Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- beac####.net
- se####.####.com
- searcht####.com
- 25wfbnp####.ru
- o####.####.com
- p####.####.com
- q####.####.com
- r####.####.com
- searcha####.com
- 1####.####.7
HTTP GET requests:
- s####.####.com/script/packcpm.php?stamat=####&treqn=####&rpn=####&cbrandom=####&cbtitle=####&cbiframe=####&cbWidth=####&cbHeight=####&cbdescription=##...
- beac####.net/wp-content/uploads/2016/04/d940e7e7f943d0acb8391c8a73a0e5a8.jpg
- q####.####.com/c?lid=####&sid=####&subid=####&fid=####&qip=####
- o####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub1=####&aff_sub5=####
- searcht####.com/player/videojs/video.min.js
- p####.####.com/store/apps/details?id=####&referrer=####
- searcht####.com/jquery-1.11.0.min.js
- 25wfbnp####.ru/Look%20Search%20Trace_files/style.css
- r####.####.com/c4b66622-6d9a-434f-8593-35d8b919b723?zoneID=####&bannerID=####&identifier=####&clickid=####
- 25wfbnp####.ru/site_real.php?session_param=####
- searcha####.com/xml/jsfeed_r.js?aff=####&saff=####
- se####.####.com/click?i=####
- 1####.####.7/?z=####
- beac####.net/wp-content/uploads/2015/12/aeb0434e60c067648f9e887ceca41b9e.jpg
- s####.####.com/script/packcpm.php?stamat=####
- searcht####.com/videotest.php?aff=####&saff=####&filter=####
HTTP POST requests:
- 25wfbnp####.ru/apk_sub.php?get_hash=####
- 25wfbnp####.ru/cpc_v2.php?get_hash=####
- 1####.####.7/?z=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/MyPref.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/shared_prefs/MyPref.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
