver=####
- beac####.net/wp-content/uploads/2015/12/aeb0434e60c067648f9e887ceca41b9e.jpg
- f####.news/wp-content/uploads/2015/08/logo-1.png
- cloudfr####.####.com/x.png
- s####.####.com/wp-content/js/devicepx-jetpack.js?ver=####
- f####.####.com/s/ptsansnarrow/v7/Q_pTky3Sc3ubRibGToTAYsLoeaHq4xHkvX1Lp5aKUY8.ttf
- f####.news/wp-content/plugins/content_timeline/js/frontend/jquery.easing.1.3.js?ver=####
- f####.news/wp-content/themes/15zine/library/js/cb-scripts.min.js?ver=####
- f####.news/wp-content/uploads/2015/08/logo.png
- f####.####.com/s/ptsansnarrow/v7/UyYrYy3ltEffJV9QueSi4VLE0juxe_YrR4_5kH0wfhI.ttf
- f####.news/wp-includes/js/comment-reply.min.js?ver=####
- f####.news/wp-content/plugins/ultimate-branding/ultimate-branding-files/modules/custom-admin-bar-files/css/general.css?ver=####
- f####.news/wp-content/plugins/ginger/front/css/cookies-enabler-dialog.css?ver=####
- a34998d####.####.net/test.png
- statcou####.com/counter/counter.js
- f####.####.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnTc.ttf
- p####.####.com/iap/636aeeb246e063ca
- f####.news/
- s####.####.com/js/300/addthis_widget.js
- f####.news/wp-content/plugins/disqus-comment-system/media/js/count.js?ver=####
- f####.news/wp-content/plugins/content_timeline/js/frontend/rollover.js?ver=####
- searcht####.com/player/videojs/video.min.js
- f####.news/wp-includes/js/wp-embed.min.js?ver=####
- f####.####.com/css?family=####&ver=####
- f####.news/wp-includes/js/jquery/ui/draggable.min.js?ver=####
- l####.direct/zkK
- f####.news/wp-includes/js/jquery/jquery.js?ver=####
- f####.news/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- nyct####.com/Track/Capture.aspx?retType=####&trk_user=####&trk_sw=####&trk_sh=####&trk_ref=####&trk_tit=####&trk_loc=####&trk_agn=####&trk_agv=####&tr...
- beac####.net/wp-content/uploads/2016/04/d940e7e7f943d0acb8391c8a73a0e5a8.jpg
- searcha####.com/xml/jsfeed_r.js?aff=####&saff=####
- ds-ak####.####.net/aksb.min.js
- f####.news/wp-content/plugins/category-specific-rss-feed-menu/wp_cat_rss_style.css
- b####.####.com/subscribebutton/subscribe
- b####.####.com/img/subscribe-button/button.png?v=####
- 25wfbnp####.ru/site_real.php?session_param=####
- f####.news/wp-content/plugins/buddypress/bp-core/js/vendor/jquery-cookie.min.js?ver=####
- f####.news/wp-content/plugins/content_timeline/js/frontend/jquery.mCustomScrollbar.min.js?ver=####
- f####.####.com/css?family=####
- f####.news/wp-content/themes/15zine/plugins/login-with-ajax/widget.css?ver=####
- b####.####.com/js/subscribebutton.noncc.min.js?h=####
- f####.news/wp-content/plugins/content_timeline/js/frontend/jquery.mousewheel.min.js?ver=####
- f####.news/wp-content/themes/15zine/buddypress/css/buddypress.css?ver=####
- f####.news/wp-content/plugins/jetpack/_inc/social-logos/social-logos.min.css?ver=####
- f####.news/wp-content/themes/15zine/library/css/font-awesome-4.4.0/fonts/fontawesome-webfont.ttf?v=####
- f####.news/wp-content/plugins/content_timeline/css/frontend/prettyPhoto.css?ver=####
- f####.news/wp-content/plugins/jetpack/modules/photon/photon.js?ver=####
- s####.####.com/e-201708.js
- f####.news/wp-content/plugins/buddypress/bp-templates/bp-legacy/js/buddypress.min.js?ver=####
- 5####.####.196/?z=####
- searcht####.com/videotest.php?aff=####&saff=####&filter=####
- f####.news/wp-includes/js/jquery/ui/core.min.js?ver=####
- f####.news/wp-content/plugins/bloom/css/style.css?ver=####
- f####.news/wp-content/plugins/jetpack/modules/wpgroho.js?ver=####
- f####.news/wp-content/plugins/addthis-all/frontend/build/addthis_wordpress_public.min.css?ver=####
- f####.news/wp-content/plugins/buddypress/bp-core/js/jquery-query.min.js?ver=####
- f####.news/wp-includes/js/wp-emoji-release.min.js?ver=####
- f####.news/wp-admin/admin-ajax.php?action=####&ver=####
- r####.####.com/log?key=####&action=####&token=####
- p####.####.com/iap/636aeeb246e063ca?cookieQ=####
- f####.news/wp-content/plugins/content_timeline/css/frontend/jquery.mCustomScrollbar.css?ver=####
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=####&de=####&dt=####&sd=####&sr=####&vp=####&je=####&_u=####&jid=####&cid=##...
- f####.news/wp-content/plugins/jetpack/css/jetpack.css?ver=####
- f####.news/wp-content/plugins/buddypress/bp-core/js/confirm.min.js?ver=####
- f####.news/wp-content/plugins/content_timeline/js/frontend/jquery.prettyPhoto.js?ver=####
- f####.news/wp-includes/js/jquery/ui/mouse.min.js?ver=####
- f####.news/wp-content/plugins/content_timeline/js/frontend/jquery.timeline.min.js?ver=####
- f####.news/wp-content/themes/15zine/library/js/modernizr.custom.min.js?ver=####
- f####.news/wp-content/plugins/ginger/front/js/cookies-enabler.min.js?ver=####
- f####.news/wp-content/plugins/bloom/js/custom.js?ver=####
HTTP POST requests:
- 25wfbnp####.ru/apk_sub.php?get_hash=####
- 25wfbnp####.ru/cpc_v2.php?get_hash=####
- 5####.####.196/?z=####
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00002f
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000034
- /data/data/####/cache/webviewCacheChromium/f_000035
- /data/data/####/cache/webviewCacheChromium/f_000036
- /data/data/####/cache/webviewCacheChromium/f_000037
- /data/data/####/cache/webviewCacheChromium/f_000030
- /data/data/####/cache/webviewCacheChromium/f_000031
- /data/data/####/cache/webviewCacheChromium/f_000032
- /data/data/####/cache/webviewCacheChromium/f_000033
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000038
- /data/data/####/cache/webviewCacheChromium/f_000039
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/MyPref.xml
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/cache/webviewCacheChromium/f_00003a
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/shared_prefs/MyPref.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
